Bump the python group across 1 directory with 5 updates

[dependabot]

Updates the requirements on av, django-health-check, django-tailwind-cli, gunicorn and ruff to permit the latest version.
Updates av to 18.1.0

Release notes

Sourced from av's releases.

v18.1.0

Features

• Infer the specific stream and codec context types for all FFmpeg encoder names in type-checked code by @​WyattBlue.
• Add CodecContext.supported_options to discover generic and codec-specific options by @​WyattBlue (#2032).
• Add Packet.rescale_ts() to rescale packet PTS, DTS, and duration to a new AVRational time base by @​WyattBlue.
• Support reusing the thread's current CUDA context via a current_ctx flag on CudaContext and VideoFrame.from_dlpack, for interop with libraries like PyTorch that initialize CUDA first by @​Yozer (#2339).
• VideoFrame.from_dlpack no longer requires restating primary_ctx/current_ctx when passing an explicit cuda_context; the flags are only validated when explicitly given by @​WyattBlue.
• Support passing an explicit CUDA stream to FFmpeg CUDA operations, including NVENC input and output, via a cuda_stream parameter on CudaContext; currently limited to logical CUDA device 0 by @​Yozer (#2360).
• Add av.AVRational, an exact rational number stored as two int32s that mirrors FFmpeg's AVRational. Codec.frame_rates now holds these rather than fractions.Fraction, and every setter that accepts a Fraction also accepts an AVRational. Unset rational attributes are falsy, so test them with if not stream.time_base: rather than is None by @​WyattBlue.
• Add Frame.metadata, the metadata FFmpeg attaches to a frame, by @​WyattBlue.
• Add CodecContext.level by @​WyattBlue.
• Add VideoCodecContext.field_order by @​WyattBlue.
• VideoFrame.save now forwards keyword arguments to the encoder, letting callers trade file size for speed (e.g. pred="none" or compression_level=1 for PNG, qscale=2 for JPG) by @​WyattBlue.
• Add InputContainer.start_time_realtime, the stream's start time in microseconds since the Unix epoch, which RTSP derives from RTCP sender reports, by @​WyattBlue (#2365).

Fixes

• Fix VideoFrame.save raising AttributeError when given a Path rather than a str by @​WyattBlue.
• Fix a frame rate assigned to a VideoStream after add_stream being dropped from the output; the codec context's frame rate is now copied to the stream before the header is written by @​WyattBlue (#2301).
• Prevent crashes and corrupted output when structural codec properties are changed after an output stream has been opened by @​WyattBlue, reported by @​oakaigh (#2232).
• Fix a crash when using a stream that has no CodecContext (a demuxed stream with no available decoder, such as one from a truncated file, or a stream created by add_mux_stream); decoding now raises DecoderNotFoundError, encoding now raises EncoderNotFoundError, and BitStreamFilterContext accepts such a stream as out_stream by @​WyattBlue, reported by @​justinrmiller (#2344).

Misc

• Support building from source against FFmpeg 9.0 by @​WyattBlue. The binary wheels still ship FFmpeg 8.1.2.

New Contributors

• @​Yozer made their first contribution in PyAV-Org/PyAV#2339

Full Changelog: PyAV-Org/PyAV@v18.0.0...v18.1.0

Changelog

Sourced from av's changelog.

v18.1.0

Features:

• Infer the specific stream and codec context types for all FFmpeg encoder names in type-checked code by :gh-user:WyattBlue.
• Add CodecContext.supported_options to discover generic and codec-specific options by :gh-user:WyattBlue (:issue:2032).
• Add Packet.rescale_ts() to rescale packet PTS, DTS, and duration to a new AVRational time base by :gh-user:WyattBlue.
• Support reusing the thread's current CUDA context via a current_ctx flag on CudaContext and VideoFrame.from_dlpack, for interop with libraries like PyTorch that initialize CUDA first by :gh-user:Yozer (:pr:2339).
• VideoFrame.from_dlpack no longer requires restating primary_ctx/current_ctx when passing an explicit cuda_context; the flags are only validated when explicitly given by :gh-user:WyattBlue.
• Support passing an explicit CUDA stream to FFmpeg CUDA operations, including NVENC input and output, via a cuda_stream parameter on CudaContext; currently limited to logical CUDA device 0 by :gh-user:Yozer (:pr:2360).
• Add av.AVRational, an exact rational number stored as two int32s that mirrors FFmpeg's AVRational. Codec.frame_rates now holds these rather than fractions.Fraction, and every setter that accepts a Fraction also accepts an AVRational. Unset rational attributes are falsy, so test them with if not stream.time_base: rather than is None by :gh-user:WyattBlue.
• Add Frame.metadata, the metadata FFmpeg attaches to a frame, by :gh-user:WyattBlue.
• Add CodecContext.level by :gh-user:WyattBlue.
• Add VideoCodecContext.field_order by :gh-user:WyattBlue.
• VideoFrame.save now forwards keyword arguments to the encoder, letting callers trade file size for speed (e.g. pred="none" or compression_level=1 for PNG, qscale=2 for JPG) by :gh-user:WyattBlue.
• Add InputContainer.start_time_realtime, the stream's start time in microseconds since the Unix epoch, which RTSP derives from RTCP sender reports, by :gh-user:WyattBlue (:issue:2365).

Fixes:

• Fix VideoFrame.save raising AttributeError when given a Path rather than a str by :gh-user:WyattBlue.
• Fix a frame rate assigned to a VideoStream after add_stream being dropped from the output; the codec context's frame rate is now copied to the stream before the header is written by :gh-user:WyattBlue (:issue:2301).

Misc.:

• Support building from source against FFmpeg 9.0 by :gh-user:WyattBlue. The binary wheels still ship FFmpeg 8.1.2.

• Prevent crashes and corrupted output when structural codec properties are changed after an output stream has been opened by :gh-user:WyattBlue, reported by :gh-user:oakaigh (:issue:2232).

• Fix a crash when using a stream that has no CodecContext (a demuxed stream with no available decoder, such as one from a truncated file, or a stream created by add_mux_stream); decoding now raises DecoderNotFoundError, encoding now raises EncoderNotFoundError, and BitStreamFilterContext accepts such a stream as out_stream by :gh-user:WyattBlue, reported by :gh-user:justinrmiller (:issue:2344).

v18.0.0

Breaking:

• Remove Python 3.10

Features:

• Support HW encoding via a hwaccel parameter on OutputContainer.add_stream (e.g. h264_vaapi, h264_nvenc, h264_videotoolbox); software frames passed to encode are uploaded to the device automatically by :gh-user:WyattBlue (:issue:2156).
• Use FFmpeg 8.1.2 in the binary wheels by :gh-user:WyattBlue.
• Expose sw_format on VideoCodecContext, and allow configuring the software format of hardware encoders by :gh-user:WyattBlue.
• Add options parameter to AudioResampler for passing libswresample options (e.g. resampler, filter_size, cutoff) by :gh-user:WyattBlue (:issue:2262).
• Support yuv420p10le in VideoFrame.to_ndarray and VideoFrame.from_ndarray by :gh-user:WyattBlue (:issue:1981).
• Add at parameter to Graph.push and Graph.vpush to push a frame to a single buffer source by index, for multi-input filters like overlay by :gh-user:WyattBlue.
• find_best_pix_fmt_of_list now returns the loss as a PixFmtLoss enum.IntFlag instead of a plain int by :gh-user:WyattBlue (:issue:2300).
• Add Colorspace.BT2020 by :gh-user:mark-oshea.
• BitStreamFilterContext now accepts a Codec or a codec-name str as in_stream to pin the input codec without a full Stream by :gh-user:WyattBlue.

Fixes:

... (truncated)

Commits

• 7e3d950 Release 18.1.0
• 842955f Changelog entries missed since 18.0.0
• fdb4ce4 Add InputContainer.start_time_realtime, closes #2365
• b9ef85f Forward encoder options from VideoFrame.save()
• f711ab6 Disable avx-512 in build-deps
• 883642e Test with ffmpeg 9.0
• b35726c FFmpeg 9.0 reorders AVCodecID
• f6f0a5e Avoid probing primary context flags for no reason
• 387fca5 Support explicit CUDA streams
• 32e9f7d Refresh installation documentation
• Additional commits viewable in compare view

Updates django-health-check to 4.5.0

Release notes

Sourced from django-health-check's releases.

4.5.0

What's Changed

• Fix #758 -- Support Django 6.1 MAILERS setting in Mail health check by @​codingjoe in codingjoe/django-health-check#759

Full Changelog: codingjoe/django-health-check@4.4.4...4.5.0

Commits

• 2181b6f Fix #758 -- Support Django 6.1 MAILERS setting in Mail health check (#759)
• b71b988 [pre-commit.ci] pre-commit autoupdate
• See full diff in compare view

Updates django-tailwind-cli to 4.7.0

Release notes

Sourced from django-tailwind-cli's releases.

v4.7.0

🎯 New Features

• Django 6.1 support: added to the test matrix and the trove classifiers.

🛠️ Developer Experience

• Switch dev tooling from just to mise: Python 3.10–3.15, uv, and pre-commit are now pinned in mise.toml. Local tasks run via mise run …; CI uses jdx/mise-action.

📚 Documentation

• Plainer README: dropped the emoji headings and marketing register, and merged the overlapping feature sections into one. Same coverage, ~20% shorter.
• Accurate tailwind setup help: --help no longer calls the command interactive. It lists the eight checks it actually runs and notes that it prompts for nothing.

🔧 Technical Improvements

• Dependency refresh: clears the advisories uv-secure flagged in the old lock. pytest-django 4.14 renamed SettingsWrapper to Settings, so the dev floor moved to 4.14.

Changelog

Sourced from django-tailwind-cli's changelog.

4.7.0 (2026-08-15)

🎯 New Features

• Django 6.1 support: added to the test matrix and the trove classifiers.

🛠️ Developer Experience

• Switch dev tooling from just to mise: Python 3.10–3.15, uv, and pre-commit are now pinned in mise.toml. Local tasks run via mise run …; CI uses jdx/mise-action.

📚 Documentation

• Plainer README: dropped the emoji headings and marketing register, and merged the overlapping feature sections into one. Same coverage, ~20% shorter.
• Accurate tailwind setup help: --help no longer calls the command interactive. It lists the eight checks it actually runs and notes that it prompts for nothing.

🔧 Technical Improvements

• Dependency refresh: clears the advisories uv-secure flagged in the old lock. pytest-django 4.14 renamed SettingsWrapper to Settings, so the dev floor moved to 4.14.

4.6.2 (2026-05-14)

🛠️ Developer Experience

• Python 3.15 support: Added py315 to the tox matrix (Django 6.0) and to the PyPI classifiers.

4.6.1 (2026-05-10)

🐛 Bug Fixes

• tailwind watch crash with TAILWIND_CLI_CSS_MAP: MultiWatchProcessManager installed signal.signal handlers that fail with ValueError: signal only works in main thread of the main interpreter under Django's autoreloader (the watch loop runs in a worker thread). Cleanup now relies on KeyboardInterrupt propagation, matching the single-entry path. Fixes #201.
• SIGTERM-graceful shutdown for both watch managers: ProcessManager and MultiWatchProcessManager now install a SIGTERM handler only when running on the main thread, so kill -TERM cleans up child watchers in tailwind watch --noreload and tailwind runserver without re-introducing the autoreloader crash. SIGINT keeps using Python's default handler (which raises KeyboardInterrupt).
• Sidestepped a Bun DLOPEN race in multi-entry watch: MultiWatchProcessManager now staggers successive watcher subprocess spawns by 300 ms. The Bun-built tailwindcss standalone binary extracts its embedded @parcel/watcher native module to /$bunfs/ on first use; two parallel processes raced on that path and the loser crashed with ERR_DLOPEN_FAILED. The 300 ms gap is below noticeable in interactive use.

🛠️ Developer Experience

• Filtered Bun native-runtime noise from watcher stderr: MultiWatchProcessManager captures each tailwindcss subprocess' stderr and drops upstream Bun stack traces (EIO: i/o error on shutdown, ERR_DLOPEN_FAILED on the rare DLOPEN race) while forwarding Tailwind's own diagnostics verbatim. Cleanup output stays clean even when the user kill -TERMs the runserver.

🔧 Technical Improvements

• Hardened GitHub Actions workflows: pinned all actions to commit SHAs, scoped top-level permissions, added concurrency groups, moved github.ref_name / github.repository out of shell interpolation into env: vars, and added a zizmor audit job to keep workflow security regressions out of CI.

4.6.0 (2026-04-11)

💥 Breaking Changes

• Removed list_templates command: Tailwind CSS 4.x handles template discovery via @source directives in your CSS source file, making this command redundant. If you need to enumerate templates programmatically, use Django's django.template.utils.get_app_template_dirs() directly.

🎯 New Features

• Configurable minification: New TAILWIND_CLI_AUTOMATIC_MINIFY setting and --minify / --no-minify flag on tailwind build for projects whose asset pipelines already minify CSS. Defaults preserve existing behavior.
• System binary support: New TAILWIND_CLI_USE_SYSTEM_BINARY setting lets django-tailwind-cli use a Tailwind CSS CLI that is already installed on PATH (e.g. via Homebrew), skipping the auto-download. Pairs with optional TAILWIND_CLI_SYSTEM_BINARY_NAME override. Emits a warning if the installed binary's version differs from an explicitly pinned TAILWIND_CLI_VERSION.
• Auto @source for editable external apps (opt-in): New TAILWIND_CLI_AUTO_SOURCE_EXTERNAL_APPS setting (default False). When enabled, the auto-generated default source CSS receives one @source directive per installed Django app whose path lives outside both BASE_DIR and site-packages — typically editable-installed packages that ship their own templates. This removes the need for fragile @source "../../../../../..." workarounds. Addresses #187.
• Watch mode auto-reload: python manage.py tailwind watch now runs under Django's own auto-reloader (the same machinery runserver uses). Changing settings.py or any Python file restarts the watch process, regenerates the source CSS (picking up new INSTALLED_APPS), and restarts the Tailwind CLI subprocess. Pass --noreload to disable.

🛠️ Developer Experience

• Gitignore cleanup: Trimmed .gitignore to project-relevant entries only
• Managed .django_tailwind_cli/ is now git-ignored by default: On first use the directory gets a .gitignore containing *, so the downloaded CLI binary and the auto-generated source.css are silently skipped by git add . without any project-level .gitignore tweak from the user. Existing .gitignore files in that directory are preserved. No-op when TAILWIND_CLI_PATH points at a custom location.

🐛 Bug Fixes

• Tox matrix: Django 4.2/5.2/6.0 factors in tox.ini were ignored because uv sync --locked reinstalled Django from uv.lock after tox's deps. The matrix now excludes Django from the sync and installs the factor-specific version via commands_pre, so just test-all actually covers all supported Django versions.

... (truncated)

Commits

• 0769c52 chore(release): prepare 4.7.0
• 7b980c8 chore: rename .mise.toml to mise.toml
• 237c729 docs: correct what tailwind setup claims to do
• 8c69463 docs: rewrite README in a plainer register
• 3665b31 chore(ci): move dev tooling to mise, add Django 6.1, refresh deps
• fb52c4b chore(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#216)
• 3873299 chore(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#218)
• cf8e8fd chore(deps): bump zizmorcore/zizmor-action from 0.6.0 to 0.6.2 (#219)
• efbdef9 chore(deps): bump sigstore/gh-action-sigstore-python from 3.4.0 to 3.5.0 (#220)
• d30d1e7 chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#215)
• Additional commits viewable in compare view

Updates gunicorn to 26.1.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.1.0

New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [ are treated as patterns, so ui/*/config.json watches every view's config without listing them one by one. Patterns are re-expanded on every reload check rather than once at startup, so a file created later starts being watched without restarting gunicorn, and ** recurses. A pattern matching nothing warns instead of failing, since with live expansion it may match later (#1643, #3662).

Security

• Dependency floors raised past known advisories: every declared floor was checked against the advisory database. tornado, h2, setuptools and pymdown-extensions permitted vulnerable versions and now require the first clean release; pytest and httpx were unpinned and now carry floors. The tornado example pinned tornado<6, which was both the source of several advisories and older than the >=6.5.0 the tornado worker needs, so the example could not run as pinned.

Bug Fixes

• SIGHUP did not reload the logger configuration: Arbiter.reload() re-read the configuration file but kept using the logger built at startup, calling only reopen_files() on its existing handlers. Changes to logconfig, logconfig_dict, logconfig_json and loglevel were ignored until a full restart, which in containers meant replacing the pod. The existing logger now re-runs its setup on reload, so new handlers, formats and levels take effect while the process identity and its listeners are preserved, and re-running the setup no longer stacks duplicate syslog handlers. An invalid log configuration on reload is not fatal either: the error is reported on stderr, the previous working configuration is restored and the master keeps running with it (#3353).

• Truncated chunked bodies accepted: RFC 9112 section 7.1.2 ends a chunked body with 0 CRLF CRLF, the second CRLF being the mandatory empty trailer section. ChunkedReader.parse_chunk_size() swallowed the NoMoreData raised while scanning for it, so a body cut short right after the last chunk line was treated as complete instead of rejected. It now raises ChunkMissingTerminator (#3382, #3685).

• --spew crashed on dynamically generated code: the trace hook indexed the 2-tuple returned by inspect.getsourcelines() by line number rather than indexing the list of lines, so a frame with no __file__ raised AttributeError: 'int' object has no attribute 'rstrip' on line 1 and

... (truncated)

Commits

• 71b59a7 Merge pull request #3698 from benoitc/fix/docker-health-check-readerror
• 48287de test: catch every transport error in the docker health check
• 3110e8c Merge pull request #3696 from benoitc/docs/roadmap
• cc56c41 Merge pull request #3693 from benoitc/release/26.1.0
• 5cf1f16 docs: surface the roadmap on the site home page
• 7e35f72 docs: add FastCGI to the roadmap and point items at Ideas
• 18ddc58 docs: drop the framework and reverse-proxy non-goals from the roadmap
• 1ecae56 docs: add a roadmap and make the chat easy to find
• ca412e3 docs: sync the Latest changelog page with 26.1.0
• 640936f docs: note the dependency security work in 26.1.0
• Additional commits viewable in compare view

Updates ruff to 0.16.3

Release notes

Sourced from ruff's releases.

0.16.3

Release Notes

Released on 2026-08-13.

Preview features

• [pylint] Fix false negatives on negative numbers (PLR6104) (#27251)
• [pyupgrade] Add rule to replace while 1 with while True (UP048) (#27190)

Bug fixes

• [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#27687)
• [pylint] Allow continue in finally on Python 3.8 (#27626)
• [pylint] Fix PLE1307 false positive with bools (#27651)
• [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#27560)
• [pylint] Improve handling of concatenated strings (PLE1300) (#27659)

Rule changes

• [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#27527)

Performance

• Enable PGO for Linux x86-64 Ruff releases (#27570)
• Enable PGO for Linux ARM64 Ruff releases (#27574)
• Enable PGO for Windows x86-64 Ruff releases (#27573)
• Enable PGO for macOS ARM64 Ruff releases (#27572)
• Reduce Expr size to 64 bytes (#27591)

CLI

• Hyperlink rule codes in ruff check --statistics output (#27646)

Documentation

• [ruff] Also suggest asyncio.TaskGroup (RUF006) (#27461)

Other changes

• Use mimalloc v3 (#27586)

Contributors

• @​Andrej730
• @​alonfaraj
• @​romero-deshaw
• @​Avasam
• @​tjkuson
• @​charliermarsh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.3

Released on 2026-08-13.

Preview features

• [pylint] Fix false negatives on negative numbers (PLR6104) (#27251)
• [pyupgrade] Add rule to replace while 1 with while True (UP048) (#27190)

Bug fixes

• [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#27687)
• [pylint] Allow continue in finally on Python 3.8 (#27626)
• [pylint] Fix PLE1307 false positive with bools (#27651)
• [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#27560)
• [pylint] Improve handling of concatenated strings (PLE1300) (#27659)

Rule changes

• [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#27527)

Performance

• Enable PGO for Linux x86-64 Ruff releases (#27570)
• Enable PGO for Linux ARM64 Ruff releases (#27574)
• Enable PGO for Windows x86-64 Ruff releases (#27573)
• Enable PGO for macOS ARM64 Ruff releases (#27572)
• Reduce Expr size to 64 bytes (#27591)

CLI

• Hyperlink rule codes in ruff check --statistics output (#27646)

Documentation

• [ruff] Also suggest asyncio.TaskGroup (RUF006) (#27461)

Other changes

• Use mimalloc v3 (#27586)

Contributors

• @​Andrej730
• @​alonfaraj
• @​romero-deshaw
• @​Avasam
• @​tjkuson
• @​charliermarsh
• @​chirizxc

... (truncated)

Commits

• b0e4702 Bump 0.16.3 (#27723)
• ecdd401 [ty] Separate script and uv modules from project metadata (#27720)
• 1263524 [ty] Simplify display implementations with std::fmt::from_fn (#27718)
• 59196ba [ty] Unify polarity-aware relation construction (#27707)
• b8c5e73 [ty] Disable CodSpeed cycle estimation for instrumented benchmarks (#27706)
• 2b0d210 [ty] Centralize matched argument relations (#27705)
• a9130f3 [pyupgrade] Add rule to replace while 1 with while True (while-one, `...
• c64c7d6 [ty] Model try exception flow with operation checkpoints (#27471)
• 9dea5ef [ty] Avoid deriving sequents for typevars with concrete bounds (#27587)
• 9798e88 [ty] Preserve enum exhaustiveness with custom missing methods (#27700)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions