Skip to content

chore(deps): bump the backend group with 8 updates - #17488

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/backend-ea49321f7b
Open

chore(deps): bump the backend group with 8 updates#17488
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/backend-ea49321f7b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the backend group with 8 updates:

Package From To
django-storages[google] 1.14.4 1.14.6
google-cloud-storage 3.14.1 3.17.1
granian 2.8.3 2.8.5
jq 1.12.0 1.13.0
justhtml 3.11.2 3.15.0
markus[datadog] 5.0.0 5.2.0
psycopg[binary] 3.2.8 3.3.6
sentry-sdk 2.69.2 2.73.0

Updates django-storages[google] from 1.14.4 to 1.14.6

Changelog

Sourced from django-storages[google]'s changelog.

1.14.6 (2025-04-01)

Google Cloud

  • Add option to sign URLs via IAM Blob API ([#1427](https://github.com/jschneier/django-storages/issues/1427)_)

S3

  • Fix exists calls when using SSE-C ([#1451](https://github.com/jschneier/django-storages/issues/1451)_)
  • Default url_protocol to https: if set to None ([#1483](https://github.com/jschneier/django-storages/issues/1483)_)

.. _#1427: jschneier/django-storages#1427 .. _#1451: jschneier/django-storages#1451 .. _#1483: jschneier/django-storages#1483

1.14.5 (2025-02-15)

General

  • Revert exists() behavior to pre-1.14.4 semantics with additional hardening for Django versions < 4.2 to fix CVE-2024-39330. This change matches the eventual behavior Django itself shipped with. ([#1484](https://github.com/jschneier/django-storages/issues/1484), [#1486](https://github.com/jschneier/django-storages/issues/1486))
  • Add support for Django 5.1 ([#1444](https://github.com/jschneier/django-storages/issues/1444)_)

Azure

  • Deprecated: The setting AZURE_API_VERSION/api_version setting is deprecated in favor of the new AZURE_CLIENT_OPTIONS setting. A future version will remove support for this setting.
  • Add AZURE_CLIENT_OPTIONS settings to enable customization of all BlobServiceClient parameters such as api_version and all retry* options. ([#1432](https://github.com/jschneier/django-storages/issues/1432)_)

Dropbox

  • As part of the above hardening fix a bug was uncovered whereby a root_path setting would be applied multiple times during save() ([#1484](https://github.com/jschneier/django-storages/issues/1484)_)
  • Fix setting OAuth2 access token via env var ([#1452](https://github.com/jschneier/django-storages/issues/1452)_)

FTP

  • Fix incorrect exists() results due to an errant appended slash ([#1438](https://github.com/jschneier/django-storages/issues/1438)_)

Google Cloud

... (truncated)

Commits

Updates google-cloud-storage from 3.14.1 to 3.17.1

Release notes

Sourced from google-cloud-storage's releases.

google-cloud-storage: v3.17.1

3.17.1 (2026-10-15)

Bug Fixes

  • storage: set GRPC_ALTS_MAX_CONCURRENT_HANDSHAKES=2 in benchmark runner (#18703) (a9ca134)

google-cloud-storage: v3.17.0

3.17.0 (2026-10-08)

Features

  • storage: add OpenTelemetry metrics gating and configuration module (#18407) (654e768)
Commits
  • 2d29c31 chore: release main (#18608)
  • 7032a89 fix(gapic-generator): resolve showcase-mypy incompatible redefinition and add...
  • 9025061 fix(bigquery): remove PendingDeprecationWarning from RowIterator.to_arrow (#1...
  • 3743ff0 perf(spanner): avoid allocating empty RequestOptions on read and query paths ...
  • a9ca134 fix(storage): set GRPC_ALTS_MAX_CONCURRENT_HANDSHAKES=2 in benchmark runner (...
  • 09a3823 refactor(bigquery): move Arrow query result reading to _arrow_query (#18644)
  • 939bdd0 feat(bigquery-storage): add Arrow options and cancel to read_rows (#18643)
  • 8e640e0 chore(deps): update dependency nox to v2026 (#18681)
  • 706ced0 chore(deps): update dependency shapely to v2.2.0 (#18694)
  • af32b51 chore(deps): update dependency typing-extensions to v4.16.0 (#18697)
  • Additional commits viewable in compare view

Updates granian from 2.8.3 to 2.8.5

Release notes

Sourced from granian's releases.

Granian 2.8.5

Patch release

Changes since 2.8.4:

  • Refactor static files path pattern matching on Windows
  • Fix a shadowing bug in static files url routing
  • Update backlog parameter documentation (#936 by @​RealOrangeOne)
  • Fix IPv6 client address formatting in access log (#933 by @​NotAFlightRisk)
  • Fix a bug in workers kill timeout budget math (#939 by @​Shaisolaris)
  • Fix asyncio event loop cleanup in threaded workers (#940 by @​Shaisolaris)
  • Fix mimalloc CFLAGS on MacOS wheels
  • Bump dependencies

Granian 2.8.4

Patch release

Changes since 2.8.3:

  • Fix ASGI query-string encoding in access log
  • Fix IPv6 formatting in server log
  • Notify ASGI/RSGI apps of client disconnection on HTTP/2 stream reset
  • Avoid to raise errors in ASGI websockets' send calls
  • Bump dependencies
Commits
  • 59cbc26 Close the loop on threaded workers shutdown (#940)
  • 5116380 Refactor static file path checker in win, fix a shadowing issue
  • 3a11d26 Bump PyO3 to 0.30
  • 438950f Keep the worker kill budget from shrinking twice (#939)
  • c497384 Fix CFLAGS for mimalloc builds on MacOS
  • a7483f4 Bump dependencies
  • 50e6fbf Use bash shell on Windows in CI
  • d8a5015 Fix IPv6 client addresses in WSGI access log (#933)
  • 78e43a8 Update backlog help text to reference that it's per worker for TCP sockets (#...
  • 4213f91 Bump version to 2.8.5
  • Additional commits viewable in compare view

Updates jq from 1.12.0 to 1.13.0

Changelog

Sourced from jq's changelog.

1.13.0

  • Add support for Python 3.15.

  • Drop support for Python 3.8.

  • Build Windows ARM64 wheels.

Commits
  • d1a14ce Bump version to 1.13.0
  • 1366325 Note Windows ARM64 wheels in changelog
  • d059f24 Enable free-threaded builds on Windows ARM64 for Python 3.15
  • ddd6236 Allow all Python versions on Windows ARM64
  • df4cf4e Add Windows ARM64 builds
  • 1834e43 Restructure MSYS2 msystem and package selection
  • 0b58305 Update cibuildwheel to 4.3.1
  • 2ca29c3 Add support for Python 3.15
  • 34a7d19 Drop support for Python 3.8
  • 2018586 Fix linking failures on Windows/MSYS2 (#135)
  • Additional commits viewable in compare view

Updates justhtml from 3.11.2 to 3.15.0

Release notes

Sourced from justhtml's releases.

Release v3.15.0

Added

  • Allow per-attribute literal and Regex(...) value allowlists in allowed_attributes, preserving URL and inline-style validation.
  • Allow per-property CSS value allowlists with literal strings and Regex(...) patterns, including explicit permission for CSS variable references.

Security

  • Keep script scanning linear across repeated HTML comment markers, including with default sanitization and the event stream API.
  • Bound Markdown list indentation to prevent quadratic output expansion from deeply nested lists.
  • Reject non-ASCII IPv4 octets during linkification without raising conversion errors on Unicode digit lookalikes.

Fixed

  • Keep whitespace after a <base>, <link> or <meta> that implies the <head> in the head, including when sanitization removes the metadata element.

Release v3.14.0

Fixed

  • Ignore NUL after a less-than sign in HTML text and in CDATA at HTML/MathML integration points, while preserving foreign-text and RAWTEXT replacement rules.
  • Preserve non-ASCII whitespace in class and attribute tokens, selector identifiers, HTML cleanup, and pretty output.
  • Apply ASCII whitespace rules to CSS declarations, URL lists, encoding labels, and streamed doctypes.
  • Reject malformed :nth-child() / :nth-of-type() formulas without accepting Unicode digits or Python integer syntax.
  • Keep a <button> nested when an object, applet, marquee, table cell, caption or integration point separates it from an open <button>, instead of closing the outer one across that scope boundary.

Performance

  • Share class and attribute token sets within selector queries and allocate attribute caches only when needed.

Release v3.13.1

Fixed

  • Honor root attribute overrides when deeply cloning nodes, elements, and templates.
  • Preserve HTML5 frameset eligibility after ordinary body elements, comments, and raw-text content (#92).
  • Exclude doctypes from element selectors, direct matching, and structural sibling indexing (#93).
  • Keep definition-list items open across intervening special elements such as search.
  • Block frameset replacement after literal or character-reference replacement characters in foreign content.

Release v3.13.0

Fixed

  • Prevent Linkify(skip_tags=()) from repeatedly linkifying the text inside its own generated anchors (#86).

Release v3.12.0

Fixed

  • Match HTML5 form recovery in template fragments, including nested and misnested forms.
  • Preserve frameset eligibility when sanitized parsing omits template wrappers from body content.

Release v3.11.3

... (truncated)

Changelog

Sourced from justhtml's changelog.

[3.15.0] - 2026-10-24

Added

  • Allow per-attribute literal and Regex(...) value allowlists in allowed_attributes, preserving URL and inline-style validation.
  • Allow per-property CSS value allowlists with literal strings and Regex(...) patterns, including explicit permission for CSS variable references.

Security

  • Keep script scanning linear across repeated HTML comment markers, including with default sanitization and the event stream API.
  • Bound Markdown list indentation to prevent quadratic output expansion from deeply nested lists.
  • Reject non-ASCII IPv4 octets during linkification without raising conversion errors on Unicode digit lookalikes.

Fixed

  • Keep whitespace after a <base>, <link> or <meta> that implies the <head> in the head, including when sanitization removes the metadata element.

[3.14.0] - 2026-10-22

Fixed

  • Ignore NUL after a less-than sign in HTML text and in CDATA at HTML/MathML integration points, while preserving foreign-text and RAWTEXT replacement rules.
  • Preserve non-ASCII whitespace in class and attribute tokens, selector identifiers, HTML cleanup, and pretty output.
  • Apply ASCII whitespace rules to CSS declarations, URL lists, encoding labels, and streamed doctypes.
  • Reject malformed :nth-child() / :nth-of-type() formulas without accepting Unicode digits or Python integer syntax.
  • Keep a <button> nested when an object, applet, marquee, table cell, caption or integration point separates it from an open <button>, instead of closing the outer one across that scope boundary.

Performance

  • Share class and attribute token sets within selector queries and allocate attribute caches only when needed.

[3.13.1] - 2026-10-12

Fixed

  • Honor root attribute overrides when deeply cloning nodes, elements, and templates.
  • Preserve HTML5 frameset eligibility after ordinary body elements, comments, and raw-text content (#92).
  • Exclude doctypes from element selectors, direct matching, and structural sibling indexing (#93).
  • Keep definition-list items open across intervening special elements such as search.
  • Block frameset replacement after literal or character-reference replacement characters in foreign content.

[3.13.0] - 2026-09-30

Fixed

  • Prevent Linkify(skip_tags=()) from repeatedly linkifying the text inside its own generated anchors (#86).

[3.12.0] - 2026-09-27

Fixed

... (truncated)

Commits
  • 1a3a963 Release v3.15.0
  • 84e6158 docs: prepare 3.15.0 release
  • f1ed4ac feat: implement per-attribute value allowlists with literal and Regex pattern...
  • 59e065b feat: add support for per-property CSS value allowlists with literal strings ...
  • 084469e security: validate ASCII IPv4 digits before conversion
  • edf74fd security: bound Markdown list indentation
  • da234ac security: keep script comment scanning linear
  • eac52a3 fix: preserve whitespace after implied head metadata (#100)
  • cc7c72d Release v3.14.0
  • fb0e655 docs: prepare 3.14.0 release notes
  • Additional commits viewable in compare view

Updates markus[datadog] from 5.0.0 to 5.2.0

Changelog

Sourced from markus[datadog]'s changelog.

5.2.0 (October 14th, 2025)

Features

  • Added support for Python 3.14 (#181)

Backwards incompatible changes

  • Dropped support for Python 3.9 (#180)

  • Switch to uv and just for maintenance and development (#167)

5.1.0 (October 30th, 2024)

Features

  • Added support for Python 3.13 (#159)

Backwards incompatible changes

  • Dropped support for Python 3.8 (#160)

  • Changed timestamp field in LoggingMetrics. The LoggingMetrics now defaults to not emitting a timestamp at all. If you would like a timestamp, you can provide the "timestamp_mode" option with either "utc" for UTC timestamps or "local" for local timezone timestamps.

    No timestamp example::

    LoggingMetrics()

    emits lines like::

    METRICS|histogram|foo|4321|#key1:val

    "utc" timestamp mode example::

    LoggingMetrics(options={"timestamp_mode": "utc"})

    emits lines like::

    METRICS|2017-03-06T11:30:00+00:00:00|histogram|foo|4321|#key1:val

    "local" timestamp mode example::

    LoggingMetrics(options={"timestamp_mode": "local"})

... (truncated)

Commits
  • ef590d2 chore: prep for 5.2.0 release
  • eb1ca83 chore: add Python 3.14 support (#181)
  • a880843 chore: drop support for Python 3.9 (#180)
  • 497563a Bump actions/checkout from 4.2.2 to 5.0.0
  • ab5f322 Bump actions/setup-python from 5.6.0 to 6.0.0
  • 1071422 Switch to CODEOWNERS
  • 400f488 Bump actions/setup-python from 5.5.0 to 5.6.0
  • ad67d8c Change ownership back to willkg (#175)
  • 33cb83e Bump actions/setup-python from 5.4.0 to 5.5.0
  • c4c58ff obs-530: update OS for rtd build
  • Additional commits viewable in compare view

Updates psycopg[binary] from 3.2.8 to 3.3.6

Changelog

Sourced from psycopg[binary]'s changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.7 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Fix segfault fetching arrays of strings or timestamps after closing the connection (:ticket:[#1428](https://github.com/psycopg/psycopg/issues/1428)).
  • Fix ~Connection.cancel_safe() failing if the cancel connection is not ready immediately, for instance on a slow network (:ticket:[#1440](https://github.com/psycopg/psycopg/issues/1440)).
  • Fix reference cycles created every time a list is dumped as an array, which kept the dumped data in memory until the next garbage collection (:ticket:[#1443](https://github.com/psycopg/psycopg/issues/1443)).
  • Fix loading intervals with a very large number of hours in text format, which could lose microseconds (:ticket:[#1446](https://github.com/psycopg/psycopg/issues/1446)).
  • Roll back the transaction if entering a ~Connection.transaction() block is interrupted, for instance by a task cancellation (:ticket:[#1451](https://github.com/psycopg/psycopg/issues/1451)).
  • Quote array elements with Unicode white space, which CockroachDB would otherwise strip from strings (cockroach#176211__, 🎫[#1465](https://github.com/psycopg/psycopg/issues/1465)).
  • Set the system SSL root certificate directory to /etc/ssl in the binary packages on Linux and macOS.

.. __: cockroachdb/cockroach#176211

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

  • Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).
  • Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).
  • Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).
  • Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).
  • Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).

... (truncated)

Commits
  • a67654d chore: bump psycopg package version to 3.3.6
  • 443814b Merge pull request #1416 from dvarrazzo/wait-async-perf
  • 42966e9 test: add helpful comments to some tests
  • 5e8797f test: add reasonable connect_timeout to most tests
  • c81ba62 perf: reduce the overhead of wait_async()
  • d2bbfe4 refactor: use get_running_loop() in the async wait functions
  • 2b1484a test: add a script to measure the async wait functions
  • 573cf4a test: fix incorrect wait timing test
  • 2b68990 refactor: drop leftovers of waiting with inf interval in wait_conn_async
  • 60765dd Merge pull request #1414 from dvarrazzo/fix-decimal-overflow
  • Additional commits viewable in compare view

Updates sentry-sdk from 2.69.2 to 2.73.0

Release notes

Sourced from sentry-sdk's releases.

2.73.0

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

Deps

Other

2.72.0

New Features ✨

Asgi

Boto3

Wsgi

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.73.0

New Features ✨

Bug Fixes 🐛

Internal Changes 🔧

Deps

Other

2.72.0

New Features ✨

Asgi

Boto3

Wsgi

... (truncated)

Commits
  • 54160ae release: 2.73.0
  • 25d265b fix: Exclude litellm==1.107.0 from extras (#8104)
  • 60116ac fix(celery): Don't round down beat schedule intervals (#7842)
  • 68bc4dd fix(arq): Don't monitor cron jobs with unsupported schedules (#8098)
  • 1c249d8 feat(huey): Add an option to monitor Huey periodic tasks (#8052)
  • 4e19592 feat(rq): Add an option to monitor rq-scheduler jobs (#8053)
  • f8b08b3 meta: Update AGENTS.md (#8077)
  • cfce72f chore(deps): bump uv from 0.13.0 to 0.13.4 (#8095)
  • a9553c4 feat(arq): Add an option to monitor arq cron jobs (#8051)
  • 641517a fix(attributes): Handle special float values correctly (#8067)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the backend group with 8 updates
a8b85d0 
Bumps the backend group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [django-storages[google]](https://github.com/jschneier/django-storages) | `1.14.4` | `1.14.6` |
| [google-cloud-storage](https://github.com/googleapis/google-cloud-python) | `3.14.1` | `3.17.1` |
| [granian](https://github.com/emmett-framework/granian) | `2.8.3` | `2.8.5` |
| [jq](https://github.com/mwilliamson/jq.py) | `1.12.0` | `1.13.0` |
| [justhtml](https://github.com/emilstenstrom/justhtml) | `3.11.2` | `3.15.0` |
| [markus[datadog]](https://github.com/mozilla-services/markus) | `5.0.0` | `5.2.0` |
| [psycopg[binary]](https://github.com/psycopg/psycopg) | `3.2.8` | `3.3.6` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.69.2` | `2.73.0` |


Updates `django-storages[google]` from 1.14.4 to 1.14.6
- [Changelog](https://github.com/jschneier/django-storages/blob/master/CHANGELOG.rst)
- [Commits](jschneier/django-storages@1.14.4...1.14.6)

Updates `google-cloud-storage` from 3.14.1 to 3.17.1
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-storage-v3.14.1...google-cloud-storage-v3.17.1)

Updates `granian` from 2.8.3 to 2.8.5
- [Release notes](https://github.com/emmett-framework/granian/releases)
- [Commits](emmett-framework/granian@v2.8.3...v2.8.5)

Updates `jq` from 1.12.0 to 1.13.0
- [Changelog](https://github.com/mwilliamson/jq.py/blob/master/CHANGELOG.rst)
- [Commits](mwilliamson/jq.py@1.12.0...1.13.0)

Updates `justhtml` from 3.11.2 to 3.15.0
- [Release notes](https://github.com/emilstenstrom/justhtml/releases)
- [Changelog](https://github.com/EmilStenstrom/justhtml/blob/main/CHANGELOG.md)
- [Commits](EmilStenstrom/justhtml@v3.11.2...v3.15.0)

Updates `markus[datadog]` from 5.0.0 to 5.2.0
- [Changelog](https://github.com/mozilla-services/markus/blob/main/HISTORY.rst)
- [Commits](mozilla-services/markus@v5.0.0...v5.2.0)

Updates `psycopg[binary]` from 3.2.8 to 3.3.6
- [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst)
- [Commits](psycopg/psycopg@3.2.8...3.3.6)

Updates `sentry-sdk` from 2.69.2 to 2.73.0
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.69.2...2.73.0)

---
updated-dependencies:
- dependency-name: django-storages[google]
  dependency-version: 1.14.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: google-cloud-storage
  dependency-version: 3.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: granian
  dependency-version: 2.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: jq
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: justhtml
  dependency-version: 3.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: markus[datadog]
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: psycopg[binary]
  dependency-version: 3.3.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: sentry-sdk
  dependency-version: 2.73.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added Backend Server stuff yo dependencies Pull requests that update a dependency file labels Nov 1, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Backend Server stuff yo dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants