Skip to content

Bump the production-dependencies group across 1 directory with 24 updates - #1933

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/main/production-dependencies-2a56a1c121
Open

Bump the production-dependencies group across 1 directory with 24 updates#1933
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/main/production-dependencies-2a56a1c121

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 24 updates in the / directory:

Package From To
flask 3.1.1 3.1.3
flask-wtf 1.2.2 1.3.0
google-cloud-datastore 2.20.2 2.21.0
grpcio 1.71.0 1.83.1
gunicorn 23.0.0 26.2.0
pika 1.3.2 1.4.4
pyyaml 6.0.2 6.0.3
requests 2.33.0 2.34.2
sdc-cryptography 1.2.1 1.4.0
structlog 25.2.0 26.1.0
boto3 1.37.23 1.37.38
marshmallow 3.26.2 4.3.1
google-cloud-storage 3.1.0 3.13.1
jsonpointer 3.0.0 3.1.1
redis 7.1.0 8.1.0
flask-compress 1.17 1.24
uwsgi 2.0.28 2.0.31
email-validator 2.2.0 2.3.0
google-cloud-pubsub 2.29.0 2.39.2
google-cloud-tasks 2.19.2 2.24.0
simplejson 3.20.1 4.1.2
markupsafe 3.0.2 3.0.3
cachetools 6.2.2 7.1.8
gevent 25.9.1 26.8.0

Updates flask from 3.1.1 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

  • stream_with_context does not fail inside async views. #5774
  • When using follow_redirects in the test client, the final state of session is correct. #5786
  • Relax type hint for passing bytes IO to send_file. #5776
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

  • stream_with_context does not fail inside async views. :issue:5774
  • When using follow_redirects in the test client, the final state of session is correct. :issue:5786
  • Relax type hint for passing bytes IO to send_file. :issue:5776
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates flask-wtf from 1.2.2 to 1.3.0

Release notes

Sourced from flask-wtf's releases.

v1.3.0

What's Changed

New Contributors

Full Changelog: pallets-eco/flask-wtf@v1.2.2...v1.3.0

Changelog

Sourced from flask-wtf's changelog.

Version 1.3.0

Released 2026-04-23

  • Don't read the whole uploaded files to know their size. :pr:635
  • Stop support for Python 3.9. Start support for Python 3.14. :pr:648
  • Migrate the project to uv. :pr:649
  • Allow setting a nonce on :class:~flask_wtf.recaptcha.RecaptchaField (string or zero-argument callable) for nonce-based Content Security Policies. :pr:312
  • Add csrf_meta_tag() helper and WTF_CSRF_META_NAME setting to render the CSRF token as an HTML <meta> tag.
  • Forward keyword arguments passed to the reCAPTCHA widget as HTML attributes on the captcha <div>, with the field id used as a default id. :pr:353
  • Add apply_exemptions parameter to :meth:~flask_wtf.csrf.CSRFProtect.protect so @csrf.exempt keeps working when validation is triggered manually. :pr:419
  • Add RECAPTCHA_ENABLED setting. :pr:509
Commits

Updates google-cloud-datastore from 2.20.2 to 2.21.0

Changelog

Sourced from google-cloud-datastore's changelog.

2.21.0 (2023-12-07)

Features

  • Add support for python 3.12 (fb6f9db)
  • Introduce compatibility with native namespace packages (fb6f9db)

Bug Fixes

  • Require proto-plus >= 1.22.3 (fb6f9db)
  • Use retry_async instead of retry in async client (fb6f9db)
Commits
  • c60ded4 chore: librarian release pull request: 20260108T181058Z (#15005)
  • c0e3e9d chore: disable treat warnings as errors (#15008)
  • 45d4cee docs(samples): Update BigQuery Storage Arrow samples batching logic (#14961)
  • 45149ba chore: librarian release pull request: 20260108T162506Z (#15001)
  • d58a9ba test: Add 'cryptography' 'cachetools' to test deps for bigquery-storage (#14999)
  • 1028946 feat: add v1 api for google-cloud-maintenance-api (#14998)
  • b3cb4de chore: librarian generate pull request: 20260107T084051Z (#14995)
  • 17cc128 chore: librarian generate pull request: 20251231T091651Z (#14991)
  • c353aa5 chore: librarian update image pull request: 20251219T024955Z (#14985)
  • f384538 chore: librarian release pull request: 20251217T215552Z (#14980)
  • Additional commits viewable in compare view

Updates grpcio from 1.71.0 to 1.83.1

Release notes

Sourced from grpcio's releases.

Release v1.83.1

This is release gRPC Core 1.83.1 (garden).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Release v1.83.0

This is release 1.83.0 (garden) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • [Security] Default to Post-Quantum Cryptography in TLS key exchange. (#42560)
  • [authz] don't pass RBAC policy by value when constructing authorization engine. (#42636)

C#

  • Migrate CSharp Grpc.Tools to new DotNet Version. (#42661)
  • [C#] Tools - Build: Fix protoc SIGSEGV on ARM64 by aligning max-page-size and migrating to manylinux_2_28. (#42590)

Python

  • [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower bound to allow 6.x. (#43001)
  • [Python] Add abort_with_status to the aio ServicerContext ABC. (#42733)
  • [Python] Update lower bound for protobuf from 6.33.5 to 7.35.1. (#42914)
  • [Python] Pyright typeCheckingMode - standard. (#42739)
  • [Python] Support Python 3.15 - Upgrade bazel dep rules_python to 2.0.2. (#42637)
  • [Python] Hide internal symbols from Python's cygrpc shared object. (#42325)
  • [Python] Handle custom Interceptor exceptions in InterceptedCall APIs . (#42593)

Release v1.83.0-pre1

This is a prerelease of gRPC Core 1.83.0 (garden).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This prerelease contains refinements, improvements, and bug fixes.

Release v1.82.2

This is release gRPC Core 1.82.2 (glacier).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

... (truncated)

Commits
  • aae2670 [Backport][v1.83.x] Fix legacy_channel.cc compile error with `std::optional<a...
  • b77ea36 [Backport][v1.83.x] Memory optimization (#43297)
  • 9dcd5aa [CI] Fix Python 3.15 Sanity (#43299)
  • ed8899e [Backport][v1.83.x] Fixing bug in GoAway and gRPC Message Compression (#43270)
  • 5f8d6df [Release] Bump version to 1.83.1 (on v1.83.x branch) (#43274)
  • 291e0be [Backport][v1.83.x][Python] Fix the StatusCode Enums to be int (#43252)
  • 05ceb5d [CI][Backport][v1.83.x][Python] Fix PSM Interop xds-v3 Python continuous fail...
  • dbc73b8 [Backport][v1.83.x][PHP]updated workflow to preserve github folder (#43243)
  • c876f4d [Release] Bump version to 1.83.0 (on v1.83.x branch) (#43036)
  • b5c40cd [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower boun...
  • Additional commits viewable in compare view

Updates gunicorn from 23.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

  • Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits
  • 36f2a3c gunicorn 26.2.0
  • cbba350 test: cover the h2c edge paths that had none
  • 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
  • 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
  • 5853551 Merge pull request #3712 from Rotzbua/patch-1
  • 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
  • 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
  • 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
  • 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
  • 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
  • Additional commits viewable in compare view

Updates pika from 1.3.2 to 1.4.4

Release notes

Sourced from pika's releases.

1.4.4

https://pypi.org/project/pika/1.4.4/ | GitHub milestone

1.4.2

https://pypi.org/project/pika/1.4.2/ | GitHub milestone

1.4.1

https://pypi.org/project/pika/1.4.1/ | GitHub milestone

1.4.0

https://pypi.org/project/pika/1.4.0/ | GitHub milestone

What's Changed

... (truncated)

Changelog

Sourced from pika's changelog.

1.4.4 (2026-08-06)

Full Changelog

Merged pull requests:

  • Revert "Fix callLater typing by passing keyword arguments" #1678 (jeremycline)

1.4.2 (2026-07-23)

Full Changelog

Closed issues:

  • Importing pika.adapters can break asyncio subprocesses on Windows #1639

Merged pull requests:

  • Stop mutating global asyncio event loop policy on import #1642 (lukebakken)

1.4.1 (2026-05-22)

Merged pull requests:

  • Fix Channel.close() for channels with multiple consumers #1596 (gbenson)

1.4.0 (2026-05-06)

Full Changelog

Implemented enhancements:

Closed issues:

  • Add Hatch scripts to standardize developer commands #1578
  • Fix outdated and broken documentation across the project #1568
  • Update Codecov default branch and badge #1563
  • GitHub actions workflows and test code need updates for RabbitMQ 4.3 #1547
  • datetime.datetime.utcfromtimestamp() is deprecated #1539
  • URLParameters这个类有bug #1533
  • Custom transport #1532
  • x-delay value is being returned in the header as a UINT64 and not a SINT16 #1531
  • Pika should advertise the exchange_exchange_bindings client capability #1530
  • Missing type annotations #1523
  • There is no info about return type of queue_declare() method of pika.channel #1522
  • Getting the user who sent the message #1510

... (truncated)

Commits

Updates pyyaml from 6.0.2 to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

  • Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

  • yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)
Commits

Updates requests from 2.33.0 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

Updates sdc-cryptography from 1.2.1 to 1.4.0

Release notes

Sourced from sdc-cryptography's releases.

1.4.0

What's Changed

Full Changelog: ONSdigital/sdc-cryptography@1.3.0...1.4.0

1.3.0

What's Changed

New Contributors

Full Changelog: ONSdigital/sdc-cryptography@1.2.3...1.3.0

1.2.3

What's Changed

New Contributors

Full Changelog: ONSdigital/sdc-cryptography@1.2.1...1.2.3

Changelog

Sourced from sdc-cryptography's changelog.

1.4.0

1.3.0

  • Migrate to poetry
  • Add support for Python 3.13 and 3.14
  • Remove support for Python 3.9 (not supported by Poetry)

1.2.3

  • Update cryptography to 48.0.1

1.2.2

  • Update cryptography to 44.0.1
Commits
  • 30e4454 Fix release version 1.4.0 in pyproject.toml (#69)
  • 5f31285 Update cryptography to 50.0.0 due to CVE-2026-69247 (#67)
  • 3441372 Fix publish to pypi GitHub action (python version quoting) (#66)
  • 9d5602c Migrate to Poetry (#65)
  • 9b0666a Bump cryptography to 48.0.1 (#64)
  • 320ec82 Bump cryptography from 43.0.0 to 44.0.1 in the pip group & add CODEOWNERS fil...
  • 557ddd8 Add Permissions to Workflow & Pin Unpinned Tags for Non-Immutable Actions (#61)
  • See full diff in compare view

Updates structlog from 25.2.0 to 26.1.0

Release notes

Sourced from structlog's releases.

26.1.0

Highlights

Given how long this release took, it's pretty thicc with nice things all over the board! Apologies for the long release cycle; it's been a victim of the slopocalypse and me trying to navigate my way thru the new normal. Extra big thanks to my sponsors for not abandoning me in these unironically trying times. ❤️

Full changelog below!

Special Thanks

This release would not be possible without my generous sponsors! Thank you to all of you making sustainable maintenance possible! If you would like to join them, go to https://github.com/sponsors/hynek and check out the sweet perks!

Above and Beyond

Variomedia AG (@variomedia), Tidelift (@tidelift), Kraken Tech (@kraken-tech), Klaviyo (@klaviyo), Privacy Solutions GmbH (@privacy-solutions), FilePreviews (@filepreviews), Ecosystems (@ecosyste-ms), TestMu AI Open Source Office (Formerly LambdaTest) (@LambdaTest-Inc), GitHub (@github), Doist (@Doist), Danie...

Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 3, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 3, 2026 07:17
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 3, 2026
@ons-eq-team

ons-eq-team commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Benchmark Results

Percentile Averages:
50th: 90ms
90th: 255ms
95th: 419ms
99th: 836ms
99.9th: 1483ms
GETs (99th): 1022ms
POSTs (99th): 621ms

PDF: 8700ms
Session: 8300ms

Total Requests: 64,967
Total Failures: 0
Error Percentage: 0.0%

@dependabot
dependabot Bot force-pushed the dependabot/pip/main/production-dependencies-2a56a1c121 branch from d5fe9f1 to 961f096 Compare July 8, 2026 10:36
@ons-eq-team

ons-eq-team commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Benchmark Results

Percentile Averages:
50th: 107ms
90th: 389ms
95th: 613ms
99th: 1223ms
99.9th: 2124ms
GETs (99th): 1464ms
POSTs (99th): 944ms

PDF: 11000ms
Session: 9100ms

Total Requests: 61,967
Total Failures: 0
Error Percentage: 0.0%

@dependabot
dependabot Bot force-pushed the dependabot/pip/main/production-dependencies-2a56a1c121 branch from 961f096 to dda3d0b Compare July 10, 2026 07:17
@ons-eq-team

ons-eq-team commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Benchmark Results

Percentile Averages:
50th: 73ms
90th: 178ms
95th: 303ms
99th: 741ms
99.9th: 4973ms
GETs (99th): 884ms
POSTs (99th): 575ms

PDF: 11000ms
Session: 9100ms

Total Requests: 66,534
Total Failures: 27
Error Percentage: 0.04%

@dependabot
dependabot Bot force-pushed the dependabot/pip/main/production-dependencies-2a56a1c121 branch from dda3d0b to 9b64ad7 Compare July 13, 2026 08:02
@ons-eq-team

ons-eq-team commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Benchmark Results

Percentile Averages:
50th: 78ms
90th: 147ms
95th: 256ms
99th: 511ms
99.9th: 4290ms
GETs (99th): 567ms
POSTs (99th): 447ms

PDF: 9300ms
Session: 7900ms

Total Requests: 67,293
Total Failures: 20
Error Percentage: 0.03%

@dependabot
dependabot Bot force-pushed the dependabot/pip/main/production-dependencies-2a56a1c121 branch from 9b64ad7 to 4020d4e Compare July 17, 2026 07:15
@ons-eq-team

ons-eq-team commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Benchmark Results

Percentile Averages:
50th: 81ms
90th: 165ms
95th: 255ms
99th: 431ms
99.9th: 1522ms
GETs (99th): 594ms
POSTs (99th): 242ms

PDF: 9400ms
Session: 8400ms

Total Requests: 67,833
Total Failures: 1
Error Percentage: 0.0%

@dependabot
dependabot Bot force-pushed the dependabot/pip/main/production-dependencies-2a56a1c121 branch 2 times, most recently from 71fca51 to d734224 Compare July 31, 2026 07:17
@ons-eq-team

ons-eq-team commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Benchmark Results

Percentile Averages:
50th: 82ms
90th: 185ms
95th: 315ms
99th: 720ms
99.9th: 4832ms
GETs (99th): 1000ms
POSTs (99th): 398ms

PDF: 12000ms
Session: 9200ms

Total Requests: 66,286
Total Failures: 16
Error Percentage: 0.02%

@dependabot
dependabot Bot force-pushed the dependabot/pip/main/production-dependencies-2a56a1c121 branch from d734224 to 613f3ed Compare August 7, 2026 07:17
@ons-eq-team

ons-eq-team commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Benchmark Results

Percentile Averages:
50th: 97ms
90th: 355ms
95th: 582ms
99th: 1188ms
99.9th: 5919ms
GETs (99th): 1468ms
POSTs (99th): 865ms

PDF: 14000ms
Session: 9300ms

Total Requests: 62,239
Total Failures: 21
Error Percentage: 0.03%

@dependabot
dependabot Bot force-pushed the dependabot/pip/main/production-dependencies-2a56a1c121 branch from 613f3ed to b1309db Compare August 14, 2026 07:18
@ons-eq-team

ons-eq-team commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Benchmark Results

Percentile Averages:
50th: 81ms
90th: 181ms
95th: 276ms
99th: 467ms
99.9th: 1911ms
GETs (99th): 651ms
POSTs (99th): 254ms

PDF: 9700ms
Session: 9600ms

Total Requests: 67,385
Total Failures: 4
Error Percentage: 0.01%

@dependabot
dependabot Bot force-pushed the dependabot/pip/main/production-dependencies-2a56a1c121 branch from b1309db to 4117252 Compare August 21, 2026 07:17
@ons-eq-team

ons-eq-team commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Benchmark Results

Percentile Averages:
50th: 91ms
90th: 221ms
95th: 369ms
99th: 906ms
99.9th: 6110ms
GETs (99th): 1218ms
POSTs (99th): 546ms

PDF: 13000ms
Session: 11000ms

Total Requests: 64,020
Total Failures: 1
Error Percentage: 0.0%

@dependabot
dependabot Bot force-pushed the dependabot/pip/main/production-dependencies-2a56a1c121 branch from 4117252 to 1e8a73f Compare August 28, 2026 07:14
@dependabot
Bump the production-dependencies group across 1 directory with 24 upd…
29c3e41 
…ates

Bumps the production-dependencies group with 24 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [flask](https://github.com/pallets/flask) | `3.1.1` | `3.1.3` |
| [flask-wtf](https://github.com/pallets-eco/flask-wtf) | `1.2.2` | `1.3.0` |
| [google-cloud-datastore](https://github.com/googleapis/google-cloud-python) | `2.20.2` | `2.21.0` |
| [grpcio](https://github.com/grpc/grpc) | `1.71.0` | `1.83.1` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `23.0.0` | `26.2.0` |
| [pika](https://github.com/pika/pika) | `1.3.2` | `1.4.4` |
| [pyyaml](https://github.com/yaml/pyyaml) | `6.0.2` | `6.0.3` |
| [requests](https://github.com/psf/requests) | `2.33.0` | `2.34.2` |
| [sdc-cryptography](https://github.com/ONSdigital/sdc-cryptography) | `1.2.1` | `1.4.0` |
| [structlog](https://github.com/hynek/structlog) | `25.2.0` | `26.1.0` |
| [boto3](https://github.com/boto/boto3) | `1.37.23` | `1.37.38` |
| [marshmallow](https://github.com/marshmallow-code/marshmallow) | `3.26.2` | `4.3.1` |
| [google-cloud-storage](https://github.com/googleapis/google-cloud-python) | `3.1.0` | `3.13.1` |
| [jsonpointer](https://github.com/stefankoegl/python-json-pointer) | `3.0.0` | `3.1.1` |
| [redis](https://github.com/redis/redis-py) | `7.1.0` | `8.1.0` |
| [flask-compress](https://github.com/colour-science/flask-compress) | `1.17` | `1.24` |
| [uwsgi](https://uwsgi-docs.readthedocs.io/en/latest/) | `2.0.28` | `2.0.31` |
| [email-validator](https://github.com/JoshData/python-email-validator) | `2.2.0` | `2.3.0` |
| [google-cloud-pubsub](https://github.com/googleapis/google-cloud-python) | `2.29.0` | `2.39.2` |
| [google-cloud-tasks](https://github.com/googleapis/google-cloud-python) | `2.19.2` | `2.24.0` |
| [simplejson](https://github.com/simplejson/simplejson) | `3.20.1` | `4.1.2` |
| [markupsafe](https://github.com/pallets/markupsafe) | `3.0.2` | `3.0.3` |
| [cachetools](https://github.com/tkem/cachetools) | `6.2.2` | `7.1.8` |
| [gevent](https://github.com/gevent/gevent) | `25.9.1` | `26.8.0` |



Updates `flask` from 3.1.1 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.1...3.1.3)

Updates `flask-wtf` from 1.2.2 to 1.3.0
- [Release notes](https://github.com/pallets-eco/flask-wtf/releases)
- [Changelog](https://github.com/pallets-eco/flask-wtf/blob/main/docs/changes.rst)
- [Commits](pallets-eco/flask-wtf@v1.2.2...v1.3.0)

Updates `google-cloud-datastore` from 2.20.2 to 2.21.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-documentai-v2.20.2...google-cloud-iam-v2.21.0)

Updates `grpcio` from 1.71.0 to 1.83.1
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.71.0...v1.83.1)

Updates `gunicorn` from 23.0.0 to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@23.0.0...26.2.0)

Updates `pika` from 1.3.2 to 1.4.4
- [Release notes](https://github.com/pika/pika/releases)
- [Changelog](https://github.com/pika/pika/blob/1.4.4/CHANGELOG.md)
- [Commits](pika/pika@1.3.2...1.4.4)

Updates `pyyaml` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES)
- [Commits](yaml/pyyaml@6.0.2...6.0.3)

Updates `requests` from 2.33.0 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.0...v2.34.2)

Updates `sdc-cryptography` from 1.2.1 to 1.4.0
- [Release notes](https://github.com/ONSdigital/sdc-cryptography/releases)
- [Changelog](https://github.com/ONSdigital/sdc-cryptography/blob/master/CHANGELOG.md)
- [Commits](ONSdigital/sdc-cryptography@1.2.1...1.4.0)

Updates `structlog` from 25.2.0 to 26.1.0
- [Release notes](https://github.com/hynek/structlog/releases)
- [Changelog](https://github.com/hynek/structlog/blob/main/CHANGELOG.md)
- [Commits](hynek/structlog@25.2.0...26.1.0)

Updates `boto3` from 1.37.23 to 1.37.38
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.37.23...1.37.38)

Updates `marshmallow` from 3.26.2 to 4.3.1
- [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst)
- [Commits](marshmallow-code/marshmallow@3.26.2...4.3.1)

Updates `google-cloud-storage` from 3.1.0 to 3.13.1
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/gcp-sphinx-docfx-yaml/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-kms-v3.1.0...google-cloud-storage-v3.13.1)

Updates `jsonpointer` from 3.0.0 to 3.1.1
- [Commits](stefankoegl/python-json-pointer@v3.0.0...v3.1.1)

Updates `redis` from 7.1.0 to 8.1.0
- [Release notes](https://github.com/redis/redis-py/releases)
- [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES)
- [Commits](redis/redis-py@v7.1.0...v8.1.0)

Updates `flask-compress` from 1.17 to 1.24
- [Changelog](https://github.com/colour-science/flask-compress/blob/master/CHANGELOG.md)
- [Commits](colour-science/flask-compress@v1.17...v1.24)

Updates `uwsgi` from 2.0.28 to 2.0.31

Updates `email-validator` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/JoshData/python-email-validator/releases)
- [Changelog](https://github.com/JoshData/python-email-validator/blob/main/CHANGELOG.md)
- [Commits](JoshData/python-email-validator@v2.2.0...v2.3.0)

Updates `google-cloud-pubsub` from 2.29.0 to 2.39.2
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-api-core-v2.29.0...google-cloud-pubsub-v2.39.2)

Updates `google-cloud-tasks` from 2.19.2 to 2.24.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-tasks-v2.19.2...google-cloud-tasks-v2.24.0)

Updates `simplejson` from 3.20.1 to 4.1.2
- [Release notes](https://github.com/simplejson/simplejson/releases)
- [Changelog](https://github.com/simplejson/simplejson/blob/main/CHANGES.txt)
- [Commits](simplejson/simplejson@v3.20.1...v4.1.2)

Updates `markupsafe` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/pallets/markupsafe/releases)
- [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst)
- [Commits](pallets/markupsafe@3.0.2...3.0.3)

Updates `cachetools` from 6.2.2 to 7.1.8
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](tkem/cachetools@v6.2.2...v7.1.8)

Updates `gevent` from 25.9.1 to 26.8.0
- [Release notes](https://github.com/gevent/gevent/releases)
- [Changelog](https://github.com/gevent/gevent/blob/master/docs/changelog_pre.rst)
- [Commits](gevent/gevent@25.9.1...26.8.0)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.37.38
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: cachetools
  dependency-version: 7.1.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: email-validator
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: flask-compress
  dependency-version: '1.24'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: flask-wtf
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: gevent
  dependency-version: 26.5.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: google-cloud-datastore
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: google-cloud-pubsub
  dependency-version: 2.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: google-cloud-storage
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: google-cloud-tasks
  dependency-version: 2.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: grpcio
  dependency-version: 1.81.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: gunicorn
  dependency-version: 26.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: jsonpointer
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: markupsafe
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: marshmallow
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: pika
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pyyaml
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: redis
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: sdc-cryptography
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: simplejson
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: structlog
  dependency-version: 26.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: uwsgi
  dependency-version: 2.0.31
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/main/production-dependencies-2a56a1c121 branch from 1e8a73f to 29c3e41 Compare September 4, 2026 07:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ons-eq-team