Skip to content

chore(backend): bump the backend group across 1 directory with 8 updates - #22

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-720b1b10dd
Open

chore(backend): bump the backend group across 1 directory with 8 updates#22
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-720b1b10dd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the backend group with 8 updates in the /backend directory:

Package From To
django 6.1.1 6.1.2
django-filter 26.1 26.2
djangorestframework 3.18.1 3.18.3
drf-spectacular-sidecar 2026.9.1 2026.10.1
iniconfig 2.3.0 2.3.1
pyjwt 2.14.0 2.15.1
rpds-py 2026.6.3 2026.9.1
tzdata 2026.4 2026.5

Updates django from 6.1.1 to 6.1.2

Commits

Updates django-filter from 26.1 to 26.2

Changelog

Sourced from django-filter's changelog.

Version 26.2 (2026-10-03)

  • Added testing against Python 3.15.

  • Dropped support for Python 3.10.

  • LinkWidget will now conditionally escape provided label text.

    Filter choices are under developer control, and applications populating them from user-supplied values, including via AllValuesFilter, must filter those appropriately, as always. Nonetheless, escaping labels by default serves as defense-in-depth hardening. Apply mark_safe() to labels intended to contain HTML.

    Thanks to Sanjeev Kumar for the report.

Commits
  • daddf7b Set date and bump version for 26.2 release.
  • a3593ea Escape LinkWidget values.
  • 29be896 Update testing to add Python 3.15 and drop 3.10.
  • 5128b8f Increase the version upper limit for flit_core to 5
  • See full diff in compare view

Updates djangorestframework from 3.18.1 to 3.18.3

Release notes

Sourced from djangorestframework's releases.

3.18.3

What's Changed

Bug fixes

Full Changelog: encode/django-rest-framework@3.18.2...3.18.3

3.18.2

What's Changed

Security

Features

Bug fixes

New Contributors

Full Changelog: encode/django-rest-framework@3.18.1...3.18.2

Commits

Updates drf-spectacular-sidecar from 2026.9.1 to 2026.10.1

Commits

Updates iniconfig from 2.3.0 to 2.3.1

Release notes

Sourced from iniconfig's releases.

Version 2.3.1

Fixes

  • Parsing values with many continuation lines is now linear instead of quadratic in time (#78, regarding #77).
  • A leading UTF-8 BOM is now stripped when reading INI files. Files saved by Windows editors used to fail with ParseError (#76, thanks @​Pitchfork-and-Torch).

Internal

  • iniconfig._parse.ParsedLine.value is now a list of lines. This is private API.

Docs

Full diff: pytest-dev/iniconfig@v2.3.0...v2.3.1

What's Changed

New Contributors

Full Changelog: pytest-dev/iniconfig@v2.3.0...v2.3.1

Changelog

Sourced from iniconfig's changelog.

2.3.1

  • fix quadratic parse time for values with many continuation lines (#78, regarding #77)
  • strip a leading UTF-8 BOM when reading INI files, which previously raised ParseError (#76)
  • internal: iniconfig._parse.ParsedLine.value is now a list of lines
Commits
  • 316fbfa changelog: add BOM stripping (#76) to 2.3.1 (#81)
  • d2dcb72 Strip leading UTF-8 BOM when reading INI files (#76)
  • 40d8c03 Merge pull request #79 from MbappeWU/codex/docs-parse-inline-comments
  • 48359c3 Merge pull request #80 from pytest-dev/claude/fix-iniconfig-test-eukh2n
  • b153213 test: expect sorted all after ruff RUF022 autofix
  • 4fddfab Merge pull request #73 from pytest-dev/pre-commit-ci-update-config
  • 15852c2 [pre-commit.ci] auto fixes from pre-commit.com hooks
  • 2e68639 [pre-commit.ci] pre-commit autoupdate
  • 23c9e08 docs: use parse API in the README example
  • e038536 Merge pull request #78 from RonnyPfannschmidt/claude/dazzling-einstein-h8zq7m
  • Additional commits viewable in compare view

Updates pyjwt from 2.14.0 to 2.15.1

Release notes

Sourced from pyjwt's releases.

2.15.1

See the 2.15.1 changelog for complete release details.

2.15.0

See the 2.15.0 changelog for complete release details.

Changelog

Sourced from pyjwt's changelog.

v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>__

Fixed


- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`[#1209](https://github.com/jpadilla/pyjwt/issues/1209) <https://github.com/jpadilla/pyjwt/issues/1209>`__).

v2.15.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&gt;__


Security

  • Wrap recursion errors from deeply nested JWT payloads in DecodeError instead of exposing a raw RecursionError.

Added


- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__

Changed

  • JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS payload, so a cache hit no longer re-parses every key. JWKSetCache.put() accepts either form and raises PyJWKSetError for anything else. As a result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance for as long as it stays cached, rather than a freshly built one per call in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
  • PyJWKClient.fetch_data() now raises PyJWKClientError("The JWKS endpoint did not return a JSON object") when the endpoint response is not a JSON object, instead of returning it for get_jwk_set() to reject. Callers reaching the JWKS through get_jwk_set() see the same error as before in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed


- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
</tr></table>

... (truncated)

Commits
  • 7d5ef55 chore: prepare 2.15.1 release
  • 7bf3252 Accept canonical Base64URL padding in JWT segments (#1216)
  • 1d41a64 chore: prepare 2.15.0 release
  • 9bc0665 fix: make recursive payload tests deterministic
  • 5fde08a fix: normalize recursive JWT payload errors
  • 171062d utils: mention bytes in force_bytes type error (#1173)
  • c9d4d53 docs/conf: drop duplicate 'and' from read() docstring (#1174)
  • 2763752 Add support for Python 3.15 (#1202)
  • 4adcd02 Catch http.client.HTTPException in PyJWKClient.fetch_data (#1201)
  • 9e501d9 fix: correct docstring typo in _validate_jti (#1179)
  • Additional commits viewable in compare view

Updates rpds-py from 2026.6.3 to 2026.9.1

Commits
  • fc7a185 Release rpds-py version 2026.9.1
  • d19ef61 Merge pull request #311 from edgarrmondragon/pypy312
  • 47ac82f Bump PyO3 to 0.29.3 and start building PyPy 3.12 wheels
  • cf0900d Merge pull request #308 from crate-py/dependabot/github_actions/github/codeql...
  • 204fd02 Merge pull request #309 from crate-py/dependabot/github_actions/astral-sh/set...
  • 264fdef Merge pull request #310 from crate-py/pre-commit-ci-update-config
  • 5ddee5c [pre-commit.ci] pre-commit autoupdate
  • 9fe3318 Bump astral-sh/setup-uv from 10.1.0 to 10.2.0
  • 2302c70 Bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1
  • 93bbcbb Merge pull request #305 from crate-py/dependabot/github_actions/astral-sh/set...
  • Additional commits viewable in compare view

Updates tzdata from 2026.4 to 2026.5

Release notes

Sourced from tzdata's releases.

2026.5: Release of upstream tzdata 2026e

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00.

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.)

As the change affects both America/Winnipeg and its backward compatibility link, the obsolescent setting TZ="Canada/Central" will now use the abbreviation EST for affected timestamps, akin to TZ="Canada/Pacific" behavior introduced in 2026b.

Another TZDB release may be needed soon if any of the portions of northwestern Ontario historically aligned with America/Winnipeg do not follow. For now, given the short leadtime with Manitoba’s announcement, assume that they will, to avoid creating new zones that may not be needed if no divergence occurs.

Changes to past timestamps

In 1925 Ireland fell back on 09-20 not 10-04 (thanks to Stan Ulbrych).

Changes to commentary

Discussion on timekeeping practices in northwestern Ontario has been expanded in light of Manitoba’s recent announcement. It is not yet known whether or to what extent these areas may adapt their own timekeeping practices in response.

Changelog

Sourced from tzdata's changelog.

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.)

As the change affects both America/Winnipeg and its backward compatibility link, the obsolescent setting TZ="Canada/Central" will now use the abbreviation EST for affected timestamps, akin to TZ="Canada/Pacific" behavior introduced in 2026b.

Another TZDB release may be needed soon if any of the portions of northwestern Ontario historically aligned with America/Winnipeg do not follow. For now, given the short leadtime with Manitoba’s announcement, assume that they will, to avoid creating new zones that may not be needed if no divergence occurs.

Changes to past timestamps

In 1925 Ireland fell back on 09-20 not 10-04 (thanks to Stan Ulbrych).

Changes to commentary

Discussion on timekeeping practices in northwestern Ontario has been expanded in light of Manitoba’s recent announcement. It is not yet known whether or to what extent these areas may adapt their own timekeeping practices in response.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(backend): bump the backend group across 1 directory with 8 updates
2d00030 
Bumps the backend group with 8 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [django](https://github.com/django/django) | `6.1.1` | `6.1.2` |
| [django-filter](https://github.com/carltongibson/django-filter) | `26.1` | `26.2` |
| [djangorestframework](https://github.com/encode/django-rest-framework) | `3.18.1` | `3.18.3` |
| [drf-spectacular-sidecar](https://github.com/tfranzel/drf-spectacular-sidecar) | `2026.9.1` | `2026.10.1` |
| [iniconfig](https://github.com/pytest-dev/iniconfig) | `2.3.0` | `2.3.1` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.14.0` | `2.15.1` |
| [rpds-py](https://github.com/crate-py/rpds) | `2026.6.3` | `2026.9.1` |
| [tzdata](https://github.com/python/tzdata) | `2026.4` | `2026.5` |



Updates `django` from 6.1.1 to 6.1.2
- [Commits](django/django@6.1.1...6.1.2)

Updates `django-filter` from 26.1 to 26.2
- [Release notes](https://github.com/carltongibson/django-filter/releases)
- [Changelog](https://github.com/carltongibson/django-filter/blob/main/CHANGES.rst)
- [Commits](carltongibson/django-filter@26.1...26.2)

Updates `djangorestframework` from 3.18.1 to 3.18.3
- [Release notes](https://github.com/encode/django-rest-framework/releases)
- [Commits](encode/django-rest-framework@3.18.1...3.18.3)

Updates `drf-spectacular-sidecar` from 2026.9.1 to 2026.10.1
- [Commits](tfranzel/drf-spectacular-sidecar@2026.9.1...2026.10.1)

Updates `iniconfig` from 2.3.0 to 2.3.1
- [Release notes](https://github.com/pytest-dev/iniconfig/releases)
- [Changelog](https://github.com/pytest-dev/iniconfig/blob/main/CHANGELOG)
- [Commits](pytest-dev/iniconfig@v2.3.0...v2.3.1)

Updates `pyjwt` from 2.14.0 to 2.15.1
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.14.0...2.15.1)

Updates `rpds-py` from 2026.6.3 to 2026.9.1
- [Release notes](https://github.com/crate-py/rpds/releases)
- [Changelog](https://github.com/crate-py/rpds/blob/main/release.toml)
- [Commits](crate-py/rpds@v2026.6.3...v2026.9.1)

Updates `tzdata` from 2026.4 to 2026.5
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.4...2026.5)

---
updated-dependencies:
- dependency-name: django
  dependency-version: 6.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: django-filter
  dependency-version: '26.2'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: djangorestframework
  dependency-version: 3.18.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: drf-spectacular-sidecar
  dependency-version: 2026.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: iniconfig
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: pyjwt
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: rpds-py
  dependency-version: 2026.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: tzdata
  dependency-version: '2026.5'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 10, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants