Skip to content

Bump the python-requirements group across 1 directory with 31 updates - #14

Open
dependabot[bot] wants to merge 1 commit into
fix-dependabot-exclude-pathsfrom
dependabot/uv/python-requirements-8afcc5189b
Open

Bump the python-requirements group across 1 directory with 31 updates#14
dependabot[bot] wants to merge 1 commit into
fix-dependabot-exclude-pathsfrom
dependabot/uv/python-requirements-8afcc5189b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown

Bumps the python-requirements group with 30 updates in the / directory:

Package From To
flask 3.1.2 3.1.3
werkzeug 3.1.4 3.1.8
wtforms 3.2.1 3.2.2
sqlalchemy 2.0.45 2.0.51
geoalchemy2 0.18.1 0.20.0
pymongo 4.15.5 4.17.0
mongoengine 0.29.1 0.29.3
peewee 3.18.3 4.1.1
wtf-peewee 3.0.6 3.1.0
boto3 1.42.14 1.43.38
azure-storage-blob 12.27.1 12.30.0
pillow 12.0.0 12.2.0
redis 7.1.0 8.0.1
tox 4.29.0 4.56.1
tox-uv 1.28.0 1.35.2
pre-commit 4.5.1 4.6.0
pre-commit-uv 4.2.0 4.2.2
pallets-sphinx-themes 2.3.0 2.5.0
pylint 4.0.4 4.0.6
pytest 9.0.2 9.1.1
pytest-cov 7.0.0 7.1.0
moto 5.1.18 5.2.2
psycopg2-binary 2.9.11 2.9.12
beautifulsoup4 4.14.3 4.15.0
mypy 1.19.1 2.1.0
pyright 1.1.407 1.1.411
types-boto3 1.42.14 1.43.38
types-peewee 3.18.3.20251105 4.0.8.20260630
types-wtforms 3.2.1.20250809 3.2.1.20260518
types-shapely 2.1.0.20250917 2.1.0.20260630

Updates flask from 3.1.2 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates werkzeug from 3.1.4 to 3.1.8

Release notes

Sourced from werkzeug's releases.

3.1.8

This is the Werkzeug 3.1.8 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.8/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-8 Milestone: https://github.com/pallets/werkzeug/milestone/45?closed=1

  • Request.host and get_host return the empty string if the header is missing or has invalid characters. #3142

3.1.7

This is the Werkzeug 3.1.7 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.7/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-7 Milestone: https://github.com/pallets/werkzeug/milestone/44?closed=1

  • parse_list_header preserves partially quoted items, discards empty items, and returns empty for unclosed quoted values. #3128
  • WWWAuthenticate.to_header does not produce a trailing space when there are no parameters. #3127
  • Transfer-Encoding is parsed as a set. #3134
  • Request.host, get_host, and host_is_trusted validate the characters of the value. An empty value is no longer allowed. A Unix socket server address is ignored. The trusted_list argument to host_is_trusted is optional. #3113
  • Fix multipart form parser handling of newline at boundary. #3088
  • Response.make_conditional sets the Accept-Ranges header even if it is not a satisfiable range request. #3108
  • merge_slashes merges any number of consecutive slashes. #3121

3.1.6

This is the Werkzeug 3.1.6 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.6/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6

  • safe_join on Windows does not allow special devices names in multi-segment paths. GHSA-29vq-49wr-vm6x

3.1.5

This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.5/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5 Milestone: https://github.com/pallets/werkzeug/milestone/43?closed=1

  • safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. GHSA-87hc-h4r5-73f7
  • The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. #3065 #3077
  • Fix AttributeError when initializing DebuggedApplication with pin_security=False. #3075
Changelog

Sourced from werkzeug's changelog.

Version 3.1.8

Released 2026-04-02

  • Request.host and get_host return the empty string if the header is missing or has invalid characters. :issue:3142

Version 3.1.7

Released 2026-03-23

  • parse_list_header preserves partially quoted items, discards empty items, and returns empty for unclosed quoted values. :pr:3128
  • WWWAuthenticate.to_header does not produce a trailing space when there are no parameters. :issue:3127
  • Transfer-Encoding is parsed as a set. :pr:3134
  • Request.host, get_host, and host_is_trusted validate the characters of the value. An empty value is no longer allowed. A Unix socket server address is ignored. The trusted_list argument to host_is_trusted is optional. :pr:3113
  • Fix multipart form parser handling of newline at boundary. :issue:3088
  • Response.make_conditional sets the Accept-Ranges header even if it is not a satisfiable range request. :issue:3108
  • merge_slashes merges any number of consecutive slashes. :issue:3121

Version 3.1.6

Released 2026-02-19

  • safe_join on Windows does not allow special devices names in multi-segment paths. :ghsa:29vq-49wr-vm6x
  • Response.make_conditional sets the Accept-Ranges header even if it is not a satisfiable range request. :issue:3108

Version 3.1.5

Released 2026-01-08

  • safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7
  • The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:3065 :issue:3077

... (truncated)

Commits

Updates wtforms from 3.2.1 to 3.2.2

Release notes

Sourced from wtforms's releases.

3.2.2

What's Changed

New Contributors

Full Changelog: pallets-eco/wtforms@3.2.1...3.2.2

Changelog

Sourced from wtforms's changelog.

Version 3.2.2

Released 2026-05-03

  • Fix :class:~validators.Disabled validation with provided formdata. :pr:880
  • End support for Python 3.9, start support for Python 3.14. :pr:883
  • Add Tamil and Serbian translations.
Commits
  • ea57c11 chore: bump to 3.2.2
  • 326dd44 chore: pre-commit update
  • 414e41c doc: translation instructions and changelog
  • 383cd0c Added translation using Weblate (Serbian)
  • 40d5718 fix: readthedocs build
  • 83a4412 chore: allow downstream tests to raise warnings
  • 409edac Merge pull request #888 from azmeuk/gha-downstream
  • 69b2e67 chore: pyproject and GHA cleaning
  • 0117d4a chore: add GHA downstream tests
  • e6b503c Merge pull request #884 from kurtmckee/rm-py39-refs
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.45 to 2.0.51

Release notes

Sourced from sqlalchemy's releases.

2.0.51

Released: June 15, 2026

orm

  • [orm] [bug] Fixed issue where _orm.subqueryload() combined with PropComparator.of_type() and PropComparator.and_() would silently drop the additional filter criteria, causing all related objects to be loaded instead of only those matching the filter. The LoaderCriteriaOption was being constructed against the base entity rather than the effective entity indicated by PropComparator.of_type(). Pull request courtesy Arya Rizky.

    References: #13207

  • [orm] [bug] Fixed bug where a failure during tpc_prepare() within _orm.Session.commit() for a two-phase session would raise IllegalStateChangeError instead of the original database exception. The internal _prepare_impl() method's error handler was unable to invoke _orm.SessionTransaction.rollback() due to a state-change guard, preventing proper cleanup and masking the underlying error.

    References: #13356

engine

  • [engine] [bug] Fixed issue where Result.freeze() would lose track of ambiguous column names present in the original CursorResult, causing key-based access on the thawed result to silently return a value instead of raising InvalidRequestError. The SimpleResultMetaData now accepts and propagates ambiguous key information so that frozen, thawed, and pickled results raise consistently for duplicate column names. Pull request courtesy Saurabh Kohli.

    References: #9427

sql

  • [sql] [bug] Fixed issue where _sql.StatementLambdaElement would proxy attribute access through the cached "expected" expression rather than the resolved expression, causing stale closure-bound parameter values to be used when a lambda statement was extended with non-lambda criteria such as an additional .where() clause. Courtesy cjc0013.

    References: #10827

... (truncated)

Commits

Updates geoalchemy2 from 0.18.1 to 0.20.0

Release notes

Sourced from geoalchemy2's releases.

0.20.0

What's Changed

Full Changelog: geoalchemy/geoalchemy2@0.19.0...0.20.0

0.19.0

What's Changed

Full Changelog: geoalchemy/geoalchemy2@0.18.4...0.19.0

0.18.4

What's Changed

Full Changelog: geoalchemy/geoalchemy2@0.18.3...0.18.4

0.18.3

What's Changed

Full Changelog: geoalchemy/geoalchemy2@0.18.2...0.18.3

0.18.2

What's Changed

... (truncated)

Changelog

Sourced from geoalchemy2's changelog.

0.20.0

0.19.0

0.18.4

0.18.3

0.18.2

Commits

Updates pymongo from 4.15.5 to 4.17.0

Release notes

Sourced from pymongo's releases.

PyMongo 4.17.0

Community notes

What's Changed

... (truncated)

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.17.0 (2026/04/20)

PyMongo 4.17 brings a number of changes including:

  • has_key, iterkeys and itervalues in :class:bson.son.SON have been deprecated and will be removed in PyMongo 5.0. These methods were deprecated in favor of the standard dictionary containment operator in and the keys() and values() methods, respectively.
  • Added the :meth:~pymongo.asynchronous.client_session.AsyncClientSession.bind and :meth:~pymongo.client_session.ClientSession.bind methods that allow users to bind a session to all database operations within the scope of a context manager instead of having to explicitly pass the session to each individual operation. See the Transactions docs <https://www.mongodb.com/docs/languages/python/pymongo-driver/current/crud/transactions/#methods>_ for examples and more information.
  • Added support for MongoDB's Intelligent Workload Management (IWM) and ingress connection rate limiting features in MongoDB server version 9.0. The driver will gracefully handle write-blocking scenarios and optimizes connection establishment during high-load conditions to maintain application availability.

Changes in Version 4.16.0 (2026/01/07)

PyMongo 4.16 brings a number of changes including:

  • Removed invalid documents from :class:bson.errors.InvalidDocument error messages as doing so may leak sensitive user data. Instead, invalid documents are stored in :attr:bson.errors.InvalidDocument.document.
  • PyMongo now requires dnspython>=2.6.1, since dnspython 1.0 is no longer maintained. The minimum version is 2.6.1 to account for CVE-2023-29483 <https://www.cve.org/CVERecord?id=CVE-2023-29483>_.
  • Removed support for Eventlet. Eventlet is actively being sunset by its maintainers and has compatibility issues with PyMongo's dnspython dependency.
  • Use Zstandard support from the standard library for Python 3.14+, and use backports.zstd for older versions.
  • Fixed return type annotation for find_one_and_* methods on :class:~pymongo.asynchronous.collection.AsyncCollection and :class:~pymongo.synchronous.collection.Collection to include None.
  • Added support for NumPy 1D-arrays in :class:bson.binary.BinaryVector.
  • Prevented :class:~pymongo.encryption.ClientEncryption from loading the crypt shared library to fix "MongoCryptError: An existing crypt_shared library is loaded by the application" unless the linked library search path is set.
Commits
  • f2103a9 Prep branch v4.17
  • 3491c08 PYTHON-5801 - Update changelog for 4.17 release (#2762)
  • 912ef33 PYTHON-5798 - Overload retargeting prose tests do not ensure that sec… (#2760)
  • b4e2c03 PYTHON-5800 - Simple collation is included in index information (#2761)
  • f31ba09 PYTHON-5797 - Add IWM and Overload Error links to changelog (#2757)
  • 5da9183 PYTHON-5794 - Add prose tests to verify correct retry behavior when a… (#2755)
  • 35e51a5 Revert "PYTHON-5768 Add AGENTS.md w/copilot instructions" (#2744) (#2754)
  • f41dd5c PYTHON-5772 Increase _gcp_helpers.py coverage (#2749)
  • 49e7a05 PYTHON-5760 Increase _azure_helpers.py coverage (#2747)
  • a2b0cd8 PYTHON-5795 Fix absolute link to CONTRIBUTING.md in README.md (#2756)
  • Additional commits viewable in compare view

Updates mongoengine from 0.29.1 to 0.29.3

Changelog

Sourced from mongoengine's changelog.

Changes in 0.29.3

  • Remove mentions of mongoengine[dot]org has we no longer own it #2905

Changes in 0.29.2

  • fixes relted with
Commits

Updates peewee from 3.18.3 to 4.1.1

Release notes

Sourced from peewee's releases.

4.1.1

  • New declarative API for pre-fetching related instances (Load()). See documentation. This replaces prefetch(), is more flexible and also supports options for applying a row limit to sub-results, and a strategy that materializes the ID list (in addition to SELECT IN and JOIN strategies).
  • Add MySQLJSONField (playhouse.mysql_ext) with contains_any() for the JSON_OVERLAPS/"match any" counterpart to contains for JSON arrays.
  • Do not traverse foreign-key fields where lazy_load=False when serializing recursively with model_to_dict(), #3055.
  • Add vendored typeshed stub with improvements.

View commits

4.1.0

  • Unfortunately, the new JSONField did not play nice w/MySQL when query was generated before a conn was opened. We were trying to do some introspection on the server version, but I've decided instead to make mariadb= be a database param, per @​alisonatwork's suggestion, with the default being "MySQL" flavored JSON. Refs #3053
  • JSONField containment (contains, contained_by) no longer wraps its argument in CAST / JSON_COMPACT on MySQL/MariaDB, #3053.

View commits

4.0.9

  • Ensure new JSONField can be inherited, #3052

View commits

4.0.8

  • Add BaseQuery.aexecute() - an async twin of execute() available on all query types, executing through the query's bound async database: await User.select().aexecute(), await user.tweets.aexecute(). Returns exactly what execute() returns, including result rows for DML with RETURNING. Queries remain non-awaitable; this is an ordinary coroutine method and the only async method on queries.
  • Add async model methods to playhouse.pwasyncio using "a"-prefixed coroutine counterparts of the row-level Model methods (acreate, aget, aget_or_none, aget_by_id, aget_or_create, aset_by_id, adelete_by_id, abulk_create, abulk_update, asave, adelete_instance), available via the new AsyncModel / AsyncModelMixin classes. Each is a thin delegation through the greenlet bridge, so behavior is identical to the synchronous implementation. Note: the Model property of async databases now returns a base class that includes these methods - relevant only if you introspect the base class of db.Model subclasses.
  • Add afetch() for explicit, awaitable lazy foreign-key resolution: user = await tweet.afetch(Tweet.user). Already-loaded relations (via join or prefetch) return immediately without a query.
  • Add db.first(query, n=1) async helper.
  • MissingGreenletBridge errors now include a hint describing the async APIs to use.
  • The asyncio extension is no longer considered preliminary - the async APIs documented in the docs are stable. The asyncio stress test now also runs in CI.

View commits

4.0.7

  • Fixes for playhouse.pwasyncio: report correct UPDATE / DELETE rowcounts on asyncpg, roll back open transactions when connections are returned to the pool, raise instead of deadlocking when querying during iterate(), and detect the MySQL / MariaDB server version.
  • Additional playhouse.pwasyncio fixes: a second iterate() on a busy connection raises instead of deadlocking, asyncpg exceptions are translated to peewee exception types, registered aggregates / collations / window functions / extensions and timeout are applied to async SQLite connections, :memory: databases use a single connection, atomic() accepts transaction arguments (e.g. lock_type), postgres connection URLs and isolation_level are supported, %% in raw SQL is unescaped, and attempting a query outside the greenlet bridge no longer emits "never awaited" warnings.
  • Fixes for playhouse.pydantic_utils: JSON fields validate as Any (now including the sqlite_ext JSONField), foreign keys may be included / excluded by field name or column name, server-side defaults like SQL('CURRENT_TIMESTAMP') are no longer emitted as schema defaults, and relationships keys are validated.
  • Add a new cross-backend JSONField to core that provides basic operations and also more consistent behavior when reading data. By default the new core JSONField treats extracted values as JSON, which is generally the correct thing, but "text-mode" is available as a chained .as_text() method. See docs. May eventually replace the backend-specific implementations with subclasses that inherit semantics of this new field. Note: playhouse.mysql_ext.JSONField is now the core field. The old json_dumps / json_loads arguments are renamed dumps / loads, the extract() method is removed (use item-access or path()), and MySQL tables are now created with JSON columns rather than TEXT.
  • Eliminate use of deprecated params when connecting to MySQL databases, thanks to @​abulgher, #3050.
  • Using fromisoformat() ended up causing previously-unconverted strings (Ymd) to be converted in some cases, e.g. formatting a datetime as a str (#3051). The change I made to address this is to make explicit casts on function calls not attempt any heuristic python-value conversion. This makes it more natural to call fn.whatever().cast('text') and you predictably get text out.

View commits

... (truncated)

Changelog

Sourced from peewee's changelog.

4.1.1

  • New declarative API for pre-fetching related instances (Load()). See documentation. This replaces prefetch(), is more flexible and also supports options for applying a row limit to sub-results, and a strategy that materializes the ID list (in addition to SELECT IN and JOIN strategies).
  • Add MySQLJSONField (playhouse.mysql_ext) with contains_any() for the JSON_OVERLAPS/"match any" counterpart to contains for JSON arrays.
  • Do not traverse foreign-key fields where lazy_load=False when serializing recursively with model_to_dict(), #3055.
  • Add vendored typeshed stub with improvements.

View commits

4.1.0

  • Unfortunately, the new JSONField did not play nice w/MySQL when query was generated before a conn was opened. We were trying to do some introspection on the server version, but I've decided instead to make mariadb= be a database param, per @​alisonatwork's sugg...

    Description has been truncated

@dependabot
Bump the python-requirements group across 1 directory with 31 updates
73837a2 
Bumps the python-requirements group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [flask](https://github.com/pallets/flask) | `3.1.2` | `3.1.3` |
| [werkzeug](https://github.com/pallets/werkzeug) | `3.1.4` | `3.1.8` |
| [wtforms](https://github.com/pallets-eco/wtforms) | `3.2.1` | `3.2.2` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.45` | `2.0.51` |
| [geoalchemy2](https://github.com/geoalchemy/geoalchemy2) | `0.18.1` | `0.20.0` |
| [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.15.5` | `4.17.0` |
| [mongoengine](https://github.com/MongoEngine/mongoengine) | `0.29.1` | `0.29.3` |
| [peewee](https://github.com/coleifer/peewee) | `3.18.3` | `4.1.1` |
| [wtf-peewee](https://github.com/coleifer/wtf-peewee) | `3.0.6` | `3.1.0` |
| [boto3](https://github.com/boto/boto3) | `1.42.14` | `1.43.38` |
| [azure-storage-blob](https://github.com/Azure/azure-sdk-for-python) | `12.27.1` | `12.30.0` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |
| [redis](https://github.com/redis/redis-py) | `7.1.0` | `8.0.1` |
| [tox](https://github.com/tox-dev/tox) | `4.29.0` | `4.56.1` |
| [tox-uv](https://github.com/tox-dev/tox-uv) | `1.28.0` | `1.35.2` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.5.1` | `4.6.0` |
| [pre-commit-uv](https://github.com/tox-dev/pre-commit-uv) | `4.2.0` | `4.2.2` |
| [pallets-sphinx-themes](https://github.com/pallets/pallets-sphinx-themes) | `2.3.0` | `2.5.0` |
| [pylint](https://github.com/pylint-dev/pylint) | `4.0.4` | `4.0.6` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.2` | `9.1.1` |
| [pytest-cov](https://github.com/pytest-dev/pytest-cov) | `7.0.0` | `7.1.0` |
| [moto](https://github.com/getmoto/moto) | `5.1.18` | `5.2.2` |
| [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.11` | `2.9.12` |
| [beautifulsoup4](https://www.crummy.com/software/BeautifulSoup/bs4/) | `4.14.3` | `4.15.0` |
| [mypy](https://github.com/python/mypy) | `1.19.1` | `2.1.0` |
| [pyright](https://github.com/RobertCraigie/pyright-python) | `1.1.407` | `1.1.411` |
| [types-boto3](https://github.com/youtype/mypy_boto3_builder) | `1.42.14` | `1.43.38` |
| [types-peewee](https://github.com/python/typeshed) | `3.18.3.20251105` | `4.0.8.20260630` |
| [types-wtforms](https://github.com/python/typeshed) | `3.2.1.20250809` | `3.2.1.20260518` |
| [types-shapely](https://github.com/python/typeshed) | `2.1.0.20250917` | `2.1.0.20260630` |



Updates `flask` from 3.1.2 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.2...3.1.3)

Updates `werkzeug` from 3.1.4 to 3.1.8
- [Release notes](https://github.com/pallets/werkzeug/releases)
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)
- [Commits](pallets/werkzeug@3.1.4...3.1.8)

Updates `wtforms` from 3.2.1 to 3.2.2
- [Release notes](https://github.com/pallets-eco/wtforms/releases)
- [Changelog](https://github.com/pallets-eco/wtforms/blob/main/CHANGES.rst)
- [Commits](pallets-eco/wtforms@3.2.1...3.2.2)

Updates `sqlalchemy` from 2.0.45 to 2.0.51
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `geoalchemy2` from 0.18.1 to 0.20.0
- [Release notes](https://github.com/geoalchemy/geoalchemy2/releases)
- [Changelog](https://github.com/geoalchemy/geoalchemy2/blob/main/CHANGES.txt)
- [Commits](geoalchemy/geoalchemy2@0.18.1...0.20.0)

Updates `pymongo` from 4.15.5 to 4.17.0
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.15.5...4.17.0)

Updates `mongoengine` from 0.29.1 to 0.29.3
- [Release notes](https://github.com/MongoEngine/mongoengine/releases)
- [Changelog](https://github.com/MongoEngine/mongoengine/blob/v0.29.3/docs/changelog.rst)
- [Commits](MongoEngine/mongoengine@v0.29.1...v0.29.3)

Updates `peewee` from 3.18.3 to 4.1.1
- [Release notes](https://github.com/coleifer/peewee/releases)
- [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md)
- [Commits](coleifer/peewee@3.18.3...4.1.1)

Updates `wtf-peewee` from 3.0.6 to 3.1.0
- [Commits](coleifer/wtf-peewee@3.0.6...3.1.0)

Updates `boto3` from 1.42.14 to 1.43.38
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.42.14...1.43.38)

Updates `azure-storage-blob` from 12.27.1 to 12.30.0
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](Azure/azure-sdk-for-python@azure-storage-blob_12.27.1...azure-storage-blob_12.30.0)

Updates `pillow` from 12.0.0 to 12.2.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.0.0...12.2.0)

Updates `redis` from 7.1.0 to 8.0.1
- [Release notes](https://github.com/redis/redis-py/releases)
- [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES)
- [Commits](redis/redis-py@v7.1.0...v8.0.1)

Updates `tox` from 4.29.0 to 4.56.1
- [Release notes](https://github.com/tox-dev/tox/releases)
- [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst)
- [Commits](tox-dev/tox@4.29.0...4.56.1)

Updates `tox-uv` from 1.28.0 to 1.35.2
- [Release notes](https://github.com/tox-dev/tox-uv/releases)
- [Commits](tox-dev/tox-uv@1.28.0...1.35.2)

Updates `pre-commit` from 4.5.1 to 4.6.0
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.5.1...v4.6.0)

Updates `pre-commit-uv` from 4.2.0 to 4.2.2
- [Release notes](https://github.com/tox-dev/pre-commit-uv/releases)
- [Commits](tox-dev/pre-commit-uv@4.2.0...4.2.2)

Updates `pallets-sphinx-themes` from 2.3.0 to 2.5.0
- [Release notes](https://github.com/pallets/pallets-sphinx-themes/releases)
- [Changelog](https://github.com/pallets/pallets-sphinx-themes/blob/main/CHANGES.md)
- [Commits](pallets/pallets-sphinx-themes@2.3.0...2.5.0)

Updates `pylint` from 4.0.4 to 4.0.6
- [Release notes](https://github.com/pylint-dev/pylint/releases)
- [Commits](pylint-dev/pylint@v4.0.4...v4.0.6)

Updates `pytest` from 9.0.2 to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.2...9.1.1)

Updates `pytest-cov` from 7.0.0 to 7.1.0
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v7.0.0...v7.1.0)

Updates `moto` from 5.1.18 to 5.2.2
- [Release notes](https://github.com/getmoto/moto/releases)
- [Changelog](https://github.com/getmoto/moto/blob/master/CHANGELOG.md)
- [Commits](getmoto/moto@5.1.18...5.2.2)

Updates `botocore` from 1.42.14 to 1.43.38
- [Commits](boto/botocore@1.42.14...1.43.38)

Updates `psycopg2-binary` from 2.9.11 to 2.9.12
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.11...2.9.12)

Updates `beautifulsoup4` from 4.14.3 to 4.15.0

Updates `mypy` from 1.19.1 to 2.1.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.19.1...v2.1.0)

Updates `pyright` from 1.1.407 to 1.1.411
- [Release notes](https://github.com/RobertCraigie/pyright-python/releases)
- [Commits](RobertCraigie/pyright-python@v1.1.407...v1.1.411)

Updates `types-boto3` from 1.42.14 to 1.43.38
- [Release notes](https://github.com/youtype/mypy_boto3_builder/releases)
- [Commits](https://github.com/youtype/mypy_boto3_builder/commits)

Updates `types-peewee` from 3.18.3.20251105 to 4.0.8.20260630
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-wtforms` from 3.2.1.20250809 to 3.2.1.20260518
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-shapely` from 2.1.0.20250917 to 2.1.0.20260630
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-requirements
- dependency-name: werkzeug
  dependency-version: 3.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-requirements
- dependency-name: wtforms
  dependency-version: 3.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-requirements
- dependency-name: sqlalchemy
  dependency-version: 2.0.51
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-requirements
- dependency-name: geoalchemy2
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: pymongo
  dependency-version: 4.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: mongoengine
  dependency-version: 0.29.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-requirements
- dependency-name: peewee
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-requirements
- dependency-name: wtf-peewee
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: boto3
  dependency-version: 1.43.38
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: azure-storage-blob
  dependency-version: 12.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: pillow
  dependency-version: 12.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: redis
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-requirements
- dependency-name: tox
  dependency-version: 4.56.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: tox-uv
  dependency-version: 1.35.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: pre-commit
  dependency-version: 4.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: pre-commit-uv
  dependency-version: 4.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-requirements
- dependency-name: pallets-sphinx-themes
  dependency-version: 2.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: pylint
  dependency-version: 4.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-requirements
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: pytest-cov
  dependency-version: 7.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: moto
  dependency-version: 5.2.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: botocore
  dependency-version: 1.43.38
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: psycopg2-binary
  dependency-version: 2.9.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-requirements
- dependency-name: beautifulsoup4
  dependency-version: 4.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: mypy
  dependency-version: 2.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python-requirements
- dependency-name: pyright
  dependency-version: 1.1.411
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-requirements
- dependency-name: types-boto3
  dependency-version: 1.43.38
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: types-peewee
  dependency-version: 4.0.8.20260630
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python-requirements
- dependency-name: types-wtforms
  dependency-version: 3.2.1.20260518
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-requirements
- dependency-name: types-shapely
  dependency-version: 2.1.0.20260630
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-requirements
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants