• f4bc676 2026.07.22 (#428)
• 4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427)
• 01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426)
• eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425)
• 474e6fc Include tests in the source distribution (#424)
• a31ef39 Bump actions/setup-python from 6.2.0 to 6.3.0 (#420)
• 98eb2c7 Bump actions/checkout from 6.0.3 to 7.0.0 (#419)
• See full diff in compare view

Sourced from fastapi's releases.

0.140.13

Fixes

• 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints. PR #15937 by @​SAURABHSALVE.

Docs

• 📝 Fix format_sse_event docstring rendering of \n\n terminator. PR #15613 by @​AshNicolus.
• 📝 Add API reference page for fastapi.sse. PR #15930 by @​SAURABHSALVE.

0.140.12

Fixes

• 🐛 Fix line splitting in format_sse_event to comply with SSE spec. PR #15515 by @​Zawwarsami16.

0.140.11

Fixes

• 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

• 🐛 Fix handling sequences with nested Annotated types. PR #14874 by @​YuriiMotov.

Internal

• 🐛 Accept any base test failure as regression. PR #16092 by @​tiangolo.
• 🐛 Preserve pytest exit code in regression check. PR #16091 by @​tiangolo.
• ✅ Test PR regressions against base code. PR #16090 by @​tiangolo.

0.140.9

Fixes

• 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

Internal

• ⬆ Bump gitpython from 3.1.50 to 3.1.54. PR #16047 by @​dependabot[bot].
• ⬆ Bump pymdown-extensions from 10.21.3 to 11.0. PR #16048 by @​dependabot[bot].
• ⬆ Bump pyasn1 from 0.6.3 to 0.6.4. PR #16045 by @​dependabot[bot].

0.140.8

Fixes

• 🐛 Fix stream item type lost when using include_router(). PR #15077 by @​alex-raw.

0.140.6

Refactors

... (truncated)

• 628663f 🔖 Release version 0.140.13 (#16096)
• 0b54fd0 📝 Update release notes
• e92a0dc 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints (#15937)
• 6215d8a 📝 Update release notes
• 12242c4 📝 Fix format_sse_event docstring rendering of \n\n terminator (#15613)
• 70a8f3d 📝 Update release notes
• 4f0152c 📝 Add API reference page for fastapi.sse (#15930)
• 5f25505 🔖 Release version 0.140.12 (#16095)
• 76e2c83 📝 Update release notes
• 0f3e7bd 🐛 Fix line splitting in format_sse_event to comply with SSE spec (#15515)
• Additional commits viewable in compare view

Sourced from geopy's releases.

2.5.0

Security Advisory

GitHub Security advisory: GHSA-mhvh-fq92-pfmr.

Regular Expression Denial of Service (ReDoS) in geopy.Point: geopy.Point.from_string may take excessive CPU time when parsing long, malformed coordinate strings due to inefficient regular-expression behavior.

The numeric geopy.Point constructor is not affected.

Geocoders' reverse methods called with string inputs exercise the vulnerable path.

Reported by Younghun Lee in #608, fix contributed by Apoorv Darshan in #610.

The fix rejects any inputs longer than 256 chars unconditionally, which may start falsely rejecting previously valid Point strings with long irrelevant prefixes.

Bugfixes

• .Geocodio: fix GeocoderQueryError being raised for empty results.
• .GoogleV3: fix utcnow deprecation warnings.

Packaging Changes

• Drop support for Python 3.7.
• Add support for Python 3.13, 3.14, and 3.15.
• Migrate build metadata from setup.py to setup.cfg. Remove download_url from the metadata. Contributed by Mike Taves. #535
• Replace distutils with packaging in tests (fixes Python 3.12+).

Code Improvements

• Remove Python 2 relics. Contributed by Miroslav Šedivý. #552

Test Improvements

• Fix applying pytest marks to fixtures (pytest >= 9.1 compatibility). Contributed by Tomáš Hrnčiar. #609
• Fix unclosed event loop warning in tests.
• Fix pytest classmethod warning.
• .Nominatim: fix test_reverse_near_zero which was failing due to locale-specific response formatting. Contributed by Alfredo Tupone. #606

Docs Improvements

... (truncated)

Sourced from geopy's changelog.

2.5.0

2026-07-12

Security Advisory

GitHub Security advisory: :ghsa:`mhvh-fq92-pfmr`.
Regular Expression Denial of Service (ReDoS) in :class:.Point:

:meth:.Point.from_string may take excessive CPU time when parsing long,

malformed coordinate strings due to inefficient regular-expression behavior.
The numeric :class:.Point constructor is not affected.
Geocoders' reverse methods called with string inputs exercise the vulnerable path.
Reported by Younghun Lee in :issue:608,

fix contributed by Apoorv Darshan in :issue:610.
The fix rejects any inputs longer than 256 chars unconditionally,

which may start falsely rejecting previously valid Point strings

with long irrelevant prefixes.
Bugfixes

- :class:`.Geocodio`: fix ``GeocoderQueryError`` being raised for empty results.
- :class:`.GoogleV3`: fix ``utcnow`` deprecation warnings.
Packaging Changes

</code></pre>

<ul>

<li>Drop support for Python 3.7.</li>

<li>Add support for Python 3.13, 3.14, and 3.15.</li>

<li>Migrate build metadata from <code>setup.py</code> to <code>setup.cfg</code>.

Remove <code>download_url</code> from the metadata.

Contributed by Mike Taves. (:issue:<code>535</code>)</li>

<li>Replace <code>distutils</code> with <code>packaging</code> in tests (fixes Python 3.12+).</li>

</ul>

<p>Code Improvements</p>

<pre><code>

Remove Python 2 relics.

Contributed by Miroslav Šedivý. (:issue:552)

Test Improvements

</code></pre>

<ul>

<li>Fix applying pytest marks to fixtures (pytest &gt;= 9.1 compatibility).</li>

</ul>

<!-- raw HTML omitted -->

</blockquote>

<p>... (truncated)</p>

</details>

<details>

<summary>Commits</summary>
<ul>

<li><a href="https://github.com/geopy/geopy/commit/402cbba8b093e5e3f89c81b902f576d65608a123&quot;&gt;&lt;code&gt;402cbba&lt;/code&gt;&lt;/a> 2.5.0</li>

<li><a href="https://github.com/geopy/geopy/commit/f8c0dbd0c40db381e3eb906cc3428e04d33b19c4&quot;&gt;&lt;code&gt;f8c0dbd&lt;/code&gt;&lt;/a> Makefile: fix make dist broken after 9af8380</li>

<li><a href="https://github.com/geopy/geopy/commit/46c9eef67abbe10857cfe651b77fc1e33f5637c1&quot;&gt;&lt;code&gt;46c9eef&lt;/code&gt;&lt;/a> Add versionchanged</li>

<li><a href="https://github.com/geopy/geopy/commit/160aec2567168eaec8b78bc6c55125f6cf669246&quot;&gt;&lt;code&gt;160aec2&lt;/code&gt;&lt;/a> Update changelog</li>

<li><a href="https://github.com/geopy/geopy/commit/106ff54eafe7ecc5966938ed07705a883882c475&quot;&gt;&lt;code&gt;106ff54&lt;/code&gt;&lt;/a> AUTHORS: update an email per user's request</li>

<li><a href="https://github.com/geopy/geopy/commit/f35e84ec387671f263099f59a56844c0fe217d51&quot;&gt;&lt;code&gt;f35e84e&lt;/code&gt;&lt;/a> Pull up AUTHORS</li>

<li><a href="https://github.com/geopy/geopy/commit/2c3df74a4af3c4499e0b4b44b45c9c86dd3be8ac&quot;&gt;&lt;code&gt;2c3df74&lt;/code&gt;&lt;/a> Improve English grammar</li>

<li><a href="https://github.com/geopy/geopy/commit/7f176f08cc018a726b795e5ed9f2ab76ab5005a8&quot;&gt;&lt;code&gt;7f176f0&lt;/code&gt;&lt;/a> tests: fix pytest error in 3.13+ caused by ce21fb7</li>

<li><a href="https://github.com/geopy/geopy/commit/547eb9b72fa22a4c8dea09098d2b207bc4e94be9&quot;&gt;&lt;code&gt;547eb9b&lt;/code&gt;&lt;/a> Geocodio: fix GeocoderQueryError being raised for empty result</li>

<li><a href="https://github.com/geopy/geopy/commit/fbca44f4361e2eb05e1232092ccc4860e02f6c7f&quot;&gt;&lt;code&gt;fbca44f&lt;/code&gt;&lt;/a> GoogleV3: fix utcnow deprecation warnings</li>

<li>Additional commits viewable in <a href="https://github.com/geopy/geopy/compare/2.4.1...2.5.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />

Updates pandas from 3.0.3 to 3.0.5

Release notes
Sourced from pandas's releases.

pandas 3.0.5
We are pleased to announce the release of pandas 3.0.5.
This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.
See the full whatsnew for a list of all the changes.
Pandas 3.0 supports Python 3.11 and higher.
The release can be installed from PyPI:
python -m pip install --upgrade pandas==3.0.*

Or from conda-forge
conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.
Thanks to all the contributors who made this release possible.
pandas 3.0.4
We are pleased to announce the release of pandas 3.0.4.
This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.
See the full whatsnew for a list of all the changes.
Pandas 3.0 supports Python 3.11 and higher.
The release can be installed from PyPI:
python -m pip install --upgrade pandas==3.0.*

Or from conda-forge
conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.
Thanks to all the contributors who made this release possible.



Commits

e68db09 RLS: 3.0.5
0697623 Backport PR #66428: DOC: update whatsnew for 3.0.5 (#66430)
5d846d0 Backport PR #66090 on branch 3.0.x (BLD: exclude numpy 2.5.0 when building wh...
bef7a2b Backport PR #66169 on branch 3.0.x (CI: Fix pyarrow-nightly job (stale nightl...
8188eb1 RLS: 3.0.4 (#66079)
bd35f15 [3.0.x] BUG: fix CoW issue in eval() (#66072)
6195872 [backport 3.0.x] BUG: anchor whole alternation in Series.str.match for PyArro...
70313be Backport PR #66051 on branch 3.0.x (BUG: fix regression in DataFrame setitem ...
57ed3e2 [backport 3.0.x] Bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#65934) (#66026)
f9693fc [backport 3.0.x] BUG(pandas 3.0 regression): drop(index=...) doesn't accept N...
Additional commits viewable in compare view




Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options


You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions