chore(backend): bump the backend group across 1 directory with 12 updates by dependabot[bot] · Pull Request #6 · code-kasha/lead-platform

dependabot · 2026-09-26T15:25:34Z

Bumps the backend group with 12 updates in the /backend directory:

Package	From	To
django	`6.0.7`	`6.1.1`
djangorestframework	`3.17.1`	`3.18.1`
drf-spectacular-sidecar	`2026.7.1`	`2026.9.1`
gunicorn	`26.0.0`	`26.2.0`
packaging	`26.2`	`26.3`
psycopg	`3.3.4`	`3.3.6`
psycopg-binary	`3.3.4`	`3.3.6`
pygments	`2.20.0`	`2.21.0`
pyjwt	`2.13.0`	`2.14.0`
pytest-django	`4.12.0`	`4.14.0`
sqlparse	`0.5.5`	`0.6.0`
tzdata	`2026.3`	`2026.4`

Updates django from 6.0.7 to 6.1.1

Commits

249b13d [6.1.x] Bumped version for 6.1.1 release.
5f26fa8 [6.1.x] Added release date for 6.1.1.
fdcf78a [6.1.x] Added remaining community package mentions to the documentation.
7241568 [6.1.x] Fixed #37222 -- Fixed QuerySet.distinct() crash on duplicated selecti...
ef3fc80 [6.1.x] Fixed #37312, Refs #36605 -- Fixed annotation preservation and key se...
b09cb6b [6.1.x] Clarified scope of object-level admin view permissions.
a6d3aa2 [6.1.x] Corrected heading hierarchy in the admin actions documentation.
9031d41 [6.1.x] Clarified object-level permission checks in admin actions.
fc805c6 [6.1.x] Fixed #37311 -- Prevented consumption of rhs iterators in annotation ...
4b0185a [6.1.x] Fixed #37300 -- Preserved parent instance hints on custom Prefetch qu...
Additional commits viewable in compare view

Updates djangorestframework from 3.17.1 to 3.18.1

Release notes

Sourced from djangorestframework's releases.

3.18.1

What's Changed

Bug fixes

Fix duplicate validation errors for GenericIPAddressField with protocol by @browniebroke in encode/django-rest-framework#10011

Fix int64 format detection for negative IntegerField minimums in OpenAPI schema definition by @zainnadeem786 in encode/django-rest-framework#9989

Fix list serializer on unique constraint validator by @MehrazRumman in encode/django-rest-framework#10033

Reject non-finite values (nan, inf) in FloatField by @winklemad in encode/django-rest-framework#9998

Other changes

Add a compatibility setting for ListSerializer error formats by @Kub-AT in encode/django-rest-framework#10027

Expand deprecation classes and review deprecation policy by @browniebroke in encode/django-rest-framework#10034

New Contributors

@abidaliamanat9 made their first contribution in encode/django-rest-framework#10028

@epuronta made their first contribution in encode/django-rest-framework#10030

@Kub-AT made their first contribution in encode/django-rest-framework#10027

@winklemad made their first contribution in encode/django-rest-framework#9998

Full Changelog: encode/django-rest-framework@3.18.0...3.18.1

3.18.0

What's Changed

Breaking changes

Drop support for Django 4.2, Django 5.0 and Django 5.1 by @p-r-a-v-i-n in encode/django-rest-framework#9899

Change errors for list serializers (many=True) to dict format by @p-r-a-v-i-n in encode/django-rest-framework#9837

Features

Add unaccent to SearchFilter by @mgaligniana in encode/django-rest-framework#9385

Add support for Django 6.1 by @browniebroke in encode/django-rest-framework#10003

Add @throttle_scope function based view decorator by @d-ryzhykau in encode/django-rest-framework#9963

Add nulls_distinct support to UniqueTogetherValidator by @mag123c in encode/django-rest-framework#9866

Bug fixes

Include choices param for non-editable fields by @ticosax in encode/django-rest-framework#9929

Improve cursor pagination template accessibility in browsable API by @kosbemrunal in encode/django-rest-framework#9905

Fix partial form data updates involving ListField by @Natgho in encode/django-rest-framework#9902

Fix crash due to browsable API extra action permissions by @dlfoerster in encode/django-rest-framework#9934

Handle unhashable BooleanField representation value by @emfpdlzj in encode/django-rest-framework#9973

Fix OpenAPI schema for zero numeric bounds on ListField children by @zainnadeem786 in encode/django-rest-framework#9977

Replace cc_delim_re usage with split_header_value for Django 6.1+ compatibility by @laymonage in encode/django-rest-framework#9978

Fix set_rollback to only rollback initialized connections by @jdetaeye in encode/django-rest-framework#9599

Fix DictField HTML input returning empty dict for missing fields by @veeceey in encode/django-rest-framework#9891

Raise clear error for unsupported unique-together list updates by @zainnadeem786 in encode/django-rest-framework#9981

Other changes

Prepare release 3.18.0 by @github-actions[bot] in encode/django-rest-framework#10015

New Contributors

@Im-Bilal made their first contribution in encode/django-rest-framework#9967

@dlfoerster made their first contribution in encode/django-rest-framework#9934

... (truncated)

Commits

dd23495 Prepare release 3.18.1 (#10036)
cb1fb66 Install gettext in prepare-release
858f1fc Reject non-finite values (nan, inf) in FloatField (#9998)
ea695cd Ensure translations are up to date when preparing release
0406c6e Update pygments requirement from >=2.17,<2.21 to ==2.21.* in the optional gro...
8c92e89 Expand deprecation classes and review deprecation policy (#10034)
3157a6a Update pytest config to native TOML format from v9 (#10035)
4f77428 Fixing issue #9484 (#10033)
f17d70f Fix int64 format detection for negative IntegerField minimums in Open API s...
5668281 Add a compatibility setting for ListSerializer error formats (#10027)
Additional commits viewable in compare view

Updates drf-spectacular-sidecar from 2026.7.1 to 2026.9.1

Commits

b88657e version bump 2026.9.1
07766c9 version bump 2026.8.1
See full diff in compare view

Updates gunicorn from 26.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

36f2a3c gunicorn 26.2.0
cbba350 test: cover the h2c edge paths that had none
9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
5853551 Merge pull request #3712 from Rotzbua/patch-1
7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)

PEP 808: accept Metadata-Version: 2.6. (#1194)

Add a limit argument to parse_tag() for compressed tag sets. (#1220)

Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)

Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)

Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)

Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)

Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)

Fix an AttributeError when hashing internally trimmed versions. (#1242)

Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)

Normalize requested extra names before comparing or hashing requirements. (#644)

Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)

Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)

Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)

Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)

Keep the parentheses of a nested group when serializing markers. (#1316)

Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)

Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)

Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)

Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)

Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)

Accept the UTF-8 charset case-insensitively in email payloads. (#1330)

Reject malformed Description-Content-Type values. (#1329)

Don't rewrite user values that contain {field} placeholders in error messages. (#1327)

Route multipart email payloads to unparsed instead of asserting. (#1247)

Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)

Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() &lt;packaging.specifiers.SpecifierSet.to_range&gt;,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() &lt;packaging.specifiers.SpecifierSet.is_subset&gt;, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

929fd4b Bump for release
f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
413d006 docs: changelog for 26.3 (#1343)
4eb0753 docs(metadata): explain selective field validation (#1342)
77e9ed4 feat(tags): add pure Python tag generator (#1346)
7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
Additional commits viewable in compare view

Updates psycopg from 3.3.4 to 3.3.6

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).

Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).

Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).

Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).

Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).

Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).

Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).

Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).

Psycopg 3.3.5 ^^^^^^^^^^^^^

Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).

Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).

Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).

Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).

Raise !DataError instead of !ValueError when ~psycopg.rows.namedtuple_row receives duplicate column names (:ticket:[#1348](https://github.com/psycopg/psycopg/issues/1348)).

Raise !DataError on inconsistent copy data (:tickets:[#1359](https://github.com/psycopg/psycopg/issues/1359), [#1360](https://github.com/psycopg/psycopg/issues/1360)).

Handle client encodings aliases (:ticket:[#1363](https://github.com/psycopg/psycopg/issues/1363)).

Fix building C extension with Cython 3.3.

Psycopg 3.3.4

... (truncated)

Commits

a67654d chore: bump psycopg package version to 3.3.6
443814b Merge pull request #1416 from dvarrazzo/wait-async-perf
42966e9 test: add helpful comments to some tests
5e8797f test: add reasonable connect_timeout to most tests
c81ba62 perf: reduce the overhead of wait_async()
d2bbfe4 refactor: use get_running_loop() in the async wait functions
2b1484a test: add a script to measure the async wait functions
573cf4a test: fix incorrect wait timing test
2b68990 refactor: drop leftovers of waiting with inf interval in wait_conn_async
60765dd Merge pull request #1414 from dvarrazzo/fix-decimal-overflow
Additional commits viewable in compare view

Updates psycopg-binary from 3.3.4 to 3.3.6

Changelog

Sourced from psycopg-binary's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).

Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).

Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).

Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).

Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).

Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).

Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).

Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).

Psycopg 3.3.5 ^^^^^^^^^^^^^

Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).

Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).

Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).

Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).

Raise !DataError instead of !ValueError when ~psycopg.rows.namedtuple_row receives duplicate column names (:ticket:[#1348](https://github.com/psycopg/psycopg/issues/1348)).

Raise !DataError on inconsistent copy data (:tickets:[#1359](https://github.com/psycopg/psycopg/issues/1359), [#1360](https://github.com/psycopg/psycopg/issues/1360)).

Handle client encodings aliases (:ticket:[#1363](https://github.com/psycopg/psycopg/issues/1363)).

Fix building C extension with Cython 3.3.

Psycopg 3.3.4

... (truncated)

Commits

a67654d chore: bump psycopg package version to 3.3.6
443814b Merge pull request #1416 from dvarrazzo/wait-async-perf
42966e9 test: add helpful comments to some tests
5e8797f test: add reasonable connect_timeout to most tests
c81ba62 perf: reduce the overhead of wait_async()
d2bbfe4 refactor: use get_running_loop() in the async wait functions
2b1484a test: add a script to measure the async wait functions
573cf4a test: fix incorrect wait timing test
2b68990 refactor: drop leftovers of waiting with inf interval in wait_conn_async
60765dd Merge pull request #1414 from dvarrazzo/fix-decimal-overflow
Additional commits viewable in compare view

Updates pygments from 2.20.0 to 2.21.0

Release notes

Sourced from pygments's releases.

2.21.0

New lexers:

BitBake (#3103)

Caddyfile (#3225)

CEL (#3048)

PureScript (#1077, #3054)

Updated lexers:

Bash: Fix coloured keyword at the beginning of a name (#2926)

Boogie: Add missing Boogie and Civl Verifier keywords (#3156)

C#:

Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)

Support dollar-prefixed and multi-quote raw strings (#3129, #2897)

Recognize union (#3182)

C/C++:

Add C23/C++26 attributes (#3084)

Add more C2Y keywords (#3092)

Highlight a function following a namespace body (#2928)

Fix C/C++ lexer support for multiline pre-processor comments (#3051)

Add .ipp as a file extension (#3141, #1008)

Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)

Csound: Add missing opcode parameter type letter (#3161)

CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)

D: Allow non-ASCII (Unicode) identifiers (#1088)

Fish: Fix single quote backslash escape (#3138, #2821)

Go: Various lexer improvements (#3199)

GoogleSQL: Require a word break after SET (#3167)

Hexdump: Only match valid digits (#3200, #2847)

JavaScript: Highlight the arguments object (#3146)

Jsonnet: Recognize colons in array slice expressions (#2828)

JSX: Allow apostrophes in element text (#2816)

Julia: Fix rstrings backslash (#3140, #2537)

Kotlin: Support companion objects without an explicit name (#2525)

Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)

Kusto: Recognize member-access dots in dynamic objects (#2779)

Lua: Various improvements (#3143)

Macaulay2: Update symbols to 1.26.05 (#3120)

Markdown:

Highlight bold-italics (***...*** and ___...___) (#3067)

Fix mention regex to support hyphens in usernames (#3139, #3135)

Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)

Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

New lexers:

BitBake (#3103)

Caddyfile (#3225)

CEL (#3048)

PureScript (#1077, #3054)

Updated lexers:

Bash: Fix coloured keyword at the beginning of a name (#2926)

Boogie: Add missing Boogie and Civl Verifier keywords (#3156)

C#:

Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)

Support dollar-prefixed and multi-quote raw strings (#3129, #2897)

Recognize union (#3182)

C/C++:

Add C23/C++26 attributes (#3084)

Add more C2Y keywords (#3092)

Highlight a function following a namespace body (#2928)

Fix C/C++ lexer support for multiline pre-processor comments (#3051)

Add .ipp as a file extension (#3141, #1008)

Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)

Csound: Add missing opcode parameter type letter (#3161)

CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)

D: Allow non-ASCII (Unicode) identifiers (#1088)

Fish: Fix single quote backslash escape (#3138, #2821)

Go: Various lexer improvements (#3199)

GoogleSQL: Require a word break after SET (#3167)

Hexdump: Only match valid digits (#3200, #2847)

JavaScript: Highlight the arguments object (#3146)

Jsonnet: Recognize colons in array slice expressions (#2828)

JSX: Allow apostrophes in element text (#2816)

Julia: Fix rstrings backslash (#3140, #2537)

Kotlin: Support companion objects without an explicit name (#2525)

Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)

Kusto: Recognize member-access dots in dynamic objects (#2779)

Lua: Various improvements (#3143)

Macaulay2: Update symbols to 1.26.05 (#3120)

Markdown:

Highlight bold-italics (***...*** and ___...___) (#3067)

Fix mention regex to support hyphens in usernames (#3139, #3135)

Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for

... (truncated)

Commits

a43b45d Get ready for the 2.21.0 release.
d8f14cb Fix version_added for Purescript.
19c5817 Remove superfluous parentheses from PostgresExplainLexer (#3232)
9992e09 Merge pull request #3191 from jvoisin/dupes
bd22577 Fix regexlint warnings after latest update.
6a62df1 Release preparation: Update the changelog.
aabba32 Merge pull request #3221 from jvoisin/alter
d3441d0 Merge pull request #3225 from jvoisin/caddy
c593f3f Add a lexer for Caddy
0644b53 Simplify single-character regex alternations to character classes
Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt's releases.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

`v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__

Security


- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.
Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
</code></pre>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c6fe464b356ff4b1ebc9ba62172d331a40aa27df&quot;&gt;&lt;code&gt;c6fe464&lt;/code&gt;&lt;/a> release: prepare v2.14.0</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f5413029ae7a2e31b1367b5303ea86a2f54ccf42&quot;&gt;&lt;code&gt;f541302&lt;/code&gt;&lt;/a> style: apply Ruff formatting</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95&quot;&gt;&lt;code&gt;801cd12&lt;/code&gt;&lt;/a> fix: reject public JWK container HMAC keys</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb&quot;&gt;&lt;code&gt;af8181c&lt;/code&gt;&lt;/a> fix: reject empty HMAC keys from JWKs</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1&quot;&gt;&lt;code&gt;ba4853a&lt;/code&gt;&lt;/a> Throttle repeated PyJWKClient refreshes</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499&quot;&gt;&lt;code&gt;2798504&lt;/code&gt;&lt;/a> fix: reject DER public keys as HMAC secrets</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07&quot;&gt;&lt;code&gt;8b4e233&lt;/code&gt;&lt;/a> fix: reject loader-accepted PEM variants</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1f8180a211256dfe5cf32294b6753f554a5a4258&quot;&gt;&lt;code&gt;1f8180a&lt;/code&gt;&lt;/a> fix: format JWS tests</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/cff1ac55fe5f1096fd05295b269fce053ee290ab&quot;&gt;&lt;code&gt;cff1ac5&lt;/code&gt;&lt;/a> Fix redirect handler return annotation</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56&quot;&gt;&lt;code&gt;0a795b8&lt;/code&gt;&lt;/a> Reject redirects in PyJWKClient fetches</li>

<li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />

Updates pytest-django from 4.12.0 to 4.14.0

Release notes
Sourced from pytest-django's releases.

v4.14.0
https://pytest-django.readthedocs.io/en/stable/changelog.html#v4-14-0-2026-08-10
v4.13.0
https://pytest-django.readthedocs.io/en/latest/changelog.html#v4-13-0-2026-08-06



Changelog
Sourced from pytest-django's changelog.

v4.14.0 (2026-08-10)
Compatibility
^^^^^^^^^^^^^

Restored (unofficial) support for Django 5.0 and Django 5.1.

Improvements
^^^^^^^^^^^^

Added a django extra to the package. By depending on this extra
(e.g. pip install pytest-django[django]), the dependency resolver
will ensure you get a version of pytest-django that is compatible with
your version of Django (lower bound only). At least from now on...

v4.13.0 (2026-08-...
Description has been truncated

code-kasha · 2026-09-26T16:26:29Z

·@·d·ependabot r·ebase

Generated by Claude Code

…ates Bumps the backend group with 12 updates in the /backend directory: | Package | From | To | | --- | --- | --- | | [django](https://github.com/django/django) | `6.0.7` | `6.1.1` | | [djangorestframework](https://github.com/encode/django-rest-framework) | `3.17.1` | `3.18.1` | | [drf-spectacular-sidecar](https://github.com/tfranzel/drf-spectacular-sidecar) | `2026.7.1` | `2026.9.1` | | [gunicorn](https://github.com/benoitc/gunicorn) | `26.0.0` | `26.2.0` | | [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` | | [psycopg](https://github.com/psycopg/psycopg) | `3.3.4` | `3.3.6` | | [psycopg-binary](https://github.com/psycopg/psycopg) | `3.3.4` | `3.3.6` | | [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.14.0` | | [pytest-django](https://github.com/pytest-dev/pytest-django) | `4.12.0` | `4.14.0` | | [sqlparse](https://github.com/andialbrecht/sqlparse) | `0.5.5` | `0.6.0` | | [tzdata](https://github.com/python/tzdata) | `2026.3` | `2026.4` | Updates `django` from 6.0.7 to 6.1.1 - [Commits](django/django@6.0.7...6.1.1) Updates `djangorestframework` from 3.17.1 to 3.18.1 - [Release notes](https://github.com/encode/django-rest-framework/releases) - [Commits](encode/django-rest-framework@3.17.1...3.18.1) Updates `drf-spectacular-sidecar` from 2026.7.1 to 2026.9.1 - [Commits](tfranzel/drf-spectacular-sidecar@2026.7.1...2026.9.1) Updates `gunicorn` from 26.0.0 to 26.2.0 - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@26.0.0...26.2.0) Updates `packaging` from 26.2 to 26.3 - [Release notes](https://github.com/pypa/packaging/releases) - [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst) - [Commits](pypa/packaging@26.2...26.3) Updates `psycopg` from 3.3.4 to 3.3.6 - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](psycopg/psycopg@3.3.4...3.3.6) Updates `psycopg-binary` from 3.3.4 to 3.3.6 - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](psycopg/psycopg@3.3.4...3.3.6) Updates `pygments` from 2.20.0 to 2.21.0 - [Release notes](https://github.com/pygments/pygments/releases) - [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES) - [Commits](pygments/pygments@2.20.0...2.21.0) Updates `pyjwt` from 2.13.0 to 2.14.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.13.0...2.14.0) Updates `pytest-django` from 4.12.0 to 4.14.0 - [Release notes](https://github.com/pytest-dev/pytest-django/releases) - [Changelog](https://github.com/pytest-dev/pytest-django/blob/main/docs/changelog.rst) - [Commits](pytest-dev/pytest-django@v4.12.0...v4.14.0) Updates `sqlparse` from 0.5.5 to 0.6.0 - [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG) - [Commits](andialbrecht/sqlparse@0.5.5...0.6.0) Updates `tzdata` from 2026.3 to 2026.4 - [Release notes](https://github.com/python/tzdata/releases) - [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md) - [Commits](python/tzdata@2026.3...2026.4) --- updated-dependencies: - dependency-name: django dependency-version: 6.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: djangorestframework dependency-version: 3.18.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: drf-spectacular-sidecar dependency-version: 2026.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: gunicorn dependency-version: 26.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: packaging dependency-version: '26.3' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: psycopg dependency-version: 3.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend - dependency-name: psycopg-binary dependency-version: 3.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend - dependency-name: pygments dependency-version: 2.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: pyjwt dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: pytest-django dependency-version: 4.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: sqlparse dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend - dependency-name: tzdata dependency-version: '2026.4' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 26, 2026

dependabot Bot changed the title ~~chore(backend): bump the backend group in /backend with 12 updates~~ chore(backend): bump the backend group across 1 directory with 12 updates Sep 26, 2026

dependabot Bot force-pushed the dependabot/pip/backend/backend-45657aee4d branch from 1419a57 to dd52618 Compare September 26, 2026 16:28

code-kasha merged commit 1eb7741 into main Sep 26, 2026
4 checks passed

dependabot Bot deleted the dependabot/pip/backend/backend-45657aee4d branch September 26, 2026 16:32

Navigation Menu

Repository navigation

chore(backend): bump the backend group across 1 directory with 12 updates - #6

chore(backend): bump the backend group across 1 directory with 12 updates#6
code-kasha merged 1 commit into
mainfrom
dependabot/pip/backend/backend-45657aee4d

dependabot Bot commented on behalf of github Sep 26, 2026 •

edited

Loading

v4.14.0

v4.13.0

v4.14.0 (2026-08-10)

v4.13.0 (2026-08-...
Description has been truncated

Uh oh!

code-kasha commented Sep 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3.18.1

What's Changed

Bug fixes

Other changes

New Contributors

3.18.0

What's Changed

Breaking changes

Features

Bug fixes

Other changes

New Contributors

gunicorn 26.2.0

Cleartext HTTP/2 (h2c)

Security

Other HTTP/2 fixes

Request bodies dropped on Upgrade requests

gunicorn 26.1.0

New Features

26.3

What's Changed

Features

Behavior adaptations

Fixes for versions and specifiers

Fixes for requirements and markers

Fixes for metadata and licenses

psycopg release notes

Current release

psycopg release notes

Current release

2.21.0

Version 2.21.0

2.14.0

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

v4.14.0

v4.13.0

v4.14.0 (2026-08-10)

v4.13.0 (2026-08-... Description has been truncated

Uh oh!

code-kasha commented Sep 26, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 26, 2026 •

edited

Loading

`psycopg` release notes

`psycopg` release notes

`v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__

v4.13.0 (2026-08-...
Description has been truncated