fix(deps): update all patch dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
Flask-WTF (changelog)	1.2.1 -> 1.2.2			dependencies	patch
PyYAML (source)	6.0.2 -> 6.0.3			dependencies	patch
chromedriver	135.0.0 -> 135.0.4			devDependencies	patch
cypress (source)	14.5.3 -> 14.5.4			devDependencies	patch
dayjs (source)	1.11.13 -> 1.11.19			dependencies	patch
debugpy (source)	1.8.12 -> 1.8.17			dependencies	patch
form-data	4.0.4 -> 4.0.5			dependencies	patch
freezegun (changelog)	1.5.1 -> 1.5.5			test	patch
node (source)	16.20.0 -> 16.20.2				patch
pyexcel	0.7.0 -> 0.7.4			dependencies	patch
pyexcel-io	0.6.6 -> 0.6.7			dependencies	patch
pyexcel-xls	0.7.0 -> 0.7.1			dependencies	patch
pyexcel-xlsx	0.6.0 -> 0.6.1			dependencies	patch
tailwindcss (source)	3.4.13 -> 3.4.18			devDependencies	patch
types-python-dateutil (changelog)	2.9.0.20241003 -> 2.9.0.20251115			test	patch
types-requests (changelog)	2.32.0.20240914 -> 2.32.4.20250913			test	patch

Review

• Updates have been tested and work
• If updates are AWS related, versions match the infrastructure (e.g. Lambda runtime, database, etc.)

---

Release Notes

yaml/pyyaml (PyYAML)

v6.0.3

Compare Source

What's Changed

• Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

giggio/node-chromedriver (chromedriver)

v135.0.4

Compare Source

v135.0.3

Compare Source

v135.0.2

Compare Source

v135.0.1

Compare Source

cypress-io/cypress (cypress)

v14.5.4

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#14-5-4

iamkun/dayjs (dayjs)

v1.11.19

Compare Source

Bug Fixes

• added usage warnings for diff + updated unit tests (#​2948) (269a7a9)
• dont instantiate regexes within ar locale functions to avoid performance overhead (#​2898) (af5e9f0)
• replace italian locale "un' ora fa" with "un'ora fa", add tests for it (#​2930) (9e9f76c)
• Updated Belarusian locale with relative time (#​2656) (1d8746c)

v1.11.18

Compare Source

Bug Fixes

• error semantic-release dependency (8cfb313)

v1.11.17

Compare Source

Bug Fixes

• [en-AU] locale use the same ordinal as moment (#​2878) (1b95ecd)

v1.11.16

Compare Source

Bug Fixes

• test release workflow (no code changes) (c38c428)

v1.11.15

Compare Source

Bug Fixes

• Fix misspellings in Irish or Irish Gaelic [ga] (#​2861) (9c14a42)

v1.11.14

Compare Source

Bug Fixes

• .utcOffset(0, true) result and its clone are different bug (#​2505) (fefdcd4)

microsoft/debugpy (debugpy)

v1.8.17

Compare Source

v1.8.16: debugpy v1.8.16

Compare Source

Fixes

• Fix bug in attach for 3.11 and lower on Windows

Thanks to @​osiewicz

v1.8.15: debugpy v1.8.15

Compare Source

Fixes:

• Step Over, Step Into, not working when debugging Subprocesses
• Allow debugging child processes started through an intermediary
• Attach to process on arm64 Mac
• Documentation typo
• 3.14 preliminary support

Thanks to @​MichaelSpece, @​jborean93, @​ConradIrwin for your help

v1.8.14: debugpy v1.8.14

Compare Source

Fixes for:

• binskim warnings on linux
• support for posix_spawnp

v1.8.13: debugpy v1.8.13

Compare Source

Fixes:

• #​1812
• #​1832

form-data/form-data (form-data)

v4.0.5

Compare Source

Commits

• [Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076
• [Dev Deps] update @ljharb/eslint-config, eslint 5822467
• [Fix] set Symbol.toStringTag in the proper place 76d0dee

spulec/freezegun (freezegun)

v1.5.5

Compare Source

• Allow parametrized arguments called 'func' (Broken in 1.5.4)

v1.5.4

Compare Source

• Fix: Ability to yield fixtures (broken in 1.5.3)

v1.5.3

Compare Source

• Fix compatibility with pytest 8.4.0 when using fixtures
• Add (back) class-decorator overload to guarantee Pytype understands it

v1.5.2

Compare Source

• Remove support for Python 3.7
• Explicitly marks support for Python 3.13
• Improved project documentation

nodejs/node (node)

v16.20.2: 2023-08-09, Version 16.20.2 'Gallium' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-32002: Policies can be bypassed via Module._load (High)
• CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
• CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
• OpenSSL Security Releases
  • OpenSSL security advisory 14th July.
  • OpenSSL security advisory 19th July.
  • OpenSSL security advisory 31st July

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

• [40c3958a5a] - deps: update archs files for OpenSSL-1.1.1v (RafaelGSS) #​49043
• [a9ac9da89a] - deps: fix openssl crypto clean (RafaelGSS) #​49043
• [362d4c7494] - deps: upgrade openssl sources to OpenSSL_1_1_1v (RafaelGSS) #​49043
• [d8ccfe9ad4] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#445
• [242aaa0caa] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#459

v16.20.1: 2023-06-20, Version 16.20.1 'Gallium' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
• CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
• CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
• CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
• CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
• OpenSSL Security Releases
  • OpenSSL security advisory 28th March.
  • OpenSSL security advisory 20th April.
  • OpenSSL security advisory 30th May
• c-ares vulnerabilities:
  • GHSA-9g78-jv2r-p7vc
  • GHSA-8r8p-23f3-64c2
  • GHSA-54xr-f67r-4pc4
  • GHSA-x6mf-cxr9-8q6v

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

• [5a92ea7a3b] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen)
• [5df04e893a] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #​48156
• [c171cbd124] - deps: update c-ares to 1.19.1 (RafaelGSS) #​48115
• [155d3aac02] - deps: update archs files for OpenSSL-1.1.1u+quic (RafaelGSS) #​48369
• [8d4c8f8ebe] - deps: upgrade openssl sources to OpenSSL_1_1_1u (RafaelGSS) #​48369
• [1a5c9284eb] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
• [e42ff4b018] - http: disable request smuggling via empty headers (Paolo Insogna) nodejs-private/node-private#429
• [10042683c8] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
• [a6f4e87bc9] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
• [b77000f4d7] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #​47851

pyexcel/pyexcel (pyexcel)

v0.7.4

Compare Source

Fixed

#. #&#8203;257 <https://github.com/pyexcel/pyexcel/issues/257>: provide meaningful
error messages where dest* params are missing in save_as and isave_as

v0.7.3

Compare Source

Fixed

#. #&#8203;263 <https://github.com/pyexcel/pyexcel/issues/263>: support pathlib from
python 3.4
#. #&#8203;267 <https://github.com/pyexcel/pyexcel/issues/267>: better error message
for file_name

v0.7.2

Compare Source

Fixed

#. #&#8203;270 <https://github.com/pyexcel/pyexcel/issues/270>: apenddoc breaks
interpreter optimization
#. #&#8203;274 <https://github.com/pyexcel/pyexcel/issues/274>: Replace deprecated
imp module with importlib - enforced pyexcel's dependency on lml>=0.2.0. This
will have an implication for linux distribution makers for pyexcel. However,
this is a reaction to the potential removal of import syntax.

v0.7.1

Compare Source

Fixed

#. #&#8203;272 <https://github.com/pyexcel/pyexcel/issues/272>_: remove chardet as a
requirement

Updated

#. various typos and linted the code

pyexcel/pyexcel-io (pyexcel-io)

v0.6.7

Compare Source

updated

#. #&#8203;115 <https://github.com/pyexcel/pyexcel-io/issues/115>: Pathnames with .
cause file_name error in get_writer.
#. #&#8203;117 <https://github.com/pyexcel/pyexcel-io/issues/117>: fix a typo in
license.

pyexcel/pyexcel-xls (pyexcel-xls)

v0.7.1

Compare Source

Removed

#. #&#8203;52 <https://github.com/pyexcel/pyexcel-xls/issues/52>_: remove xlsm
support for xlrd > 2.0.0

Updated

#. #&#8203;54 <https://github.com/pyexcel/pyexcel-xls/issues/54>_: first project in
pyexcel to migrate to pytest

pyexcel/pyexcel-xlsx (pyexcel-xlsx)

v0.6.1

Compare Source

Updated

#. Compatability with openpyxl 3.1.0 and later

tailwindlabs/tailwindcss (tailwindcss)

v3.4.18

Compare Source

Fixed

• Improve support for raw supports-[…] queries in arbitrary values (#​13605)
• Fix require.cache error when loaded through a TypeScript file in Node 22.18+ (#​18665)
• Support import.meta.resolve(…) in configs for new enough Node.js versions (#​18938)
• Allow using newer versions of postcss-load-config for better ESM and TypeScript PostCSS config support with the CLI (#​18938)
• Remove irrelevant utility rules when matching important classes (#​19030)

v3.4.17

Compare Source

Fixed

• Work around Node v22.12+ issue (#​15421)

v3.4.16

Compare Source

Fixed

• Ensure the TypeScript types for PluginsConfig allow undefined values (#​14668)

v3.4.15

Compare Source

• Bump versions for security vulnerabilities (#​14697)
• Ensure the TypeScript types for the boxShadow theme configuration allows arrays (#​14856)
• Set fallback for opacity variables to ensure setting colors with the selection:* variant works in Chrome 131 (#​15003)

v3.4.14

Compare Source

Fixed

• Don't set display: none on elements that use hidden="until-found" (#​14625)

---

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone America/Montreal, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock

The --no-wheel and --wheel options are deprecated. They have no effect for Python > 3.8 as wheel is no longer bundled in virtualenv.
Updating dependencies
Resolving dependencies...

Creating virtualenv notification-admin-3EIkLYcy-py3.12 in /home/ubuntu/.cache/pypoetry/virtualenvs

Because notifications-utils (53.2.10) @ git+https://github.com/cds-snc/notifier-utils.git@53.2.10 depends on both PyYAML (6.0.2) and PyYAML (6.0.2), pyyaml is required.
So, because notification-admin depends on PyYAML (6.0.3), version solving failed.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[whabanks]

Tested with the corresponding utils bumps: cds-snc/notification-utils#366