Bump the python group across 1 directory with 4 updates

[dependabot]

Bumps the python group with 4 updates in the / directory: gunicorn, sentry-sdk, djangorestframework-stubs and ruff.

Updates gunicorn from 26.1.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

Commits

• 36f2a3c gunicorn 26.2.0
• cbba350 test: cover the h2c edge paths that had none
• 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
• 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
• 5853551 Merge pull request #3712 from Rotzbua/patch-1
• 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
• 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
• 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
• 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
• 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
• Additional commits viewable in compare view

Updates sentry-sdk from 2.68.0 to 2.68.1

Release notes

Sourced from sentry-sdk's releases.

2.68.1

enable_logs

• (logs) Don't stop sending auto-collected logs when enable_logs=True by @​sentrivana in #7237

  If you have enable_logs set to True, our logging integrations for the standard library logging module as well as Loguru will auto-collect logs and send them to Sentry as Sentry logs by default, preserving old behavior. Turning automatic collection off for a specific integration can still be achieved using the capture_sentry_logs integration option.

  import sentry_sdk
  from sentry_sdk.integrations.logging import LoggingIntegration
  from sentry_sdk.integrations.loguru import LoguruIntegration
  sentry_sdk.init(
  enable_logs=True,
  integrations=[
  LoggingIntegration(capture_sentry_logs=True),
  LoguruIntegration(capture_sentry_logs=False),
  ],
  )

  Please note that the enable_logs option is deprecated and will be removed in the next major release. The sentry_sdk.logger.X API now works regardless of it, and auto-collection can be opted into via the capture_sentry_logs integration-level options, which are False by default, unless you have enable_logs=True. We've added this compatibility layer to make the transition to a enable_logs-free world easier.

Bug Fixes 🐛

• (django) Add failed_request_status_codes by @​mgaligniana in #7140
• (anthropic) Gate gen_ai.response.tool_calls on outputs, not inputs by @​ericapisani in #7207
• (google_genai) Gate streaming gen_ai.response.tool_calls on outputs, not inputs by @​ericapisani in #7210
• (langchain) Use gen_ai.tool.definitions attribute when data collection is enabled by @​ericapisani in #7204
• (langgraph,huggingface_hub) Gate gen_ai.response.tool_calls on outputs, not inputs by @​ericapisani in #7208
• (openai) Gate gen_ai.response.tool_calls on outputs, not inputs by @​ericapisani in #7205
• (openai_agents) Gate gen_ai.response.tool_calls on outputs, not inputs by @​ericapisani in #7209

Changelog

Sourced from sentry-sdk's changelog.

2.68.1

enable_logs

• (logs) Don't stop sending auto-collected logs when enable_logs=True by @​sentrivana in #7237

  If you have enable_logs set to True, our logging integrations for the standard library logging module as well as Loguru will auto-collect logs and send them to Sentry as Sentry logs by default, preserving old behavior. Turning automatic collection off for a specific integration can still be achieved using the capture_sentry_logs integration option.

  import sentry_sdk
  from sentry_sdk.integrations.logging import LoggingIntegration
  from sentry_sdk.integrations.loguru import LoguruIntegration
  sentry_sdk.init(
  enable_logs=True,
  integrations=[
  LoggingIntegration(capture_sentry_logs=True),
  LoguruIntegration(capture_sentry_logs=False),
  ],
  )

  Please note that the enable_logs option is deprecated and will be removed in the next major release. The sentry_sdk.logger.X API now works regardless of it, and auto-collection can be opted into via the capture_sentry_logs integration-level options, which are False by default, unless you have enable_logs=True. We've added this compatibility layer to make the transition to a enable_logs-free world easier.

Bug Fixes 🐛

• (django) Add failed_request_status_codes by @​mgaligniana in #7140
• (anthropic) Gate gen_ai.response.tool_calls on outputs, not inputs by @​ericapisani in #7207
• (google_genai) Gate streaming gen_ai.response.tool_calls on outputs, not inputs by @​ericapisani in #7210
• (langchain) Use gen_ai.tool.definitions attribute when data collection is enabled by @​ericapisani in #7204
• (langgraph,huggingface_hub) Gate gen_ai.response.tool_calls on outputs, not inputs by @​ericapisani in #7208
• (openai) Gate gen_ai.response.tool_calls on outputs, not inputs by @​ericapisani in #7205
• (openai_agents) Gate gen_ai.response.tool_calls on outputs, not inputs by @​ericapisani in #7209

Commits

• 98f7d91 Update changelog
• 8f886ff release: 2.68.1
• df4ec02 fix(logs): Don't stop sending auto-collected logs when enable_logs=True (#7...
• e320318 test(pyramid): Add tests for data_collection gating of request body (#7218)
• 7b8a385 test(bottle): Add tests for data_collection gating of request body (#7217)
• cbcadc9 test(sanic): Add tests for data_collection gating of request body (#7216)
• e42c798 feat(tornado): Gate request body collection on data_collection option (#7215)
• d05bb60 test(django): Add tests for data_collection gating of request body (#7213)
• bcce67b feat(wsgi): Gate request body collection on data_collection option (#7212)
• 41220c4 fix(google_genai): Gate streaming gen_ai.response.tool_calls on outputs, no...
• Additional commits viewable in compare view

Updates djangorestframework-stubs from 3.18.0 to 3.18.1

Release notes

Sourced from djangorestframework-stubs's releases.

3.18.1

This release dropped Python 3.10 support, following django-stubs upstream (requires Python 3.11+ now).

What's Changed

• Mark stub-only synthetic types with @type_check_only by @​intgr with @​Copilot in typeddjango/djangorestframework-stubs#1038
• Fix PrimaryKeyRelatedField pk_field attribute & parameter type by @​intgr with @​Copilot in typeddjango/djangorestframework-stubs#1047
• Fix ManyRelatedField type parameters & relation field default/initial types by @​intgr in typeddjango/djangorestframework-stubs#1049

Housekeeping

• Drop Python 3.10 support by @​intgr in typeddjango/djangorestframework-stubs#1035
• Cleanup Python 3.10 compatibility by @​intgr in typeddjango/djangorestframework-stubs#1036
• Categorize stubtest allowlist_todo.txt entries by @​intgr with @​Copilot in typeddjango/djangorestframework-stubs#1037
• Fix remaining items in stubtest allowlist_todo.txt and remove the file by @​intgr with @​Copilot in typeddjango/djangorestframework-stubs#1039
• Version 3.18.1 release by @​intgr in typeddjango/djangorestframework-stubs#1050

Full Changelog: typeddjango/djangorestframework-stubs@3.18.0...3.18.1

Commits

• 11062a8 Version 3.18.1 release (#1050)
• 1d74bea Lock file maintenance
• fd11a58 Fix ManyRelatedField type parameters & relation field default/initial t...
• fd54923 Fix PrimaryKeyRelatedField pk_field attribute & parameter type (#1047)
• 3336102 [pre-commit.ci] pre-commit autoupdate (#1046)
• e4c9d11 Lock file maintenance
• 3410442 Bump sqlparse from 0.5.5 to 0.6.0 (#1042)
• 36692fc [pre-commit.ci] pre-commit autoupdate (#1041)
• 5247f84 Update astral-sh/setup-uv action to v10.0.1 (#1040)
• 603aa12 Fix remaining items in stubtest allowlist_todo.txt and remove the file (#1039)
• Additional commits viewable in compare view

Updates ruff from 0.16.3 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

... (truncated)

Commits

• 9e4938c Bump 0.16.5 (#28110)
• aad0e90 Allow rules without codes (#28049)
• 5fdab73 Update preview default rules and categories (#27877)
• 29c8e5b Document rule acceptance guidelines (#27910)
• 50a4d7f Document the new category selectors (#27906)
• ada8795 Introduce category selectors (#27666)
• d894723 [ty] Infer lambda parameters through callable type aliases (#28109)
• 2685fde [ty] Narrow functional enum members in == and match (#28103)
• efcffd2 [ty] Intersection simplifications with subtype-related generic specialization...
• eb78048 [ty] Bump ecosystem-analyzer for HTML escaping (#28104)
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.