Skip to content

chore(deps): bump the dependencies group across 2 directories with 34 updates - #449

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/docs/dependencies-5c4e0a4508
Open

chore(deps): bump the dependencies group across 2 directories with 34 updates#449
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/docs/dependencies-5c4e0a4508

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown

Bumps the dependencies group with 1 update in the /docs directory: mkdocstrings.
Bumps the dependencies group with 33 updates in the /src/backend directory:

Package From To
blessed 1.50.0 1.52.0
boto3 1.43.110 1.43.118
botocore 1.43.110 1.43.118
brotli 1.2.0 1.2.1
django 5.2.17 6.1.2
django-allauth 65.19.6 65.20.1
django-money 3.6.1 3.6.2
django-mptt 0.18.0 0.20.0
django-otp 1.3.0 1.7.5
dulwich 1.2.17 1.2.19
fonttools 4.66.1 4.67.0
googleapis-common-protos 1.75.5 1.76.0
grpcio 1.84.0 1.84.1
markdown 3.11 3.11.2
paramiko 5.0.0 5.1.0
pint 0.26.1 0.26.2
platformdirs 4.12.4 4.13.5
pycparser 3.11 3.12
pydantic 2.14.0 2.14.1
pydantic-core 2.50.0 2.50.1
pydyf 0.12.1 0.13.0
pypdf 6.20.0 6.21.2
python-dateutil 2.9.0.post0 3.0.0
s3transfer 0.19.2 0.19.3
sentry-sdk 2.71.0 2.73.0
setuptools 84.0.0 84.2.1
wcwidth 0.9.2 0.9.3
wrapt 2.5.0 2.5.1
coverage 7.16.2 7.17.0
pip 26.2.1 26.2.2
pluggy 1.6.0 1.7.0
prek 0.5.5 0.5.7
ty 0.0.76 0.0.91

Updates mkdocstrings from 1.0.6 to 1.0.8

Release notes

Sourced from mkdocstrings's releases.

1.0.8

1.0.8 - 2026-10-19

Compare with 1.0.7

Bug Fixes

1.0.7

1.0.7 - 2026-10-10

Compare with 1.0.6

Build

  • Drop support for Python 3.10 (2c2cbb1 by Timothée Mazzucotelli).

Bug Fixes

Changelog

Sourced from mkdocstrings's changelog.

1.0.8 - 2026-10-19

Compare with 1.0.7

Bug Fixes

1.0.7 - 2026-10-10

Compare with 1.0.6

Build

  • Drop support for Python 3.10 (2c2cbb1 by Timothée Mazzucotelli).

Bug Fixes

Commits
  • df77e42 chore: Prepare release 1.0.8
  • cbc4590 chore: Stop testing on Python 3.10
  • f402d2c fix: Prefix code anchor/span IDs to avoid collisions
  • e9538c4 docs: Link the VBA handler to its published documentation
  • 79eefbc chore: Prepare release 1.0.7
  • 2c2cbb1 build: Drop support for Python 3.10
  • 7275d14 chore: Lint
  • ff510f2 fix: Support pymdownx 12.2
  • 8b635eb chore: Template upgrade
  • e0cf0ed chore: Template upgrade
  • Additional commits viewable in compare view

Updates blessed from 1.50.0 to 1.52.0

Release notes

Sourced from blessed's releases.

1.52

What's Changed

Full Changelog: jquast/blessed@1.51...1.52

1.51

What's Changed

Full Changelog: jquast/blessed@1.50...1.51

Changelog

Sourced from blessed's changelog.

.. py:currentmodule:: blessed.terminal

Version History

1.52 (unreleased, on "master" branch only)

  • bugfix: :meth:~Terminal.wrap discarded lines containing only spaces or tabs when drop_whitespace=False, they are now wrapped and retained, :ghpull:423.

1.51

  • introduced: :meth:~Terminal.clip to extract a "window" of displayed columns from a string, a more precise version of :meth:~Terminal.truncate, retaining terminal sequences, :ghpull:420.
  • improved: :meth:~Terminal.length, :meth:~Terminal.ljust, :meth:~Terminal.rjust, :meth:~Terminal.center, :meth:~Terminal.truncate, and :meth:~Terminal.wrap with terminal-specific Corrections_ by detecting the terminal software name at class-initialization, :ghissue:420.
  • change: East Asian ambiguous width is not measured at class-initialization. Call :meth:~Terminal.detect_ambiguous_width to measure it, which assigns and caches :attr:~Terminal.ambiguous_width, or set AMBIGUOUS_WIDE to 1 or 2 to supply the value without measurement, :ghpull:420.
  • introduced: :meth:~Terminal.detect_term_program to detect the terminal software name, or to detect it again after initialization, as needed by a terminal attached later, such as a remote stream, :ghpull:420.
  • change: :meth:~Terminal.get_software_version returns the TERM_PROGRAM and TERM_PROGRAM_VERSION environment values when defined, without inquiry, and these values also override the Corrections_ detection and the XTVERSION query otherwise made for :attr:~Terminal.term_program, :ghpull:420.
  • deprecated: Python 3.8 and earlier no longer supported. :ghpull:420.

1.50

  • change: default timeout of automatic terminal queries from 1 to 5 seconds with environment variable BLESSED_QUERY_TIMEOUT_SECONDS override, :ghpull:414.
  • bugfix: Do not automatic query XTGETTCAP_ for older CONPTY builds (Windows Server 2022), which displays control codes as visible text :ghpull:411.
  • bugfix: :meth:~Terminal.mouse_enabled failed to yield MOUSE_* keystrokes on older CONPTY builds (Windows Server 2022), where the console's "QuickEdit mode" blocks transmission, :ghpull:412.
  • bugfix: an XTGETTCAP_ received after query time out was returned by :meth:~Terminal.inkey as errant keystrokes. It is no longer yielded by :meth:~Terminal.inkey, :ghpull:413.
  • bugfix: :meth:~Terminal.does_iterm2_graphics results are now more accurate, by drawing a transparent pixel, :ghpull:416.
  • improve: performance of :meth:~Terminal.does_xtgettcap, :ghpull:415.
  • improve: skip some automatic queries for Apple's Terminal.app that leak VT100 codes as output :ghpull:417.
  • change: default timeout of automatic terminal queries from 1 to 5 seconds with environment variable BLESSED_QUERY_TIMEOUT_SECONDS override, :ghpull:414.

1.49

  • introduce: :meth:~Terminal.get_font_coverage reports codepoints the terminal font has a glyph for, by mintty's OSC 7771 Font Glyph Coverage Enquiry or the APC 25a1 Glyph Protocol,

... (truncated)

Commits
  • eb97098 write changelog for #423, bump for 1.52
  • a28ee7b Preserve whitespace-only lines when wrapping (#423)
  • 328c75d Refactor term_program detection into public Terminal.detect_term_program(), a...
  • 2a73ac0 wcwidth 0.9.2 integration (#420)
  • See full diff in compare view

Updates boto3 from 1.43.110 to 1.43.118

Commits

Updates botocore from 1.43.110 to 1.43.118

Commits
  • 444e17a Merge branch 'release-1.43.118'
  • e6a2aa0 Bumping version to 1.43.118
  • f704c6a Update endpoints model
  • f623757 Update to latest models
  • 9313a4d Backfill 1.43.117 changelog entry for CA bundle fix (#3839)
  • ece3056 Merge branch 'release-1.43.117'
  • 9dc596d Merge branch 'release-1.43.117' into develop
  • 5c706c0 Bumping version to 1.43.117
  • 27fc40e Update to latest models
  • 0a6c7b6 Remove Comodo AAA root from vendored cert bundle (#3838)
  • Additional commits viewable in compare view

Updates brotli from 1.2.0 to 1.2.1

Release notes

Sourced from brotli's releases.

v1.2.1

SECURITY

Changelog

Sourced from brotli's changelog.

[1.2.1] - 2026-10-21

SECURITY

Commits

Updates django from 5.2.17 to 6.1.2

Commits

Updates django-allauth from 65.19.6 to 65.20.1

Commits

Updates django-money from 3.6.1 to 3.6.2

Changelog

Sourced from django-money's changelog.

Changelog

Unreleased_

...

Commits

Updates django-mptt from 0.18.0 to 0.20.0

Changelog

Sourced from django-mptt's changelog.

========== Change log

Next version

0.21 (2026-10-27)

  • Fixed tree methods of proxy models with a filtering custom manager (e.g. get_queryset().filter(level=2)) only seeing the filtered rows: e.g. get_root() raised DoesNotExist, and inserting nodes through such a manager corrupted the tree. Tree operations now use an unfiltered tree manager bound to the proxy model, so they still return proxy instances (fixes #853, regression in 0.19).
  • TreeManager.db_manager() now passes the database on to the manager that proxy and multi-table inheritance models delegate tree operations to.
  • Tree writes (inserting, moving and deleting nodes, rebuild(), partial_rebuild(), build_tree_nodes()) now always see every row, even if the model's tree manager is a TreeManager subclass which filters get_queryset(). Previously, hidden nodes could lead to crashes or a corrupted tree, e.g. duplicate tree ids or child nodes left behind in the wrong tree. Positions for order_insertion_by now also take hidden siblings into account. Read methods such as get_children() still apply the filter.

0.20 (2026-10-20)

  • DraggableMPTTAdmin now uses Script(src, **attrs) instead of the deprecated JS(src, {...}) form of django-js-asset, and requires django-js-asset>=4.0.

0.19.1 (2026-10-16)

  • Fixed move_to() / TreeManager.move_node() corrupting the tree when the node or the target instance was loaded before other nodes were moved; their tree fields (and the node's parent) are now reloaded from the database before the move (#257, #568).
  • Fixed delay_mptt_updates() leaving a gap in the old tree when a node was moved out of it; the old tree is now rebuilt as well when the block exits (fixes #483).
  • Documented why transaction.atomic() alone does not prevent concurrent writes from corrupting the tree and how to serialize tree writes.

0.19 (2026-10-16)

... (truncated)

Commits
  • 24cd820 django-mptt 0.20
  • 07ef548 Use Script instead of the deprecated JS attrs dict
  • 6a0ad74 django-mptt 0.19.1
  • 3410f48 Document a concrete recipe for serializing tree writes
  • 1b96b33 Update README: rebuild() does not lock, CI badge, issue link
  • 27f4cd6 Note LLM disclosure for issue comments and the closed tree issues in AGENTS.md
  • 67c4ee3 Reload tree fields of both nodes before move_to() (#257, #568)
  • 27efff7 Rebuild the old tree when moving nodes in delay_mptt_updates (fixes #483)
  • 44dca73 Update action versions
  • f4b47ea django-mptt 0.19
  • Additional commits viewable in compare view

Updates django-otp from 1.3.0 to 1.7.5

Changelog

Sourced from django-otp's changelog.

v1.7.5 - October 16, 2026 - Revoke sessions for unconfirmed devices

  • [#195](https://github.com/django-otp/django-otp/issues/195)_: revoke session when device unconfirmed (Chris Griffin)

.. _#195: django-otp/django-otp#195

v1.7.4 - October 08, 2026 - Form improvement

  • [#194](https://github.com/django-otp/django-otp/issues/194)_: Fix otp_device select silently defaulting to a device instead of requiring an explicit choice (Varun Juneja)

.. _#194: django-otp/django-otp#194

v1.7.3 - September 06, 2026 - Admin asset fixes

  • [#191](https://github.com/django-otp/django-otp/issues/191)_: Improve admin page compatibility with CSP (Varun Juneja)

.. _#191: django-otp/django-otp#191

v1.7.2 - September 03, 2026 - Fix throttling overflow

  • [#190](https://github.com/django-otp/django-otp/issues/190)_: OverflowError on the admin login page when a device's throttling failure count is high (Varun Juneja)

.. _#190: django-otp/django-otp#190

v1.7.1 - September 02, 2026 - Form improvement

  • Routine test matrix update
  • [#188](https://github.com/django-otp/django-otp/issues/188)_: Fix authentication form inappropriately triggering rate-limiting

Thanks to Varun Juneja.

.. _#188: django-otp/django-otp#188

v1.7.0 - January 07, 2026 - Async support

  • [#185](https://github.com/django-otp/django-otp/issues/185)_: Make OTPMiddleware async capable

... (truncated)

Commits
  • 1c77c58 Version 1.7.5
  • eab8249 fix(middleware): revoke session when device unconfirmed
  • fe33c51 Version 1.7.4
  • 8cd4500 Fix #193: give the otp_device select a blank default so it can't silently pic...
  • 88cf497 Version 1.7.3
  • 4f8a5d2 Add a justfile
  • 9b64aaf Move admin template inline styles/scripts into static files for CSP compatibi...
  • a3be9e8 Version 1.7.2
  • 2db531b Cap the exponential throttle delay so a high failure count doesn't overflow
  • 3bc09de Version 1.7.1
  • Additional commits viewable in compare view

Updates dulwich from 1.2.17 to 1.2.19

Release notes

Sourced from dulwich's releases.

dulwich-1.2.19

  • Keep assume-unchanged and other index flags on entries whose content does not change (status, reset, checkout, restore, stash pop, add).
  • Split interactive rebase todo lists only on newlines, so a carriage return in a commit subject can no longer inject an instruction such as exec.
  • Don't follow a symlinked leading directory in update_working_tree, which could remove a file outside the work tree.
  • Make ancestor collection during upload-pack negotiation and pack generation linear rather than quadratic.
  • Fold the commit message's first paragraph onto a single Subject line in format-patch, so later lines no longer end up in the mail headers.

dulwich-1.2.18

  • Add support for Python 3.15.
  • Many checkout, reset, pull and merge fixes: honour .gitattributes (including in subdirectories) and line-ending conversion, handle file/directory swaps, keep merge state consistent, and stop pull from dropping local commits or leaving HEAD moved on refusal.
  • Sparse checkout fixes: patterns now match git's semantics, excluded paths stay out of the working tree and out of status, and emptied directories are removed.
  • Fix a race where GitFile.close() could remove another writer's lockfile.
  • Much improved LFS support: working lfs_fetch/lfs_pull/lfs_push with git-lfs semantics, proxy/TLS settings honoured for uploads, filter.lfs.required and GIT_LFS_SKIP_SMUDGE support, consistent LFSError exceptions, and rejection of non-HTTP transfer URLs.
  • Raise MemoryError/ApplyDeltaError for bogus delta sizes rather than aborting.
  • Faster porcelain.status (especially on Windows) and porcelain.add.

See NEWS for the full list.

Changelog

Sourced from dulwich's changelog.

1.2.19 2026-10-22

  • Keep the assume-unchanged flag (and other index flags) on entries whose content does not change, rather than clearing it when status refreshes the stat cache or on reset, checkout, restore, stash pop and add. (Jelmer Vernooij)

  • Split the interactive rebase todo list only on newlines, so a carriage return or other line separator in a commit subject can no longer add an instruction such as exec to the rebase. (Kartik Kenchi)

  • In update_working_tree, leave a path alone when one of its leading directories has been replaced by a symlink, rather than following the symlink and removing a file outside the work tree. (Kartik Kenchi)

  • Walk the commit graph with a deque in _collect_ancestors so enumerating reachable commits (during upload-pack negotiation and pack generation) is linear rather than O(n^2) in the number of commits. (Kartik Kenchi)

  • Fold the commit message's first paragraph onto a single Subject line in write_commit_patch (format-patch), so later lines of the message no longer end up in the mail headers. (Kartik Kenchi)

1.2.18 2026-10-11

  • Add support for Python 3.15. (Jelmer Vernooij)

  • Apply the .gitattributes of the tree being checked out in reset --hard, checkout, pull and merge, rather than those of the commit being left. (Jelmer Vernooij, #2463)

  • Fix get_untracked_paths with precompose_unicode returning paths starting with ../ when the walk root's name is decomposed (NFD). (Jelmer Vernooij)

  • Speed up porcelain.status by no longer resolving every walked path when looking for untracked files, which was particularly slow on Windows. (Jelmer Vernooij, #2465)

  • Fix checkout, pull and merge refusing to overwrite clean files subject to line ending conversion (e.g. eol=crlf). (Jelmer Vernooij, #2466)

  • Allow forced checkouts to replace a locally modified file with a directory, like git checkout -f. (Jelmer Vernooij, #2466)

  • Keep paths outside the sparse checkout out of the working tree in update_working_tree, so reset --hard, checkout and merge no longer write excluded files and drop their skip-worktree bits. (Jelmer Vernooij, #2472)

... (truncated)

Commits
  • f50f2c1 Release 1.2.19
  • 29b3a96 Allow pyo3 0.30 (#2526)
  • 823dda9 Allow pyo3 0.30
  • 74052de Preserve index flags on entries whose content is unchanged (#2524)
  • 3cf451b Preserve index flags on entries whose content is unchanged
  • d102e4c fold commit message to a single Subject line in write_commit_patch (#2522)
  • 5b18768 split rebase todo only on newlines in RebaseTodo.from_string (#2520)
  • e707e11 CONTRIBUTING: Update AI usage section (#2521)
  • 2815f2e CONTRIBUTING: Update AI usage section
  • b6bab7b walk ancestors with a deque in _collect_ancestors (#2518)
  • Additional commits viewable in compare view

Updates fonttools from 4.66.1 to 4.67.0

Release notes

Sourced from fonttools's releases.

4.67.0

  • [varLib] Support decreasing design-space axis mappings, via a new keyword-only allow_decreasing argument to models.normalizeValue (#3970, #4217, #4243).
  • [designspaceLib] Allow partial DesignSpace v5 axis subsets: omitted range attributes on an <axis-subset> are taken from the parent axis, as the spec says (#4205).
  • [designspaceLib] Fix DesignSpaceDocument.normalize() for mapped axes: axis bounds and rule conditions are now normalized from their original values (#4218).
  • [designspaceLib] splitInterpolable and splitVariableFonts now warn when a source or instance is dropped because it lies outside the document's own axes, instead of silently discarding it (#4244).
  • [varLib.instancer] Add support for instancing variable COLRv1 fonts (#2699, #4279).
  • [varLib.instancer] Apply VVAR vertical-origin deltas to VORG, and use OpenType rounding for instanced advances and vertical origins (#4221).
  • [varLib.instancer] Keep a universal FeatureVariations record when pinning removes its last condition but other axes remain (#4247).
  • [varLib.instancer] Preserve ppem Device corrections in GDEF, BASE, GPOS and JSTF instead of asserting on them (#4290).
  • [varLib.instancer] Allow requesting an axis's original range on VARC fonts (#4280).
  • [varLib.instancer, subset] Fold, remove or remap MATH VariationIndex devices when instancing, subsetting the GDEF store or optimizing it (#4288).
  • [varLib] Raise ValueError: Missing required table fvar from varLib.mutator and the instancer CLI on a static font, instead of a bare KeyError (#3751, #4300).
  • [featureVars] When adding rvrn, also shift lookup indices inside existing FeatureVariations (#4233). Handle null ConditionSet and FeatureTableSubstitution offsets when building, subsetting and instancing (#4234, #4235). Keep FeatureTableSubstitution records sorted after merging new ones into an existing record (#4248).
  • [ttLib] Fix FeatureParams (size, ssXX, cvXX) in FeatureVariations alternate feature tables, which failed to compile and round-trip (#3623, #4278).
  • [ttLib] Fully decode lazily loaded ligatures, SinglePos and PairPos arrays during recursive decompilation, so reorderGlyphs() on a lazy font no longer corrupts or asserts on them (#4231, #4232).
  • [VARC] Update the variation-store binary format to follow harfbuzz/boring-expansion-spec#175: SparseVarRegionList.RegionCount is uint32, sparse axes use Offset32 and MultiVarData items are stored in an INDEX. VARC fonts built with earlier fontTools versions must be rebuilt (#4219).
  • [VARC] Several fixes: derive component conditions from conditionIndex (#4237), set the implicit scaleY when importing XML (#4238), report the font's current coordinates for components that reset unspecified axes (#4239), and keep inherited coordinates when drawing CFF2 VARC components (#4236).
  • [varLib] buildMultiVarData accepts flattened per-region vector tuples (#4245).
  • [otConverters] Bounds-check CFF2 INDEX count and offSize on read, raising TTLibError instead of allocating huge lazy lists (#4220).
  • [ttLib] Handle empty packed deltas when OPTIMIZE_FONT_SPEED is set (#4241).
  • [scaleUpem] Scale per-glyph VORG origins (#4222); fix VARC scaling for static fonts and condition variations (#4223); don't mutate the shared default CFF FontMatrix (#4251, #4252).
  • [cmap] Fix format 2 compilation when all codes are single-byte (#1524, #4211) or all single-byte codes map to .notdef (#4215). Formats 2 and 4 now reject glyph IDs above 65535 instead of wrapping them (#4226). Split format 14 default UVS ranges longer than 256 codepoints (#4229). Empty format 12 and 13 subtables round-trip (#4246).
  • [glyf] Use unsigned instruction lengths, so programs of 32768-65535 bytes compile and decompile correctly (#4227). Keep instructions in zero-contour glyphs (#4228).
  • [pens] Fix cubic off-curve detection in TTGlyphPointPen across contour starts (#4224). Glyph.drawPoints() now raises NotImplementedError for an all-off-curve cubic contour, which the point pen protocol cannot express (#3191, #4225). RoundingPen passes the all-off-curve None sentinel through (#4311, #4312).
  • [CFF2] Preserve operands when a blend has zero regions (#4240).
  • [cffLib] Read CFF font names as Latin-1, matching how they are written (#4253). Deleting a CFF dict attribute now actually removes it (#2725, #4264).
  • [CFF2ToCFF] Fix conversion of fonts with local subroutines (#4258). A CFF2 table with a single FontDict is now converted to a name-keyed CFF font that keeps its glyph names (#3890, #4265).
  • [subset] Handle a null GDEF variation store (#4230).
  • [merge] Support merging fonts that both have a MATH table (#3823, #4257).
  • [feaLib] Reject the same mark class used twice in one anchor list (#3628, #4255). Don't crash on value records whose devices are all NULL (#2396, #4261). Pad a short OS/2 Vendor with spaces (#4259).
  • [feaLib] Raise FeatureLibError with a location, instead of a bare Python error, for: a BASE script list without a matching tag list (#4263), a UnicodeRange bit outside 0-127 (#4266), a name string that cannot be decoded (#4267), a STAT axis location with no or too many values (#4268), and a non-ASCII OS/2 Vendor (#4269).
  • [name] Fix the BCP 47 tags of some Mac and Windows language IDs, e.g. es was mapped to Mac Estonian (#3733, #4256). getDebugName prefers the Windows English name over the Mac one (#3969, #4273).
  • [post] Don't crash on a format 2.0 table with numGlyphs set to 0 (#3060, #4274).
  • [VDMX] Recompute numRecs and numRatios when compiling (#4293).
  • [Silf] Fix compiling a Silf table that was decompiled from binary (#4294).
  • [woff2] Preserve minorVersion when copying flavor data (#4249, #4250).
  • [ttGlyphSet] Compute glyph width lazily for glyf variable fonts without HVAR, so .width is correct before drawing (#3964, #4260).
  • [varLib.interpolatable] Respect designspace source layers (#3951, #4275); fix --json output with SciPy (#3870, #4276).
  • [misc.psLib] Fix tokenizing of escaped parentheses in PostScript strings (#4207).
  • [svgLib] Raise ValueError instead of IndexError on a truncated path command (#4254).
  • [misc.transform] Preserve the direction of the remaining axis when decomposing a transform whose first column is zero (#4242).
  • [misc.textTools] Tag.__ne__ returns NotImplemented for unsupported types (#4305, #4306).
  • [misc.dictTools] hashdict rejects in-place union (|=) (#4313, #4314).
  • [misc.xmlReader] Close owned input streams when parsing fails (#4298).
  • [misc.filesystem] WriteZipFS.close() can be called more than once (#4309, #4310).
  • [EBDT] Keep EBDT/CBDT glyph metrics after probing a missing attribute (#3806, #4216).
Changelog

Sourced from fonttools's changelog.

4.67.0 (released 2026-10-14)

  • [varLib] Support decreasing design-space axis mappings, via a new keyword-only allow_decreasing argument to models.normalizeValue (#3970, #4217, #4243).
  • [designspaceLib] Allow partial DesignSpace v5 axis subsets: omitted range attributes on an <axis-subset> are taken from the parent axis, as the spec says (#4205).
  • [designspaceLib] Fix DesignSpaceDocument.normalize() for mapped axes: axis bounds and rule conditions are now normalized from their original values (#4218).
  • [designspaceLib] splitInterpolable and splitVariableFonts now warn when a source or instance is dropped because it lies outside the document's own axes, instead of silently discarding it (#4244).
  • [varLib.instancer] Add support for instancing variable COLRv1 fonts (#2699, #4279).
  • [varLib.instancer] Apply VVAR vertical-origin deltas to VORG, and use OpenType rounding for instanced advances and vertical origins (#4221).
  • [varLib.instancer] Keep a universal FeatureVariations record when pinning removes its last condition but other axes remain (#4247).
  • [varLib.instancer] Preserve ppem Device corrections in GDEF, BASE, GPOS and JSTF instead of asserting on them (#4290).
  • [varLib.instancer] Allow requesting an axis's original range on VARC fonts (#4280).
  • [varLib.instancer, subset] Fold, remove or remap MATH VariationIndex devices when instancing, subsetting the GDEF store or optimizing it (#4288).
  • [varLib] Raise ValueError: Missing required table fvar from varLib.mutator and the instancer CLI on a static font, instead of a bare KeyError (#3751, #4300).
  • [featureVars] When adding rvrn, also shift lookup indices inside existing FeatureVariations (#4233). Handle null ConditionSet and FeatureTableSubstitution offsets when building, subsetting and instancing (#4234, #4235). Keep FeatureTableSubstitution records sorted after merging new ones into an existing record (#4248).
  • [ttLib] Fix FeatureParams (size, ssXX, cvXX) in FeatureVariations alternate feature tables, which failed to compile and round-trip (#3623, #4278).
  • [ttLib] Fully decode lazily loaded ligatures, SinglePos and PairPos arrays during recursive decompilation, so reorderGlyphs() on a lazy font no longer corrupts or asserts on them (#4231, #4232).
  • [VARC] Update the variation-store binary format to follow harfbuzz/boring-expansion-spec#175: SparseVarRegionList.RegionCount is uint32, sparse axes use Offset32 and MultiVarData items are stored in an INDEX. VARC fonts built with earlier fontTools versions must be rebuilt (#4219).
  • [VARC] Several fixes: derive component conditions from conditionIndex (#4237), set the implicit scaleY when importing XML (#4238), report the font's current coordinates for components that reset unspecified axes (#4239), and keep inherited coordinates when drawing CFF2 VARC components (#4236).
  • [varLib] buildMultiVarData accepts flattened per-region vector tuples (#4245).
  • [otConverters] Bounds-check CFF2 INDEX count and offSize on read, raising TTLibError instead of allocating huge lazy lists (#4220).
  • [ttLib] Handle empty packed deltas when OPTIMIZE_FONT_SPEED is set (#4241).
  • [scaleUpem] Scale per-glyph VORG origins (#4222); fix VARC scaling for static fonts and condition variations (#4223); don't mutate the shared default CFF FontMatrix (#4251, #4252).
  • [cmap] Fix format 2 compilation when all codes are single-byte (#1524, #4211) or

... (truncated)

Commits
  • 16f88cb Release 4.67.0
  • 5049c83 Update NEWS.rst [skip ci]
  • fdfd15f Merge pull request #4314 from xiehuanyi/fix/hashdict-inplace-union-20261014
  • 87ee7d3 Merge pull request #4312 from xiehuanyi/fix/roundingpen-offcurve-none-20261014
  • e6e65d3 [dictTools] Reject in-place union on hashdict
  • 10cfefe Merge pull request #4310 from xiehuanyi/fix/writezipfs-idempotent-close-20261014
  • 06157e4 Merge pull request #4300 from CAOShurong/codex/3751-missing-fvar
  • 2940a2e Merge pull request #4298 from xiehuanyi/fix-xml-reader-failure-cleanup
  • 821805d Merge pull request #4306 from xiehuanyi/fix/tag-notimplemented-comparison-202...
  • 85538d6 [roundingPen] Preserve all-off-curve quadratic sentinel
  • Additional commits viewable in compare view

Updates googleapis-common-protos from 1.75.5 to 1.76.0

Release notes

Sourced from googleapis-common-protos's releases.

googleapis-common-protos: v1.76.0

1.76.0 (2026-10-22)

Features

  • declare support for Python 3.15 (#18737) (

@dependabot
chore(deps): bump the dependencies group across 2 directories with 34…
9af9cc7 
… updates

Bumps the dependencies group with 1 update in the /docs directory: [mkdocstrings](https://github.com/mkdocstrings/mkdocstrings).
Bumps the dependencies group with 33 updates in the /src/backend directory:

| Package | From | To |
| --- | --- | --- |
| [blessed](https://github.com/jquast/blessed) | `1.50.0` | `1.52.0` |
| [boto3](https://github.com/boto/boto3) | `1.43.110` | `1.43.118` |
| [botocore](https://github.com/boto/botocore) | `1.43.110` | `1.43.118` |
| [brotli](https://github.com/google/brotli) | `1.2.0` | `1.2.1` |
| [django](https://github.com/django/django) | `5.2.17` | `6.1.2` |
| [django-allauth](https://github.com/sponsors/pennersr) | `65.19.6` | `65.20.1` |
| [django-money](https://github.com/django-money/django-money) | `3.6.1` | `3.6.2` |
| [django-mptt](https://github.com/django-mptt/django-mptt) | `0.18.0` | `0.20.0` |
| [django-otp](https://github.com/django-otp/django-otp) | `1.3.0` | `1.7.5` |
| [dulwich](https://github.com/dulwich/dulwich) | `1.2.17` | `1.2.19` |
| [fonttools](https://github.com/fonttools/fonttools) | `4.66.1` | `4.67.0` |
| [googleapis-common-protos](https://github.com/googleapis/google-cloud-python) | `1.75.5` | `1.76.0` |
| [grpcio](https://github.com/grpc/grpc) | `1.84.0` | `1.84.1` |
| [markdown](https://github.com/Python-Markdown/markdown) | `3.11` | `3.11.2` |
| [paramiko](https://github.com/paramiko/paramiko) | `5.0.0` | `5.1.0` |
| [pint](https://github.com/hgrecco/pint) | `0.26.1` | `0.26.2` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.12.4` | `4.13.5` |
| [pycparser](https://github.com/eliben/pycparser) | `3.11` | `3.12` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.14.0` | `2.14.1` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.50.0` | `2.50.1` |
| [pydyf](https://github.com/CourtBouillon/pydyf) | `0.12.1` | `0.13.0` |
| [pypdf](https://github.com/py-pdf/pypdf) | `6.20.0` | `6.21.2` |
| [python-dateutil](https://github.com/dateutil/dateutil) | `2.9.0.post0` | `3.0.0` |
| [s3transfer](https://github.com/boto/s3transfer) | `0.19.2` | `0.19.3` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.71.0` | `2.73.0` |
| [setuptools](https://github.com/pypa/setuptools) | `84.0.0` | `84.2.1` |
| [wcwidth](https://github.com/jquast/wcwidth) | `0.9.2` | `0.9.3` |
| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `2.5.0` | `2.5.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.16.2` | `7.17.0` |
| [pip](https://github.com/pypa/pip) | `26.2.1` | `26.2.2` |
| [pluggy](https://github.com/pytest-dev/pluggy) | `1.6.0` | `1.7.0` |
| [prek](https://github.com/j178/prek) | `0.5.5` | `0.5.7` |
| [ty](https://github.com/astral-sh/ty) | `0.0.76` | `0.0.91` |



Updates `mkdocstrings` from 1.0.6 to 1.0.8
- [Release notes](https://github.com/mkdocstrings/mkdocstrings/releases)
- [Changelog](https://github.com/mkdocstrings/mkdocstrings/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/mkdocstrings@1.0.6...1.0.8)

Updates `blessed` from 1.50.0 to 1.52.0
- [Release notes](https://github.com/jquast/blessed/releases)
- [Changelog](https://github.com/jquast/blessed/blob/master/docs/history.rst)
- [Commits](jquast/blessed@1.50...1.52)

Updates `boto3` from 1.43.110 to 1.43.118
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.110...1.43.118)

Updates `botocore` from 1.43.110 to 1.43.118
- [Commits](boto/botocore@1.43.110...1.43.118)

Updates `brotli` from 1.2.0 to 1.2.1
- [Release notes](https://github.com/google/brotli/releases)
- [Changelog](https://github.com/google/brotli/blob/go/brotli/v1.2.1/CHANGELOG.md)
- [Commits](google/brotli@v1.2.0...go/brotli/v1.2.1)

Updates `django` from 5.2.17 to 6.1.2
- [Commits](django/django@5.2.17...6.1.2)

Updates `django-allauth` from 65.19.6 to 65.20.1
- [Commits](https://github.com/sponsors/pennersr/commits)

Updates `django-money` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/django-money/django-money/releases)
- [Changelog](https://github.com/django-money/django-money/blob/main/docs/changes.rst)
- [Commits](https://github.com/django-money/django-money/commits)

Updates `django-mptt` from 0.18.0 to 0.20.0
- [Changelog](https://github.com/django-mptt/django-mptt/blob/main/CHANGELOG.rst)
- [Commits](django-mptt/django-mptt@0.18...0.20)

Updates `django-otp` from 1.3.0 to 1.7.5
- [Changelog](https://github.com/django-otp/django-otp/blob/master/CHANGES.rst)
- [Commits](django-otp/django-otp@v1.3.0...v1.7.5)

Updates `dulwich` from 1.2.17 to 1.2.19
- [Release notes](https://github.com/dulwich/dulwich/releases)
- [Changelog](https://github.com/jelmer/dulwich/blob/main/NEWS)
- [Commits](jelmer/dulwich@dulwich-1.2.17...dulwich-1.2.19)

Updates `fonttools` from 4.66.1 to 4.67.0
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.66.1...4.67.0)

Updates `googleapis-common-protos` from 1.75.5 to 1.76.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@googleapis-common-protos-v1.75.5...googleapis-common-protos-v1.76.0)

Updates `grpcio` from 1.84.0 to 1.84.1
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.84.0...v1.84.1)

Updates `markdown` from 3.11 to 3.11.2
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.11.0...3.11.2)

Updates `paramiko` from 5.0.0 to 5.1.0
- [Commits](paramiko/paramiko@5.0.0...5.1.0)

Updates `pint` from 0.26.1 to 0.26.2
- [Changelog](https://github.com/hgrecco/pint/blob/master/CHANGES)
- [Commits](hgrecco/pint@0.26.1...0.26.2)

Updates `platformdirs` from 4.12.4 to 4.13.5
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.12.4...4.13.5)

Updates `pycparser` from 3.11 to 3.12
- [Release notes](https://github.com/eliben/pycparser/releases)
- [Commits](eliben/pycparser@release_v3.11...release_v3.12)

Updates `pydantic` from 2.14.0 to 2.14.1
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.14.0...v2.14.1)

Updates `pydantic-core` from 2.50.0 to 2.50.1
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@core-v2.50.0...core-v2.50.1)

Updates `pydyf` from 0.12.1 to 0.13.0
- [Release notes](https://github.com/CourtBouillon/pydyf/releases)
- [Changelog](https://github.com/CourtBouillon/pydyf/blob/main/docs/changelog.rst)
- [Commits](CourtBouillon/pydyf@v0.12.1...v0.13.0)

Updates `pypdf` from 6.20.0 to 6.21.2
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.20.0...6.21.2)

Updates `python-dateutil` from 2.9.0.post0 to 3.0.0
- [Release notes](https://github.com/dateutil/dateutil/releases)
- [Changelog](https://github.com/dateutil/dateutil/blob/master/NEWS)
- [Commits](dateutil/dateutil@2.9.0.post0...3.0.0)

Updates `s3transfer` from 0.19.2 to 0.19.3
- [Changelog](https://github.com/boto/s3transfer/blob/develop/CHANGELOG.rst)
- [Commits](boto/s3transfer@0.19.2...0.19.3)

Updates `sentry-sdk` from 2.71.0 to 2.73.0
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.71.0...2.73.0)

Updates `setuptools` from 84.0.0 to 84.2.1
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v84.0.0...v84.2.1)

Updates `wcwidth` from 0.9.2 to 0.9.3
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Changelog](https://github.com/jquast/wcwidth/blob/master/docs/history.rst)
- [Commits](jquast/wcwidth@0.9.2...0.9.3)

Updates `wrapt` from 2.5.0 to 2.5.1
- [Release notes](https://github.com/GrahamDumpleton/wrapt/releases)
- [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst)
- [Commits](GrahamDumpleton/wrapt@2.5.0...2.5.1)

Updates `coverage` from 7.16.2 to 7.17.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.16.2...7.17.0)

Updates `pip` from 26.2.1 to 26.2.2
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@26.2.1...26.2.2)

Updates `pluggy` from 1.6.0 to 1.7.0
- [Changelog](https://github.com/pytest-dev/pluggy/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pluggy@1.6.0...1.7.0)

Updates `prek` from 0.5.5 to 0.5.7
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/main/CHANGELOG.md)
- [Commits](j178/prek@v0.5.5...v0.5.7)

Updates `ty` from 0.0.76 to 0.0.91
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.76...0.0.91)

---
updated-dependencies:
- dependency-name: mkdocstrings
  dependency-version: 1.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: blessed
  dependency-version: 1.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: boto3
  dependency-version: 1.43.118
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: botocore
  dependency-version: 1.43.118
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: brotli
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: django
  dependency-version: 6.1.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: django-allauth
  dependency-version: 65.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: django-money
  dependency-version: 3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: django-mptt
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: django-otp
  dependency-version: 1.7.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: dulwich
  dependency-version: 1.2.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: fonttools
  dependency-version: 4.67.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: googleapis-common-protos
  dependency-version: 1.76.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: grpcio
  dependency-version: 1.84.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: markdown
  dependency-version: 3.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: paramiko
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pint
  dependency-version: 0.26.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: platformdirs
  dependency-version: 4.13.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pycparser
  dependency-version: '3.12'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: pydantic-core
  dependency-version: 2.50.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: pydyf
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pypdf
  dependency-version: 6.21.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: python-dateutil
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: s3transfer
  dependency-version: 0.19.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: sentry-sdk
  dependency-version: 2.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: setuptools
  dependency-version: 84.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: wcwidth
  dependency-version: 0.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: wrapt
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: coverage
  dependency-version: 7.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pip
  dependency-version: 26.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: pluggy
  dependency-version: 1.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: prek
  dependency-version: 0.5.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ty
  dependency-version: 0.0.91
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 30, 2026
@sonarqubecloud

sonarqubecloud Bot commented Oct 30, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@matmair matmair

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@matmair