Skip to content

⬆️(dependencies) update python dependencies - #2822

Merged
lunika merged 4 commits into
mainfrom
renovate/python-dependencies
Oct 23, 2026
Merged

⬆️(dependencies) update python dependencies#2822
lunika merged 4 commits into
mainfrom
renovate/python-dependencies

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
PyJWT ==2.15.0 → ==2.15.1 age confidence project.dependencies patch
boto3 ==1.43.103 → ==1.43.111 age confidence project.dependencies patch 1.43.114 (+2)
django-filter (changelog) ==26.1 → ==26.2 age confidence project.dependencies minor
djangorestframework (changelog) ==3.18.1 → ==3.18.3 age confidence project.dependencies patch
drf-spectacular-sidecar ==2026.9.1 → ==2026.10.1 age confidence project.optional-dependencies minor
openai ==3.19.2 → ==3.29.0 age confidence project.dependencies minor 3.35.1 (+6)
posthog ==7.60.1 → ==7.67.0 age confidence project.dependencies minor 7.71.0 (+6)
pycrdt ==0.14.6 → ==0.14.8 age confidence project.dependencies patch 0.14.9
pydantic (changelog) ==2.13.5 → ==2.14.1 age confidence project.dependencies minor
pydantic-ai-slim (source, changelog) ==2.53.0 → ==2.55.0 age confidence project.dependencies minor 2.57.0 (+1)
pylint (changelog) ==4.0.9 → ==4.1.3 age confidence project.optional-dependencies minor
python (source) ~=3.14.0 → ~=3.15.0 age confidence requires-python minor
ruff (source, changelog) ==0.16.0 → ==0.17.0 age confidence project.optional-dependencies minor 0.17.1
servestatic (changelog) ==4.3.4 → ==4.4.0 age confidence project.dependencies minor
types-requests (changelog) ==2.33.0.20260906 → ==2.33.0.20261006 age confidence project.optional-dependencies patch
uv_build (source, changelog) >=0.12.19,<0.13 → >=0.13,<0.14 age confidence build-system.requires minor 0.13.1

Release Notes

jpadilla/pyjwt (PyJWT)

v2.15.1

Compare Source

Changed


- Add public ``jwt.decode`` regression coverage for AWS ALB-style padded
  ES256 tokens, including rejection of tampered payloads and signatures,
  in `#&#8203;1211 <https://github.com/jpadilla/pyjwt/pull/1211>`__.

`v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`#&#8203;1209 <https://github.com/jpadilla/pyjwt/issues/1209>`__).

`v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>`__
-----------------------------------------------------------------------

Security
  • Wrap recursion errors from deeply nested JWT payloads in DecodeError
    instead of exposing a raw RecursionError.

Added


- Support Python 3.15 by @kytta in `#&#8203;1202 <https://github.com/jpadilla/pyjwt/pull/1202>`__

Changed
  • JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS
    payload, so a cache hit no longer re-parses every key. JWKSetCache.put()
    accepts either form and raises PyJWKSetError for anything else. As a
    result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance
    for as long as it stays cached, rather than a freshly built one per call in
    #&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>__
  • PyJWKClient.fetch_data() now raises
    PyJWKClientError("The JWKS endpoint did not return a JSON object") when
    the endpoint response is not a JSON object, instead of returning it for
    get_jwk_set() to reject. Callers reaching the JWKS through
    get_jwk_set() see the same error as before in
    #&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed


- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `#&#8203;914 <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
  a JSON object is skipped, a key whose components have the wrong type raises
  ``InvalidKeyError`` and is skipped, and a set left with no usable keys raises
  ``PyJWKSetError``. A single bad entry no longer fails an otherwise usable
  JWK Set in `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Wrap ``http.client.HTTPException`` (e.g. ``IncompleteRead`` from a
  truncated response) in ``PyJWKClient.fetch_data`` as
  ``PyJWKClientConnectionError``, matching the other network failure
  modes the method already documents.

`v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__
-----------------------------------------------------------------------

Security
  • Harden HMAC key validation against public-key material supplied as JWK,
    JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
    GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>,
    GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>    ,
    GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>,
    and GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>    .
  • Reject automatic redirects when PyJWKClient fetches a JWKS, preventing
    redirected destinations from being treated as trusted key sources. See
    GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>__.
  • Limit repeated JWKS refreshes caused by unknown key IDs while preserving
    normal key-rotation behavior. See
    GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>__.
  • Handle deeply nested and malformed JWS/JWK input without uncaught recursion
    errors or whole-set parsing failures. See
    GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>__
    and GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>__.
  • Stop mutating the caller-supplied options mapping during decode
    when verify_signature is false, so a mapping reused across a
    signature-disabled peek and a fully verified decode cannot silently
    skip registered-claim verification. See
    GHSA-gvp8-978c-rx2q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q>__.
  • Enforce compact JWS encoding rules during decoding. See
    GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>__.
  • Reject detached-payload arguments for attached JWS inputs. Thanks to @xclow3n <https://github.com/xclow3n>__ for reporting this behavior; fixed in commit
    37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>__.

Fixed


- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.

`v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>`__
-----------------------------------------------------------------------

Security
  • Reject JWK JSON documents passed as raw HMAC secrets in
    HMACAlgorithm.prepare_key to close an algorithm-confusion gap that
    the existing PEM/SSH guard did not cover. Reported by @​aradona91 in
    GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>__.
  • Bind the JWT header alg to PyJWK.algorithm_name during
    verification so the caller's algorithms=[...] allow-list cannot be
    bypassed when decoding with a PyJWK / PyJWKClient key. Reported
    by @​sushi-gif in GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>__.
  • Reject non-http(s) URI schemes in PyJWKClient so attacker-
    influenced URIs cannot read local files or reach unintended schemes via
    urllib's default file:// / ftp:// / data: handlers. Reported
    by @​KEIJOT in GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>__.
  • Preserve the cached JWK Set on fetch errors in PyJWKClient.fetch_data.
    The previous finally-block put(None) pattern cleared the cache
    on any transient outage, turning one bad JWKS request into application-
    wide auth failure. Reported by @​eddieran in GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>__.
  • Skip the unconditional base64 decode of the compact-form payload segment
    when b64=false is set in the protected header, and require that
    segment to be empty (RFC 7515 Appendix F detached form). Closes an
    unauthenticated DoS amplifier. Reported by @​thesmartshadow in
    GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>__.

Fixed


- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``"b64"`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.

Changed
  • Migrate the dev, docs, and tests package extras to dependency groups by @​kurtmckee in #&#8203;1152 <https://github.com/jpadilla/pyjwt/pull/1152>__
boto/boto3 (boto3)

v1.43.111

Compare Source

========

  • api-change:deadline: [botocore] The new ListMemberships API enables users to discover their memberships across Deadline Cloud resources, enabling scoped users of Deadline resources to discover and interact with the resources they have been provided scoped access to.
  • api-change:mediatailor: [botocore] Add caching settings to http functions
  • api-change:meteringmarketplace: [botocore] AWS Marketplace Metering Service adds AgreementId to ResolveCustomer API response.
  • api-change:quicksight: [botocore] Adds granular custom permissions for the Gong action connector (GongAction, CreateAndUpdateGongAction, ShareGongAction, UseGongAction) and for create, update, and share operations on 45 data source connectors, such as Amazon S3 and Snowflake, through the Custom Permissions APIs.
  • api-change:securityagent: [botocore] Adds a test scope field to specify whether a pentest targets a web application or a generative AI application.

v1.43.110

Compare Source

========

  • api-change:budgets: [botocore] Adds a product attribute dimension to CreateBudget and UpdateBudget, letting customers filter AWS Budgets costs by structured attributes such as Amazon Bedrock model, provider, inference type, and feature.
  • api-change:ce: [botocore] Adds a product attribute dimension to GetCostAndUsage, GetCostAndUsageWithResources, and GetDimensionValues, letting customers group, filter, and discover Cost Explorer costs by structured attributes such as Amazon Bedrock model, provider, inference type, and feature.
  • api-change:cloudformation: [botocore] CloudFormation introduces force rollback, a new opt-in capability that lets your stacks complete a rollback even when an individual resource cannot be reverted. Set ForceRollback on ContinueUpdateRollback and CloudFormation records each resource that fails as skipped, completing the rollback.
  • api-change:codeconnections: [botocore] This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.0. The SDK will prioritize its most performant protocol.
  • api-change:datazone: [botocore] Adds support for multi-file notebook import. StartNotebookImport now accepts an s3Files source location with an ordered list of Amazon S3 objects, creating one notebook cell per file, plus a type field to create either a DATA or SQL notebook.
  • api-change:devops-agent: [botocore] Adds release management associations with private network access to AWS DevOps Agent, and a releaseManagementAssociationId field on GitHub and GitLab associations. This helps release management agents (Release-readiness review and Release Testing) access customer resources that are behind a VPC.
  • api-change:eks: [botocore] Configurations support for EKS ACK Capabilities, including EnableCrossNamespace and DisableServices configuration.
  • api-change:emr-serverless: [botocore] This release adds support for system profile logs for lakeformation enabled Spark connect sessions .
  • api-change:fms: [botocore] This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.1. The SDK will prioritize its most performant protocol.
  • api-change:gamelift: [botocore] Amazon GameLift Servers container fleets now support CPU bursting for game server container groups. The TotalVcpuLimit property of a game server container group definition is now optional. When you omit it, the group has no CPU cap and its containers can burst into unused CPU on the instance.
  • api-change:glue: [botocore] Introduced GetSystemLogsForJobRun and GetSystemLogsForSession APIs, enabling account admins to retrieve system-space logs for FGAC-enabled Glue jobs and sessions.
  • api-change:guardduty: [botocore] Added support for GuardDuty RDS Data Activity Monitoring
  • api-change:health: [botocore] This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.1. The SDK will prioritize its most performant protocol.
  • api-change:keyspaces: [botocore] This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.0. The SDK will prioritize its most performant protocol.
  • api-change:lambda: [botocore] AWS Lambda now supports OAuth 2.0 (OAUTHBEARER), IAM, and IAM with OAUTHBEARER authentication for self-managed Apache Kafka event source mappings, including optional OAuth scope, audience, logical cluster, and identity pool parameters. OAuth 2.0 is also available for Confluent Schema Registry.
  • api-change:marketplace-agreement: [botocore] This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.0. The SDK will prioritize its most performant protocol.
  • api-change:medialive: [botocore] AWS Elemental MediaLive Workflow Monitor now supports AWS Elemental Inference feeds as a target resource type for CloudWatch alarm templates.
  • api-change:opensearch: [botocore] This release adds a new EncryptionMode option (DISK or NATIVE) to EncryptionAtRestOptions for the CreateDomain and UpdateDomainConfig operations, enabling selection of engine-native index-level encryption on supported Amazon OpenSearch Service domains.
  • api-change:pi: [botocore] This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.1. The SDK will prioritize its most performant protocol.
  • api-change:securityagent: [botocore] Include model field for suggested remediation steps as part of findings
  • api-change:securityhub: [botocore] Release findings export APIs - StartExportJobV2, GetExportJobV2, ListExportJobsV2, and CancelExportJobV2. This supports exporting findings from AWS Security Hub to Amazon S3 bucket.
  • api-change:security-ir: [botocore] Adds support for retrieving finding-lifecycle metrics for an AWS Security Incident Response membership.
  • api-change:sesv2: [botocore] SESV2 DEED - Documentation Update
  • api-change:translate: [botocore] This release adds Smithy RPC v2 CBOR as an additional protocol alongside the existing AWS JSON 1.1. The SDK will prioritize its most performant protocol.

v1.43.109

Compare Source

========

  • api-change:lambda-web: [botocore] Removes operations that are not yet generally available from the Lambda Web.

v1.43.108

Compare Source

========

  • api-change:cognito-idp: [botocore] Amazon Cognito User Pools now supports the OIDC-standard authentication context class reference (ACR) and authentication methods reference (AMR) claims on issued access and Id tokens. Amazon Cognito User Pools also now supports step-up authentication via our existing authentication APIs.
  • api-change:glue: [botocore] Added refresh token grant type to Glue Connection supported OAuth 2.0 grant types
  • api-change:invoicing: [botocore] API and doc updates related to adding MarketplacePunchOutEnabled and MarketplacePunchOutPreference fields to ProcurementPortalPreferences related APIs
  • api-change:lambda-web: [botocore] Documentation update for AWS Lambda Web Functions, clarifies that the LambdaWeb APIs are experimental and not yet available to external customers.
  • api-change:mediapackagev2: [botocore] Dynamic Multiview enables viewers to watch multiple live video streams in a single combined output. Static filter configuration allows users to configure endpoints with layouts and sources without using query parameters. The number of sources per multiview channel has been increased to 50.
  • api-change:pinpoint-sms-voice-v2: [botocore] AWS End User Messaging SMS CarrierLookup API now supports phone number cleansing on customer opt-in. when selected, the response includes the additional field "OriginalPhoneNumber". It can also return additional PhoneNumberType enums, VOIP and PREPAID.
  • api-change:securityagent: [botocore] Adds trigger filters that control which pull request events, target branches, and labels start an automatic code review.

v1.43.107

Compare Source

========

  • api-change:bedrock-agent: [botocore] Adds an optional textReadyAt field to ListIngestionJobs and GetIngestionJob for Managed Knowledge Bases data source sync jobs. The field denotes the timestamp at which all the documents in the scope of a sync job had their text content indexed and are available for retrieval.
  • api-change:cloudfront: [botocore] Added always-amz-auth as a supported signing behavior for Origin Access Control (OAC), enabling CloudFront to authenticate requests to Lambda-Web origins.
  • api-change:ec2: [botocore] This release launches the AMI tag sharing feature, which lets AMI owners share tags alongside their AMIs, eliminating the need to build and maintain custom tag replication workflows.
  • api-change:endpoint-rules: [botocore] Update endpoint-rules client to latest version
  • api-change:endusermessaging: [botocore] AWS End User Messaging now supports Brand profiles and Notify code configurations. Brand profiles capture your sender details once to reuse across phone number registrations. Notify code configurations let you define your OTP policy and delivery settings to send passcodes in minutes.
  • api-change:health: [botocore] Adds DescribeServiceLifecycle operation returning lifecycle information for AWS services, including end-of-support dates, version recommendations, and lifecycle events.
  • api-change:lambda-web: [botocore] Lambda Web Functions GA launch. Lambda Web Functions enable customers to run web applications and API backends
  • api-change:quicksight: [botocore] This release adds HierarchyFilter support for Amazon QuickSight analysis and dashboard and 2 legged OAuth for databricks datasources.
  • api-change:sagemaker: [botocore] Release support for c8a.16xlarge and m8a.16xlarge instance types for SageMaker HyperPod
  • api-change:securityhub: [botocore] Adds GetRemediationsV2 and ListExposuresByRemediationV2 APIs. This feature allows customers to see their highest priority remediations for their Exposure findings. Remediations target key changes customers can make to resources to drive finding resolution.
  • api-change:transfer: [botocore] AWS Transfer Family Workflows adds support for the structuredLogDestinations option, enabling customers to specify a custom Amazon CloudWatch Logs log group for managed workflow execution logs.

v1.43.106

Compare Source

========

  • api-change:account: [botocore] This release adds support for verifying an AWS account's primary contact phone number. SendPhoneNumberVerification sends a one-time code by SMS, VerifyPhoneNumber validates it, and GetContactInformation now returns the verification status.
  • api-change:agent-registry: [botocore] Minor doc update for the AWS Agent Registry Custom metadata SearchDiscoverableRegistryRecords API
  • api-change:batch: [botocore] AWS Batch adds support for Amazon EKS access entries on EKS compute environments through the new accessEntry setting in CreateComputeEnvironment and UpdateComputeEnvironment.
  • api-change:bedrock: [botocore] Amazon Bedrock Automated Reasoning policies now accept Unicode letters in identifier names such as type names, type value names, and variable names. You can now author policies in non-English languages using accented or non-Latin characters.
  • api-change:bedrock-agentcore-control: [botocore] This release adds support for private certificate authorities on Amazon Bedrock AgentCore Gateway targets. The new certificateConfigurations parameter on CreateGatewayTarget and UpdateGatewayTarget references a PEM-encoded CA certificate in Amazon S3 or AWS Secrets Manager.
  • api-change:connect: [botocore] Amazon Connect Rules can now trigger in-app notifications to users as a rule action. Notification character limit was increased to 500 visible characters.
  • api-change:datazone: [botocore] Support for setting notebook run notification configurations
  • api-change:dynamodb: [botocore] Adds support for filtering exported table data using FilterExpression, ProjectionExpression and KeyConditionExpression with ExportTableToPointInTime.
  • api-change:ecs: [botocore] Releasing VPCL for BlueGreen ecs deployments.
  • api-change:globalaccelerator: [botocore] IpSets now include the Network Zone for each Static IP address.
  • api-change:glue: [botocore] Enable Catalog ID for crawler, column statistics and materialized views.
  • api-change:guardduty: [botocore] GuardDuty AWS Organizations policy integration. GetDetector and GetMemberDetectors now show whether a GuardDuty policy manages a feature.
  • api-change:logs: [botocore] Amazon CloudWatch Logs now supports an optional roleArn parameter on PutDeliveryDestination for X-Ray trace delivery destinations, specifying the IAM role to assume when delivering traces.
  • api-change:observabilityadmin: [botocore] Enablement for Bedrock PaymentManager logs via Observability Admin Telemetry Rule
  • api-change:organizations: [botocore] Add support for policy operations on the GUARDDUTY POLICY policy type.
  • api-change:s3: [botocore] Amazon S3 adds a new optional S3 Inventory field, IntelligentTieringReferenceDate, reporting the reference date S3 Intelligent-Tiering uses to evaluate an object's tier-transition eligibility. The value is populated for objects in the Intelligent-Tiering storage class and left blank for others.
  • api-change:s3vectors: [botocore] Amazon S3 Vectors now supports metadata prefiltering, providing higher recall on filtered queries.
  • api-change:sagemaker: [botocore] This feature enables customers to modify their accounting database via API.

v1.43.105

Compare Source

========

  • api-change:appstream: [botocore] Add support for NVIDIA GRID driver version metadata in Workspace Applications image responses through the new ImageSoftwareMetadata field.
  • api-change:bedrock-agent-runtime: [botocore] Amazon Bedrock Agentic Retrieve now supports the Bedrock Mantle (OpenAI Responses) endpoint via a new MantleFoundationModel configuration with an optional projectId.
  • api-change:deadline: [botocore] AWS Deadline Cloud now supports Docker software add-ons on service-managed fleets. Adds support for Open Job Description EXPR and Feature Bundle 1 job templates with typed job parameters and job, step, and parameter names up to 512 characters.
  • api-change:ec2: [botocore] Adds the LaunchStatus field to CapacityReservation in the DescribeCapacityReservations response. This field indicates whether you can currently launch instances into an UltraServer.
  • api-change:elasticache: [botocore] Amazon ElastiCache Serverless now supports public endpoints for Valkey caches. With the new Connection Type parameter, you can create a serverless cache accessible over the internet without any VPC configuration. Public endpoint caches require IAM authentication.
  • api-change:elementalinference: [botocore] Adds an extendedAnalysis setting to contextual metadata outputs to control detection of people, environments, brands, and on-screen text, and updates the summaryGeneration documentation.
  • api-change:glue: [botocore] Add support for Glue system-managed materialized views.
  • api-change:identitystore: [botocore] Add support for network access controls to restrict Identity Store API and SCIM access to trusted networks, optimistic locking for users and groups via resource revisions, and resource ARNs as identifiers in requests.
  • api-change:inspector2: [botocore] The ListFindingAggregations API now includes Low, Informational, and Untriaged counts alongside the existing severity counts in SeverityCounts.
  • api-change:mediatailor: [botocore] AWS Elemental MediaTailor now supports beaconing configuration on playback configurations. In Insights reporting mode, MediaTailor will now gather client side beaconing metrics. Set the reporting mode to Disabled to turn this off.
  • api-change:opensearch: [botocore] Amazon OpenSearch Service now supports advisory pre-validations for domain config changes. Non-critical checks now surface as warnings you can acknowledge (via the new AcceptedWarnings parameter) and proceed, instead of hard-blocking. Severity is reported in change-progress and dry-run results.
  • api-change:rds: [botocore] Adds the TargetResourceConfigurations parameter to CreateBlueGreenDeployment, letting you specify a target KMS key for each resource in the green environment.
  • api-change:sagemaker: [botocore] Adds support for cpu flex type instances on SageMaker Training and Processing. Also contains minor updates to DescribeTrainingPlan to support ARN inputs.
  • api-change:securityagent: [botocore] Adds support for Azure DevOps and Bitbucket Data Center integration providers.
  • api-change:sesv2: [botocore] Added Filter support for ListTenants, ListEmailIdentities, and ListConfigurationSets APIs.
  • api-change:transfer: [botocore] AWS Transfer Family now supports configuring up to three custom ports on public SFTP servers, instead of the single default port 22. You can also set each port's communication mode (server-talk-first or client-talk-first) so legacy and modern SFTP clients connect reliably.

v1.43.104

Compare Source

========

  • api-change:agent-registry: [botocore] AWS Agent Registry adds support for custom metadata. Discovery APIs now return custom metadata on registry records and support filtering by metadata fields. Semantic search includes custom metadata for improved relevance. Filter customMetadata fields using eq, ne, and in operators.
  • api-change:agent-registry-control: [botocore] AWS Agent Registry adds support for custom metadata. Define a typed metadata schema on your registry and attach structured key-value metadata to registry records. Schemas are additive only. Enforcement is progressive. Records show a compliance status computed against the current schema.
  • api-change:bedrock-agentcore-control: [botocore] Amazon Bedrock AgentCore Gateway now supports returning the complete MCP tools list in a single response by disabling pagination for the tools list operation. This feature is available in limited preview.
  • api-change:billing: [botocore] Adds support for (a) listing Business Support account charges via ListBusinessSupportAccountCharges and (b) subscription history via ListBusinessSupportSubscriptionHistory through the AWS Billing API.
  • api-change:connect: [botocore] This release adds ConnectionTypes and ChatStreamingConfiguration to StartChatContact, and ConnectionCredentials, Websocket, and StreamingId to its response, so customers can request connection information and chat streaming in the same call that starts the chat.
  • api-change:ec2: [botocore] API changes to AWS Client VPN to support device posture assessment and Cedar authorization policies
  • api-change:eks: [botocore] An optional customer provided prefix used to construct the hostname of the Argo CD server endpoint for EKS Argo CD Capability.
  • api-change:fsx: [botocore] Amazon FSx has expanded the model-level maximum on the ThroughputCapacity, ThroughputCapacityPerHAPair, and Iops API parameters. Actual supported values are unchanged and depend on file system type and configuration.
  • api-change:glue: [botocore] Added a new exception to several batch APIs
  • api-change:guardduty: [botocore] Adding awsServiceName field to GuardDuty Findings
  • api-change:securityagent: [botocore] Run automated penetration tests directly from your CI-CD pipeline to scan code changes before they ship, gating deployments on the findings
  • api-change:ssm: [botocore] Add support for sharing SSM documents with organizations and OUs using RAM.
carltongibson/django-filter (django-filter)

v26.2

Compare Source

  • Added testing against Python 3.15.

  • Dropped support for Python 3.10.

  • LinkWidget will now conditionally escape provided label text.

    Filter choices are under developer control, and applications populating them
    from user-supplied values, including via AllValuesFilter, must filter
    those appropriately, as always. Nonetheless, escaping labels by default
    serves as defense-in-depth hardening. Apply mark_safe() to labels
    intended to contain HTML.

    Thanks to Sanjeev Kumar for the report.

encode/django-rest-framework (djangorestframework)

v3.18.3

Compare Source

What's Changed

Bug fixes

Full Changelog: encode/django-rest-framework@3.18.2...3.18.3

v3.18.2

Compare Source

What's Changed

Security
Features
Bug fixes

New Contributors

Full Changelog: encode/django-rest-framework@3.18.1...3.18.2

tfranzel/drf-spectacular-sidecar (drf-spectacular-sidecar)

v2026.10.1

Compare Source

openai/openai-python (openai)

v3.29.0

Compare Source

Features
Chores

v3.28.0

Compare Source

Features
  • api: add agent environment suspension and expiration (#​4046) (6aa25a9)
Chores

v3.27.0

Compare Source

Features

v3.26.1

Compare Source

Bug Fixes

v3.26.0

Compare Source

Features

v3.25.0

Compare Source

Features
  • agents: observe local tool failures (#​4028) (95d9645)
  • agents: run local tools during streamed session creation (#​4027) (919b623)
  • api: add agent turn items and usage source grouping (#​4030) (bd74c4e)
  • lib: export type_to_response_format_param publicly (#​2993) (becc1d2)
  • tools: support tool search (defer_loading=true) in typed function helpers (#​4029) (eec627f)

v3.24.0

Compare Source

Features
  • api: add custom voice creation and agent session events (#​4013) (e5de2e5)
Bug Fixes

v3.23.0

Compare Source

Features
  • agents: [1/n] return typed answers from session streams (#​4007) (10f8816)
  • agents: stage files and download turn artifacts (#​4009) (4fc2438)
  • api: Add session traces and Realtime translations (#​4001) (138e3d1)
  • beta: expose typed application actions as agent tools (#​4006) (f219c55)
  • collect final output from beta Agents streams (157ac4c)
Bug Fixes
  • api: allow original image detail in Chat Completions (#​4005) (8a136c2)
  • api: correct the eval run cancellation endpoint (#​4003) (28c5c9a)
  • api: retain WebSocket endpoint paths and query parameters (#​3999) (7f203fd)
  • keep Castiron budget results valid when main advances (#​4012) (73f189b)
  • responses: avoid replaying uncertain typed sends on reconnect (#​4011) (1dbbf61)
  • responses: respect send queue limits during reconnect (#​4000) (50f95ac)
  • use monotonic clock for file processing timeout (#​3748) (58aca1d)
Chores

v3.22.1

Compare Source

Bug Fixes
Chores
  • tests: mark sample_file.txt as text with LF line endings (#​3879) (fd78a48)
Documentation

v3.22.0

Compare Source

Features

v3.21.0

Compare Source

Features

v3.20.0

Compare Source

Features
  • api: add Agents credential and session options (#​3967) (bb68198)
  • api: add Cyber access programs to Responses (#​3956) (09c5b6f)
  • responses: opt in to incremental WebSocket text and tool snapshots (#​3973) (d0207b4)
  • responses: preserve detailed WebSocket accumulator snapshots (#​3981) (a380cf2)
Bug Fixes

[!IMPORTANT]
✂ PR body was truncated to here.

@renovate renovate Bot added automated Pull request created automatically dependencies Pull requests that update a dependency file noChangeLog labels Oct 12, 2026
@lunika
lunika self-requested a review October 12, 2026 07:19
@renovate
renovate Bot force-pushed the renovate/python-dependencies branch from cd95e24 to 08076c8 Compare October 18, 2026 21:47
@lunika
lunika force-pushed the renovate/python-dependencies branch from 08076c8 to 648980c Compare October 23, 2026 14:25
@renovate

renovate Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@lunika
lunika force-pushed the renovate/python-dependencies branch from 4c7d4b5 to ff525f2 Compare October 23, 2026 14:54
lunika added 4 commits October 23, 2026 17:18
@lunika
⬆️(dependencies) update python dependencies
40d7840
@lunika
📌(backend) stay in python3.14
357e6d2 
We don't want to upgrade to python 3.15 right now. We updated the
renovate configuration to not upgrade the python version.
@lunika
📌(backend) install brotli as a servestatic dependency
761934a 
we installed brotli as a direct dependency. It is used by servestatic
and not by docs directly.
@lunika
⬆️(backend) update opentelemetry-api to version 1.45.1
eb56850 
pin version to fix CVE-2026-114603
@lunika
lunika force-pushed the renovate/python-dependencies branch from ff525f2 to eb56850 Compare October 23, 2026 15:18
@lunika
lunika merged commit eb56850 into main Oct 23, 2026
49 of 50 checks passed
@lunika
lunika deleted the renovate/python-dependencies branch October 23, 2026 15:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lunika lunika lunika approved these changes

Assignees

No one assigned

Labels

automated Pull request created automatically dependencies Pull requests that update a dependency file noChangeLog

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lunika