Bump the python-requirements group with 10 updates

[dependabot]

Updates the requirements on aiohttp, cachetools, markdownify, mistune, regex, sentry-sdk[pure-eval], yarl, ruff, setuptools and setuptools-scm to permit the latest version.
Updates aiohttp from 3.14.1 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

• Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

  Related issues and pull requests on GitHub: :issue:13180.

• Fixed error message construction in the C HTTP parser -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:13222.

---

3.14.2 (2026-07-20)

Bug fixes

• Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

  Related issues and pull requests on GitHub: :issue:5303.

• Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

  Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

• 5e392ce Release v3.14.3 (#13225)
• 49f65d5 [PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...
• 240099e [PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...
• d93f30a Bump version (#13202)
• c1b9212 Release v3.14.2 (#13201)
• 380d4b5 [PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...
• e1e1bee Make llhttp method array size dynamic (#13174) (#13196)
• aa4cf29 [PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...
• 71b57b4 [PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...
• 64a03fb [PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...
• Additional commits viewable in compare view

Updates cachetools from 7.1.4 to 7.1.6

Changelog

Sourced from cachetools's changelog.

v7.1.6 (2026-07-24)

• Minor style improvements to keep ruff happy.

v7.1.5 (2026-07-23)

• Fix TLRUCache silently keeping stale values on expired overwrites.

• Reject negative cache item getsizeof values.

• Update build environment.

Commits

• 13bb86a Minor style improvements to keep ruff happy.
• e2250be Fix RTD version handling.
• 0d2a6ea Release v7.1.5.
• d64cf80 Prepare v7.1.5.
• fcbb0de Fix #406: Merge branch 'gaoflow-fix-tlru-overwrite-expired-stale-value' into ...
• c0fdf6a Fix TLRUCache silently keeping stale value on expired overwrite
• 978d34d Bump actions/setup-python from 6.2.0 to 6.3.0
• d5c7eea Reject negative cache item sizes
• 578e976 Update build environment.
• e164b70 Bump codecov/codecov-action from 6.0.0 to 7.0.0
• Additional commits viewable in compare view

Updates markdownify from 1.2.2 to 1.2.3

Release notes

Sourced from markdownify's releases.

1.2.3

What's Changed

• fix: allow None to be used for strip_pre and warp_width params in types by @​G-Rath in matthewwithanm/python-markdownify#257
• fix: preserve text nested inside <br> by html.parser (#244) by @​gaoflow in matthewwithanm/python-markdownify#264

New Contributors

• @​gaoflow made their first contribution in matthewwithanm/python-markdownify#264

Full Changelog: matthewwithanm/python-markdownify@1.2.2...1.2.3

Commits

• 9341855 Merge branch 'develop'
• bc98c9e bump to version v1.2.3
• dd5728e fix: preserve text nested inside <br> by html.parser (#264)
• 0b359c0 fix: allow None to be used for strip_pre and warp_width params in types...
• See full diff in compare view

Updates mistune from 3.3.2 to 3.3.4

Release notes

Sourced from mistune's releases.

v3.3.4

   🐞 Bug Fixes

• Improve parsing for edge cases  -  by @​lepture (53412)
• Improve inline parser by learning from wenmode  -  by @​lepture (37bb7)
• Prevent deep alt parsing  -  by @​lepture (b77ee)
• def_list: A tab after the ':' marker no longer makes the definition a code block  -  by @​chuenchen309 and Claude Opus 4.8 (7aa49)
• table: Reject a non-delimiter second row instead of eating it  -  by @​chuenchen309 and Claude Opus 4.8 (86f9f)

   🏎 Performance

• Optimize inline edge-case parsing  -  by @​lepture (b4dd3)

    View changes on GitHub

v3.3.3

   🐞 Bug Fixes

• Set prev token in render_list_item and add block_text to ignore_blocks  -  by @​gaoflow in lepture/mistune#456 (0799e)
• Improve nested bracket link input  -  by @​lepture (fe02f)
• Escape literal emphasis markers in MarkdownRenderer  -  by @​Sanjays2402 (b0429)
• Use SAFE_PROTOCOLS instead of HARMFUL_PROTOCOLS  -  by @​lepture (4009f)
• Add max_emphasis_depth  -  by @​lepture (0938f)
• Add image max depth  -  by @​lepture (cca5e)
• inline: Use original run length in emphasis multiple-of-3 rule  -  by @​greymoth-jp and Claude Opus 4.8 (1M context) (2d26b)

   🏎 Performance

• Improve link label parsing performance  -  by @​lepture (e001d)
• Improve performance for math and formatting plugins  -  by @​lepture (c2228)
• Improve for footnotes, ruby and spoiler  -  by @​lepture (ae7e9)

    View changes on GitHub

Changelog

Sourced from mistune's changelog.

Version 3.3.4

Released on Jul 22, 2026

• Harden inline parsing against deeply nested and adversarial link, image, emphasis, formatting, math, and reference inputs.
• Improve performance for repeated link suffixes, dense emphasis, unclosed formatting markers, inline spoilers, and adjacent ruby tokens.
• Refactor the inline parser into dedicated emphasis and link modules.
• Escape literal */_ emphasis markers in the Markdown renderer so round-tripping escaped text does not re-introduce emphasis.

Version 3.3.3

Released on Jul 9, 2026

• Limit deeply nested emphasis and image parsing to avoid RecursionError.
• Fix repeated link suffix and unclosed formatting marker performance issues.
• Fix unclosed inline spoiler performance issues.
• Avoid recursive parsing for adjacent ruby tokens.
• Speed up footnote reference indexing.

Commits

• 69ec2b8 chore: release 3.3.4
• 234aa25 test: more deadline for pypy
• b77ee58 fix: prevent deep alt parsing
• 66b2171 refactor: expose entity boundary helper
• 30ef44b refactor: move link token construction
• 3066209 refactor: require explicit emphasis depth
• 0396492 refactor: split inline parser modules
• 80b3e85 refactor: isolate inline parser state bounds
• 7b0194c test: cover inline performance edge cases
• b4dd328 perf: optimize inline edge-case parsing
• Additional commits viewable in compare view

Updates regex from 2026.6.28 to 2026.7.19

Changelog

Sourced from regex's changelog.

Version: 2026.7.19

Git issue 607: SIGSEGV: NULL pointer dereference in `basic_match()` when `(?R)`/`(?0)` recursion is used inside a fuzzy-matching quantifier
Git issue 608: SIGSEGV: out-of-bounds read in `bytes1_char_at()` with `DOTALL` + a fuzzy constraint + `(?r)` reverse-direction matching

Version: 2026.7.10

Clarified that the POSIX flag makes it look for only the longest overall match.
Git issue 606: regex's compiled-pattern cache eviction is not free-threading-safe

Version: 2026.6.28

Git issue 604: regex fails on free-threading python because setlocale is not thread-safe

Version: 2026.5.9

Reverse matching with full unicode casefolding could lead to out-of-range string indexes.

Version: 2026.4.4

A fix for older Python versions before free-threading was  supported.

Version: 2026.4.3

More fixes for free-threading.

Version: 2026.3.32

Fixed segfault.

Version: 2026.3.31

Fixed bug again.

Version: 2026.3.30

Fixed bug.

Version: 2026.3.28

Fixed version.

Version: 2026.3.27

Various fixes, including ones to improve free-threading support.

Version: 2026.2.28

Replaced atomic operations with mutex on pattern object for free-threaded Python.

... (truncated)

Commits

• 0525aff Git issue 608: SIGSEGV: out-of-bounds read in bytes1_char_at() with `DOTALL...
• 07dfa3b Git issue 607: SIGSEGV: NULL pointer dereference in basic_match() when `(?R...
• e7716da Python 3.15 not released yet.
• e204ddb Git issue 606: regex's compiled-pattern cache eviction is not free-threadin...
• d7e1927 Updated main.yml for Python 3.15.
• See full diff in compare view

Updates sentry-sdk[pure-eval] to 2.66.1

Release notes

Sourced from sentry-sdk[pure-eval]'s releases.

2.66.1

Bug Fixes 🐛

Tracing

• Handle exceptions raised within traces_sampler and other callbacks by @​ericapisani in #6853

Internal Changes 🔧

• Fix flaky decorator test by @​sl0thentr0py in #6830

Changelog

Sourced from sentry-sdk[pure-eval]'s changelog.

2.66.1

Bug Fixes 🐛

Tracing

• Handle exceptions raised within traces_sampler and other callbacks by @​ericapisani in #6853

Internal Changes 🔧

• Fix flaky decorator test by @​sl0thentr0py in #6830

2.66.0

New Features ✨

• (tracing) Promote trace_lifecycle and ignore_spans to top-level options by @​ericapisani in #6821

Bug Fixes 🐛

Tracing

• Skip child span creation in streaming path when no current span (HTTP clients) by @​sentrivana in #6811
• Skip child span creation in streaming path when no current span (task queues) by @​sentrivana in #6814
• Skip child span creation in streaming path when no current span (misc) by @​sentrivana in #6815
• Skip child span creation in streaming path when no current span (databases) by @​sentrivana in #6808
• Skip child span creation in streaming path when no current span (web frameworks) by @​sentrivana in #6810
• Skip child span creation in streaming path when no current span (django) by @​sentrivana in #6809

Internal Changes 🔧

• (logging) Fix flaky test_logging_captured_warnings by @​ericapisani in #6824
• Remove flaky no cyclic garbage test by @​alexander-alderman-webb in #6817
• Remove Claude permission settings by @​cleptric in #6806
• Move nullcontext to sentry_sdk.utils by @​sentrivana in #6805

2.65.0

New Features ✨

Huey

• Set messaging.destination.name on consumer spans by @​alexander-alderman-webb in #6779
• Set messaging.destination.name on producer spans by @​alexander-alderman-webb in #6778

Other

• (arq) Set messaging.destination.name on consumer spans by @​alexander-alderman-webb in #6767
• (dramatiq) Set messaging.destination.name on consumer spans by @​alexander-alderman-webb in #6776
• (rq) Set messaging.destination.name on consumer spans by @​alexander-alderman-webb in #6774

... (truncated)

Commits

• 653a292 Update CHANGELOG.md
• e20c226 release: 2.66.1
• 4524b65 fix(tracing): Stop setting NoOpSpan on scope in the streaming trace lifecyc...
• 2e9f26e ref(tracing): No-op and emit warning in start_transaction with the streamin...
• 3a50950 fix(tracing): handle exceptions raised within traces_sampler and other callba...
• b5171b7 ref: Use top-level trace_lifecycle and ignore_spans options in tests (#6855)
• 17e0348 ref: Use old sampling context format in span streaming (#6848)
• 2e09497 test: Add streaming tests to test_http_headers (#6785)
• 9996734 feat(tracing): Send sentry.segment.name.source instead of `sentry.span.sour...
• 00224f7 remove span streaming docs in changelog (#6831)
• Additional commits viewable in compare view

Updates yarl from 1.24.2 to 1.24.5

Changelog

Sourced from yarl's changelog.

v1.24.5

(2026-07-19)

Contributor-facing changes

• Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1806.

---

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

• Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1804.

---

v1.24.3

(2026-07-19)

... (truncated)

Commits

• 0b30cb0 Release 1.24.5 (#1807)
• 56150c8 Run the IDNA sweep test only on native Linux x86_64 (#1806)
• 515adca Release 1.24.4 (#1805)
• ab5dec2 Do not install hypothesis in the wheel-build test env (#1804)
• f9d10fb Release 1.24.3 (#1803)
• 058b7cb Test lone surrogate handling in encoded and parsed URL paths (#991)
• a181cee Update hypothesis requirement from >=6.156.4 to >=6.157.0 in /requirements (#...
• 28c1bcc Encode scheme-shaped path colon in relative-path builders (#1802)
• 51e2802 Reject hosts with Unicode default-ignorable code points (#1801)
• 3921a73 Drop lone surrogates that split a percent escape in the Cython quoter (#1752)
• Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Updates setuptools to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

• Require Python 3.10 or later.

Bugfixes

• MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

• pypa/distutils#334

v82.0.1

Bugfixes

• Fix the loading of launcher manifest.xml file. (#5047)
• Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

• Add advice about how to improve predictability when installing sdists. (#5168)

Misc

• #4941, #5157, #5169, #5175

v82.0.0

... (truncated)

Commits

• 6519f72 Bump version: 82.0.1 → 83.0.0
• d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
• a2df31e Capture removal of dry_run parameter in changelog.
• 00144dc Moved newsfragment to the release where it occurred.
• a4a5a2b Add news fragment.
• 77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
• 3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
• bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
• a2bc3ac Fix broken intersphinx reference to build's installation docs
• 2d6a739 Use stacked parametrize decorators instead of itertools.product
• Additional commits viewable in compare view

Updates setuptools-scm to 10.2.1

Release notes

Sourced from setuptools-scm's releases.

setuptools-scm v10.2.1

Fixed

• Omit scm_version.json and scm_file_list.json from wheel .dist-info while still including them in sdists for fallback discovery. (#1473)

Commits

• ac108b2 Merge pull request #1475 from pypa/release/main
• b3beed6 Prepare release: setuptools-scm v10.2.1
• ec67f8c Merge pull request #1474 from RonnyPfannschmidt/fix/1473-omit-scm-metadata-fr...
• 08f22bd fix: lazy-import bdist_wheel and simplify unlink
• 82768f0 fix: omit SCM egg-info JSON from wheels
• 5b91e2f Merge pull request #1460 from pypa/dependabot/uv/uv-f4f52c089d
• 4ac1724 Merge pull request #1463 from pypa/release/main
• 474cc9c Prepare release: vcs-versioning v2.2.2
• 29c8f6c Merge pull request #1462 from RonnyPfannschmidt/fix/vcs-versioning-pytest-tim...
• 25d32ee fix: add missing pytest-timeout to vcs-versioning test dependencies (#1461)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions