Bump the python-ci group across 1 directory with 6 updates by dependabot[bot] · Pull Request #40 · SecAI-Hub/SecAI_OS

dependabot · 2026-05-15T03:57:36Z

Bumps the python-ci group with 6 updates in the / directory:

Package	From	To
requests	`2.33.1`	`2.34.2`
ruff	`0.15.12`	`0.15.13`
mypy	`1.20.2`	`2.1.0`
gunicorn	`25.3.0`	`26.0.0`
types-pyyaml	`6.0.12.20260408`	`6.0.12.20260510`
types-requests	`2.33.0.20260408`	`2.33.0.20260513`

Updates requests from 2.33.1 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

Widened json input type from dict and list to Mapping and Sequence. (#7436)

Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)

Response.reason moved from str | None to str to improve handling for users. (#7437)

Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

@k223kim made their first contribution in psf/requests#7433

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

Special thanks to @bastimeyer, @cthoyt, @edgarrmondragon, and @srittau for helping review and test the types ahead of the release. (#7272)

Improvements

Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)

Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)

Requests added support for Python 3.14t. (#7419)

Bugfixes

Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)

Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

Widened json input type from dict and list to Mapping and Sequence. (#7436)

Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)

Response.reason moved from str | None to str to improve handling for users. (#7437)

Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

Special thanks to @bastimeyer, @cthoyt, @edgarrmondragon, and @srittau for helping review and test the types ahead of the release. (#7272)

Improvements

Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)

Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)

Requests added support for Python 3.14t. (#7419)

Bugfixes

Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)

Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)

Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

Commits

6e83187 v2.34.2
84d10f0 Move Request.headers back to Mapping (#7441)
b7b549b v2.34.1
e511bc7 Fix mutability issues with headers input types (#7431)
5691f59 Update JsonType containers to read-based collections (#7436)
2144213 Constrain Response.reason to str (#7437)
6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
0b401c7 v2.34.0
86b378d Align Session.get parameters with requests.get (#7429)
a4f9a59 Port bpo-39057 to Requests (#7427)
Additional commits viewable in compare view

Updates ruff from 0.15.12 to 0.15.13

Release notes

Sourced from ruff's releases.

0.15.13

Release Notes

Released on 2026-05-14.

Preview features

Add a rule to flag lazy imports that are eagerly evaluated (#25016)

[pylint] Standardize diagnostic message (PLR0914, PLR0917) (#24996)

Bug fixes

Fix F811 false positive for class methods (#24933)

Fix setting selection for multi-folder workspace (#24819)

[eradicate] Fix false positive for lines with leading whitespace (ERA001) (#25122)

[flake8-pyi] Fix false positive for f-string debug specifier (PYI016) (#24098)

Rule changes

Always include panic payload in panic diagnostic message (#24873)

Restrict PYI034 for in-place operations to enclosing class (#24511)

Improve error message for parameters that are declared global (#24902)

Update known stdlib (#25103)

Performance

[isort] Avoid constructing glob::Patterns for literal known modules (#25123)

CLI

Add TOML examples to --config help text (#25013)

Colorize ruff check 'All checks passed' (#25085)

Configuration

Increase max allowed value of line-length setting (#24962)

Documentation

Add D203 to rules that conflict with the formatter (#25044)

Clarify COM819 and formatter interaction (#25045)

Clarify that NotImplemented is a value, not an exception (F901) (#25054)

Update number of lint rules supported (#24942)

Other changes

Simplify the playground's markdown template (#24924)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.13

Released on 2026-05-14.

Preview features

Add a rule to flag lazy imports that are eagerly evaluated (#25016)

[pylint] Standardize diagnostic message (PLR0914, PLR0917) (#24996)

Bug fixes

Fix F811 false positive for class methods (#24933)

Fix setting selection for multi-folder workspace (#24819)

[eradicate] Fix false positive for lines with leading whitespace (ERA001) (#25122)

[flake8-pyi] Fix false positive for f-string debug specifier (PYI016) (#24098)

Rule changes

Always include panic payload in panic diagnostic message (#24873)

Restrict PYI034 for in-place operations to enclosing class (#24511)

Improve error message for parameters that are declared global (#24902)

Update known stdlib (#25103)

Performance

[isort] Avoid constructing glob::Patterns for literal known modules (#25123)

CLI

Add TOML examples to --config help text (#25013)

Colorize ruff check 'All checks passed' (#25085)

Configuration

Increase max allowed value of line-length setting (#24962)

Documentation

Add D203 to rules that conflict with the formatter (#25044)

Clarify COM819 and formatter interaction (#25045)

Clarify that NotImplemented is a value, not an exception (F901) (#25054)

Update number of lint rules supported (#24942)

Other changes

Simplify the playground's markdown template (#24924)

Contributors

@MichaReiser

... (truncated)

Commits

2afb467 Bump 0.15.13 (#25157)
3008796 [ty] classify TypeVar semantic tokens as type parameters (#24891)
79470e3 [isort] Avoid constructing glob::Patterns for literal known modules (#25123)
2522549 Remove shellcheck from prek (#25154)
7db7170 [ty] Support TypedDict key completions in incomplete, anonymous contexts (#25...
bb3dd53 [ty] Run full iteration analysis on narrowed typevars (#25143)
828cdb7 [ty] Isolate file-watching test environment (#25151)
89e1d86 [ty] Preserve TypedDict keys through dict unpacking (#24523)
86f3064 [ty] Avoid accessing args[0] for static_assert (#25149)
ed819f9 [ty] Treat custom enum __new__ values as dynamic (#25136)
Additional commits viewable in compare view

Updates mypy from 1.20.2 to 2.1.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.1

We’ve just uploaded mypy 2.1.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy
You can read the full documentation for this release on Read the Docs.

librt.vecs: Fast Growable Array Type for Mypyc

The new librt.vecs module provides an efficient growable array type vec that is optimized for mypyc use. It provides fast, packed arrays with integer and floating point value types, which can be several times faster than list, and tens of times faster than array.array in code compiled using mypyc. It also supports nested vec objects and non-value-type items, such as vec[vec[str]].

Refer to the documentation for the details.

Contributed by Jukka Lehtosalo.

librt.random: Fast Pseudo-Random Number Generation

The new librt.random module provides fast pseudo-random number generation that is optimized for code compiled using mypyc. It can be 3x to 10x faster than the stdlib random module in compiled code.

Refer to the documentation for the details.

Contributed by Jukka Lehtosalo (PR 21433).

Mypyc Improvements

Make compilation order with multiple files consistent (Piotr Sawicki, PR 21419)

Fix crash on accessing StopAsyncIteration (Piotr Sawicki, PR 21406)

Fix incremental compilation with separate flag (Vaggelis Danias, PR 21299)

Fixes to Crashes

Fix crash on partial type with --allow-redefinition and global declaration (Jukka Lehtosalo, PR 21428)

Fix broken awaitable generator patching (Ivan Levkivskyi, PR 21435)

Changes to Messages

... (truncated)

Commits

c1c336d Remove +dev from version
74df14b Add changelog for mypy 2.1 (#21464)
022d9bc Revert "TypeForm: Enable by default (#21262)"
8826288 [mypyc] Document librt.random (#21463)
3f4067b Bump librt version to 0.11.0 (#21458)
2b1eb58 [mypyc] Enable incremental self-compilation (#21369)
8152f4a Respect file config comments for stale modules (#21444)
116d60b Fix nondeterminism from nonassociativity of overload joins (#21455)
6c4af8e Fix function call message change for small number of args (#21432)
4b8fdca [mypyc] Add librt.random module (#21433)
Additional commits viewable in compare view

Updates gunicorn from 25.3.0 to 26.0.0

Release notes

Sourced from gunicorn's releases.

26.0.0

Breaking Changes

Eventlet worker removed: The eventlet worker class has been dropped. Migrate to gevent, gthread, or tornado.

New Features

ASGI Framework Compatibility Suite: New end-to-end compatibility test harness covering Starlette, FastAPI, Litestar, Quart, Sanic, and BlackSheep. Current grid passes 438/444 tests (98%).

ASGI Test Suite Expansion: 134 additional ASGI unit tests covering protocol semantics, lifespan, websockets, and chunked framing.

Security

HTTP/1.1 Request-Target Validation (RFC 9112 sections 3.2.3, 3.2.4):

Reject authority-form request-target outside CONNECT

Reject asterisk-form request-target outside OPTIONS

Reject relative-reference request-targets

Header Field Hardening (RFC 9110):

Reject control characters in header field-value (section 5.5)

Reject forbidden trailer field-names (section 6.5.1)

Reject Content-Length list form (RFC 9112 section 6.3)

Request Smuggling Hardening:

Tighten keepalive gate and scope finish_body byte cap

Keep _body_receiver alive across the keepalive smuggling gate so pipelined requests cannot re-enter a closed body

Address parser/protocol findings from a six-point WSGI/ASGI audit

PROXY Protocol (ASGI): Enforce proxy_allow_ips and tighten v1/v2 parsing in the ASGI callback parser.

Connection Draining: Drain the connection on close per RFC 9112 section 9.6 to prevent reset-on-close truncation.

Bug Fixes

Body Framing on HEAD/204/304:

Keep Content-Length on HEAD and 304 responses (#3621)

Drop body framing on HEAD/204/304 even when the framework set it

Warn once when an ASGI app emits a body for a no-body response

HTTP/2 ASGI:

Fix _handle_stream_ended to set _body_complete in the async HTTP/2 handler so request bodies finalize correctly on stream end

Add InvalidChunkExtension mapping and fast-parser support in ASGI tests (#3565)

HTTP/1.1 100-Continue: Stop adding Transfer-Encoding: chunked to 100-Continue interim responses.

WebSocket Close Handshake (RFC 6455):

Comply with the close handshake state machine

Close the transport after the close handshake completes

Fix binary send when the text key is None

Early Hints: Validate headers in the early_hints callback to match process_headers; pass only the header name to InvalidHeader (#3588).

ASGI Framework Fixes:

Fix ASGI disconnect handling for Django-style apps

Fix Litestar request handling (use raw ASGI receive for body/headers)

Fix Litestar HTTP endpoints for compatibility tests

Fix Quart headers endpoint to normalize keys to lowercase

Fix Quart WebSocket close test app (missing accept())

Fix duplicate Transfer-Encoding header for BlackSheep streaming

... (truncated)

Commits

5d819cf release: 26.0.0
b45c70d Merge pull request #3611 from zc-mattcen/docs-typo
99c8d48 Merge pull request #3623 from benoitc/chore/drop-eventlet-add-h2-uvloop-test-...
5a655af Merge pull request #3622 from benoitc/test/docker-port-and-ipv4-fixes
201df19 chore: remove eventlet worker; add h2 and uvloop to test deps
f4ac8e1 test: pass action name to dirty client and stabilize after TTOU spam
54d38af test: unblock docker fixtures on macOS hosts
68843c8 Merge pull request #3621 from benoitc/fix/asgi-preserve-content-length-on-hea...
31f2618 Merge pull request #3620 from benoitc/fix/asgi-proxy-protocol-trust-and-parsing
41ec752 fix: keep Content-Length on HEAD and 304 responses
Additional commits viewable in compare view

Updates types-pyyaml from 6.0.12.20260408 to 6.0.12.20260510

Commits

See full diff in compare view

Updates types-requests from 2.33.0.20260408 to 2.33.0.20260513

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-ci group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.12` | `0.15.13` | | [mypy](https://github.com/python/mypy) | `1.20.2` | `2.1.0` | | [gunicorn](https://github.com/benoitc/gunicorn) | `25.3.0` | `26.0.0` | | [types-pyyaml](https://github.com/python/typeshed) | `6.0.12.20260408` | `6.0.12.20260510` | | [types-requests](https://github.com/python/typeshed) | `2.33.0.20260408` | `2.33.0.20260513` | Updates `requests` from 2.33.1 to 2.34.2 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.33.1...v2.34.2) Updates `ruff` from 0.15.12 to 0.15.13 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.12...0.15.13) Updates `mypy` from 1.20.2 to 2.1.0 - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v1.20.2...v2.1.0) Updates `gunicorn` from 25.3.0 to 26.0.0 - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@25.3.0...26.0.0) Updates `types-pyyaml` from 6.0.12.20260408 to 6.0.12.20260510 - [Commits](https://github.com/python/typeshed/commits) Updates `types-requests` from 2.33.0.20260408 to 2.33.0.20260513 - [Commits](https://github.com/python/typeshed/commits) --- updated-dependencies: - dependency-name: requests dependency-version: 2.34.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-ci - dependency-name: ruff dependency-version: 0.15.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-ci - dependency-name: mypy dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: python-ci - dependency-name: gunicorn dependency-version: 26.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: python-ci - dependency-name: types-pyyaml dependency-version: 6.0.12.20260510 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-ci - dependency-name: types-requests dependency-version: 2.33.0.20260513 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-ci ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels May 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the python-ci group across 1 directory with 6 updates#40

Bump the python-ci group across 1 directory with 6 updates#40
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-ci-88e3887e9a

dependabot Bot commented on behalf of github May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 15, 2026

v2.34.2

2.34.2 (2026-05-14)

v2.34.1

2.34.1 (2026-05-13)

New Contributors

v2.34.0

2.34.0 (2026-05-11)

2.34.2 (2026-05-14)

2.34.1 (2026-05-13)

2.34.0 (2026-05-11)

0.15.13

Release Notes

Preview features

Bug fixes

Rule changes

Performance

CLI

Configuration

Documentation

Other changes

Contributors

0.15.13

Preview features

Bug fixes

Rule changes

Performance

CLI

Configuration

Documentation

Other changes

Contributors

Mypy Release Notes

Next Release

Mypy 2.1

librt.vecs: Fast Growable Array Type for Mypyc

librt.random: Fast Pseudo-Random Number Generation

Mypyc Improvements

Fixes to Crashes

Changes to Messages

26.0.0

Breaking Changes

New Features

Security

Bug Fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants