From 73783f938277737dd3e21c907bfbe196b550fb1a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 11:23:24 +0000 Subject: [PATCH 1/6] Bump imagesize from 2.0.0 to 2.0.1 (#13567) Bumps [imagesize](https://github.com/shibukawa/imagesize_py) from 2.0.0 to 2.0.1.
Release notes

Sourced from imagesize's releases.

Bug fix

Related issues: shibukawa/imagesize_py#64 shibukawa/imagesize_py#83 shibukawa/imagesize_py#84

Related pull requests: shibukawa/imagesize_py#86 shibukawa/imagesize_py#87 shibukawa/imagesize_py#88 shibukawa/imagesize_py#89 shibukawa/imagesize_py#90 shibukawa/imagesize_py#91 shibukawa/imagesize_py#92

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=imagesize&package-manager=pip&previous-version=2.0.0&new-version=2.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/doc-spelling.txt | 2 +- requirements/doc.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 24f86982945..b392d836661 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -109,7 +109,7 @@ idna==3.19 # requests # trustme # yarl -imagesize==2.0.0 +imagesize==2.0.1 # via sphinx iniconfig==2.3.0 # via pytest diff --git a/requirements/dev.txt b/requirements/dev.txt index 40f1fb2ca1a..1e34f81b944 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -107,7 +107,7 @@ idna==3.19 # requests # trustme # yarl -imagesize==2.0.0 +imagesize==2.0.1 # via sphinx iniconfig==2.3.0 # via pytest diff --git a/requirements/doc-spelling.txt b/requirements/doc-spelling.txt index b76adf01d3a..b62377d7e16 100644 --- a/requirements/doc-spelling.txt +++ b/requirements/doc-spelling.txt @@ -22,7 +22,7 @@ docutils==0.21.2 # sphinx idna==3.19 # via requests -imagesize==2.0.0 +imagesize==2.0.1 # via sphinx jinja2==3.1.6 # via diff --git a/requirements/doc.txt b/requirements/doc.txt index a82e5f3c76b..5fe2d0edafc 100644 --- a/requirements/doc.txt +++ b/requirements/doc.txt @@ -22,7 +22,7 @@ docutils==0.21.2 # sphinx idna==3.19 # via requests -imagesize==2.0.0 +imagesize==2.0.1 # via sphinx jinja2==3.1.6 # via From 88da73a5fe9b3ec12d5052bbc52dbd0d6d645b00 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 11:29:56 +0000 Subject: [PATCH 2/6] Bump gunicorn from 26.1.0 to 26.2.0 (#13571) Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 26.1.0 to 26.2.0.
Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=gunicorn&package-manager=pip&previous-version=26.1.0&new-version=26.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/base-ft.txt | 2 +- requirements/base.txt | 2 +- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test-mobile.txt | 2 +- requirements/test.txt | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt index 4e243c86ed1..05eb111844f 100644 --- a/requirements/base-ft.txt +++ b/requirements/base-ft.txt @@ -26,7 +26,7 @@ frozenlist==1.8.0 # via # -r requirements/runtime-deps.in # aiosignal -gunicorn==26.1.0 +gunicorn==26.2.0 # via -r requirements/base-ft.in idna==3.19 # via yarl diff --git a/requirements/base.txt b/requirements/base.txt index 14b31ce18ad..fe468e38bc3 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -26,7 +26,7 @@ frozenlist==1.8.0 # via # -r requirements/runtime-deps.in # aiosignal -gunicorn==26.1.0 +gunicorn==26.2.0 # via -r requirements/base.in idna==3.19 # via yarl diff --git a/requirements/constraints.txt b/requirements/constraints.txt index b392d836661..1719bcc1418 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -100,7 +100,7 @@ frozenlist==1.8.0 # -r requirements/runtime-deps.in # aiohttp # aiosignal -gunicorn==26.1.0 +gunicorn==26.2.0 # via -r requirements/base.in identify==2.6.19 # via pre-commit diff --git a/requirements/dev.txt b/requirements/dev.txt index 1e34f81b944..9ce56c3637c 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -98,7 +98,7 @@ frozenlist==1.8.0 # -r requirements/runtime-deps.in # aiohttp # aiosignal -gunicorn==26.1.0 +gunicorn==26.2.0 # via -r requirements/base.in identify==2.6.19 # via pre-commit diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index 071ca517aa8..304735580de 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -59,7 +59,7 @@ frozenlist==1.8.0 # -r requirements/runtime-deps.in # aiohttp # aiosignal -gunicorn==26.1.0 +gunicorn==26.2.0 # via -r requirements/base-ft.in idna==3.19 # via diff --git a/requirements/test-mobile.txt b/requirements/test-mobile.txt index 5116d51f110..1cb597f14b4 100644 --- a/requirements/test-mobile.txt +++ b/requirements/test-mobile.txt @@ -47,7 +47,7 @@ frozenlist==1.8.0 # -r requirements/runtime-deps.in # aiohttp # aiosignal -gunicorn==26.1.0 +gunicorn==26.2.0 # via -r requirements/base-ft.in idna==3.19 # via yarl diff --git a/requirements/test.txt b/requirements/test.txt index ff2303ad5eb..934575f3dd6 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -59,7 +59,7 @@ frozenlist==1.8.0 # -r requirements/runtime-deps.in # aiohttp # aiosignal -gunicorn==26.1.0 +gunicorn==26.2.0 # via -r requirements/base.in idna==3.19 # via From 2677660835e7bfeeb89b8f8c81f1669f6f90f4ed Mon Sep 17 00:00:00 2001 From: Sam Bull Date: Fri, 28 Aug 2026 16:32:19 +0100 Subject: [PATCH 3/6] Fix flaky benchmark test (#13565) --- aiohttp/helpers.py | 44 +++++++++++++++++++++--------- tests/test_benchmarks_multipart.py | 13 +++++++-- 2 files changed, 42 insertions(+), 15 deletions(-) diff --git a/aiohttp/helpers.py b/aiohttp/helpers.py index 04354988efd..e6d6b6ca1ca 100644 --- a/aiohttp/helpers.py +++ b/aiohttp/helpers.py @@ -69,33 +69,51 @@ DEFAULT_CHUNK_SIZE = 2**18 # 256 KiB COOKIE_MAX_LENGTH = 4096 _QUOTED_PAIR_SUB = re.compile(r"\\(.)") -_QUOTED_STRING = r'"(?:[^"\\]|\\.)*"' -_ESCAPED_COMMENT = r"(?:[^()\\]|\\.)*" -# Matches one element in a comma-separated header list. -# Group 1: content of a top-level quoted-string (quotes stripped). -# Group 2: an unquoted element (may contain parameter quoted-strings / comments). -_LIST_ELEMENT_RE = re.compile( - rf""" +if sys.version_info >= (3, 11): + _QUOTED_STRING_CONTENT = r'(?:[^"\\]++|\\.)*+' + _ESCAPED_COMMENT = r"(?:[^()\\]++|\\.)*+" + _LIST_ELEMENT = rf""" [ \t]* (?: - "( (?:[^"\\]|\\.)* )" # group 1: top-level quoted-string + "( {_QUOTED_STRING_CONTENT} )" # group 1: top-level quoted-string [ \t]* (?:,|\Z) | ( # group 2: unquoted element (?: - (?<=[^\s]=) {_QUOTED_STRING} # parameter quoted value + (?<=[^\s]=) "{_QUOTED_STRING_CONTENT}" # parameter quoted value + | (?<=\s) \( {_ESCAPED_COMMENT} \) # comment + | [^,"(\\]++ # run of ordinary characters + | [^,] # quote, paren or backslash the branches above rejected + )++ + ) + (?:,|\Z) + ) + """ +else: + _QUOTED_STRING_CONTENT = r'(?:[^"\\]|\\.)*' + _ESCAPED_COMMENT = r"(?:[^()\\]|\\.)*" + _LIST_ELEMENT = rf""" + [ \t]* + (?: + "( {_QUOTED_STRING_CONTENT} )" # group 1: top-level quoted-string + [ \t]* (?:,|\Z) + | ( # group 2: unquoted element + (?: + (?<=[^\s]=) "{_QUOTED_STRING_CONTENT}" # parameter quoted value | (?<=\s) \( {_ESCAPED_COMMENT} \) # comment | [^,] # any non-comma character )+? ) (?:,|\Z) ) - """, - re.VERBOSE, -) + """ +# Matches one element in a comma-separated header list. +# Group 1: content of a top-level quoted-string (quotes stripped). +# Group 2: an unquoted element (may contain parameter quoted-strings / comments). +_LIST_ELEMENT_RE = re.compile(_LIST_ELEMENT, re.VERBOSE) # Finds parameter quoted-strings and comments inside an unquoted element for unescaping. _PROTECTED_RE = re.compile( rf""" - (?<=[^\s]=) {_QUOTED_STRING} # parameter quoted-string + (?<=[^\s]=) "{_QUOTED_STRING_CONTENT}" # parameter quoted-string | (?<=\s) \( {_ESCAPED_COMMENT} \) # comment """, re.VERBOSE, diff --git a/tests/test_benchmarks_multipart.py b/tests/test_benchmarks_multipart.py index 6c82aacbcb1..c6c4b24ae3c 100644 --- a/tests/test_benchmarks_multipart.py +++ b/tests/test_benchmarks_multipart.py @@ -48,17 +48,26 @@ def _part(body: bytes, loop: asyncio.AbstractEventLoop) -> BodyPartReader: def test_read_base64_part( event_loop: asyncio.AbstractEventLoop, benchmark: BenchmarkFixture ) -> None: - """Read a line-wrapped base64 part to completion. + """Read a line-wrapped base64 part to completion chunk by chunk. Every 8 KiB chunk lands mid-quartet, so this covers the common cost of the base64 realignment in ``read_chunk`` on well-formed input. + + The chunks are deliberately dropped rather than accumulated: growing one + large buffer inside the measured region made the measurement depend on + whether realloc could extend it in place -- allocator luck, which showed + up as double-digit swings between unrelated CodSpeed runs. """ body = base64.encodebytes(b"x" * (256 * 1024)).replace(b"\n", b"\r\n") body += b"\r\n--:--" + async def read_all_chunks(part: BodyPartReader) -> None: + while not part.at_eof(): + await part.read_chunk(BodyPartReader.chunk_size) + @benchmark def _run() -> None: - event_loop.run_until_complete(_part(body, event_loop).read()) + event_loop.run_until_complete(read_all_chunks(_part(body, event_loop))) def test_read_chunk_base64_realignment( From 28b297b5aa36ea26f2813ba93298889c546d4178 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 15:51:42 +0000 Subject: [PATCH 4/6] Bump platformdirs from 4.11.3 to 4.11.4 (#13573) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.3 to 4.11.4.
Release notes

Sourced from platformdirs's releases.

4.11.4

What's Changed

Full Changelog: https://github.com/tox-dev/platformdirs/compare/4.11.3...4.11.4

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.5 (2026-08-27)

  • Give :func:~platformdirs.user_preference_dir and :func:~platformdirs.user_preference_path the same arguments as :func:~platformdirs.user_config_dir. Added without arguments in :pr:491, they could only return the unscoped base directory even though the property they wrap appends the app name and version. :pr:531
  • Make :func:~platformdirs.site_applications_path return the first entry when multipath=True, matching :func:~platformdirs.site_data_path. On Unix and macOS it passed the whole $XDG_DATA_DIRS list to :class:~pathlib.Path, giving one unusable path such as /first/applications:/second/applications. :pr:532
  • Give :func:~platformdirs.user_applications_dir, :func:~platformdirs.user_applications_path, :func:~platformdirs.site_applications_dir and :func:~platformdirs.site_applications_path the app arguments. Android scopes both applications directories to the app, so without them the functions could only return the unscoped base directory there. On the two site functions they are keyword-only, keeping multipath first positional as it has been since 4.9.0; the two user functions take their boolean options keyword-only. :pr:534
  • Correct the ordering note on the iterator methods. use_site_for_root drops the user directory entirely, so the iterators are documented as yielding the most specific directory first rather than always yielding the user one. :pr:533

4.11.4 (2026-08-24)

  • Stop the iter_*_dirs methods yielding the same directory twice when a site directory resolves to its user equivalent - :pr:520 covered only Unix with use_site_for_root. It also hit :meth:~platformdirs.PlatformDirs.iter_runtime_dirs on Unix with $XDG_RUNTIME_DIR set, on Windows and macOS, and all six iterators on Android. :pr:524
  • Fix the config merging example in the how-to guide. iter_config_paths yields the user directory first, so the config.update loop let the site defaults override the user's config instead of the other way round. :pr:529

4.11.3 (2026-08-13)

  • python -m platformdirs now lists :func:~platformdirs.user_desktop_dir, which was missing from the properties it prints. :pr:523
  • Stop :func:~platformdirs.site_data_dir, :func:~platformdirs.site_config_dir and :func:~platformdirs.site_applications_dir raising IndexError on Unix and macOS when $XDG_DATA_DIRS or $XDG_CONFIG_DIRS holds only separators and whitespace, such as ":". These values now fall back to the platform defaults, and each entry is stripped of surrounding whitespace. :pr:523

4.11.2 (2026-08-10)

... (truncated)

Commits
  • e5fd9ea Release 4.11.4
  • 4bf9228 docs: fix merge order in the config how-to (#529)
  • c653668 fix: stop iter_*_dirs yielding the same directory twice (#524)
  • f18ebaf 🔧 chore: batch dependency updates weekly on Tuesday (#528)
  • b2f29d8 build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 in the all group (...
  • 272f340 build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 in the all group (#...
  • d3cf61c [pre-commit.ci] pre-commit autoupdate (#525)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=platformdirs&package-manager=pip&previous-version=4.11.3&new-version=4.11.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 1719bcc1418..0d57a20c527 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -166,7 +166,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.3 +platformdirs==4.11.4 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 9ce56c3637c..94fd848ad5b 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -163,7 +163,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.3 +platformdirs==4.11.4 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index 9ec4e344732..25b72d475d5 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -84,7 +84,7 @@ packaging==26.3 # via pytest pathspec==1.1.1 # via mypy -platformdirs==4.11.3 +platformdirs==4.11.4 # via virtualenv pluggy==1.6.0 # via pytest From 963971147a57b5a23559835fec094c8babcca62f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 15:54:24 +0000 Subject: [PATCH 5/6] Bump virtualenv from 21.7.4 to 21.7.5 (#13570) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.4 to 21.7.5.
Release notes

Sourced from virtualenv's releases.

21.7.5

What's Changed

New Contributors

Full Changelog: https://github.com/pypa/virtualenv/compare/21.7.4...21.7.5

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.5

  • Fix the type check against python-discovery 1.5.2, whose annotations allow a None prefix and integer sysconfig_vars values: config var substitution now skips a missing prefix and locating the shared libpython requires string INSTSONAME/LIBDIR values. (:issue:3211)
  • ExePathRef.can_run now checks the group and other execute bits instead of only the owner one, and returns False rather than None when a file carries none of the three - by :user:darrenhuai. (:issue:3217)
  • safe_delete no longer passes ignore_errors=True to shutil.rmtree, which replaced its own chmod-and-retry handler with a no-op and swallowed every failure. Read-only files - every file in a wheel image, which set_tree marks - survived, so --reset-app-data and --clear kept trees they reported deleting. The handler now retries only the deletion itself, keeps the other mode bits, and raises the original error for anything it cannot clear - by :user:darrenhuai. (:issue:3222)

v21.7.4 (2026-08-10)

Commits
  • 2a645ae release 21.7.5
  • a48bf4b 🐛 fix(util): make safe_delete's error handler actually run (#3222)
  • 31b5081 🐛 fix(create): check every execute bit in ExePathRef.can_run (#3217)
  • 5640eef [pre-commit.ci] pre-commit autoupdate (#3221)
  • 1ebcab6 docs: actualize python support version (#3220)
  • eb241a0 🔧 chore: batch dependency updates weekly on Tuesday (#3219)
  • 9534eda chore(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#3218)
  • c8c4285 chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#3215)
  • ea806db [pre-commit.ci] pre-commit autoupdate (#3214)
  • a21130f Push renamed changelog to PR branch in upgrade workflow (#3213)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=virtualenv&package-manager=pip&previous-version=21.7.4&new-version=21.7.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 0d57a20c527..c8126004e6c 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -331,7 +331,7 @@ uvloop==0.22.1 ; platform_system != "Windows" # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.4 +virtualenv==21.7.5 # via pre-commit wheel==0.48.0 # via pip-tools diff --git a/requirements/dev.txt b/requirements/dev.txt index 94fd848ad5b..0e6d85975f6 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -321,7 +321,7 @@ uvloop==0.22.1 ; platform_system != "Windows" and implementation_name == "cpytho # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.4 +virtualenv==21.7.5 # via pre-commit wheel==0.48.0 # via pip-tools diff --git a/requirements/lint.txt b/requirements/lint.txt index 25b72d475d5..8e5087580bf 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -164,7 +164,7 @@ uvloop==0.22.1 ; platform_system != "Windows" # via -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.4 +virtualenv==21.7.5 # via pre-commit yarl==1.24.5 # via aiohttp From 14a1b5427213b5b982922627a44e4c5ae23bc0e3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 15:56:55 +0000 Subject: [PATCH 6/6] Bump python-discovery from 1.5.2 to 1.5.3 (#13569) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.5.2 to 1.5.3.
Release notes

Sourced from python-discovery's releases.

v1.5.3

What's Changed

New Contributors

Full Changelog: https://github.com/tox-dev/python-discovery/compare/1.5.2...1.5.3

Changelog

Sourced from python-discovery's changelog.

Bug fixes - 1.5.3

  • Restore discovery of Python 3.6 and 3.7 interpreters: the interrogation script had grown 3.8-only syntax and is now kept to Python 3.6. Candidates below 3.6 log one warning naming the version found instead of two debug-level query attempts, and the verdict is cached so they are queried only once; an absolute-path spec for one raises RuntimeError with the same message - by :user:gaborbernat. (:issue:116)
  • Prefer the version-matched system executable when CPython reports an existing generic executable for a copied POSIX virtual environment. (:issue:124)

Improved documentation - 1.5.3

  • Document the version floors: runs on Python 3.8+, discovers interpreters down to 3.6 - by :user:gaborbernat. (:issue:116)

v1.5.1 (2026-07-31)

Bug fixes - 1.5.1

  • Locate uv's interpreter store the way uv does, using XDG on macOS (~/.local/share/uv/python) and roaming %APPDATA%\uv\python on Windows, neither of which platformdirs reported. The uv variables now come from the env mapping rather than os.environ - by :user:gaborbernat. (:issue:109)
  • Pick uv-managed interpreters by install directory name instead of globbing the store. A bare 3.8 now means CPython, the way uv resolves it, rather than whichever implementation the filesystem happened to list first, and probing runs newest version first - by :user:gaborbernat. (:issue:110)

Packaging updates and notes for downstreams - 1.5.1

  • Drop the platformdirs runtime dependency; locating uv's store was the only thing it did - by :user:gaborbernat. (:issue:109)

v1.5.0 (2026-07-21)

Packaging updates and notes for downstreams - 1.5.0

  • Declare support for Python 3.15 and run the test suite against it, currently in beta. (:issue:104)

v1.4.4 (2026-07-08)

Bug fixes - 1.4.4

  • Parse the debug build flag in interpreter specs - python3.13d and Debian's python3.13-dbg / python3.13-debug now select a Py_DEBUG interpreter instead of being misread as an ISA named dbg. Resolving a virtualenv to its base interpreter also checks the free-threaded and debug ABI flags, so a debug or free-threaded environment no longer resolves to a release build of the same version - by :user:gaborbernat. (:issue:96)

... (truncated)

Commits
  • a451887 release 1.5.3
  • ba973b4 🔧 chore: batch dependency updates weekly on Tuesday (#125)
  • 4d85746 🐛 fix(py_info): prefer exact base Python
  • 8ca46d5 build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#123)
  • 67cbc06 build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#122)
  • d86823b [pre-commit.ci] pre-commit autoupdate (#121)
  • b30753a Avoid passing a non-Collection iterable to parametrize (#120)
  • e87c2c6 📄 docs: publish llms.txt from the docs build (#118)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python-discovery&package-manager=pip&previous-version=1.5.2&new-version=1.5.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index c8126004e6c..d228c63b9af 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -235,7 +235,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.5.2 +python-discovery==1.5.3 # via virtualenv python-on-whales==0.81.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 0e6d85975f6..e33a94873dd 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -230,7 +230,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.5.2 +python-discovery==1.5.3 # via virtualenv python-on-whales==0.81.0 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index 8e5087580bf..041f3c5094c 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -125,7 +125,7 @@ pytest-mock==3.15.1 # via -r requirements/lint.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.5.2 +python-discovery==1.5.3 # via virtualenv python-on-whales==0.81.0 # via -r requirements/lint.in