Skip to content

fix: correct singular/plural in macOS platform-tag warning - #697

Merged
agronholm merged 4 commits into
pypa:mainfrom
nikolauspschuetz:fix-macosx-warning-singular-plural
Aug 13, 2026
Merged

fix: correct singular/plural in macOS platform-tag warning#697
agronholm merged 4 commits into
pypa:mainfrom
nikolauspschuetz:fix-macosx-warning-singular-plural

Conversation

@nikolauspschuetz

@nikolauspschuetz nikolauspschuetz commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

Problem

In calculate_macosx_platform_tag() the list of libraries that need a higher
deployment target is built and then immediately rebound to a joined string:

problematic_files = [k for k, v in versions_dict.items() if v > start_version]
problematic_files = "\n".join(problematic_files)
if len(problematic_files) == 1:
    files_form = "this file"
else:
    files_form = "these files"

By the time len(problematic_files) == 1 runs, problematic_files is a string,
so len() counts characters, not files. A single-file path is many characters
long, so the count is never 1 — the "this file" branch is effectively dead
and the warning always reads "these files", even when exactly one library is
at fault.

Fix

Compute files_form from the list length before joining.

Test

New tests/test_macosx_libfile.py (the module had no test file). It monkeypatches
extract_macosx_min_system_version so no real Mach-O binaries are needed, and is
parametrized over one vs. two .dylib files, asserting the warning says
"this file" vs. "these files" respectively. Fails before the fix (single
case), passes after.

docs/news.rst updated under a new **UNRELEASED** section.

for the record: fix found + patched with AI assistance; reviewed and tested by me.

The list of problematic files was rebound to a joined string before the
count was checked, so len() counted characters instead of files. The
singular "this file" branch was therefore dead and the warning always
read "these files", even for a single library. Compute the wording from
the list length before joining.
@codecov

codecov Bot commented Aug 13, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.45%. Comparing base (21c4da4) to head (7c058a0).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #697      +/-   ##
==========================================
+ Coverage   57.22%   63.45%   +6.23%     
==========================================
  Files          15       15              
  Lines        1267     1267              
==========================================
+ Hits          725      804      +79     
+ Misses        542      463      -79     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@nikolauspschuetz
nikolauspschuetz marked this pull request as ready for review August 13, 2026 06:13

@henryiii henryiii left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good fix, but I think I would rename the veritable instead.

Comment thread src/wheel/macosx_libfile.py Outdated
files_form = "this file"
else:
files_form = "these files"
problematic_files = "\n".join(problematic_files)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would generally never recommend changing
the type of a variable. The string form should have a different name from the list form. Mypy has a check for this I believe. That would've protected from this problem.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was a large piece of contributed code which was mostly beyond my understanding, so this kind of thing was able to slip by unnoticed.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good call — done in caa78fa. problematic_files now stays the list, and the joined string is a separate problematic_files_text, so the variable no longer changes type. Agreed a mypy no-redefinition check would have caught the original.

Comment thread docs/news.rst
Per review: keep problematic_files as the list and name the joined
string separately, rather than rebinding the variable's type.
Comment thread src/wheel/macosx_libfile.py
Replace writing empty bytes to touching the file.
@agronholm
agronholm merged commit 60cfdda into pypa:main Aug 13, 2026
16 checks passed
mergify Bot pushed a commit to aws/jsii that referenced this pull request Aug 17, 2026
…ges/@jsii/python-runtime (#5224)

Updates the requirements on [wheel](https://github.com/pypa/wheel) to permit the latest version.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/pypa/wheel/releases">wheel's releases</a>.</em></p>
<blockquote>
<h2>0.48.0</h2>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel pack</code> to add, replace, or remove a PEP 440 local version identifier from a wheel (<a href="https://redirect.github.com/pypa/wheel/issues/570">#570</a>)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible core metadata versions (<a href="https://redirect.github.com/pypa/wheel/issues/643">#643</a>)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (<a href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (<a href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw">GHSA-vgq5-9859-3mmw</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>UNRELEASED</strong></p>
<ul>
<li>Fixed the macOS platform-tag warning always using the plural &quot;these files&quot;
wording, even when only a single library required a higher deployment target
(<code>[#697](pypa/wheel#697) &lt;https://github.com/pypa/wheel/pull/697&gt;</code>_)</li>
</ul>
<p><strong>0.48.0 (2026-08-12)</strong></p>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel pack</code> to add, replace, or remove a
PEP 440 local version identifier from a wheel
(<code>[#570](pypa/wheel#570) &lt;https://github.com/pypa/wheel/issues/570&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible core metadata versions
(<code>[#643](pypa/wheel#643) &lt;https://github.com/pypa/wheel/issues/643&gt;</code>_)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when retagging wheels whose
entries use ZIP64, by dropping the central-directory ZIP64 extra field that is
not valid in a local file header
(<code>[#692](pypa/wheel#692) &lt;https://github.com/pypa/wheel/issues/692&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside the destination
directory when the input archive contained a maliciously crafted project name
or version with path separators (arbitrary file write / path traversal)
(<code>GHSA-vgq5-9859-3mmw &lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw&gt;</code>_)</li>
</ul>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata about wheel files without
unpacking them (<code>[#639](pypa/wheel#639) &lt;https://github.com/pypa/wheel/issues/639&gt;</code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the <code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[#411](pypa/wheel#411) &lt;https://github.com/pypa/wheel/issues/411&gt;</code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging' from 'wheel'</code> when
installed alongside an old version of setuptools and running the <code>bdist_wheel</code>
command (<code>[#676](pypa/wheel#676) &lt;https://github.com/pypa/wheel/issues/676&gt;</code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with <code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a <code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84"><code>21c4da4</code></a> Fixed the release heading format</li>
<li><a href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2"><code>f06d4db</code></a> Flit no longer supports --setup-py</li>
<li><a href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c"><code>1a96c3e</code></a> Created a new release</li>
<li><a href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b"><code>d7d625d</code></a> Fixed wheel convert writing outside the target directory on malicious input (...</li>
<li><a href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465"><code>986a440</code></a> Strip ZIP64 extra field when retagging wheels (<a href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>) (<a href="https://redirect.github.com/pypa/wheel/issues/695">#695</a>)</li>
<li><a href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d"><code>0ca6f24</code></a> feat: add --local-version option to wheel pack (<a href="https://redirect.github.com/pypa/wheel/issues/694">#694</a>)</li>
<li><a href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb"><code>4a63caf</code></a> Preserve compatible metadata versions in convert (<a href="https://redirect.github.com/pypa/wheel/issues/690">#690</a>)</li>
<li><a href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a"><code>33650c6</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pypa/wheel/issues/691">#691</a>)</li>
<li><a href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2"><code>197012d</code></a> Increased the upper bound for flit-core as a build requirement</li>
<li>See full diff in <a href="https://github.com/pypa/wheel/compare/0.47.0...0.48.0">compare view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>
github-actions Bot pushed a commit to aio-libs/aiohttp that referenced this pull request Aug 17, 2026
Bumps [wheel](https://github.com/pypa/wheel) from 0.47.0 to 0.48.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/releases">wheel's
releases</a>.</em></p>
<blockquote>
<h2>0.48.0</h2>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a PEP 440 local version
identifier from a wheel (<a
href="https://redirect.github.com/pypa/wheel/issues/570">#570</a>)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions (<a
href="https://redirect.github.com/pypa/wheel/issues/643">#643</a>)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose entries use ZIP64, by dropping the
central-directory ZIP64 extra field that is not valid in a local file
header (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination directory when the input archive contained a maliciously
crafted project name or version with path separators (arbitrary file
write / path traversal) (<a
href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw">GHSA-vgq5-9859-3mmw</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>UNRELEASED</strong></p>
<ul>
<li>Fixed the macOS platform-tag warning always using the plural
&quot;these files&quot;
wording, even when only a single library required a higher deployment
target
(<code>[#697](pypa/wheel#697)
&lt;https://github.com/pypa/wheel/pull/697&gt;</code>_)</li>
</ul>
<p><strong>0.48.0 (2026-08-12)</strong></p>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a
PEP 440 local version identifier from a wheel
(<code>[#570](pypa/wheel#570)
&lt;https://github.com/pypa/wheel/issues/570&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions
(<code>[#643](pypa/wheel#643)
&lt;https://github.com/pypa/wheel/issues/643&gt;</code>_)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose
entries use ZIP64, by dropping the central-directory ZIP64 extra field
that is
not valid in a local file header
(<code>[#692](pypa/wheel#692)
&lt;https://github.com/pypa/wheel/issues/692&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination
directory when the input archive contained a maliciously crafted project
name
or version with path separators (arbitrary file write / path traversal)
(<code>GHSA-vgq5-9859-3mmw
&lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw&gt;</code>_)</li>
</ul>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without
unpacking them (<code>[#639](pypa/wheel#639)
&lt;https://github.com/pypa/wheel/issues/639&gt;</code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the
<code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[#411](pypa/wheel#411)
&lt;https://github.com/pypa/wheel/issues/411&gt;</code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when
installed alongside an old version of setuptools and running the
<code>bdist_wheel</code>
command (<code>[#676](pypa/wheel#676)
&lt;https://github.com/pypa/wheel/issues/676&gt;</code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84"><code>21c4da4</code></a>
Fixed the release heading format</li>
<li><a
href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2"><code>f06d4db</code></a>
Flit no longer supports --setup-py</li>
<li><a
href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c"><code>1a96c3e</code></a>
Created a new release</li>
<li><a
href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b"><code>d7d625d</code></a>
Fixed wheel convert writing outside the target directory on malicious
input (...</li>
<li><a
href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465"><code>986a440</code></a>
Strip ZIP64 extra field when retagging wheels (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>) (<a
href="https://redirect.github.com/pypa/wheel/issues/695">#695</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d"><code>0ca6f24</code></a>
feat: add --local-version option to wheel pack (<a
href="https://redirect.github.com/pypa/wheel/issues/694">#694</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb"><code>4a63caf</code></a>
Preserve compatible metadata versions in convert (<a
href="https://redirect.github.com/pypa/wheel/issues/690">#690</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a"><code>33650c6</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/691">#691</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2"><code>197012d</code></a>
Increased the upper bound for flit-core as a build requirement</li>
<li>See full diff in <a
href="https://github.com/pypa/wheel/compare/0.47.0...0.48.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=wheel&package-manager=pip&previous-version=0.47.0&new-version=0.48.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
github-actions Bot pushed a commit to aio-libs/aiohttp that referenced this pull request Aug 17, 2026
Bumps [wheel](https://github.com/pypa/wheel) from 0.47.0 to 0.48.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/releases">wheel's
releases</a>.</em></p>
<blockquote>
<h2>0.48.0</h2>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a PEP 440 local version
identifier from a wheel (<a
href="https://redirect.github.com/pypa/wheel/issues/570">#570</a>)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions (<a
href="https://redirect.github.com/pypa/wheel/issues/643">#643</a>)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose entries use ZIP64, by dropping the
central-directory ZIP64 extra field that is not valid in a local file
header (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination directory when the input archive contained a maliciously
crafted project name or version with path separators (arbitrary file
write / path traversal) (<a
href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw">GHSA-vgq5-9859-3mmw</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>UNRELEASED</strong></p>
<ul>
<li>Fixed the macOS platform-tag warning always using the plural
&quot;these files&quot;
wording, even when only a single library required a higher deployment
target
(<code>[#697](pypa/wheel#697)
&lt;https://github.com/pypa/wheel/pull/697&gt;</code>_)</li>
</ul>
<p><strong>0.48.0 (2026-08-12)</strong></p>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a
PEP 440 local version identifier from a wheel
(<code>[#570](pypa/wheel#570)
&lt;https://github.com/pypa/wheel/issues/570&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions
(<code>[#643](pypa/wheel#643)
&lt;https://github.com/pypa/wheel/issues/643&gt;</code>_)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose
entries use ZIP64, by dropping the central-directory ZIP64 extra field
that is
not valid in a local file header
(<code>[#692](pypa/wheel#692)
&lt;https://github.com/pypa/wheel/issues/692&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination
directory when the input archive contained a maliciously crafted project
name
or version with path separators (arbitrary file write / path traversal)
(<code>GHSA-vgq5-9859-3mmw
&lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw&gt;</code>_)</li>
</ul>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without
unpacking them (<code>[#639](pypa/wheel#639)
&lt;https://github.com/pypa/wheel/issues/639&gt;</code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the
<code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[#411](pypa/wheel#411)
&lt;https://github.com/pypa/wheel/issues/411&gt;</code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when
installed alongside an old version of setuptools and running the
<code>bdist_wheel</code>
command (<code>[#676](pypa/wheel#676)
&lt;https://github.com/pypa/wheel/issues/676&gt;</code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84"><code>21c4da4</code></a>
Fixed the release heading format</li>
<li><a
href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2"><code>f06d4db</code></a>
Flit no longer supports --setup-py</li>
<li><a
href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c"><code>1a96c3e</code></a>
Created a new release</li>
<li><a
href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b"><code>d7d625d</code></a>
Fixed wheel convert writing outside the target directory on malicious
input (...</li>
<li><a
href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465"><code>986a440</code></a>
Strip ZIP64 extra field when retagging wheels (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>) (<a
href="https://redirect.github.com/pypa/wheel/issues/695">#695</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d"><code>0ca6f24</code></a>
feat: add --local-version option to wheel pack (<a
href="https://redirect.github.com/pypa/wheel/issues/694">#694</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb"><code>4a63caf</code></a>
Preserve compatible metadata versions in convert (<a
href="https://redirect.github.com/pypa/wheel/issues/690">#690</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a"><code>33650c6</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/691">#691</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2"><code>197012d</code></a>
Increased the upper bound for flit-core as a build requirement</li>
<li>See full diff in <a
href="https://github.com/pypa/wheel/compare/0.47.0...0.48.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=wheel&package-manager=pip&previous-version=0.47.0&new-version=0.48.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
lukasmasuch pushed a commit to streamlit/streamlit that referenced this pull request Aug 17, 2026
Bumps the python-minor-patch group with 2 updates:
[pre-commit](https://github.com/pre-commit/pre-commit) and
[wheel](https://github.com/pypa/wheel).

Updates `pre-commit` from 4.6.1 to 4.6.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pre-commit/pre-commit/releases">pre-commit's
releases</a>.</em></p>
<blockquote>
<h2>pre-commit v4.6.2</h2>
<h3>Fixes</h3>
<ul>
<li>Fix <code>language: node</code> hooks that contain
<code>&quot;scripts&quot;: {&quot;build&quot;: ...}</code> with
npm 11.x.
<ul>
<li>Regressed in 4.6.1.</li>
<li><a
href="https://redirect.github.com/pre-commit/pre-commit/issues/3737">#3737</a>
issue by <a
href="https://github.com/mheiges"><code>@​mheiges</code></a>.</li>
<li><a
href="https://redirect.github.com/pre-commit/pre-commit/issues/3743">#3743</a>
PR by <a
href="https://github.com/asottile"><code>@​asottile</code></a>.</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md">pre-commit's
changelog</a>.</em></p>
<blockquote>
<h1>4.6.2 - 2026-08-10</h1>
<h3>Fixes</h3>
<ul>
<li>Fix <code>language: node</code> hooks that contain
<code>&quot;scripts&quot;: {&quot;build&quot;: ...}</code> with
npm 11.x.
<ul>
<li>Regressed in 4.6.1.</li>
<li><a
href="https://redirect.github.com/pre-commit/pre-commit/issues/3737">#3737</a>
issue by <a
href="https://github.com/mheiges"><code>@​mheiges</code></a>.</li>
<li><a
href="https://redirect.github.com/pre-commit/pre-commit/issues/3743">#3743</a>
PR by <a
href="https://github.com/asottile"><code>@​asottile</code></a>.</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pre-commit/pre-commit/commit/9767b6c8211a6bf683875a0afcf2b390457a4b66"><code>9767b6c</code></a>
v4.6.2</li>
<li><a
href="https://github.com/pre-commit/pre-commit/commit/42ee3ff5ac1cae639613c9ad002d0502ae82384f"><code>42ee3ff</code></a>
Merge pull request <a
href="https://redirect.github.com/pre-commit/pre-commit/issues/3743">#3743</a>
from pre-commit/npm-build-scripts-11-x</li>
<li><a
href="https://github.com/pre-commit/pre-commit/commit/30566198cb2d05201625f92b660a34c38ffe2dc7"><code>3056619</code></a>
fix <code>language: node</code> for hooks with build scripts and npm
11.x</li>
<li>See full diff in <a
href="https://github.com/pre-commit/pre-commit/compare/v4.6.1...v4.6.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `wheel` from 0.47.0 to 0.48.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/releases">wheel's
releases</a>.</em></p>
<blockquote>
<h2>0.48.0</h2>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a PEP 440 local version
identifier from a wheel (<a
href="https://redirect.github.com/pypa/wheel/issues/570">#570</a>)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions (<a
href="https://redirect.github.com/pypa/wheel/issues/643">#643</a>)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose entries use ZIP64, by dropping the
central-directory ZIP64 extra field that is not valid in a local file
header (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination directory when the input archive contained a maliciously
crafted project name or version with path separators (arbitrary file
write / path traversal) (<a
href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw">GHSA-vgq5-9859-3mmw</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>UNRELEASED</strong></p>
<ul>
<li>Fixed the macOS platform-tag warning always using the plural
&quot;these files&quot;
wording, even when only a single library required a higher deployment
target
(<code>[#697](pypa/wheel#697)
&lt;https://github.com/pypa/wheel/pull/697&gt;</code>_)</li>
</ul>
<p><strong>0.48.0 (2026-08-12)</strong></p>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a
PEP 440 local version identifier from a wheel
(<code>[#570](pypa/wheel#570)
&lt;https://github.com/pypa/wheel/issues/570&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions
(<code>[#643](pypa/wheel#643)
&lt;https://github.com/pypa/wheel/issues/643&gt;</code>_)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose
entries use ZIP64, by dropping the central-directory ZIP64 extra field
that is
not valid in a local file header
(<code>[#692](pypa/wheel#692)
&lt;https://github.com/pypa/wheel/issues/692&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination
directory when the input archive contained a maliciously crafted project
name
or version with path separators (arbitrary file write / path traversal)
(<code>GHSA-vgq5-9859-3mmw
&lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw&gt;</code>_)</li>
</ul>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without
unpacking them (<code>[#639](pypa/wheel#639)
&lt;https://github.com/pypa/wheel/issues/639&gt;</code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the
<code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[#411](pypa/wheel#411)
&lt;https://github.com/pypa/wheel/issues/411&gt;</code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when
installed alongside an old version of setuptools and running the
<code>bdist_wheel</code>
command (<code>[#676](pypa/wheel#676)
&lt;https://github.com/pypa/wheel/issues/676&gt;</code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84"><code>21c4da4</code></a>
Fixed the release heading format</li>
<li><a
href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2"><code>f06d4db</code></a>
Flit no longer supports --setup-py</li>
<li><a
href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c"><code>1a96c3e</code></a>
Created a new release</li>
<li><a
href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b"><code>d7d625d</code></a>
Fixed wheel convert writing outside the target directory on malicious
input (...</li>
<li><a
href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465"><code>986a440</code></a>
Strip ZIP64 extra field when retagging wheels (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>) (<a
href="https://redirect.github.com/pypa/wheel/issues/695">#695</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d"><code>0ca6f24</code></a>
feat: add --local-version option to wheel pack (<a
href="https://redirect.github.com/pypa/wheel/issues/694">#694</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb"><code>4a63caf</code></a>
Preserve compatible metadata versions in convert (<a
href="https://redirect.github.com/pypa/wheel/issues/690">#690</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a"><code>33650c6</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/691">#691</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2"><code>197012d</code></a>
Increased the upper bound for flit-core as a build requirement</li>
<li>See full diff in <a
href="https://github.com/pypa/wheel/compare/0.47.0...0.48.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Lockfile-only dev/build tooling bumps with no application code
changes; wheel 0.48.0 includes a security fix for `wheel convert` that
is unlikely to affect normal Streamlit dev unless that CLI is used on
untrusted inputs.
> 
> **Overview**
> Updates **`uv.lock`** only for the **python-minor-patch** Dependabot
group: **`pre-commit`** **4.6.1 → 4.6.2** and **`wheel`** **0.47.0 →
0.48.0** (sdist/wheel URLs and hashes).
> 
> **`pre-commit` 4.6.2** fixes **`language: node`** hooks that define an
npm **`build`** script under **npm 11.x** (regression from 4.6.1).
> 
> **`wheel` 0.48.0** adds **`wheel pack --local-version`**, fixes
**`wheel convert`** metadata handling and **`wheel tags`** ZIP64
retagging, and patches a **`wheel convert`** path-traversal / arbitrary
write issue (**GHSA-vgq5-9859-3mmw**).
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
2137ea2. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
neu-ro-github-bot Bot pushed a commit to neuro-inc/apolo-cli that referenced this pull request Aug 18, 2026
Updates the requirements on [wheel](https://github.com/pypa/wheel) to
permit the latest version.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/releases">wheel's
releases</a>.</em></p>
<blockquote>
<h2>0.48.0</h2>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a PEP 440 local version
identifier from a wheel (<a
href="https://redirect.github.com/pypa/wheel/issues/570">#570</a>)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions (<a
href="https://redirect.github.com/pypa/wheel/issues/643">#643</a>)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose entries use ZIP64, by dropping the
central-directory ZIP64 extra field that is not valid in a local file
header (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination directory when the input archive contained a maliciously
crafted project name or version with path separators (arbitrary file
write / path traversal) (<a
href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw">GHSA-vgq5-9859-3mmw</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>UNRELEASED</strong></p>
<ul>
<li>Fixed the macOS platform-tag warning always using the plural
&quot;these files&quot;
wording, even when only a single library required a higher deployment
target
(<code>[#697](pypa/wheel#697)
&lt;https://github.com/pypa/wheel/pull/697&gt;</code>_)</li>
</ul>
<p><strong>0.48.0 (2026-08-12)</strong></p>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a
PEP 440 local version identifier from a wheel
(<code>[#570](pypa/wheel#570)
&lt;https://github.com/pypa/wheel/issues/570&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions
(<code>[#643](pypa/wheel#643)
&lt;https://github.com/pypa/wheel/issues/643&gt;</code>_)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose
entries use ZIP64, by dropping the central-directory ZIP64 extra field
that is
not valid in a local file header
(<code>[#692](pypa/wheel#692)
&lt;https://github.com/pypa/wheel/issues/692&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination
directory when the input archive contained a maliciously crafted project
name
or version with path separators (arbitrary file write / path traversal)
(<code>GHSA-vgq5-9859-3mmw
&lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw&gt;</code>_)</li>
</ul>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without
unpacking them (<code>[#639](pypa/wheel#639)
&lt;https://github.com/pypa/wheel/issues/639&gt;</code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the
<code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[#411](pypa/wheel#411)
&lt;https://github.com/pypa/wheel/issues/411&gt;</code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when
installed alongside an old version of setuptools and running the
<code>bdist_wheel</code>
command (<code>[#676](pypa/wheel#676)
&lt;https://github.com/pypa/wheel/issues/676&gt;</code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84"><code>21c4da4</code></a>
Fixed the release heading format</li>
<li><a
href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2"><code>f06d4db</code></a>
Flit no longer supports --setup-py</li>
<li><a
href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c"><code>1a96c3e</code></a>
Created a new release</li>
<li><a
href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b"><code>d7d625d</code></a>
Fixed wheel convert writing outside the target directory on malicious
input (...</li>
<li><a
href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465"><code>986a440</code></a>
Strip ZIP64 extra field when retagging wheels (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>) (<a
href="https://redirect.github.com/pypa/wheel/issues/695">#695</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d"><code>0ca6f24</code></a>
feat: add --local-version option to wheel pack (<a
href="https://redirect.github.com/pypa/wheel/issues/694">#694</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb"><code>4a63caf</code></a>
Preserve compatible metadata versions in convert (<a
href="https://redirect.github.com/pypa/wheel/issues/690">#690</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a"><code>33650c6</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/691">#691</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2"><code>197012d</code></a>
Increased the upper bound for flit-core as a build requirement</li>
<li>See full diff in <a
href="https://github.com/pypa/wheel/compare/0.47.0...0.48.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
meefs pushed a commit to meefs/openvino that referenced this pull request Aug 19, 2026
…7463)

Updates the requirements on [wheel](https://github.com/pypa/wheel) to
permit the latest version.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/releases">wheel's
releases</a>.</em></p>
<blockquote>
<h2>0.48.0</h2>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a PEP 440 local version
identifier from a wheel (<a
href="https://redirect.github.com/pypa/wheel/issues/570">#570</a>)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions (<a
href="https://redirect.github.com/pypa/wheel/issues/643">#643</a>)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose entries use ZIP64, by dropping the
central-directory ZIP64 extra field that is not valid in a local file
header (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination directory when the input archive contained a maliciously
crafted project name or version with path separators (arbitrary file
write / path traversal) (<a
href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw">GHSA-vgq5-9859-3mmw</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>UNRELEASED</strong></p>
<ul>
<li>Fixed the macOS platform-tag warning always using the plural
&quot;these files&quot;
wording, even when only a single library required a higher deployment
target
(<code>[openvinotoolkit#697](pypa/wheel#697)
&lt;https://github.com/pypa/wheel/pull/697&gt;</code>_)</li>
</ul>
<p><strong>0.48.0 (2026-08-12)</strong></p>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a
PEP 440 local version identifier from a wheel
(<code>[openvinotoolkit#570](pypa/wheel#570)
&lt;https://github.com/pypa/wheel/issues/570&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions
(<code>[openvinotoolkit#643](pypa/wheel#643)
&lt;https://github.com/pypa/wheel/issues/643&gt;</code>_)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose
entries use ZIP64, by dropping the central-directory ZIP64 extra field
that is
not valid in a local file header
(<code>[openvinotoolkit#692](pypa/wheel#692)
&lt;https://github.com/pypa/wheel/issues/692&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination
directory when the input archive contained a maliciously crafted project
name
or version with path separators (arbitrary file write / path traversal)
(<code>GHSA-vgq5-9859-3mmw
&lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw&gt;</code>_)</li>
</ul>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without
unpacking them (<code>[openvinotoolkit#639](pypa/wheel#639)
&lt;https://github.com/pypa/wheel/issues/639&gt;</code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the
<code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[openvinotoolkit#411](pypa/wheel#411)
&lt;https://github.com/pypa/wheel/issues/411&gt;</code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when
installed alongside an old version of setuptools and running the
<code>bdist_wheel</code>
command (<code>[openvinotoolkit#676](pypa/wheel#676)
&lt;https://github.com/pypa/wheel/issues/676&gt;</code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84"><code>21c4da4</code></a>
Fixed the release heading format</li>
<li><a
href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2"><code>f06d4db</code></a>
Flit no longer supports --setup-py</li>
<li><a
href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c"><code>1a96c3e</code></a>
Created a new release</li>
<li><a
href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b"><code>d7d625d</code></a>
Fixed wheel convert writing outside the target directory on malicious
input (...</li>
<li><a
href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465"><code>986a440</code></a>
Strip ZIP64 extra field when retagging wheels (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>) (<a
href="https://redirect.github.com/pypa/wheel/issues/695">#695</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d"><code>0ca6f24</code></a>
feat: add --local-version option to wheel pack (<a
href="https://redirect.github.com/pypa/wheel/issues/694">#694</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb"><code>4a63caf</code></a>
Preserve compatible metadata versions in convert (<a
href="https://redirect.github.com/pypa/wheel/issues/690">#690</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a"><code>33650c6</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/691">#691</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2"><code>197012d</code></a>
Increased the upper bound for flit-core as a build requirement</li>
<li><a
href="https://github.com/pypa/wheel/commit/efd83a750f07a33462ea2eed365fd8dac9e51442"><code>efd83a7</code></a>
Created a new release</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/wheel/compare/0.38.1...0.48.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
rickeylev added a commit to rickeylev/rules_python that referenced this pull request Aug 23, 2026
…azel-contrib#4098)

Bumps the uv group with 2 updates in the /examples/bzlmod directory:
[certifi](https://github.com/certifi/python-certifi) and
[wheel](https://github.com/pypa/wheel).
Bumps the uv group with 3 updates in the /examples/pip_parse directory:
[idna](https://github.com/kjd/idna),
[requests](https://github.com/psf/requests) and
[urllib3](https://github.com/urllib3/urllib3).
Bumps the uv group with 1 update in the /tests/multiple_inputs
directory: [urllib3](https://github.com/urllib3/urllib3).
Bumps the uv group with 3 updates in the /tests/uv/lock/pyproject_toml
directory: [idna](https://github.com/kjd/idna),
[requests](https://github.com/psf/requests) and
[urllib3](https://github.com/urllib3/urllib3).
Bumps the uv group with 3 updates in the /tests/uv/lock/workspaces
directory: [idna](https://github.com/kjd/idna),
[requests](https://github.com/psf/requests) and
[urllib3](https://github.com/urllib3/urllib3).

Updates `certifi` from 2023.7.22 to 2024.7.4
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"><code>bd81538</code></a>
2024.07.04 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/295">#295</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3"><code>06a2cbf</code></a>
Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/294">#294</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23"><code>13bba02</code></a>
Bump actions/checkout from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/293">#293</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554"><code>e8abcd0</code></a>
Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/292">#292</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1"><code>124f4ad</code></a>
2024.06.02 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/291">#291</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a"><code>c2196ce</code></a>
--- (<a
href="https://redirect.github.com/certifi/python-certifi/issues/290">#290</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2"><code>fefdeec</code></a>
Bump actions/checkout from 4.1.4 to 4.1.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/289">#289</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf"><code>3c5fb15</code></a>
Bump actions/download-artifact from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/286">#286</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1"><code>4a9569a</code></a>
Bump actions/checkout from 4.1.2 to 4.1.4 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/287">#287</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3"><code>1fc8086</code></a>
Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/288">#288</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04">compare
view</a></li>
</ul>
</details>
<br />

Updates `wheel` from 0.40.0 to 0.46.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/releases">wheel's
releases</a>.</em></p>
<blockquote>
<h2>0.46.2</h2>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the destination tree with maliciously crafted wheels
(CVE-2026-24049)</li>
</ul>
<h2>0.46.1</h2>
<ul>
<li>Temporarily restored the <code>wheel.macosx_libfile</code> module
(<a
href="https://redirect.github.com/pypa/wheel/issues/659">#659</a>)</li>
</ul>
<h2>0.46.0</h2>
<ul>
<li>Dropped support for Python 3.8</li>
<li>Removed the <code>bdist_wheel</code> setuptools command
implementation and entry point. The <code>wheel.bdist_wheel</code>
module is now just an alias to
<code>setuptools.command.bdist_wheel</code>, emitting a deprecation
warning on import.</li>
<li>Removed vendored <code>packaging</code> in favor of a run-time
dependency on it</li>
<li>Made the <code>wheel.metadata</code> module private (with a
deprecation warning if it's imported</li>
<li>Made the <code>wheel.cli</code> package private (no deprecation
warning)</li>
<li>Fixed an exception when calling the <code>convert</code> command
with an empty description field</li>
</ul>
<h2>0.45.1</h2>
<ul>
<li>Fixed pure Python wheels converted from eggs and wininst files
having the ABI tag in the file name</li>
</ul>
<h2>0.45.0</h2>
<ul>
<li>
<p>Refactored the <code>convert</code> command to not need setuptools to
be installed</p>
</li>
<li>
<p>Don't configure setuptools logging unless running
<code>bdist_wheel</code></p>
</li>
<li>
<p>Added a redirection from <code>wheel.bdist_wheel.bdist_wheel</code>
to <code>setuptools.command.bdist_wheel.bdist_wheel</code> to improve
compatibility with <code>setuptools</code>' latest fixes.</p>
<p>Projects are still advised to migrate away from the deprecated module
and import the <code>setuptools</code>' implementation explicitly. (PR
by <a
href="https://github.com/abravalheri"><code>@​abravalheri</code></a>)</p>
</li>
</ul>
<h2>0.44.0</h2>
<ul>
<li>Canonicalized requirements in METADATA file (PR by Wim
Jeantine-Glenn)</li>
<li>Deprecated the <code>bdist_wheel</code> module, as the code was
migrated to <code>setuptools</code> itself</li>
</ul>
<h2>0.43.0</h2>
<ul>
<li>Dropped support for Python 3.7</li>
<li>Updated vendored <code>packaging</code> to 24.0</li>
</ul>
<h2>0.42.0</h2>
<ul>
<li>Allowed removing build tag with <code>wheel tags --build
&quot;&quot;</code></li>
<li>Fixed <code>wheel pack</code> and <code>wheel tags</code> writing
updated <code>WHEEL</code> fields after a blank line, causing other
tools to ignore them</li>
<li>Fixed <code>wheel pack</code> and <code>wheel tags</code> writing
<code>WHEEL</code> with CRLF line endings or a mix of CRLF and LF</li>
<li>Fixed <code>wheel pack --build-number &quot;&quot;</code> not
removing build tag from <code>WHEEL</code> (above changes by Benjamin
Gilbert)</li>
</ul>
<h2>0.41.3</h2>
<ul>
<li>Updated vendored <code>packaging</code> to 23.2</li>
<li>Fixed ABI tag generation for CPython 3.13a1 on Windows (PR by Sam
Gross)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>UNRELEASED</strong></p>
<ul>
<li>Fixed the macOS platform-tag warning always using the plural
&quot;these files&quot;
wording, even when only a single library required a higher deployment
target
(<code>[#697](https://github.com/pypa/wheel/issues/697)
&lt;https://github.com/pypa/wheel/pull/697&gt;</code>_)</li>
</ul>
<p><strong>0.48.0 (2026-08-12)</strong></p>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a
PEP 440 local version identifier from a wheel
(<code>[#570](https://github.com/pypa/wheel/issues/570)
&lt;https://github.com/pypa/wheel/issues/570&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions
(<code>[#643](https://github.com/pypa/wheel/issues/643)
&lt;https://github.com/pypa/wheel/issues/643&gt;</code>_)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose
entries use ZIP64, by dropping the central-directory ZIP64 extra field
that is
not valid in a local file header
(<code>[#692](https://github.com/pypa/wheel/issues/692)
&lt;https://github.com/pypa/wheel/issues/692&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination
directory when the input archive contained a maliciously crafted project
name
or version with path separators (arbitrary file write / path traversal)
(<code>GHSA-vgq5-9859-3mmw
&lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw&gt;</code>_)</li>
</ul>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without
unpacking them (<code>[#639](https://github.com/pypa/wheel/issues/639)
&lt;https://github.com/pypa/wheel/issues/639&gt;</code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the
<code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[#411](https://github.com/pypa/wheel/issues/411)
&lt;https://github.com/pypa/wheel/issues/411&gt;</code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when
installed alongside an old version of setuptools and running the
<code>bdist_wheel</code>
command (<code>[#676](https://github.com/pypa/wheel/issues/676)
&lt;https://github.com/pypa/wheel/issues/676&gt;</code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/wheel/commit/eba4036ccaca4e2d0c5b5bf3e3be59b2b2877d6b"><code>eba4036</code></a>
Updated the version number for v0.46.2</li>
<li><a
href="https://github.com/pypa/wheel/commit/557fb5425036ccca95330b2c8875e54c9f4483cf"><code>557fb54</code></a>
Created a new release</li>
<li><a
href="https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef"><code>7a7d2de</code></a>
Fixed security issue around wheel unpack (<a
href="https://redirect.github.com/pypa/wheel/issues/675">#675</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/41418fac233d6973ea8798d620df4aa5b3aa1b66"><code>41418fa</code></a>
Fixed test failures due to metadata normalization changes</li>
<li><a
href="https://github.com/pypa/wheel/commit/c1d442bec6c634fcfb89e5d58698dd226685bd14"><code>c1d442b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/674">#674</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/0bac8820ec90b1aaa0695d79a56563137b48686d"><code>0bac882</code></a>
Update github actions environments (<a
href="https://redirect.github.com/pypa/wheel/issues/673">#673</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/be9f45b4ee1210b2a815d2eefea56b71efd99d63"><code>be9f45b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/667">#667</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/6244f08bb92d7569da6c2fbea23de0846ad34ff3"><code>6244f08</code></a>
Update pre-commit ruff legacy alias (<a
href="https://redirect.github.com/pypa/wheel/issues/668">#668</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/15b7577654e8bcd23e009c6bac036b65c11d8d8f"><code>15b7577</code></a>
PEP 639 compliance (<a
href="https://redirect.github.com/pypa/wheel/issues/670">#670</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/fc8cb4163e4f48d86092cb2a16076f1b3efcd10f"><code>fc8cb41</code></a>
Revert &quot;Removed redundant Python version from the publish workflow
(<a
href="https://redirect.github.com/pypa/wheel/issues/666">#666</a>)&quot;</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/wheel/compare/0.40.0...0.46.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `certifi` from 2023.7.22 to 2024.7.4
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"><code>bd81538</code></a>
2024.07.04 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/295">#295</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3"><code>06a2cbf</code></a>
Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/294">#294</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23"><code>13bba02</code></a>
Bump actions/checkout from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/293">#293</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554"><code>e8abcd0</code></a>
Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/292">#292</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1"><code>124f4ad</code></a>
2024.06.02 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/291">#291</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a"><code>c2196ce</code></a>
--- (<a
href="https://redirect.github.com/certifi/python-certifi/issues/290">#290</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2"><code>fefdeec</code></a>
Bump actions/checkout from 4.1.4 to 4.1.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/289">#289</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf"><code>3c5fb15</code></a>
Bump actions/download-artifact from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/286">#286</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1"><code>4a9569a</code></a>
Bump actions/checkout from 4.1.2 to 4.1.4 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/287">#287</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3"><code>1fc8086</code></a>
Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/288">#288</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04">compare
view</a></li>
</ul>
</details>
<br />

Updates `certifi` from 2023.7.22 to 2024.7.4
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"><code>bd81538</code></a>
2024.07.04 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/295">#295</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3"><code>06a2cbf</code></a>
Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/294">#294</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23"><code>13bba02</code></a>
Bump actions/checkout from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/293">#293</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554"><code>e8abcd0</code></a>
Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/292">#292</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1"><code>124f4ad</code></a>
2024.06.02 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/291">#291</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a"><code>c2196ce</code></a>
--- (<a
href="https://redirect.github.com/certifi/python-certifi/issues/290">#290</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2"><code>fefdeec</code></a>
Bump actions/checkout from 4.1.4 to 4.1.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/289">#289</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf"><code>3c5fb15</code></a>
Bump actions/download-artifact from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/286">#286</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1"><code>4a9569a</code></a>
Bump actions/checkout from 4.1.2 to 4.1.4 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/287">#287</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3"><code>1fc8086</code></a>
Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/288">#288</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04">compare
view</a></li>
</ul>
</details>
<br />

Updates `certifi` from 2023.7.22 to 2024.7.4
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"><code>bd81538</code></a>
2024.07.04 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/295">#295</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3"><code>06a2cbf</code></a>
Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/294">#294</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23"><code>13bba02</code></a>
Bump actions/checkout from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/293">#293</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554"><code>e8abcd0</code></a>
Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/292">#292</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1"><code>124f4ad</code></a>
2024.06.02 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/291">#291</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a"><code>c2196ce</code></a>
--- (<a
href="https://redirect.github.com/certifi/python-certifi/issues/290">#290</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2"><code>fefdeec</code></a>
Bump actions/checkout from 4.1.4 to 4.1.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/289">#289</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf"><code>3c5fb15</code></a>
Bump actions/download-artifact from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/286">#286</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1"><code>4a9569a</code></a>
Bump actions/checkout from 4.1.2 to 4.1.4 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/287">#287</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3"><code>1fc8086</code></a>
Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/288">#288</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04">compare
view</a></li>
</ul>
</details>
<br />

Updates `certifi` from 2023.7.22 to 2024.7.4
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"><code>bd81538</code></a>
2024.07.04 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/295">#295</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3"><code>06a2cbf</code></a>
Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/294">#294</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23"><code>13bba02</code></a>
Bump actions/checkout from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/293">#293</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554"><code>e8abcd0</code></a>
Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/292">#292</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1"><code>124f4ad</code></a>
2024.06.02 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/291">#291</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a"><code>c2196ce</code></a>
--- (<a
href="https://redirect.github.com/certifi/python-certifi/issues/290">#290</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2"><code>fefdeec</code></a>
Bump actions/checkout from 4.1.4 to 4.1.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/289">#289</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf"><code>3c5fb15</code></a>
Bump actions/download-artifact from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/286">#286</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1"><code>4a9569a</code></a>
Bump actions/checkout from 4.1.2 to 4.1.4 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/287">#287</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3"><code>1fc8086</code></a>
Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/288">#288</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04">compare
view</a></li>
</ul>
</details>
<br />

Updates `idna` from 2.10 to 3.15
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/releases">idna's
releases</a>.</em></p>
<blockquote>
<h2>v3.15</h2>
<p>No release notes provided.</p>
<h2>v3.14</h2>
<p>No release notes provided.</p>
<h2>v3.13</h2>
<p>No release notes provided.</p>
<h2>v3.12</h2>
<p>No release notes provided.</p>
<h2>v3.11</h2>
<p>No release notes provided.</p>
<h2>v3.10</h2>
<p>No release notes provided.</p>
<h2>v3.9</h2>
<p>No release notes provided.</p>
<h2>v3.8</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix regression where IDNAError exception was not being produced for
certain inputs.</li>
<li>Add support for Python 3.13, drop support for Python 3.5 as it is no
longer testable.</li>
<li>Documentation improvements</li>
<li>Updates to package testing using Github actions</li>
</ul>
<p>Thanks to Hugo van Kemenade for contributions to this release.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kjd/idna/compare/v3.7...v3.8">https://github.com/kjd/idna/compare/v3.7...v3.8</a></p>
<h2>v3.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix issue where specially crafted inputs to encode() could take
exceptionally long amount of time to process. [CVE-2024-3651]</li>
</ul>
<p>Thanks to Guido Vranken for reporting the issue.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kjd/idna/compare/v3.6...v3.7">https://github.com/kjd/idna/compare/v3.6...v3.7</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's
changelog</a>.</em></p>
<blockquote>
<h2>3.15 (2026-05-12)</h2>
<ul>
<li>Enforce DNS-length cap on individual labels early in
<code>check_label</code>,
short-circuiting contextual-rule processing for oversized input
while staying compatible with UTS 46 usage.</li>
<li>Tidy core helpers: hoist bidi category sets to module-level
frozensets (avoiding per-codepoint list construction), simplify
length checks, and reuse the shared <code>_unicode_dots_re</code> from
<code>idna.core</code> in the codec module.</li>
<li>Use <code>raise ... from err</code> for proper exception chaining
and
switch internal string formatting to f-strings.</li>
<li>Allow <code>flit_core</code> 4.x in the build backend.</li>
<li>Expand the ruff lint set (flake8-bugbear, flake8-simplify,
pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
to Python 3.14.</li>
<li>Add Dependabot configuration for GitHub Actions.</li>
<li>Convert README and HISTORY from reStructuredText to Markdown.</li>
<li>Reference CVE-2026-45409 for the 3.14 advisory in place of the
initial GHSA identifier.</li>
</ul>
<p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.</p>
<h2>3.14 (2026-05-10)</h2>
<ul>
<li>Removed opportunity to process long inputs into quadratic
time by rejecting oversize inputs up-front. Closes a bypass
of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li>
</ul>
<p>Thanks to Stan Ulbrych for reporting the issue.</p>
<h2>3.13 (2026-04-22)</h2>
<ul>
<li>Correct classification error for codepoint U+A7F1</li>
</ul>
<h2>3.12 (2026-04-21)</h2>
<ul>
<li>Update to Unicode 17.0.0.</li>
<li>Issue a deprecation warning for the transitional argument.</li>
<li>Added lazy-loading to provide some performance improvements.</li>
<li>Removed vestiges of code related to Python 2 support, including
segmentation of data structures specific to Jython.</li>
</ul>
<p>Thanks to Rodrigo Nogueira for contributions to this release.</p>
<h2>3.11 (2025-10-12)</h2>
<ul>
<li>Update to Unicode 16.0.0, including significant changes to UTS46
processing. As a result of Unicode ending support for it, transitional
processing no longer has an effect and returns the same result.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a>
Release 3.15</li>
<li><a
href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a>
Pre-release 3.15rc0</li>
<li><a
href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from
kjd/convert-docs-to-markdown</li>
<li><a
href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a>
Convert README and HISTORY from reStructuredText to Markdown</li>
<li><a
href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from
kjd/dependabot/github_actions/actions-f3e34333ea</li>
<li><a
href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a>
Merge branch 'master' into
dependabot/github_actions/actions-f3e34333ea</li>
<li><a
href="https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631"><code>bbd8004</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/234">#234</a> from
StanFromIreland/patch-1</li>
<li><a
href="https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc"><code>edd07c0</code></a>
Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions
group</li>
<li><a
href="https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123"><code>5557db0</code></a>
Merge branch 'master' into patch-1</li>
<li><a
href="https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d"><code>f11746c</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/235">#235</a> from
StanFromIreland/patch-2</li>
<li>Additional commits viewable in <a
href="https://github.com/kjd/idna/compare/v2.10...v3.15">compare
view</a></li>
</ul>
</details>
<br />

Updates `requests` from 2.25.1 to 2.33.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/releases">requests's
releases</a>.</em></p>
<blockquote>
<h2>v2.33.0</h2>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report any gaps or feedback you may have in the
issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts contents to a non-deterministic location to prevent malicious
file replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause malformed
authentication to be applied to Requests on Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/M0d3v1"><code>@​M0d3v1</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li>
<li><a href="https://github.com/aminvakil"><code>@​aminvakil</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li>
<li><a href="https://github.com/E8Price"><code>@​E8Price</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li>
<li><a href="https://github.com/mitre88"><code>@​mitre88</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li>
<li><a href="https://github.com/magsen"><code>@​magsen</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li>
<li><a
href="https://github.com/Rohan5commit"><code>@​Rohan5commit</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a></p>
<h2>v2.32.5</h2>
<h2>2.32.5 (2025-08-18)</h2>
<p><strong>Bugfixes</strong></p>
<ul>
<li>The SSLContext caching feature originally introduced in 2.32.0 has
created
a new class of issues in Requests that have had negative impact across a
number
of use cases. The Requests team has decided to revert this feature as
long term
maintenance of it is proving to be unsustainable in its current
iteration.</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Added support for Python 3.14.</li>
<li>Dropped support for Python 3.8 following its end of support.</li>
</ul>
<h2>v2.32.4</h2>
<h2>2.32.4 (2025-06-10)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's
changelog</a>.</em></p>
<blockquote>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that
uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report
any gaps or feedback you may have in the issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>2.32.5 (2025-08-18)</h2>
<p><strong>Bugfixes</strong></p>
<ul>
<li>The SSLContext caching feature originally introduced in 2.32.0 has
created
a new class of issues in Requests that have had negative impact across a
number
of use cases. The Requests team has decided to revert this feature as
long term
maintenance of it is proving to be unsustainable in its current
iteration.</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Added support for Python 3.14.</li>
<li>Dropped support for Python 3.8 following its end of support.</li>
</ul>
<h2>2.32.4 (2025-06-10)</h2>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2024-47081 Fixed an issue where a maliciously crafted URL and
trusted
environment will retrieve credentials for the wrong hostname/machine
from a
netrc file.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a>
v2.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a>
Move badges to top of README (<a
href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a>
Remove unused extraction call (<a
href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a>
docs: fix FAQ grammar in httplib2 example</li>
<li><a
href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a>
docs(socks): same block as other sections</li>
<li><a
href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a>
Bump github/codeql-action from 4.33.0 to 4.34.1</li>
<li><a
href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a>
Bump github/codeql-action from 4.32.0 to 4.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a>
docs: exclude Response.is_permanent_redirect from API docs (<a
href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a>
docs: clarify Quickstart POST example (<a
href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/psf/requests/compare/v2.25.1...v2.33.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `urllib3` from 1.26.20 to 2.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.7.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Addressed high-severity security issues. Impact was limited to
specific use cases detailed in the accompanying advisories; overall user
exposure was estimated to be marginal.</p>
<ul>
<li>
<p>Decompression-bomb safeguards of the streaming API were bypassed:</p>
<ol>
<li>When <code>HTTPResponse.drain_conn()</code> was called after the
response had been read and decompressed partially. (Reported by <a
href="https://github.com/Cycloctane"><code>@​Cycloctane</code></a>)</li>
<li>During the second <code>HTTPResponse.read(amt=N)</code> or
<code>HTTPResponse.stream(amt=N)</code> call when the response was
decompressed using the official <a
href="https://pypi.org/project/brotli/">Brotli</a> library. (Reported by
<a
href="https://github.com/kimkou2024"><code>@​kimkou2024</code></a>)</li>
</ol>
<p>See GHSA-mf9v-mfxr-j63j for details.</p>
</li>
<li>
<p>HTTP pools created using
<code>ProxyManager.connection_from_url</code> did not strip sensitive
headers specified in <code>Retry.remove_headers_on_redirect</code> when
redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by <a
href="https://github.com/christos-spearbit"><code>@​christos-spearbit</code></a>)</p>
</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Used <code>FutureWarning</code> instead of
<code>DeprecationWarning</code> for better visibility of existing
deprecation notices. Rescheduled the removal of deprecated features to
version 3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3763">urllib3/urllib3#3763</a>)</li>
<li>Removed support for end-of-life Python 3.9. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3720">urllib3/urllib3#3720</a>)</li>
<li>Removed support for end-of-life PyPy3.10. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4979">urllib3/urllib3#4979</a>)</li>
<li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3777">urllib3/urllib3#3777</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was
ignoring decompressed data buffered from previous partial reads. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3636">urllib3/urllib3#3636</a>)</li>
<li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only
part of the response after a partial read when
<code>cache_content=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4967">urllib3/urllib3#4967</a>)</li>
<li>Fixed <code>HTTPResponse.stream()</code> and
<code>HTTPResponse.read_chunked()</code> to handle <code>amt=0</code>.
(<a
href="https://redirect.github.com/urllib3/urllib3/issues/3793">urllib3/urllib3#3793</a>)</li>
<li>Updated <code>_TYPE_BODY</code> type alias to include missing
<code>Iterable[str]</code>, matching the documented and runtime behavior
of chunked request bodies. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3798">urllib3/urllib3#3798</a>)</li>
<li>Fixed <code>LocationParseError</code> when paths resembling
schemeless URIs were passed to
<code>HTTPConnectionPool.urlopen()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3352">urllib3/urllib3#3352</a>)</li>
<li>Fixed <code>BaseHTTPResponse.readinto()</code> type annotation to
accept <code>memoryview</code> in addition to <code>bytearray</code>,
matching the <code>io.RawIOBase.readinto</code> contract and enabling
use with <code>io.BufferedReader</code> without type errors. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li>
</ul>
<h2>2.6.3</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Changes</h2>
<ul>
<li>Fixed a security issue where decompression-bomb safeguards of the
streaming API were bypassed when HTTP redirects were followed.
(CVE-2026-21441 reported by <a
href="https://github.com/D47A"><code>@​D47A</code></a>, 8.9 High,
GHSA-38jv-5279-wg99)</li>
<li>Started treating <code>Retry-After</code> times greater than 6 hours
as 6 hours by default. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3743">urllib3/urllib3#3743</a>)</li>
<li>Fixed <code>urllib3.connection.VerifiedHTTPSConnection</code> on
Emscripten. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3752">urllib3/urllib3#3752</a>)</li>
</ul>
<h2>2.6.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.7.0 (2026-05-07)</h1>
<h2>Security</h2>
<p>Addressed high-severity security issues.
Impact was limited to specific use cases detailed in the accompanying
advisories; overall user exposure was estimated to be marginal.</p>
<ul>
<li>
<p>Decompression-bomb safeguards of the streaming API were bypassed:</p>
<ol>
<li>When <code>HTTPResponse.drain_conn()</code> was called after the
response had been
read and decompressed partially.</li>
<li>During the second <code>HTTPResponse.read(amt=N)</code> or
<code>HTTPResponse.stream(amt=N)</code> call when the response was
decompressed
using the official <code>Brotli
&lt;https://pypi.org/project/brotli/&gt;</code>__ library.</li>
</ol>
<p>See <code>GHSA-mf9v-mfxr-j63j
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j&gt;</code>__
for details.</p>
</li>
<li>
<p>HTTP pools created using
<code>ProxyManager.connection_from_url</code> did not strip
sensitive headers specified in
<code>Retry.remove_headers_on_redirect</code> when
redirecting to a different host.
(<code>GHSA-qccp-gfcp-xxvc
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc&gt;</code>__)</p>
</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Used <code>FutureWarning</code> instead of
<code>DeprecationWarning</code> for better
visibility of existing deprecation notices. Rescheduled the removal of
deprecated features to version 3.0.
(<code>[#3763](https://github.com/urllib3/urllib3/issues/3763)
&lt;https://github.com/urllib3/urllib3/issues/3763&gt;</code>__)</li>
<li>Removed support for end-of-life Python 3.9.
(<code>[#3720](https://github.com/urllib3/urllib3/issues/3720)
&lt;https://github.com/urllib3/urllib3/issues/3720&gt;</code>__)</li>
<li>Removed support for end-of-life PyPy3.10.
(<code>[#4979](https://github.com/urllib3/urllib3/issues/4979)
&lt;https://github.com/urllib3/urllib3/issues/4979&gt;</code>__)</li>
<li>Bumped the minimum supported pyOpenSSL version to 19.0.0.
(<code>[#3777](https://github.com/urllib3/urllib3/issues/3777)
&lt;https://github.com/urllib3/urllib3/issues/3777&gt;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was
ignoring decompressed
data buffered from previous partial reads.
(<code>[#3636](https://github.com/urllib3/urllib3/issues/3636)
&lt;https://github.com/urllib3/urllib3/issues/3636&gt;</code>__)</li>
<li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only
part of the
response after a partial read when <code>cache_content=True</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2"><code>9a950b9</code></a>
Release 2.7.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc"><code>5ec0de4</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a"><code>2bdcc44</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c"><code>f45b0df</code></a>
Fix a misleading example for <code>ProxyManager</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4970">#4970</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b"><code>577193c</code></a>
Switch to nightly PyPy3.11 in CI for now (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4984">#4984</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc"><code>e90af45</code></a>
Avoid infinite loop in <code>HTTPResponse.read_chunked</code> when
<code>amt=0</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4974">#4974</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210"><code>67ed74f</code></a>
Bump dev dependencies (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4972">#4972</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d"><code>3abd481</code></a>
Upgrade mypy to version 1.20.2 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4978">#4978</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890"><code>2b8725d</code></a>
Drop support for EOL PyPy3.10 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4979">#4979</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33"><code>2944b2a</code></a>
Upgrade <code>setup-chrome</code> and <code>setup-firefox</code> to fix
warnings (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4973">#4973</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/1.26.20...2.7.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `urllib3` from 1.26.20 to 2.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.7.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Addressed high-severity security issues. Impact was limited to
specific use cases detailed in the accompanying advisories; overall user
exposure was estimated to be marginal.</p>
<ul>
<li>
<p>Decompression-bomb safeguards of the streaming API were bypassed:</p>
<ol>
<li>When <code>HTTPResponse.drain_conn()</code> was called after the
response had been read and decompressed partially. (Reported by <a
href="https://github.com/Cycloctane"><code>@​Cycloctane</code></a>)</li>
<li>During the second <code>HTTPResponse.read(amt=N)</code> or
<code>HTTPResponse.stream(amt=N)</code> call when the response was
decompressed using the official <a
href="https://pypi.org/project/brotli/">Brotli</a> library. (Reported by
<a
href="https://github.com/kimkou2024"><code>@​kimkou2024</code></a>)</li>
</ol>
<p>See GHSA-mf9v-mfxr-j63j for details.</p>
</li>
<li>
<p>HTTP pools created using
<code>ProxyManager.connection_from_url</code> did not strip sensitive
headers specified in <code>Retry.remove_headers_on_redirect</code> when
redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by <a
href="https://github.com/christos-spearbit"><code>@​christos-spearbit</code></a>)</p>
</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Used <code>FutureWarning</code> instead of
<code>DeprecationWarning</code> for better visibility of existing
deprecation notices. Rescheduled the removal of deprecated features to
version 3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3763">urllib3/urllib3#3763</a>)</li>
<li>Removed support for end-of-life Python 3.9. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3720">urllib3/urllib3#3720</a>)</li>
<li>Removed support for end-of-life PyPy3.10. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4979">urllib3/urllib3#4979</a>)</li>
<li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3777">urllib3/urllib3#3777</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was
ignoring decompressed data buffered from previous partial reads. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3636">urllib3/urllib3#3636</a>)</li>
<li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only
part of the response after a partial read when
<code>cache_content=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4967">urllib3/urllib3#4967</a>)</li>
<li>Fixed <code>HTTPResponse.stream()</code> and
<code>HTTPResponse.read_chunked()</code> to handle <code>amt=0</code>.
(<a
href="https://redirect.github.com/urllib3/urllib3/issues/3793">urllib3/urllib3#3793</a>)</li>
<li>Updated <code>_TYPE_BODY</code> type alias to include missing
<code>Iterable[str]</code>, matching the documented and runtime behavior
of chunked request bodies. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3798">urllib3/urllib3#3798</a>)</li>
<li>Fixed <code>LocationParseError</code> when paths resembling
schemeless URIs were passed to
<code>HTTPConnectionPool.urlopen()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3352">urllib3/urllib3#3352</a>)</li>
<li>Fixed <code>BaseHTTPResponse.readinto()</code> type annotation to
accept <code>memoryview</code> in addition to <code>bytearray</code>,
matching the <code>io.RawIOBase.readinto</code> contract and enabling
use with <code>io.BufferedReader</code> without type errors. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li>
</ul>
<h2>2.6.3</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Changes</h2>
<ul>
<li>Fixed a security issue where decompression-bomb safeguards of the
streaming API were bypassed when HTTP redirects were followed.
(CVE-2026-21441 reported by <a
href="https://github.com/D47A"><code>@​D47A</code></a>, 8.9 High,
GHSA-38jv-5279-wg99)</li>
<li>Started treating <code>Retry-After</code> times greater than 6 hours
as 6 hours by default. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3743">urllib3/urllib3#3743</a>)</li>
<li>Fixed <code>urllib3.connection.VerifiedHTTPSConnection</code> on
Emscripten. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3752">urllib3/urllib3#3752</a>)</li>
</ul>
<h2>2.6.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.7.0 (2026-05-07)</h1>
<h2>Security</h2>
<p>Addressed high-severity security issues.
Impact was limited to specific use cases detailed in the accompanying
advisories; overall user exposure was estimated to be marginal.</p>
<ul>
<li>
<p>Decompression-bomb safeguards of the streaming API were bypassed:</p>
<ol>
<li>When <code>HTTPResponse.drain_conn()</code> was called after the
response had been
read and decompressed partially.</li>
<li>During the second <code>HTTPResponse.read(amt=N)</code> or
<code>HTTPResponse.stream(amt=N)</code> call when the response was
decompressed
using the official <code>Brotli
&lt;https://pypi.org/project/brotli/&gt;</code>__ library.</li>
</ol>
<p>See <code>GHSA-mf9v-mfxr-j63j
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j&gt;</code>__
for details.</p>
</li>
<li>
<p>HTTP pools created using
<code>ProxyManager.connection_from_url</code> did not strip
sensitive headers specified in
<code>Retry.remove_headers_on_redirect</code> when
redirecting to a different host.
(<code>GHSA-qccp-gfcp-xxvc
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc&gt;</code>__)</p>
</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Used <code>FutureWarning</code> instead of
<code>DeprecationWarning</code> for better
visibility of existing deprecation notices. Rescheduled the removal of
deprecated features to version 3.0.
(<code>[#3763](https://github.com/urllib3/urllib3/issues/3763)
&lt;https://github.com/urllib3/urllib3/issues/3763&gt;</code>__)</li>
<li>Removed support for end-of-life Python 3.9.
(<code>[#3720](https://github.com/urllib3/urllib3/issues/3720)
&lt;https://github.com/urllib3/urllib3/issues/3720&gt;</code>__)</li>
<li>Removed support for end-of-life PyPy3.10.
(<code>[#4979](https://github.com/urllib3/urllib3/issues/4979)
&lt;https://github.com/urllib3/urllib3/issues/4979&gt;</code>__)</li>
<li>Bumped the minimum supported pyOpenSSL version to 19.0.0.
(<code>[#3777](https://github.com/urllib3/urllib3/issues/3777)
&lt;https://github.com/urllib3/urllib3/issues/3777&gt;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was
ignoring decompressed
data buffered from previous partial reads.
(<code>[#3636](https://github.com/urllib3/urllib3/issues/3636)
&lt;https://github.com/urllib3/urllib3/issues/3636&gt;</code>__)</li>
<li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only
part of the
response after a partial read when <code>cache_content=True</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2"><code>9a950b9</code></a>
Release 2.7.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc"><code>5ec0de4</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a"><code>2bdcc44</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c"><code>f45b0df</code></a>
Fix a misleading example for <code>ProxyManager</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4970">#4970</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b"><code>577193c</code></a>
Switch to nightly PyPy3.11 in CI for now (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4984">#4984</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc"><code>e90af45</code></a>
Avoid infinite loop in <code>HTTPResponse.read_chunked</code> when
<code>amt=0</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4974">#4974</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210"><code>67ed74f</code></a>
Bump dev dependencies (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4972">#4972</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d"><code>3abd481</code></a>
Upgrade mypy to version 1.20.2 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4978">#4978</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890"><code>2b8725d</code></a>
Drop support for EOL PyPy3.10 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4979">#4979</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33"><code>2944b2a</code></a>
Upgrade <code>setup-chrome</code> and <code>setup-firefox</code> to fix
warnings (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4973">#4973</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/1.26.20...2.7.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `idna` from 2.10 to 3.15
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/releases">idna's
releases</a>.</em></p>
<blockquote>
<h2>v3.15</h2>
<p>No release notes provided.</p>
<h2>v3.14</h2>
<p>No release notes provided.</p>
<h2>v3.13</h2>
<p>No release notes provided.</p>
<h2>v3.12</h2>
<p>No release notes provided.</p>
<h2>v3.11</h2>
<p>No release notes provided.</p>
<h2>v3.10</h2>
<p>No release notes provided.</p>
<h2>v3.9</h2>
<p>No release notes provided.</p>
<h2>v3.8</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix regression where IDNAError exception was not being produced for
certain inputs.</li>
<li>Add support for Python 3.13, drop support for Python 3.5 as it is no
longer testable.</li>
<li>Documentation improvements</li>
<li>Updates to package testing using Github actions</li>
</ul>
<p>Thanks to Hugo van Kemenade for contributions to this release.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kjd/idna/compare/v3.7...v3.8">https://github.com/kjd/idna/compare/v3.7...v3.8</a></p>
<h2>v3.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix issue where specially crafted inputs to encode() could take
exceptionally long amount of time to process. [CVE-2024-3651]</li>
</ul>
<p>Thanks to Guido Vranken for reporting the issue.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kjd/idna/compare/v3.6...v3.7">https://github.com/kjd/idna/compare/v3.6...v3.7</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's
changelog</a>.</em></p>
<blockquote>
<h2>3.15 (2026-05-12)</h2>
<ul>
<li>Enforce DNS-length cap on individual labels early in
<code>check_label</code>,
short-circuiting contextual-rule processing for oversized input
while staying compatible with UTS 46 usage.</li>
<li>Tidy core helpers: hoist bidi category sets to module-level
frozensets (avoiding per-codepoint list construction), simplify
length checks, and reuse the shared <code>_unicode_dots_re</code> from
<code>idna.core</code> in the codec module.</li>
<li>Use <code>raise ... from err</code> for proper exception chaining
and
switch internal string formatting to f-strings.</li>
<li>Allow <code>flit_core</code> 4.x in the build backend.</li>
<li>Expand the ruff lint set (flake8-bugbear, flake8-simplify,
pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
to Python 3.14.</li>
<li>Add Dependabot configuration for GitHub Actions.</li>
<li>Convert README and HISTORY from reStructuredText to Markdown.</li>
<li>Reference CVE-2026-45409 for the 3.14 advisory in place of the
initial GHSA identifier.</li>
</ul>
<p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.</p>
<h2>3.14 (2026-05-10)</h2>
<ul>
<li>Removed opportunity to process long inputs into quadratic
time by rejecting oversize inputs up-front. Closes a bypass
of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li>
</ul>
<p>Thanks to Stan Ulbrych for reporting the issue.</p>
<h2>3.13 (2026-04-22)</h2>
<ul>
<li>Correct classification error for codepoint U+A7F1</li>
</ul>
<h2>3.12 (2026-04-21)</h2>
<ul>
<li>Update to Unicode 17.0.0.</li>
<li>Issue a deprecation warning for the transitional argument.</li>
<li>Added lazy-loading to provide some performance improvements.</li>
<li>Removed vestiges of code related to Python 2 support, including
segmentation of data structures specific to Jython.</li>
</ul>
<p>Thanks to Rodrigo Nogueira for contributions to this release.</p>
<h2>3.11 (2025-10-12)</h2>
<ul>
<li>Update to Unicode 16.0.0, including significant changes to UTS46
processing. As a result of Unicode ending support for it, transitional
processing no longer has an effect and returns the same result.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a>
Release 3.15</li>
<li><a
href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a>
Pre-release 3.15rc0</li>
<li><a
href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from
kjd/convert-docs-to-markdown</li>
<li><a
href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a>
Convert README and HISTORY from reStructuredText to Markdown</li>
<li><a
href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from
kjd/dependabot/github_actions/actions-f3e34333ea</li>
<li><a
href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a>
Merge branch 'mas…
rickeylev added a commit to rickeylev/rules_python that referenced this pull request Aug 23, 2026
…azel-contrib#4097)

Bumps the pip group with 2 updates in the /examples/bzlmod directory:
[certifi](https://github.com/certifi/python-certifi) and
[wheel](https://github.com/pypa/wheel).
Bumps the pip group with 3 updates in the /examples/pip_parse directory:
[idna](https://github.com/kjd/idna),
[requests](https://github.com/psf/requests) and
[urllib3](https://github.com/urllib3/urllib3).
Bumps the pip group with 1 update in the /tests/multiple_inputs
directory: [urllib3](https://github.com/urllib3/urllib3).
Bumps the pip group with 3 updates in the /tests/uv/lock/pyproject_toml
directory: [idna](https://github.com/kjd/idna),
[requests](https://github.com/psf/requests) and
[urllib3](https://github.com/urllib3/urllib3).
Bumps the pip group with 3 updates in the /tests/uv/lock/workspaces
directory: [idna](https://github.com/kjd/idna),
[requests](https://github.com/psf/requests) and
[urllib3](https://github.com/urllib3/urllib3).

Updates `certifi` from 2023.7.22 to 2024.7.4
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"><code>bd81538</code></a>
2024.07.04 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/295">#295</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3"><code>06a2cbf</code></a>
Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/294">#294</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23"><code>13bba02</code></a>
Bump actions/checkout from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/293">#293</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554"><code>e8abcd0</code></a>
Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/292">#292</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1"><code>124f4ad</code></a>
2024.06.02 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/291">#291</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a"><code>c2196ce</code></a>
--- (<a
href="https://redirect.github.com/certifi/python-certifi/issues/290">#290</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2"><code>fefdeec</code></a>
Bump actions/checkout from 4.1.4 to 4.1.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/289">#289</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf"><code>3c5fb15</code></a>
Bump actions/download-artifact from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/286">#286</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1"><code>4a9569a</code></a>
Bump actions/checkout from 4.1.2 to 4.1.4 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/287">#287</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3"><code>1fc8086</code></a>
Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/288">#288</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04">compare
view</a></li>
</ul>
</details>
<br />

Updates `wheel` from 0.40.0 to 0.46.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/releases">wheel's
releases</a>.</em></p>
<blockquote>
<h2>0.46.2</h2>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the destination tree with maliciously crafted wheels
(CVE-2026-24049)</li>
</ul>
<h2>0.46.1</h2>
<ul>
<li>Temporarily restored the <code>wheel.macosx_libfile</code> module
(<a
href="https://redirect.github.com/pypa/wheel/issues/659">#659</a>)</li>
</ul>
<h2>0.46.0</h2>
<ul>
<li>Dropped support for Python 3.8</li>
<li>Removed the <code>bdist_wheel</code> setuptools command
implementation and entry point. The <code>wheel.bdist_wheel</code>
module is now just an alias to
<code>setuptools.command.bdist_wheel</code>, emitting a deprecation
warning on import.</li>
<li>Removed vendored <code>packaging</code> in favor of a run-time
dependency on it</li>
<li>Made the <code>wheel.metadata</code> module private (with a
deprecation warning if it's imported</li>
<li>Made the <code>wheel.cli</code> package private (no deprecation
warning)</li>
<li>Fixed an exception when calling the <code>convert</code> command
with an empty description field</li>
</ul>
<h2>0.45.1</h2>
<ul>
<li>Fixed pure Python wheels converted from eggs and wininst files
having the ABI tag in the file name</li>
</ul>
<h2>0.45.0</h2>
<ul>
<li>
<p>Refactored the <code>convert</code> command to not need setuptools to
be installed</p>
</li>
<li>
<p>Don't configure setuptools logging unless running
<code>bdist_wheel</code></p>
</li>
<li>
<p>Added a redirection from <code>wheel.bdist_wheel.bdist_wheel</code>
to <code>setuptools.command.bdist_wheel.bdist_wheel</code> to improve
compatibility with <code>setuptools</code>' latest fixes.</p>
<p>Projects are still advised to migrate away from the deprecated module
and import the <code>setuptools</code>' implementation explicitly. (PR
by <a
href="https://github.com/abravalheri"><code>@​abravalheri</code></a>)</p>
</li>
</ul>
<h2>0.44.0</h2>
<ul>
<li>Canonicalized requirements in METADATA file (PR by Wim
Jeantine-Glenn)</li>
<li>Deprecated the <code>bdist_wheel</code> module, as the code was
migrated to <code>setuptools</code> itself</li>
</ul>
<h2>0.43.0</h2>
<ul>
<li>Dropped support for Python 3.7</li>
<li>Updated vendored <code>packaging</code> to 24.0</li>
</ul>
<h2>0.42.0</h2>
<ul>
<li>Allowed removing build tag with <code>wheel tags --build
&quot;&quot;</code></li>
<li>Fixed <code>wheel pack</code> and <code>wheel tags</code> writing
updated <code>WHEEL</code> fields after a blank line, causing other
tools to ignore them</li>
<li>Fixed <code>wheel pack</code> and <code>wheel tags</code> writing
<code>WHEEL</code> with CRLF line endings or a mix of CRLF and LF</li>
<li>Fixed <code>wheel pack --build-number &quot;&quot;</code> not
removing build tag from <code>WHEEL</code> (above changes by Benjamin
Gilbert)</li>
</ul>
<h2>0.41.3</h2>
<ul>
<li>Updated vendored <code>packaging</code> to 23.2</li>
<li>Fixed ABI tag generation for CPython 3.13a1 on Windows (PR by Sam
Gross)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>UNRELEASED</strong></p>
<ul>
<li>Fixed the macOS platform-tag warning always using the plural
&quot;these files&quot;
wording, even when only a single library required a higher deployment
target
(<code>[#697](https://github.com/pypa/wheel/issues/697)
&lt;https://github.com/pypa/wheel/pull/697&gt;</code>_)</li>
</ul>
<p><strong>0.48.0 (2026-08-12)</strong></p>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a
PEP 440 local version identifier from a wheel
(<code>[#570](https://github.com/pypa/wheel/issues/570)
&lt;https://github.com/pypa/wheel/issues/570&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions
(<code>[#643](https://github.com/pypa/wheel/issues/643)
&lt;https://github.com/pypa/wheel/issues/643&gt;</code>_)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose
entries use ZIP64, by dropping the central-directory ZIP64 extra field
that is
not valid in a local file header
(<code>[#692](https://github.com/pypa/wheel/issues/692)
&lt;https://github.com/pypa/wheel/issues/692&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination
directory when the input archive contained a maliciously crafted project
name
or version with path separators (arbitrary file write / path traversal)
(<code>GHSA-vgq5-9859-3mmw
&lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw&gt;</code>_)</li>
</ul>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without
unpacking them (<code>[#639](https://github.com/pypa/wheel/issues/639)
&lt;https://github.com/pypa/wheel/issues/639&gt;</code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the
<code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[#411](https://github.com/pypa/wheel/issues/411)
&lt;https://github.com/pypa/wheel/issues/411&gt;</code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when
installed alongside an old version of setuptools and running the
<code>bdist_wheel</code>
command (<code>[#676](https://github.com/pypa/wheel/issues/676)
&lt;https://github.com/pypa/wheel/issues/676&gt;</code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/wheel/commit/eba4036ccaca4e2d0c5b5bf3e3be59b2b2877d6b"><code>eba4036</code></a>
Updated the version number for v0.46.2</li>
<li><a
href="https://github.com/pypa/wheel/commit/557fb5425036ccca95330b2c8875e54c9f4483cf"><code>557fb54</code></a>
Created a new release</li>
<li><a
href="https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef"><code>7a7d2de</code></a>
Fixed security issue around wheel unpack (<a
href="https://redirect.github.com/pypa/wheel/issues/675">#675</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/41418fac233d6973ea8798d620df4aa5b3aa1b66"><code>41418fa</code></a>
Fixed test failures due to metadata normalization changes</li>
<li><a
href="https://github.com/pypa/wheel/commit/c1d442bec6c634fcfb89e5d58698dd226685bd14"><code>c1d442b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/674">#674</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/0bac8820ec90b1aaa0695d79a56563137b48686d"><code>0bac882</code></a>
Update github actions environments (<a
href="https://redirect.github.com/pypa/wheel/issues/673">#673</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/be9f45b4ee1210b2a815d2eefea56b71efd99d63"><code>be9f45b</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/667">#667</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/6244f08bb92d7569da6c2fbea23de0846ad34ff3"><code>6244f08</code></a>
Update pre-commit ruff legacy alias (<a
href="https://redirect.github.com/pypa/wheel/issues/668">#668</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/15b7577654e8bcd23e009c6bac036b65c11d8d8f"><code>15b7577</code></a>
PEP 639 compliance (<a
href="https://redirect.github.com/pypa/wheel/issues/670">#670</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/fc8cb4163e4f48d86092cb2a16076f1b3efcd10f"><code>fc8cb41</code></a>
Revert &quot;Removed redundant Python version from the publish workflow
(<a
href="https://redirect.github.com/pypa/wheel/issues/666">#666</a>)&quot;</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/wheel/compare/0.40.0...0.46.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `certifi` from 2023.7.22 to 2024.7.4
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"><code>bd81538</code></a>
2024.07.04 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/295">#295</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3"><code>06a2cbf</code></a>
Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/294">#294</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23"><code>13bba02</code></a>
Bump actions/checkout from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/293">#293</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554"><code>e8abcd0</code></a>
Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/292">#292</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1"><code>124f4ad</code></a>
2024.06.02 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/291">#291</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a"><code>c2196ce</code></a>
--- (<a
href="https://redirect.github.com/certifi/python-certifi/issues/290">#290</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2"><code>fefdeec</code></a>
Bump actions/checkout from 4.1.4 to 4.1.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/289">#289</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf"><code>3c5fb15</code></a>
Bump actions/download-artifact from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/286">#286</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1"><code>4a9569a</code></a>
Bump actions/checkout from 4.1.2 to 4.1.4 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/287">#287</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3"><code>1fc8086</code></a>
Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/288">#288</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04">compare
view</a></li>
</ul>
</details>
<br />

Updates `certifi` from 2023.7.22 to 2024.7.4
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"><code>bd81538</code></a>
2024.07.04 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/295">#295</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3"><code>06a2cbf</code></a>
Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/294">#294</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23"><code>13bba02</code></a>
Bump actions/checkout from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/293">#293</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554"><code>e8abcd0</code></a>
Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/292">#292</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1"><code>124f4ad</code></a>
2024.06.02 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/291">#291</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a"><code>c2196ce</code></a>
--- (<a
href="https://redirect.github.com/certifi/python-certifi/issues/290">#290</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2"><code>fefdeec</code></a>
Bump actions/checkout from 4.1.4 to 4.1.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/289">#289</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf"><code>3c5fb15</code></a>
Bump actions/download-artifact from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/286">#286</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1"><code>4a9569a</code></a>
Bump actions/checkout from 4.1.2 to 4.1.4 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/287">#287</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3"><code>1fc8086</code></a>
Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/288">#288</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04">compare
view</a></li>
</ul>
</details>
<br />

Updates `certifi` from 2023.7.22 to 2024.7.4
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"><code>bd81538</code></a>
2024.07.04 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/295">#295</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/06a2cbf21f345563dde6c28b60e29d57e9b210b3"><code>06a2cbf</code></a>
Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/294">#294</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/13bba02b72bac97c432c277158bc04b4d2a6bc23"><code>13bba02</code></a>
Bump actions/checkout from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/293">#293</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/e8abcd0e62b334c164b95d49fcabdc9ecbca0554"><code>e8abcd0</code></a>
Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/292">#292</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/124f4adf171e15cd9a91a8b6e0325ecc97be8fe1"><code>124f4ad</code></a>
2024.06.02 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/291">#291</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/c2196ce5d6ee675b27755a19948480a7823e2c6a"><code>c2196ce</code></a>
--- (<a
href="https://redirect.github.com/certifi/python-certifi/issues/290">#290</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/fefdeec7588ff1c05214b85a552afcad5fdb51b2"><code>fefdeec</code></a>
Bump actions/checkout from 4.1.4 to 4.1.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/289">#289</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/3c5fb1560b826a7f83f1f9750173ff766492c9cf"><code>3c5fb15</code></a>
Bump actions/download-artifact from 4.1.6 to 4.1.7 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/286">#286</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/4a9569a3eb58db8548536fc16c5c5c7af946a5b1"><code>4a9569a</code></a>
Bump actions/checkout from 4.1.2 to 4.1.4 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/287">#287</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/1fc808626a895a916b1e4c2b63abae6c5eafdbe3"><code>1fc8086</code></a>
Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/288">#288</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/certifi/python-certifi/compare/2023.07.22...2024.07.04">compare
view</a></li>
</ul>
</details>
<br />

Updates `idna` from 2.10 to 3.15
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/releases">idna's
releases</a>.</em></p>
<blockquote>
<h2>v3.15</h2>
<p>No release notes provided.</p>
<h2>v3.14</h2>
<p>No release notes provided.</p>
<h2>v3.13</h2>
<p>No release notes provided.</p>
<h2>v3.12</h2>
<p>No release notes provided.</p>
<h2>v3.11</h2>
<p>No release notes provided.</p>
<h2>v3.10</h2>
<p>No release notes provided.</p>
<h2>v3.9</h2>
<p>No release notes provided.</p>
<h2>v3.8</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix regression where IDNAError exception was not being produced for
certain inputs.</li>
<li>Add support for Python 3.13, drop support for Python 3.5 as it is no
longer testable.</li>
<li>Documentation improvements</li>
<li>Updates to package testing using Github actions</li>
</ul>
<p>Thanks to Hugo van Kemenade for contributions to this release.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kjd/idna/compare/v3.7...v3.8">https://github.com/kjd/idna/compare/v3.7...v3.8</a></p>
<h2>v3.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix issue where specially crafted inputs to encode() could take
exceptionally long amount of time to process. [CVE-2024-3651]</li>
</ul>
<p>Thanks to Guido Vranken for reporting the issue.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kjd/idna/compare/v3.6...v3.7">https://github.com/kjd/idna/compare/v3.6...v3.7</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's
changelog</a>.</em></p>
<blockquote>
<h2>3.15 (2026-05-12)</h2>
<ul>
<li>Enforce DNS-length cap on individual labels early in
<code>check_label</code>,
short-circuiting contextual-rule processing for oversized input
while staying compatible with UTS 46 usage.</li>
<li>Tidy core helpers: hoist bidi category sets to module-level
frozensets (avoiding per-codepoint list construction), simplify
length checks, and reuse the shared <code>_unicode_dots_re</code> from
<code>idna.core</code> in the codec module.</li>
<li>Use <code>raise ... from err</code> for proper exception chaining
and
switch internal string formatting to f-strings.</li>
<li>Allow <code>flit_core</code> 4.x in the build backend.</li>
<li>Expand the ruff lint set (flake8-bugbear, flake8-simplify,
pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
to Python 3.14.</li>
<li>Add Dependabot configuration for GitHub Actions.</li>
<li>Convert README and HISTORY from reStructuredText to Markdown.</li>
<li>Reference CVE-2026-45409 for the 3.14 advisory in place of the
initial GHSA identifier.</li>
</ul>
<p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.</p>
<h2>3.14 (2026-05-10)</h2>
<ul>
<li>Removed opportunity to process long inputs into quadratic
time by rejecting oversize inputs up-front. Closes a bypass
of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li>
</ul>
<p>Thanks to Stan Ulbrych for reporting the issue.</p>
<h2>3.13 (2026-04-22)</h2>
<ul>
<li>Correct classification error for codepoint U+A7F1</li>
</ul>
<h2>3.12 (2026-04-21)</h2>
<ul>
<li>Update to Unicode 17.0.0.</li>
<li>Issue a deprecation warning for the transitional argument.</li>
<li>Added lazy-loading to provide some performance improvements.</li>
<li>Removed vestiges of code related to Python 2 support, including
segmentation of data structures specific to Jython.</li>
</ul>
<p>Thanks to Rodrigo Nogueira for contributions to this release.</p>
<h2>3.11 (2025-10-12)</h2>
<ul>
<li>Update to Unicode 16.0.0, including significant changes to UTS46
processing. As a result of Unicode ending support for it, transitional
processing no longer has an effect and returns the same result.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a>
Release 3.15</li>
<li><a
href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a>
Pre-release 3.15rc0</li>
<li><a
href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from
kjd/convert-docs-to-markdown</li>
<li><a
href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a>
Convert README and HISTORY from reStructuredText to Markdown</li>
<li><a
href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from
kjd/dependabot/github_actions/actions-f3e34333ea</li>
<li><a
href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a>
Merge branch 'master' into
dependabot/github_actions/actions-f3e34333ea</li>
<li><a
href="https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631"><code>bbd8004</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/234">#234</a> from
StanFromIreland/patch-1</li>
<li><a
href="https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc"><code>edd07c0</code></a>
Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions
group</li>
<li><a
href="https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123"><code>5557db0</code></a>
Merge branch 'master' into patch-1</li>
<li><a
href="https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d"><code>f11746c</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/235">#235</a> from
StanFromIreland/patch-2</li>
<li>Additional commits viewable in <a
href="https://github.com/kjd/idna/compare/v2.10...v3.15">compare
view</a></li>
</ul>
</details>
<br />

Updates `requests` from 2.25.1 to 2.33.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/releases">requests's
releases</a>.</em></p>
<blockquote>
<h2>v2.33.0</h2>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report any gaps or feedback you may have in the
issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts contents to a non-deterministic location to prevent malicious
file replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause malformed
authentication to be applied to Requests on Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/M0d3v1"><code>@​M0d3v1</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li>
<li><a href="https://github.com/aminvakil"><code>@​aminvakil</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li>
<li><a href="https://github.com/E8Price"><code>@​E8Price</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li>
<li><a href="https://github.com/mitre88"><code>@​mitre88</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li>
<li><a href="https://github.com/magsen"><code>@​magsen</code></a> made
their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li>
<li><a
href="https://github.com/Rohan5commit"><code>@​Rohan5commit</code></a>
made their first contribution in <a
href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a></p>
<h2>v2.32.5</h2>
<h2>2.32.5 (2025-08-18)</h2>
<p><strong>Bugfixes</strong></p>
<ul>
<li>The SSLContext caching feature originally introduced in 2.32.0 has
created
a new class of issues in Requests that have had negative impact across a
number
of use cases. The Requests team has decided to revert this feature as
long term
maintenance of it is proving to be unsustainable in its current
iteration.</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Added support for Python 3.14.</li>
<li>Dropped support for Python 3.8 following its end of support.</li>
</ul>
<h2>v2.32.4</h2>
<h2>2.32.4 (2025-06-10)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's
changelog</a>.</em></p>
<blockquote>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that
uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report
any gaps or feedback you may have in the issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>2.32.5 (2025-08-18)</h2>
<p><strong>Bugfixes</strong></p>
<ul>
<li>The SSLContext caching feature originally introduced in 2.32.0 has
created
a new class of issues in Requests that have had negative impact across a
number
of use cases. The Requests team has decided to revert this feature as
long term
maintenance of it is proving to be unsustainable in its current
iteration.</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Added support for Python 3.14.</li>
<li>Dropped support for Python 3.8 following its end of support.</li>
</ul>
<h2>2.32.4 (2025-06-10)</h2>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2024-47081 Fixed an issue where a maliciously crafted URL and
trusted
environment will retrieve credentials for the wrong hostname/machine
from a
netrc file.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a>
v2.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a>
Move badges to top of README (<a
href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a>
Remove unused extraction call (<a
href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a>
docs: fix FAQ grammar in httplib2 example</li>
<li><a
href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a>
docs(socks): same block as other sections</li>
<li><a
href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a>
Bump github/codeql-action from 4.33.0 to 4.34.1</li>
<li><a
href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a>
Bump github/codeql-action from 4.32.0 to 4.33.0</li>
<li><a
href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a>
docs: exclude Response.is_permanent_redirect from API docs (<a
href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li>
<li><a
href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a>
docs: clarify Quickstart POST example (<a
href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/psf/requests/compare/v2.25.1...v2.33.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `urllib3` from 1.26.20 to 2.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.7.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Addressed high-severity security issues. Impact was limited to
specific use cases detailed in the accompanying advisories; overall user
exposure was estimated to be marginal.</p>
<ul>
<li>
<p>Decompression-bomb safeguards of the streaming API were bypassed:</p>
<ol>
<li>When <code>HTTPResponse.drain_conn()</code> was called after the
response had been read and decompressed partially. (Reported by <a
href="https://github.com/Cycloctane"><code>@​Cycloctane</code></a>)</li>
<li>During the second <code>HTTPResponse.read(amt=N)</code> or
<code>HTTPResponse.stream(amt=N)</code> call when the response was
decompressed using the official <a
href="https://pypi.org/project/brotli/">Brotli</a> library. (Reported by
<a
href="https://github.com/kimkou2024"><code>@​kimkou2024</code></a>)</li>
</ol>
<p>See GHSA-mf9v-mfxr-j63j for details.</p>
</li>
<li>
<p>HTTP pools created using
<code>ProxyManager.connection_from_url</code> did not strip sensitive
headers specified in <code>Retry.remove_headers_on_redirect</code> when
redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by <a
href="https://github.com/christos-spearbit"><code>@​christos-spearbit</code></a>)</p>
</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Used <code>FutureWarning</code> instead of
<code>DeprecationWarning</code> for better visibility of existing
deprecation notices. Rescheduled the removal of deprecated features to
version 3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3763">urllib3/urllib3#3763</a>)</li>
<li>Removed support for end-of-life Python 3.9. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3720">urllib3/urllib3#3720</a>)</li>
<li>Removed support for end-of-life PyPy3.10. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4979">urllib3/urllib3#4979</a>)</li>
<li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3777">urllib3/urllib3#3777</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was
ignoring decompressed data buffered from previous partial reads. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3636">urllib3/urllib3#3636</a>)</li>
<li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only
part of the response after a partial read when
<code>cache_content=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4967">urllib3/urllib3#4967</a>)</li>
<li>Fixed <code>HTTPResponse.stream()</code> and
<code>HTTPResponse.read_chunked()</code> to handle <code>amt=0</code>.
(<a
href="https://redirect.github.com/urllib3/urllib3/issues/3793">urllib3/urllib3#3793</a>)</li>
<li>Updated <code>_TYPE_BODY</code> type alias to include missing
<code>Iterable[str]</code>, matching the documented and runtime behavior
of chunked request bodies. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3798">urllib3/urllib3#3798</a>)</li>
<li>Fixed <code>LocationParseError</code> when paths resembling
schemeless URIs were passed to
<code>HTTPConnectionPool.urlopen()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3352">urllib3/urllib3#3352</a>)</li>
<li>Fixed <code>BaseHTTPResponse.readinto()</code> type annotation to
accept <code>memoryview</code> in addition to <code>bytearray</code>,
matching the <code>io.RawIOBase.readinto</code> contract and enabling
use with <code>io.BufferedReader</code> without type errors. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li>
</ul>
<h2>2.6.3</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Changes</h2>
<ul>
<li>Fixed a security issue where decompression-bomb safeguards of the
streaming API were bypassed when HTTP redirects were followed.
(CVE-2026-21441 reported by <a
href="https://github.com/D47A"><code>@​D47A</code></a>, 8.9 High,
GHSA-38jv-5279-wg99)</li>
<li>Started treating <code>Retry-After</code> times greater than 6 hours
as 6 hours by default. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3743">urllib3/urllib3#3743</a>)</li>
<li>Fixed <code>urllib3.connection.VerifiedHTTPSConnection</code> on
Emscripten. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3752">urllib3/urllib3#3752</a>)</li>
</ul>
<h2>2.6.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.7.0 (2026-05-07)</h1>
<h2>Security</h2>
<p>Addressed high-severity security issues.
Impact was limited to specific use cases detailed in the accompanying
advisories; overall user exposure was estimated to be marginal.</p>
<ul>
<li>
<p>Decompression-bomb safeguards of the streaming API were bypassed:</p>
<ol>
<li>When <code>HTTPResponse.drain_conn()</code> was called after the
response had been
read and decompressed partially.</li>
<li>During the second <code>HTTPResponse.read(amt=N)</code> or
<code>HTTPResponse.stream(amt=N)</code> call when the response was
decompressed
using the official <code>Brotli
&lt;https://pypi.org/project/brotli/&gt;</code>__ library.</li>
</ol>
<p>See <code>GHSA-mf9v-mfxr-j63j
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j&gt;</code>__
for details.</p>
</li>
<li>
<p>HTTP pools created using
<code>ProxyManager.connection_from_url</code> did not strip
sensitive headers specified in
<code>Retry.remove_headers_on_redirect</code> when
redirecting to a different host.
(<code>GHSA-qccp-gfcp-xxvc
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc&gt;</code>__)</p>
</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Used <code>FutureWarning</code> instead of
<code>DeprecationWarning</code> for better
visibility of existing deprecation notices. Rescheduled the removal of
deprecated features to version 3.0.
(<code>[#3763](https://github.com/urllib3/urllib3/issues/3763)
&lt;https://github.com/urllib3/urllib3/issues/3763&gt;</code>__)</li>
<li>Removed support for end-of-life Python 3.9.
(<code>[#3720](https://github.com/urllib3/urllib3/issues/3720)
&lt;https://github.com/urllib3/urllib3/issues/3720&gt;</code>__)</li>
<li>Removed support for end-of-life PyPy3.10.
(<code>[#4979](https://github.com/urllib3/urllib3/issues/4979)
&lt;https://github.com/urllib3/urllib3/issues/4979&gt;</code>__)</li>
<li>Bumped the minimum supported pyOpenSSL version to 19.0.0.
(<code>[#3777](https://github.com/urllib3/urllib3/issues/3777)
&lt;https://github.com/urllib3/urllib3/issues/3777&gt;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was
ignoring decompressed
data buffered from previous partial reads.
(<code>[#3636](https://github.com/urllib3/urllib3/issues/3636)
&lt;https://github.com/urllib3/urllib3/issues/3636&gt;</code>__)</li>
<li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only
part of the
response after a partial read when <code>cache_content=True</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2"><code>9a950b9</code></a>
Release 2.7.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc"><code>5ec0de4</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a"><code>2bdcc44</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c"><code>f45b0df</code></a>
Fix a misleading example for <code>ProxyManager</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4970">#4970</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b"><code>577193c</code></a>
Switch to nightly PyPy3.11 in CI for now (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4984">#4984</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc"><code>e90af45</code></a>
Avoid infinite loop in <code>HTTPResponse.read_chunked</code> when
<code>amt=0</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4974">#4974</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210"><code>67ed74f</code></a>
Bump dev dependencies (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4972">#4972</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d"><code>3abd481</code></a>
Upgrade mypy to version 1.20.2 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4978">#4978</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890"><code>2b8725d</code></a>
Drop support for EOL PyPy3.10 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4979">#4979</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33"><code>2944b2a</code></a>
Upgrade <code>setup-chrome</code> and <code>setup-firefox</code> to fix
warnings (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4973">#4973</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/1.26.20...2.7.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `urllib3` from 1.26.20 to 2.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/releases">urllib3's
releases</a>.</em></p>
<blockquote>
<h2>2.7.0</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Security</h2>
<p>Addressed high-severity security issues. Impact was limited to
specific use cases detailed in the accompanying advisories; overall user
exposure was estimated to be marginal.</p>
<ul>
<li>
<p>Decompression-bomb safeguards of the streaming API were bypassed:</p>
<ol>
<li>When <code>HTTPResponse.drain_conn()</code> was called after the
response had been read and decompressed partially. (Reported by <a
href="https://github.com/Cycloctane"><code>@​Cycloctane</code></a>)</li>
<li>During the second <code>HTTPResponse.read(amt=N)</code> or
<code>HTTPResponse.stream(amt=N)</code> call when the response was
decompressed using the official <a
href="https://pypi.org/project/brotli/">Brotli</a> library. (Reported by
<a
href="https://github.com/kimkou2024"><code>@​kimkou2024</code></a>)</li>
</ol>
<p>See GHSA-mf9v-mfxr-j63j for details.</p>
</li>
<li>
<p>HTTP pools created using
<code>ProxyManager.connection_from_url</code> did not strip sensitive
headers specified in <code>Retry.remove_headers_on_redirect</code> when
redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by <a
href="https://github.com/christos-spearbit"><code>@​christos-spearbit</code></a>)</p>
</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Used <code>FutureWarning</code> instead of
<code>DeprecationWarning</code> for better visibility of existing
deprecation notices. Rescheduled the removal of deprecated features to
version 3.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3763">urllib3/urllib3#3763</a>)</li>
<li>Removed support for end-of-life Python 3.9. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3720">urllib3/urllib3#3720</a>)</li>
<li>Removed support for end-of-life PyPy3.10. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4979">urllib3/urllib3#4979</a>)</li>
<li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3777">urllib3/urllib3#3777</a>)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was
ignoring decompressed data buffered from previous partial reads. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3636">urllib3/urllib3#3636</a>)</li>
<li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only
part of the response after a partial read when
<code>cache_content=True</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4967">urllib3/urllib3#4967</a>)</li>
<li>Fixed <code>HTTPResponse.stream()</code> and
<code>HTTPResponse.read_chunked()</code> to handle <code>amt=0</code>.
(<a
href="https://redirect.github.com/urllib3/urllib3/issues/3793">urllib3/urllib3#3793</a>)</li>
<li>Updated <code>_TYPE_BODY</code> type alias to include missing
<code>Iterable[str]</code>, matching the documented and runtime behavior
of chunked request bodies. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3798">urllib3/urllib3#3798</a>)</li>
<li>Fixed <code>LocationParseError</code> when paths resembling
schemeless URIs were passed to
<code>HTTPConnectionPool.urlopen()</code>. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3352">urllib3/urllib3#3352</a>)</li>
<li>Fixed <code>BaseHTTPResponse.readinto()</code> type annotation to
accept <code>memoryview</code> in addition to <code>bytearray</code>,
matching the <code>io.RawIOBase.readinto</code> contract and enabling
use with <code>io.BufferedReader</code> without type errors. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li>
</ul>
<h2>2.6.3</h2>
<h2>🚀 urllib3 is fundraising for HTTP/2 support</h2>
<p><a
href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3
is raising ~$40,000 USD</a> to release HTTP/2 support and ensure
long-term sustainable maintenance of the project after a sharp decline
in financial support. If your company or organization uses Python and
would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and
thousands of other projects <a
href="https://opencollective.com/urllib3">please consider contributing
financially</a> to ensure HTTP/2 support is developed sustainably and
maintained for the long-haul.</p>
<p>Thank you for your support.</p>
<h2>Changes</h2>
<ul>
<li>Fixed a security issue where decompression-bomb safeguards of the
streaming API were bypassed when HTTP redirects were followed.
(CVE-2026-21441 reported by <a
href="https://github.com/D47A"><code>@​D47A</code></a>, 8.9 High,
GHSA-38jv-5279-wg99)</li>
<li>Started treating <code>Retry-After</code> times greater than 6 hours
as 6 hours by default. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3743">urllib3/urllib3#3743</a>)</li>
<li>Fixed <code>urllib3.connection.VerifiedHTTPSConnection</code> on
Emscripten. (<a
href="https://redirect.github.com/urllib3/urllib3/issues/3752">urllib3/urllib3#3752</a>)</li>
</ul>
<h2>2.6.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's
changelog</a>.</em></p>
<blockquote>
<h1>2.7.0 (2026-05-07)</h1>
<h2>Security</h2>
<p>Addressed high-severity security issues.
Impact was limited to specific use cases detailed in the accompanying
advisories; overall user exposure was estimated to be marginal.</p>
<ul>
<li>
<p>Decompression-bomb safeguards of the streaming API were bypassed:</p>
<ol>
<li>When <code>HTTPResponse.drain_conn()</code> was called after the
response had been
read and decompressed partially.</li>
<li>During the second <code>HTTPResponse.read(amt=N)</code> or
<code>HTTPResponse.stream(amt=N)</code> call when the response was
decompressed
using the official <code>Brotli
&lt;https://pypi.org/project/brotli/&gt;</code>__ library.</li>
</ol>
<p>See <code>GHSA-mf9v-mfxr-j63j
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j&gt;</code>__
for details.</p>
</li>
<li>
<p>HTTP pools created using
<code>ProxyManager.connection_from_url</code> did not strip
sensitive headers specified in
<code>Retry.remove_headers_on_redirect</code> when
redirecting to a different host.
(<code>GHSA-qccp-gfcp-xxvc
&lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc&gt;</code>__)</p>
</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Used <code>FutureWarning</code> instead of
<code>DeprecationWarning</code> for better
visibility of existing deprecation notices. Rescheduled the removal of
deprecated features to version 3.0.
(<code>[#3763](https://github.com/urllib3/urllib3/issues/3763)
&lt;https://github.com/urllib3/urllib3/issues/3763&gt;</code>__)</li>
<li>Removed support for end-of-life Python 3.9.
(<code>[#3720](https://github.com/urllib3/urllib3/issues/3720)
&lt;https://github.com/urllib3/urllib3/issues/3720&gt;</code>__)</li>
<li>Removed support for end-of-life PyPy3.10.
(<code>[#4979](https://github.com/urllib3/urllib3/issues/4979)
&lt;https://github.com/urllib3/urllib3/issues/4979&gt;</code>__)</li>
<li>Bumped the minimum supported pyOpenSSL version to 19.0.0.
(<code>[#3777](https://github.com/urllib3/urllib3/issues/3777)
&lt;https://github.com/urllib3/urllib3/issues/3777&gt;</code>__)</li>
</ul>
<h2>Bugfixes</h2>
<ul>
<li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was
ignoring decompressed
data buffered from previous partial reads.
(<code>[#3636](https://github.com/urllib3/urllib3/issues/3636)
&lt;https://github.com/urllib3/urllib3/issues/3636&gt;</code>__)</li>
<li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only
part of the
response after a partial read when <code>cache_content=True</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2"><code>9a950b9</code></a>
Release 2.7.0</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc"><code>5ec0de4</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a"><code>2bdcc44</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c"><code>f45b0df</code></a>
Fix a misleading example for <code>ProxyManager</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4970">#4970</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b"><code>577193c</code></a>
Switch to nightly PyPy3.11 in CI for now (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4984">#4984</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc"><code>e90af45</code></a>
Avoid infinite loop in <code>HTTPResponse.read_chunked</code> when
<code>amt=0</code> (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4974">#4974</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210"><code>67ed74f</code></a>
Bump dev dependencies (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4972">#4972</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d"><code>3abd481</code></a>
Upgrade mypy to version 1.20.2 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4978">#4978</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890"><code>2b8725d</code></a>
Drop support for EOL PyPy3.10 (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4979">#4979</a>)</li>
<li><a
href="https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33"><code>2944b2a</code></a>
Upgrade <code>setup-chrome</code> and <code>setup-firefox</code> to fix
warnings (<a
href="https://redirect.github.com/urllib3/urllib3/issues/4973">#4973</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/urllib3/urllib3/compare/1.26.20...2.7.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `idna` from 2.10 to 3.15
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/releases">idna's
releases</a>.</em></p>
<blockquote>
<h2>v3.15</h2>
<p>No release notes provided.</p>
<h2>v3.14</h2>
<p>No release notes provided.</p>
<h2>v3.13</h2>
<p>No release notes provided.</p>
<h2>v3.12</h2>
<p>No release notes provided.</p>
<h2>v3.11</h2>
<p>No release notes provided.</p>
<h2>v3.10</h2>
<p>No release notes provided.</p>
<h2>v3.9</h2>
<p>No release notes provided.</p>
<h2>v3.8</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix regression where IDNAError exception was not being produced for
certain inputs.</li>
<li>Add support for Python 3.13, drop support for Python 3.5 as it is no
longer testable.</li>
<li>Documentation improvements</li>
<li>Updates to package testing using Github actions</li>
</ul>
<p>Thanks to Hugo van Kemenade for contributions to this release.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kjd/idna/compare/v3.7...v3.8">https://github.com/kjd/idna/compare/v3.7...v3.8</a></p>
<h2>v3.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix issue where specially crafted inputs to encode() could take
exceptionally long amount of time to process. [CVE-2024-3651]</li>
</ul>
<p>Thanks to Guido Vranken for reporting the issue.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kjd/idna/compare/v3.6...v3.7">https://github.com/kjd/idna/compare/v3.6...v3.7</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/blob/master/HISTORY.md">idna's
changelog</a>.</em></p>
<blockquote>
<h2>3.15 (2026-05-12)</h2>
<ul>
<li>Enforce DNS-length cap on individual labels early in
<code>check_label</code>,
short-circuiting contextual-rule processing for oversized input
while staying compatible with UTS 46 usage.</li>
<li>Tidy core helpers: hoist bidi category sets to module-level
frozensets (avoiding per-codepoint list construction), simplify
length checks, and reuse the shared <code>_unicode_dots_re</code> from
<code>idna.core</code> in the codec module.</li>
<li>Use <code>raise ... from err</code> for proper exception chaining
and
switch internal string formatting to f-strings.</li>
<li>Allow <code>flit_core</code> 4.x in the build backend.</li>
<li>Expand the ruff lint set (flake8-bugbear, flake8-simplify,
pyupgrade, perflint) and apply the surfaced fixes; pin lint CI
to Python 3.14.</li>
<li>Add Dependabot configuration for GitHub Actions.</li>
<li>Convert README and HISTORY from reStructuredText to Markdown.</li>
<li>Reference CVE-2026-45409 for the 3.14 advisory in place of the
initial GHSA identifier.</li>
</ul>
<p>Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for
contributions to this release.</p>
<h2>3.14 (2026-05-10)</h2>
<ul>
<li>Removed opportunity to process long inputs into quadratic
time by rejecting oversize inputs up-front. Closes a bypass
of the CVE-2024-3651 mitigation. [CVE-2026-45409]</li>
</ul>
<p>Thanks to Stan Ulbrych for reporting the issue.</p>
<h2>3.13 (2026-04-22)</h2>
<ul>
<li>Correct classification error for codepoint U+A7F1</li>
</ul>
<h2>3.12 (2026-04-21)</h2>
<ul>
<li>Update to Unicode 17.0.0.</li>
<li>Issue a deprecation warning for the transitional argument.</li>
<li>Added lazy-loading to provide some performance improvements.</li>
<li>Removed vestiges of code related to Python 2 support, including
segmentation of data structures specific to Jython.</li>
</ul>
<p>Thanks to Rodrigo Nogueira for contributions to this release.</p>
<h2>3.11 (2025-10-12)</h2>
<ul>
<li>Update to Unicode 16.0.0, including significant changes to UTS46
processing. As a result of Unicode ending support for it, transitional
processing no longer has an effect and returns the same result.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8"><code>af30a09</code></a>
Release 3.15</li>
<li><a
href="https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2"><code>30314d4</code></a>
Pre-release 3.15rc0</li>
<li><a
href="https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9"><code>05d4b21</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/237">#237</a> from
kjd/convert-docs-to-markdown</li>
<li><a
href="https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee"><code>2987fdb</code></a>
Convert README and HISTORY from reStructuredText to Markdown</li>
<li><a
href="https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c"><code>59fa800</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/236">#236</a> from
kjd/dependabot/github_actions/actions-f3e34333ea</li>
<li><a
href="https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2"><code>def6983</code></a>
Merge branch 'master' into
dependabot/github_actions/actions-f3e34333ea</li>
<li><a
href="https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631"><code>bbd8004</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/234">#234</a> from
StanFromIreland/patch-1</li>
<li><a
href="https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc"><code>edd07c0</code></a>
Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions
group</li>
<li><a
href="https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123"><code>5557db0</code></a>
Merge branch 'master' into patch-1</li>
<li><a
href="https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d"><code>f11746c</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/235">#235</a> from
StanFromIreland/patch-2</li>
<li>Additional commits viewable in <a
href="https://github.com/kjd/idna/compare/v2.10...v3.15">compare
view</a></li>
</ul>
</details>
<br />

Updates `requests` from 2.25.1 to 2.33.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/psf/requests/releases">requests's
releases</a>.</em></p>
<blockquote>
<h2>v2.33.0</h2>
<h2>2.33.0 (2026-03-25)</h2>
<p><strong>Announcements</strong></p>
<ul>
<li>📣 Requests is adding inline types. If you have a typed code base
that uses Requests, please take a look at <a
href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>.
Give it a try, and report any gaps or feedback you may have in the
issue. 📣</li>
</ul>
<p><strong>Security</strong></p>
<ul>
<li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now
extracts contents to a non-deterministic location to prevent malicious
file replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.</li>
</ul>
<p><strong>Improvements</strong></p>
<ul>
<li>Migrated to a PEP 517 build system using setuptools. (<a
href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li>
</ul>
<p><strong>Bugfixes</strong></p>
<ul>
<li>Fixed an issue where an empty netrc entry could cause malformed
authentication to be applied to Requests on Python 3.11+. (<a
href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li>
</ul>
<p><strong>Deprecations</strong></p>
<ul>
<li>Dropped support for Python 3.9 following its end of support. (<a
href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li>
</ul>
<p><strong>Documentation</strong></p>
<ul>
<li>Various typo fixes and doc improvements.</li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/M0d3v1"><code>@​M0d3v1</code></a> made
their first contribution in <a
href="https://redirect.git…
vbvictor pushed a commit to vbvictor/acp that referenced this pull request Aug 24, 2026
Bumps the dev-dependencies group with 3 updates:
[ruff](https://github.com/astral-sh/ruff),
[mypy](https://github.com/python/mypy) and
[wheel](https://github.com/pypa/wheel).

Updates `ruff` from 0.16.2 to 0.16.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.3</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-13.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>pylint</code>] Fix false negatives on negative numbers
(<code>PLR6104</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li>
<li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code>
with <code>while True</code> (<code>UP048</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bandit</code>] Also check keyword arguments
(<code>S602</code>, <code>S603</code>, <code>S607</code>,
<code>S609</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li>
<li>[<code>pylint</code>] Allow <code>continue</code> in
<code>finally</code> on Python 3.8 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li>
<li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with
bools (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li>
<li>[<code>pylint</code>] Fix false positives and negatives with
<code>%b</code> format character (<code>PLE1300</code>,
<code>PLE1307</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li>
<li>[<code>pylint</code>] Improve handling of concatenated strings
(<code>PLE1300</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>numpy</code>] Make <code>np.chararray</code> autofix
backwards-compatible (<code>NPY201</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Enable PGO for Linux x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li>
<li>Enable PGO for Linux ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li>
<li>Enable PGO for Windows x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li>
<li>Enable PGO for macOS ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li>
<li>Reduce <code>Expr</code> size to 64 bytes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Hyperlink rule codes in <code>ruff check --statistics</code> output
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code>
(<code>RUF006</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Use mimalloc v3 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/Andrej730"><code>@​Andrej730</code></a></li>
<li><a
href="https://github.com/alonfaraj"><code>@​alonfaraj</code></a></li>
<li><a
href="https://github.com/romero-deshaw"><code>@​romero-deshaw</code></a></li>
<li><a href="https://github.com/Avasam"><code>@​Avasam</code></a></li>
<li><a href="https://github.com/tjkuson"><code>@​tjkuson</code></a></li>
<li><a
href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.3</h2>
<p>Released on 2026-08-13.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>pylint</code>] Fix false negatives on negative numbers
(<code>PLR6104</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li>
<li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code>
with <code>while True</code> (<code>UP048</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bandit</code>] Also check keyword arguments
(<code>S602</code>, <code>S603</code>, <code>S607</code>,
<code>S609</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li>
<li>[<code>pylint</code>] Allow <code>continue</code> in
<code>finally</code> on Python 3.8 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li>
<li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with
bools (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li>
<li>[<code>pylint</code>] Fix false positives and negatives with
<code>%b</code> format character (<code>PLE1300</code>,
<code>PLE1307</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li>
<li>[<code>pylint</code>] Improve handling of concatenated strings
(<code>PLE1300</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>numpy</code>] Make <code>np.chararray</code> autofix
backwards-compatible (<code>NPY201</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Enable PGO for Linux x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li>
<li>Enable PGO for Linux ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li>
<li>Enable PGO for Windows x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li>
<li>Enable PGO for macOS ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li>
<li>Reduce <code>Expr</code> size to 64 bytes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Hyperlink rule codes in <code>ruff check --statistics</code> output
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code>
(<code>RUF006</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Use mimalloc v3 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/Andrej730"><code>@​Andrej730</code></a></li>
<li><a
href="https://github.com/alonfaraj"><code>@​alonfaraj</code></a></li>
<li><a
href="https://github.com/romero-deshaw"><code>@​romero-deshaw</code></a></li>
<li><a href="https://github.com/Avasam"><code>@​Avasam</code></a></li>
<li><a href="https://github.com/tjkuson"><code>@​tjkuson</code></a></li>
<li><a
href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li>
<li><a
href="https://github.com/chirizxc"><code>@​chirizxc</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/b0e47022cfce4f3594aa26d15ea792681430b6f6"><code>b0e4702</code></a>
Bump 0.16.3 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27723">#27723</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ecdd401fdbc5b0b22e18759c8bd25cda452e8b32"><code>ecdd401</code></a>
[ty] Separate script and uv modules from project metadata (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27720">#27720</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/126352467217bebfa4cb86fd3c4d20820322d9e3"><code>1263524</code></a>
[ty] Simplify display implementations with std::fmt::from_fn (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27718">#27718</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/59196baedf23c9876d1fcf1fa2ae78f80d306f94"><code>59196ba</code></a>
[ty] Unify polarity-aware relation construction (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27707">#27707</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b8c5e73abe5b15a74fb066e474d30397d1421cfe"><code>b8c5e73</code></a>
[ty] Disable CodSpeed cycle estimation for instrumented benchmarks (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27706">#27706</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2b0d21094e2a55491bff60c07fd6f8803876cae5"><code>2b0d210</code></a>
[ty] Centralize matched argument relations (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27705">#27705</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/a9130f3381fe137626d22288c0d45f996541ca7e"><code>a9130f3</code></a>
[<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with
<code>while True</code> (<code>while-one</code>, `...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/c64c7d6dad1e0a4966ce578b2c03af1e8e7673e1"><code>c64c7d6</code></a>
[ty] Model try exception flow with operation checkpoints (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27471">#27471</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/9dea5ef180b3de748b5fe45787056716f235d11a"><code>9dea5ef</code></a>
[ty] Avoid deriving sequents for typevars with concrete bounds (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27587">#27587</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/9798e88de673ec73051980ebd9aeb681161f3c27"><code>9798e88</code></a>
[ty] Preserve enum exhaustiveness with custom <em>missing</em> methods
(<a
href="https://redirect.github.com/astral-sh/ruff/issues/27700">#27700</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.2...0.16.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `mypy` from 2.3.0 to 2.3.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's
changelog</a>.</em></p>
<blockquote>
<h3>Mypy 2.3.1</h3>
<ul>
<li>Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR
<a
href="https://redirect.github.com/python/mypy/pull/21826">21826</a>)</li>
<li>Fix mypyc <code>default_factory</code> for inherited dataclass
(Daniël van Noord, PR <a
href="https://redirect.github.com/python/mypy/pull/21785">21785</a>)</li>
<li>Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR
<a
href="https://redirect.github.com/python/mypy/pull/21734">21734</a>)</li>
<li>Fix crash when unpacking return value from overload (Shantanu, PR <a
href="https://redirect.github.com/python/mypy/pull/21830">21830</a>)</li>
</ul>
<h3>Acknowledgements</h3>
<p>Thanks to all mypy contributors who contributed to this release:</p>
<ul>
<li>Agriya Khetarpal</li>
<li>Ethan Sarp</li>
<li>Ivan Levkivskyi</li>
<li>Jingchen Ye</li>
<li>Jukka Lehtosalo</li>
<li>Piotr Sawicki</li>
<li>Shantanu</li>
<li>Tom Bannink</li>
<li>Viktor Szépe</li>
<li>ygale</li>
</ul>
<p>I'd also like to thank my employer, Dropbox, for supporting mypy
development.</p>
<h2>Mypy 2.2</h2>
<p>We've just uploaded mypy 2.2.0 to the Python Package Index (<a
href="https://pypi.org/project/mypy/">PyPI</a>).
Mypy is a static type checker for Python. This release includes new
features, performance
improvements and bug fixes. You can install it as follows:</p>
<pre><code>python3 -m pip install -U mypy
</code></pre>
<p>You can read the full documentation for this release on <a
href="http://mypy.readthedocs.io">Read the Docs</a>.</p>
<h3>Support for Closed TypedDicts (PEP 728)</h3>
<p>Mypy now supports closed TypedDicts as specified in PEP 728. A closed
TypedDict cannot have extra
keys beyond those explicitly defined. This allows the type checker to
determine that certain
operations are safe when they otherwise wouldn't be due to the potential
presence of unknown keys.</p>
<p>You can use the <code>closed</code> keyword argument with
<code>TypedDict</code>:</p>
<pre lang="python"><code>HasName = TypedDict(&quot;HasName&quot;,
{&quot;name&quot;: str})
HasOnlyName = TypedDict(&quot;HasOnlyName&quot;, {&quot;name&quot;:
str}, closed=True)
Movie = TypedDict(&quot;Movie&quot;, {&quot;name&quot;: str,
&quot;year&quot;: int})
<p>movie: Movie = {&quot;name&quot;: &quot;Nimona&quot;,
&quot;year&quot;: 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie # Error: HasOnlyName is closed and
Movie has extra &quot;year&quot; key
&lt;/tr&gt;&lt;/table&gt;
</code></pre></p>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python/mypy/commit/d642c4478e9e3acbe9233edbe17ffc569a1a778c"><code>d642c44</code></a>
Bump version to 2.3.1</li>
<li><a
href="https://github.com/python/mypy/commit/a39242983d3c2cb85886a1eb6d5869180672784c"><code>a392429</code></a>
[mypyc] Fix crash on double yielding Iterators (<a
href="https://redirect.github.com/python/mypy/issues/21826">#21826</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/4843e7773e7dc8fe3f1fd1319277d6d11cd6cdb3"><code>4843e77</code></a>
[mypyc] Fix <code>default_factory</code> for inherited dataclass (<a
href="https://redirect.github.com/python/mypy/issues/21785">#21785</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/14f5df93ed8d1be4f4cc9c447eb2e6e619362e05"><code>14f5df9</code></a>
[mypyc] Clear coroutine env on coroutine completion (<a
href="https://redirect.github.com/python/mypy/issues/21734">#21734</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/6dfa06dda6e34912279e498d35a43ba6dc30bfee"><code>6dfa06d</code></a>
Fix crash when unpacking return value from overload (<a
href="https://redirect.github.com/python/mypy/issues/21830">#21830</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/a3857467da126d28b55724e8bb682019df9a503e"><code>a385746</code></a>
Bump version to 2.3.1+dev</li>
<li>See full diff in <a
href="https://github.com/python/mypy/compare/v2.3.0...v2.3.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `wheel` from 0.47.0 to 0.48.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/releases">wheel's
releases</a>.</em></p>
<blockquote>
<h2>0.48.0</h2>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a PEP 440 local version
identifier from a wheel (<a
href="https://redirect.github.com/pypa/wheel/issues/570">#570</a>)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions (<a
href="https://redirect.github.com/pypa/wheel/issues/643">#643</a>)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose entries use ZIP64, by dropping the
central-directory ZIP64 extra field that is not valid in a local file
header (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination directory when the input archive contained a maliciously
crafted project name or version with path separators (arbitrary file
write / path traversal) (<a
href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw">GHSA-vgq5-9859-3mmw</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>UNRELEASED</strong></p>
<ul>
<li>Fixed the macOS platform-tag warning always using the plural
&quot;these files&quot;
wording, even when only a single library required a higher deployment
target
(<code>[#697](pypa/wheel#697)
&lt;https://github.com/pypa/wheel/pull/697&gt;</code>_)</li>
</ul>
<p><strong>0.48.0 (2026-08-12)</strong></p>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a
PEP 440 local version identifier from a wheel
(<code>[#570](pypa/wheel#570)
&lt;https://github.com/pypa/wheel/issues/570&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions
(<code>[#643](pypa/wheel#643)
&lt;https://github.com/pypa/wheel/issues/643&gt;</code>_)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose
entries use ZIP64, by dropping the central-directory ZIP64 extra field
that is
not valid in a local file header
(<code>[#692](pypa/wheel#692)
&lt;https://github.com/pypa/wheel/issues/692&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination
directory when the input archive contained a maliciously crafted project
name
or version with path separators (arbitrary file write / path traversal)
(<code>GHSA-vgq5-9859-3mmw
&lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw&gt;</code>_)</li>
</ul>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without
unpacking them (<code>[#639](pypa/wheel#639)
&lt;https://github.com/pypa/wheel/issues/639&gt;</code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the
<code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[#411](pypa/wheel#411)
&lt;https://github.com/pypa/wheel/issues/411&gt;</code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when
installed alongside an old version of setuptools and running the
<code>bdist_wheel</code>
command (<code>[#676](pypa/wheel#676)
&lt;https://github.com/pypa/wheel/issues/676&gt;</code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84"><code>21c4da4</code></a>
Fixed the release heading format</li>
<li><a
href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2"><code>f06d4db</code></a>
Flit no longer supports --setup-py</li>
<li><a
href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c"><code>1a96c3e</code></a>
Created a new release</li>
<li><a
href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b"><code>d7d625d</code></a>
Fixed wheel convert writing outside the target directory on malicious
input (...</li>
<li><a
href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465"><code>986a440</code></a>
Strip ZIP64 extra field when retagging wheels (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>) (<a
href="https://redirect.github.com/pypa/wheel/issues/695">#695</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d"><code>0ca6f24</code></a>
feat: add --local-version option to wheel pack (<a
href="https://redirect.github.com/pypa/wheel/issues/694">#694</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb"><code>4a63caf</code></a>
Preserve compatible metadata versions in convert (<a
href="https://redirect.github.com/pypa/wheel/issues/690">#690</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a"><code>33650c6</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/691">#691</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2"><code>197012d</code></a>
Increased the upper bound for flit-core as a build requirement</li>
<li>See full diff in <a
href="https://github.com/pypa/wheel/compare/0.47.0...0.48.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
vbvictor pushed a commit to clang-tidy-infra/triage-agent that referenced this pull request Aug 24, 2026
Bumps the dev-dependencies group with 3 updates:
[ruff](https://github.com/astral-sh/ruff),
[mypy](https://github.com/python/mypy) and
[wheel](https://github.com/pypa/wheel).

Updates `ruff` from 0.16.2 to 0.16.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.3</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-13.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>pylint</code>] Fix false negatives on negative numbers
(<code>PLR6104</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li>
<li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code>
with <code>while True</code> (<code>UP048</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bandit</code>] Also check keyword arguments
(<code>S602</code>, <code>S603</code>, <code>S607</code>,
<code>S609</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li>
<li>[<code>pylint</code>] Allow <code>continue</code> in
<code>finally</code> on Python 3.8 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li>
<li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with
bools (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li>
<li>[<code>pylint</code>] Fix false positives and negatives with
<code>%b</code> format character (<code>PLE1300</code>,
<code>PLE1307</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li>
<li>[<code>pylint</code>] Improve handling of concatenated strings
(<code>PLE1300</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>numpy</code>] Make <code>np.chararray</code> autofix
backwards-compatible (<code>NPY201</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Enable PGO for Linux x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li>
<li>Enable PGO for Linux ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li>
<li>Enable PGO for Windows x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li>
<li>Enable PGO for macOS ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li>
<li>Reduce <code>Expr</code> size to 64 bytes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Hyperlink rule codes in <code>ruff check --statistics</code> output
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code>
(<code>RUF006</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Use mimalloc v3 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/Andrej730"><code>@​Andrej730</code></a></li>
<li><a
href="https://github.com/alonfaraj"><code>@​alonfaraj</code></a></li>
<li><a
href="https://github.com/romero-deshaw"><code>@​romero-deshaw</code></a></li>
<li><a href="https://github.com/Avasam"><code>@​Avasam</code></a></li>
<li><a href="https://github.com/tjkuson"><code>@​tjkuson</code></a></li>
<li><a
href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.3</h2>
<p>Released on 2026-08-13.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>pylint</code>] Fix false negatives on negative numbers
(<code>PLR6104</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li>
<li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code>
with <code>while True</code> (<code>UP048</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bandit</code>] Also check keyword arguments
(<code>S602</code>, <code>S603</code>, <code>S607</code>,
<code>S609</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li>
<li>[<code>pylint</code>] Allow <code>continue</code> in
<code>finally</code> on Python 3.8 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li>
<li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with
bools (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li>
<li>[<code>pylint</code>] Fix false positives and negatives with
<code>%b</code> format character (<code>PLE1300</code>,
<code>PLE1307</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li>
<li>[<code>pylint</code>] Improve handling of concatenated strings
(<code>PLE1300</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>numpy</code>] Make <code>np.chararray</code> autofix
backwards-compatible (<code>NPY201</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Enable PGO for Linux x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li>
<li>Enable PGO for Linux ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li>
<li>Enable PGO for Windows x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li>
<li>Enable PGO for macOS ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li>
<li>Reduce <code>Expr</code> size to 64 bytes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Hyperlink rule codes in <code>ruff check --statistics</code> output
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code>
(<code>RUF006</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Use mimalloc v3 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/Andrej730"><code>@​Andrej730</code></a></li>
<li><a
href="https://github.com/alonfaraj"><code>@​alonfaraj</code></a></li>
<li><a
href="https://github.com/romero-deshaw"><code>@​romero-deshaw</code></a></li>
<li><a href="https://github.com/Avasam"><code>@​Avasam</code></a></li>
<li><a href="https://github.com/tjkuson"><code>@​tjkuson</code></a></li>
<li><a
href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li>
<li><a
href="https://github.com/chirizxc"><code>@​chirizxc</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/b0e47022cfce4f3594aa26d15ea792681430b6f6"><code>b0e4702</code></a>
Bump 0.16.3 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27723">#27723</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ecdd401fdbc5b0b22e18759c8bd25cda452e8b32"><code>ecdd401</code></a>
[ty] Separate script and uv modules from project metadata (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27720">#27720</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/126352467217bebfa4cb86fd3c4d20820322d9e3"><code>1263524</code></a>
[ty] Simplify display implementations with std::fmt::from_fn (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27718">#27718</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/59196baedf23c9876d1fcf1fa2ae78f80d306f94"><code>59196ba</code></a>
[ty] Unify polarity-aware relation construction (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27707">#27707</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b8c5e73abe5b15a74fb066e474d30397d1421cfe"><code>b8c5e73</code></a>
[ty] Disable CodSpeed cycle estimation for instrumented benchmarks (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27706">#27706</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2b0d21094e2a55491bff60c07fd6f8803876cae5"><code>2b0d210</code></a>
[ty] Centralize matched argument relations (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27705">#27705</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/a9130f3381fe137626d22288c0d45f996541ca7e"><code>a9130f3</code></a>
[<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with
<code>while True</code> (<code>while-one</code>, `...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/c64c7d6dad1e0a4966ce578b2c03af1e8e7673e1"><code>c64c7d6</code></a>
[ty] Model try exception flow with operation checkpoints (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27471">#27471</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/9dea5ef180b3de748b5fe45787056716f235d11a"><code>9dea5ef</code></a>
[ty] Avoid deriving sequents for typevars with concrete bounds (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27587">#27587</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/9798e88de673ec73051980ebd9aeb681161f3c27"><code>9798e88</code></a>
[ty] Preserve enum exhaustiveness with custom <em>missing</em> methods
(<a
href="https://redirect.github.com/astral-sh/ruff/issues/27700">#27700</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.2...0.16.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `mypy` from 2.3.0 to 2.3.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's
changelog</a>.</em></p>
<blockquote>
<h3>Mypy 2.3.1</h3>
<ul>
<li>Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR
<a
href="https://redirect.github.com/python/mypy/pull/21826">21826</a>)</li>
<li>Fix mypyc <code>default_factory</code> for inherited dataclass
(Daniël van Noord, PR <a
href="https://redirect.github.com/python/mypy/pull/21785">21785</a>)</li>
<li>Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR
<a
href="https://redirect.github.com/python/mypy/pull/21734">21734</a>)</li>
<li>Fix crash when unpacking return value from overload (Shantanu, PR <a
href="https://redirect.github.com/python/mypy/pull/21830">21830</a>)</li>
</ul>
<h3>Acknowledgements</h3>
<p>Thanks to all mypy contributors who contributed to this release:</p>
<ul>
<li>Agriya Khetarpal</li>
<li>Ethan Sarp</li>
<li>Ivan Levkivskyi</li>
<li>Jingchen Ye</li>
<li>Jukka Lehtosalo</li>
<li>Piotr Sawicki</li>
<li>Shantanu</li>
<li>Tom Bannink</li>
<li>Viktor Szépe</li>
<li>ygale</li>
</ul>
<p>I'd also like to thank my employer, Dropbox, for supporting mypy
development.</p>
<h2>Mypy 2.2</h2>
<p>We've just uploaded mypy 2.2.0 to the Python Package Index (<a
href="https://pypi.org/project/mypy/">PyPI</a>).
Mypy is a static type checker for Python. This release includes new
features, performance
improvements and bug fixes. You can install it as follows:</p>
<pre><code>python3 -m pip install -U mypy
</code></pre>
<p>You can read the full documentation for this release on <a
href="http://mypy.readthedocs.io">Read the Docs</a>.</p>
<h3>Support for Closed TypedDicts (PEP 728)</h3>
<p>Mypy now supports closed TypedDicts as specified in PEP 728. A closed
TypedDict cannot have extra
keys beyond those explicitly defined. This allows the type checker to
determine that certain
operations are safe when they otherwise wouldn't be due to the potential
presence of unknown keys.</p>
<p>You can use the <code>closed</code> keyword argument with
<code>TypedDict</code>:</p>
<pre lang="python"><code>HasName = TypedDict(&quot;HasName&quot;,
{&quot;name&quot;: str})
HasOnlyName = TypedDict(&quot;HasOnlyName&quot;, {&quot;name&quot;:
str}, closed=True)
Movie = TypedDict(&quot;Movie&quot;, {&quot;name&quot;: str,
&quot;year&quot;: int})
<p>movie: Movie = {&quot;name&quot;: &quot;Nimona&quot;,
&quot;year&quot;: 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie # Error: HasOnlyName is closed and
Movie has extra &quot;year&quot; key
&lt;/tr&gt;&lt;/table&gt;
</code></pre></p>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python/mypy/commit/d642c4478e9e3acbe9233edbe17ffc569a1a778c"><code>d642c44</code></a>
Bump version to 2.3.1</li>
<li><a
href="https://github.com/python/mypy/commit/a39242983d3c2cb85886a1eb6d5869180672784c"><code>a392429</code></a>
[mypyc] Fix crash on double yielding Iterators (<a
href="https://redirect.github.com/python/mypy/issues/21826">#21826</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/4843e7773e7dc8fe3f1fd1319277d6d11cd6cdb3"><code>4843e77</code></a>
[mypyc] Fix <code>default_factory</code> for inherited dataclass (<a
href="https://redirect.github.com/python/mypy/issues/21785">#21785</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/14f5df93ed8d1be4f4cc9c447eb2e6e619362e05"><code>14f5df9</code></a>
[mypyc] Clear coroutine env on coroutine completion (<a
href="https://redirect.github.com/python/mypy/issues/21734">#21734</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/6dfa06dda6e34912279e498d35a43ba6dc30bfee"><code>6dfa06d</code></a>
Fix crash when unpacking return value from overload (<a
href="https://redirect.github.com/python/mypy/issues/21830">#21830</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/a3857467da126d28b55724e8bb682019df9a503e"><code>a385746</code></a>
Bump version to 2.3.1+dev</li>
<li>See full diff in <a
href="https://github.com/python/mypy/compare/v2.3.0...v2.3.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `wheel` from 0.47.0 to 0.48.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/releases">wheel's
releases</a>.</em></p>
<blockquote>
<h2>0.48.0</h2>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a PEP 440 local version
identifier from a wheel (<a
href="https://redirect.github.com/pypa/wheel/issues/570">#570</a>)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions (<a
href="https://redirect.github.com/pypa/wheel/issues/643">#643</a>)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose entries use ZIP64, by dropping the
central-directory ZIP64 extra field that is not valid in a local file
header (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination directory when the input archive contained a maliciously
crafted project name or version with path separators (arbitrary file
write / path traversal) (<a
href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw">GHSA-vgq5-9859-3mmw</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>UNRELEASED</strong></p>
<ul>
<li>Fixed the macOS platform-tag warning always using the plural
&quot;these files&quot;
wording, even when only a single library required a higher deployment
target
(<code>[#697](pypa/wheel#697)
&lt;https://github.com/pypa/wheel/pull/697&gt;</code>_)</li>
</ul>
<p><strong>0.48.0 (2026-08-12)</strong></p>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a
PEP 440 local version identifier from a wheel
(<code>[#570](pypa/wheel#570)
&lt;https://github.com/pypa/wheel/issues/570&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions
(<code>[#643](pypa/wheel#643)
&lt;https://github.com/pypa/wheel/issues/643&gt;</code>_)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose
entries use ZIP64, by dropping the central-directory ZIP64 extra field
that is
not valid in a local file header
(<code>[#692](pypa/wheel#692)
&lt;https://github.com/pypa/wheel/issues/692&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination
directory when the input archive contained a maliciously crafted project
name
or version with path separators (arbitrary file write / path traversal)
(<code>GHSA-vgq5-9859-3mmw
&lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw&gt;</code>_)</li>
</ul>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without
unpacking them (<code>[#639](pypa/wheel#639)
&lt;https://github.com/pypa/wheel/issues/639&gt;</code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the
<code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[#411](pypa/wheel#411)
&lt;https://github.com/pypa/wheel/issues/411&gt;</code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when
installed alongside an old version of setuptools and running the
<code>bdist_wheel</code>
command (<code>[#676](pypa/wheel#676)
&lt;https://github.com/pypa/wheel/issues/676&gt;</code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84"><code>21c4da4</code></a>
Fixed the release heading format</li>
<li><a
href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2"><code>f06d4db</code></a>
Flit no longer supports --setup-py</li>
<li><a
href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c"><code>1a96c3e</code></a>
Created a new release</li>
<li><a
href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b"><code>d7d625d</code></a>
Fixed wheel convert writing outside the target directory on malicious
input (...</li>
<li><a
href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465"><code>986a440</code></a>
Strip ZIP64 extra field when retagging wheels (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>) (<a
href="https://redirect.github.com/pypa/wheel/issues/695">#695</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d"><code>0ca6f24</code></a>
feat: add --local-version option to wheel pack (<a
href="https://redirect.github.com/pypa/wheel/issues/694">#694</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb"><code>4a63caf</code></a>
Preserve compatible metadata versions in convert (<a
href="https://redirect.github.com/pypa/wheel/issues/690">#690</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a"><code>33650c6</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/691">#691</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2"><code>197012d</code></a>
Increased the upper bound for flit-core as a build requirement</li>
<li>See full diff in <a
href="https://github.com/pypa/wheel/compare/0.47.0...0.48.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
vbvictor pushed a commit to clang-tidy-infra/CTIT that referenced this pull request Aug 25, 2026
Bumps the dev-dependencies group with 3 updates:
[ruff](https://github.com/astral-sh/ruff),
[mypy](https://github.com/python/mypy) and
[wheel](https://github.com/pypa/wheel).

Updates `ruff` from 0.16.2 to 0.16.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.3</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-13.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>pylint</code>] Fix false negatives on negative numbers
(<code>PLR6104</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li>
<li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code>
with <code>while True</code> (<code>UP048</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bandit</code>] Also check keyword arguments
(<code>S602</code>, <code>S603</code>, <code>S607</code>,
<code>S609</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li>
<li>[<code>pylint</code>] Allow <code>continue</code> in
<code>finally</code> on Python 3.8 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li>
<li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with
bools (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li>
<li>[<code>pylint</code>] Fix false positives and negatives with
<code>%b</code> format character (<code>PLE1300</code>,
<code>PLE1307</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li>
<li>[<code>pylint</code>] Improve handling of concatenated strings
(<code>PLE1300</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>numpy</code>] Make <code>np.chararray</code> autofix
backwards-compatible (<code>NPY201</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Enable PGO for Linux x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li>
<li>Enable PGO for Linux ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li>
<li>Enable PGO for Windows x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li>
<li>Enable PGO for macOS ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li>
<li>Reduce <code>Expr</code> size to 64 bytes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Hyperlink rule codes in <code>ruff check --statistics</code> output
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code>
(<code>RUF006</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Use mimalloc v3 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/Andrej730"><code>@​Andrej730</code></a></li>
<li><a
href="https://github.com/alonfaraj"><code>@​alonfaraj</code></a></li>
<li><a
href="https://github.com/romero-deshaw"><code>@​romero-deshaw</code></a></li>
<li><a href="https://github.com/Avasam"><code>@​Avasam</code></a></li>
<li><a href="https://github.com/tjkuson"><code>@​tjkuson</code></a></li>
<li><a
href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.3</h2>
<p>Released on 2026-08-13.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>pylint</code>] Fix false negatives on negative numbers
(<code>PLR6104</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li>
<li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code>
with <code>while True</code> (<code>UP048</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bandit</code>] Also check keyword arguments
(<code>S602</code>, <code>S603</code>, <code>S607</code>,
<code>S609</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li>
<li>[<code>pylint</code>] Allow <code>continue</code> in
<code>finally</code> on Python 3.8 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li>
<li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with
bools (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li>
<li>[<code>pylint</code>] Fix false positives and negatives with
<code>%b</code> format character (<code>PLE1300</code>,
<code>PLE1307</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li>
<li>[<code>pylint</code>] Improve handling of concatenated strings
(<code>PLE1300</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>[<code>numpy</code>] Make <code>np.chararray</code> autofix
backwards-compatible (<code>NPY201</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Enable PGO for Linux x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li>
<li>Enable PGO for Linux ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li>
<li>Enable PGO for Windows x86-64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li>
<li>Enable PGO for macOS ARM64 Ruff releases (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li>
<li>Reduce <code>Expr</code> size to 64 bytes (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li>
</ul>
<h3>CLI</h3>
<ul>
<li>Hyperlink rule codes in <code>ruff check --statistics</code> output
(<a
href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code>
(<code>RUF006</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Use mimalloc v3 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/Andrej730"><code>@​Andrej730</code></a></li>
<li><a
href="https://github.com/alonfaraj"><code>@​alonfaraj</code></a></li>
<li><a
href="https://github.com/romero-deshaw"><code>@​romero-deshaw</code></a></li>
<li><a href="https://github.com/Avasam"><code>@​Avasam</code></a></li>
<li><a href="https://github.com/tjkuson"><code>@​tjkuson</code></a></li>
<li><a
href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li>
<li><a
href="https://github.com/chirizxc"><code>@​chirizxc</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/b0e47022cfce4f3594aa26d15ea792681430b6f6"><code>b0e4702</code></a>
Bump 0.16.3 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27723">#27723</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ecdd401fdbc5b0b22e18759c8bd25cda452e8b32"><code>ecdd401</code></a>
[ty] Separate script and uv modules from project metadata (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27720">#27720</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/126352467217bebfa4cb86fd3c4d20820322d9e3"><code>1263524</code></a>
[ty] Simplify display implementations with std::fmt::from_fn (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27718">#27718</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/59196baedf23c9876d1fcf1fa2ae78f80d306f94"><code>59196ba</code></a>
[ty] Unify polarity-aware relation construction (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27707">#27707</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b8c5e73abe5b15a74fb066e474d30397d1421cfe"><code>b8c5e73</code></a>
[ty] Disable CodSpeed cycle estimation for instrumented benchmarks (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27706">#27706</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/2b0d21094e2a55491bff60c07fd6f8803876cae5"><code>2b0d210</code></a>
[ty] Centralize matched argument relations (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27705">#27705</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/a9130f3381fe137626d22288c0d45f996541ca7e"><code>a9130f3</code></a>
[<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with
<code>while True</code> (<code>while-one</code>, `...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/c64c7d6dad1e0a4966ce578b2c03af1e8e7673e1"><code>c64c7d6</code></a>
[ty] Model try exception flow with operation checkpoints (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27471">#27471</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/9dea5ef180b3de748b5fe45787056716f235d11a"><code>9dea5ef</code></a>
[ty] Avoid deriving sequents for typevars with concrete bounds (<a
href="https://redirect.github.com/astral-sh/ruff/issues/27587">#27587</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/9798e88de673ec73051980ebd9aeb681161f3c27"><code>9798e88</code></a>
[ty] Preserve enum exhaustiveness with custom <em>missing</em> methods
(<a
href="https://redirect.github.com/astral-sh/ruff/issues/27700">#27700</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.2...0.16.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `mypy` from 2.3.0 to 2.3.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's
changelog</a>.</em></p>
<blockquote>
<h3>Mypy 2.3.1</h3>
<ul>
<li>Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR
<a
href="https://redirect.github.com/python/mypy/pull/21826">21826</a>)</li>
<li>Fix mypyc <code>default_factory</code> for inherited dataclass
(Daniël van Noord, PR <a
href="https://redirect.github.com/python/mypy/pull/21785">21785</a>)</li>
<li>Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR
<a
href="https://redirect.github.com/python/mypy/pull/21734">21734</a>)</li>
<li>Fix crash when unpacking return value from overload (Shantanu, PR <a
href="https://redirect.github.com/python/mypy/pull/21830">21830</a>)</li>
</ul>
<h3>Acknowledgements</h3>
<p>Thanks to all mypy contributors who contributed to this release:</p>
<ul>
<li>Agriya Khetarpal</li>
<li>Ethan Sarp</li>
<li>Ivan Levkivskyi</li>
<li>Jingchen Ye</li>
<li>Jukka Lehtosalo</li>
<li>Piotr Sawicki</li>
<li>Shantanu</li>
<li>Tom Bannink</li>
<li>Viktor Szépe</li>
<li>ygale</li>
</ul>
<p>I'd also like to thank my employer, Dropbox, for supporting mypy
development.</p>
<h2>Mypy 2.2</h2>
<p>We've just uploaded mypy 2.2.0 to the Python Package Index (<a
href="https://pypi.org/project/mypy/">PyPI</a>).
Mypy is a static type checker for Python. This release includes new
features, performance
improvements and bug fixes. You can install it as follows:</p>
<pre><code>python3 -m pip install -U mypy
</code></pre>
<p>You can read the full documentation for this release on <a
href="http://mypy.readthedocs.io">Read the Docs</a>.</p>
<h3>Support for Closed TypedDicts (PEP 728)</h3>
<p>Mypy now supports closed TypedDicts as specified in PEP 728. A closed
TypedDict cannot have extra
keys beyond those explicitly defined. This allows the type checker to
determine that certain
operations are safe when they otherwise wouldn't be due to the potential
presence of unknown keys.</p>
<p>You can use the <code>closed</code> keyword argument with
<code>TypedDict</code>:</p>
<pre lang="python"><code>HasName = TypedDict(&quot;HasName&quot;,
{&quot;name&quot;: str})
HasOnlyName = TypedDict(&quot;HasOnlyName&quot;, {&quot;name&quot;:
str}, closed=True)
Movie = TypedDict(&quot;Movie&quot;, {&quot;name&quot;: str,
&quot;year&quot;: int})
<p>movie: Movie = {&quot;name&quot;: &quot;Nimona&quot;,
&quot;year&quot;: 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie # Error: HasOnlyName is closed and
Movie has extra &quot;year&quot; key
&lt;/tr&gt;&lt;/table&gt;
</code></pre></p>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python/mypy/commit/d642c4478e9e3acbe9233edbe17ffc569a1a778c"><code>d642c44</code></a>
Bump version to 2.3.1</li>
<li><a
href="https://github.com/python/mypy/commit/a39242983d3c2cb85886a1eb6d5869180672784c"><code>a392429</code></a>
[mypyc] Fix crash on double yielding Iterators (<a
href="https://redirect.github.com/python/mypy/issues/21826">#21826</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/4843e7773e7dc8fe3f1fd1319277d6d11cd6cdb3"><code>4843e77</code></a>
[mypyc] Fix <code>default_factory</code> for inherited dataclass (<a
href="https://redirect.github.com/python/mypy/issues/21785">#21785</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/14f5df93ed8d1be4f4cc9c447eb2e6e619362e05"><code>14f5df9</code></a>
[mypyc] Clear coroutine env on coroutine completion (<a
href="https://redirect.github.com/python/mypy/issues/21734">#21734</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/6dfa06dda6e34912279e498d35a43ba6dc30bfee"><code>6dfa06d</code></a>
Fix crash when unpacking return value from overload (<a
href="https://redirect.github.com/python/mypy/issues/21830">#21830</a>)</li>
<li><a
href="https://github.com/python/mypy/commit/a3857467da126d28b55724e8bb682019df9a503e"><code>a385746</code></a>
Bump version to 2.3.1+dev</li>
<li>See full diff in <a
href="https://github.com/python/mypy/compare/v2.3.0...v2.3.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `wheel` from 0.47.0 to 0.48.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/releases">wheel's
releases</a>.</em></p>
<blockquote>
<h2>0.48.0</h2>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a PEP 440 local version
identifier from a wheel (<a
href="https://redirect.github.com/pypa/wheel/issues/570">#570</a>)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions (<a
href="https://redirect.github.com/pypa/wheel/issues/643">#643</a>)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose entries use ZIP64, by dropping the
central-directory ZIP64 extra field that is not valid in a local file
header (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination directory when the input archive contained a maliciously
crafted project name or version with path separators (arbitrary file
write / path traversal) (<a
href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw">GHSA-vgq5-9859-3mmw</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes</h1>
<p><strong>UNRELEASED</strong></p>
<ul>
<li>Fixed the macOS platform-tag warning always using the plural
&quot;these files&quot;
wording, even when only a single library required a higher deployment
target
(<code>[#697](pypa/wheel#697)
&lt;https://github.com/pypa/wheel/pull/697&gt;</code>_)</li>
</ul>
<p><strong>0.48.0 (2026-08-12)</strong></p>
<ul>
<li>Added a <code>--local-version</code> option to <code>wheel
pack</code> to add, replace, or remove a
PEP 440 local version identifier from a wheel
(<code>[#570](pypa/wheel#570)
&lt;https://github.com/pypa/wheel/issues/570&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible
core metadata versions
(<code>[#643](pypa/wheel#643)
&lt;https://github.com/pypa/wheel/issues/643&gt;</code>_)</li>
<li>Fixed <code>wheel tags</code> producing invalid archives when
retagging wheels whose
entries use ZIP64, by dropping the central-directory ZIP64 extra field
that is
not valid in a local file header
(<code>[#692](pypa/wheel#692)
&lt;https://github.com/pypa/wheel/issues/692&gt;</code>_)</li>
<li>Fixed <code>wheel convert</code> writing the converted wheel outside
the destination
directory when the input archive contained a maliciously crafted project
name
or version with path separators (arbitrary file write / path traversal)
(<code>GHSA-vgq5-9859-3mmw
&lt;https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw&gt;</code>_)</li>
</ul>
<p><strong>0.47.0 (2026-04-22)</strong></p>
<ul>
<li>Added the <code>wheel info</code> subcommand to display metadata
about wheel files without
unpacking them (<code>[#639](pypa/wheel#639)
&lt;https://github.com/pypa/wheel/issues/639&gt;</code>_)</li>
<li>Fixed <code>WheelFile</code> raising <code>Missing RECORD
file</code> when the wheel filename contains
uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the
<code>.dist-info</code> directory
inside uses normalized lowercase naming
(<code>[#411](pypa/wheel#411)
&lt;https://github.com/pypa/wheel/issues/411&gt;</code>_)</li>
</ul>
<p><strong>0.46.3 (2026-01-22)</strong></p>
<ul>
<li>Fixed <code>ImportError: cannot import name '_setuptools_logging'
from 'wheel'</code> when
installed alongside an old version of setuptools and running the
<code>bdist_wheel</code>
command (<code>[#676](pypa/wheel#676)
&lt;https://github.com/pypa/wheel/issues/676&gt;</code>_)</li>
</ul>
<p><strong>0.46.2 (2026-01-22)</strong></p>
<ul>
<li>Restored the <code>bdist_wheel</code> command for compatibility with
<code>setuptools</code> older than
v70.1</li>
<li>Importing <code>wheel.bdist_wheel</code> now emits a
<code>FutureWarning</code> instead of a
<code>DeprecationWarning</code></li>
<li>Fixed <code>wheel unpack</code> potentially altering the permissions
of files outside of the
destination tree with maliciously crafted wheels (CVE-2026-24049)</li>
</ul>
<p><strong>0.46.1 (2025-04-08)</strong></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84"><code>21c4da4</code></a>
Fixed the release heading format</li>
<li><a
href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2"><code>f06d4db</code></a>
Flit no longer supports --setup-py</li>
<li><a
href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c"><code>1a96c3e</code></a>
Created a new release</li>
<li><a
href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b"><code>d7d625d</code></a>
Fixed wheel convert writing outside the target directory on malicious
input (...</li>
<li><a
href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465"><code>986a440</code></a>
Strip ZIP64 extra field when retagging wheels (<a
href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>) (<a
href="https://redirect.github.com/pypa/wheel/issues/695">#695</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d"><code>0ca6f24</code></a>
feat: add --local-version option to wheel pack (<a
href="https://redirect.github.com/pypa/wheel/issues/694">#694</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb"><code>4a63caf</code></a>
Preserve compatible metadata versions in convert (<a
href="https://redirect.github.com/pypa/wheel/issues/690">#690</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a"><code>33650c6</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/pypa/wheel/issues/691">#691</a>)</li>
<li><a
href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2"><code>197012d</code></a>
Increased the upper bound for flit-core as a build requirement</li>
<li>See full diff in <a
href="https://github.com/pypa/wheel/compare/0.47.0...0.48.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants