Skip to content

chore(deps-pip): bump the pip group across 1 directory with 12 updates - #555

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-077667a862
Open

chore(deps-pip): bump the pip group across 1 directory with 12 updates#555
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-077667a862

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pip group with 12 updates in the / directory:

Package From To
sqlalchemy 2.0.41 2.1.6
psycopg2-binary 2.9.10 2.9.13
flask-wtf 1.2.2 1.3.0
wtforms 3.2.1 3.2.2
email-validator 2.2.0 2.3.0
python-dotenv 1.2.2 1.2.4
requests 2.33.0 2.34.2
cryptography 50.0.0 50.0.2
py7zr 1.1.3 1.1.4
flask-socketio 5.6.1 5.7.0
gunicorn 23.0.0 26.2.0
pytest 9.0.3 9.1.1

Updates sqlalchemy from 2.0.41 to 2.1.6

Release notes

Sourced from sqlalchemy's releases.

2.1.6

Released: October 21, 2026

orm

  • [orm] [bug] Fixed issue where a Session flush that replaced an expired object in the identity map with a newly flushed object of the same primary key would emit a SELECT to refresh the expired object, solely in order to determine whether to emit an "Identity map already had an identity" warning. This could occur when a row loaded within a transaction is rolled back and its primary key value is subsequently reused, and could lead to an AttributeError if the expired object were garbage collected during that load. The check now emits no SQL, and an expired object that is replaced in this way no longer causes the warning to be emitted.

    This change is also backported to: 2.0.56

    References: #13711

  • [orm] [bug] [regression] Fixed regression caused by #13070 where using more than one orm.with_loader_criteria() option for the same entity, where the criteria made use of correlated subqueries referring to that entity, would fail with a RecursionError when compiling.

    References: #13701

  • [orm] [bug] [regression] Fixed regression caused by the new implementation of .params() for statements introduced in #7066, where parameter values passed to the .params() method of an ORM statement created using Select.from_statement() would not be applied when the statement was compiled without the compiled statement cache, such as when the cache was disabled or when the statement was stringified directly, leading to an error that a value is required for the bound parameter.

    References: #13709

orm extensions

  • [bug] [orm extensions] Fixed an issue in the instrumentation_toplevel extension where unrelated classes inheriting from typing.Generic could incorrectly raise a TypeError when using different instrumentation implementations. Pull request courtesy TomasCaruso10.

    This change is also backported to: 2.0.56

    References: #13680

... (truncated)

Commits

Updates psycopg2-binary from 2.9.10 to 2.9.13

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
  • Fix parsing of malformed bytea input.
  • Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
  • Add a pyproject.toml file to declare a PEP 517 build backend (:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
  • Drop support for Python 3.9.

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.14.
  • Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
  • Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
  • ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
  • Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.13.
  • Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
  • ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
  • Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.12.
  • Drop support for Python 3.6.

What's new in psycopg 2.9.8

... (truncated)

Commits
  • f650e7a chore: bump to release 2.9.13
  • 368c8a1 chore!: drop support for Python 3.9
  • 9b39e65 chore: drop scaleway build support
  • 2ca7041 fix: fix handling of PostgreSQL 18 exceptions
  • 5385c02 Build CPython 3.15 wheels
  • 1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
  • 433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
  • 8fb80bc fix: fix parsing of malformed int64 input in arrays
  • f98014a fix: fix parsing of malformed bytea input
  • 822b79c chore: bump dependencies in binary package
  • Additional commits viewable in compare view

Updates flask-wtf from 1.2.2 to 1.3.0

Release notes

Sourced from flask-wtf's releases.

v1.3.0

What's Changed

New Contributors

Full Changelog: pallets-eco/flask-wtf@v1.2.2...v1.3.0

Changelog

Sourced from flask-wtf's changelog.

Version 1.3.0

Released 2026-04-23

  • Don't read the whole uploaded files to know their size. :pr:635
  • Stop support for Python 3.9. Start support for Python 3.14. :pr:648
  • Migrate the project to uv. :pr:649
  • Allow setting a nonce on :class:~flask_wtf.recaptcha.RecaptchaField (string or zero-argument callable) for nonce-based Content Security Policies. :pr:312
  • Add csrf_meta_tag() helper and WTF_CSRF_META_NAME setting to render the CSRF token as an HTML <meta> tag.
  • Forward keyword arguments passed to the reCAPTCHA widget as HTML attributes on the captcha <div>, with the field id used as a default id. :pr:353
  • Add apply_exemptions parameter to :meth:~flask_wtf.csrf.CSRFProtect.protect so @csrf.exempt keeps working when validation is triggered manually. :pr:419
  • Add RECAPTCHA_ENABLED setting. :pr:509
Commits

Updates wtforms from 3.2.1 to 3.2.2

Release notes

Sourced from wtforms's releases.

3.2.2

What's Changed

New Contributors

Full Changelog: pallets-eco/wtforms@3.2.1...3.2.2

Changelog

Sourced from wtforms's changelog.

Version 3.2.2

Released 2026-05-03

  • Fix :class:~validators.Disabled validation with provided formdata. :pr:880
  • End support for Python 3.9, start support for Python 3.14. :pr:883
  • Add Tamil and Serbian translations.
Commits
  • ea57c11 chore: bump to 3.2.2
  • 326dd44 chore: pre-commit update
  • 414e41c doc: translation instructions and changelog
  • 383cd0c Added translation using Weblate (Serbian)
  • 40d5718 fix: readthedocs build
  • 83a4412 chore: allow downstream tests to raise warnings
  • 409edac Merge pull request #888 from azmeuk/gha-downstream
  • 69b2e67 chore: pyproject and GHA cleaning
  • 0117d4a chore: add GHA downstream tests
  • e6b503c Merge pull request #884 from kurtmckee/rm-py39-refs
  • Additional commits viewable in compare view

Updates email-validator from 2.2.0 to 2.3.0

Release notes

Sourced from email-validator's releases.

v2.3.0

  • The package name is changed from using an underscore (email_validator) to a dash (email-validator) to match PyPi's normalized package name.
  • The library no longer checks that the local part is at most 64 characters because a more careful reading of RFC 5321 indicates the limit is optional and such email addresses have been found in the wild. However the check can be restored using a new strict=True parameter, and the overall 254 character email address length limit is still in place.
  • New EmailSyntaxError messages are used for some exiting syntax errors related to @-sign homoglyphs and invalid characters in internationalized domains.
  • When using allow_display_name=True, display names are now returned with Unicode NFC normalization.
  • TypeError is now raised if something other than str (or bytes) is passed as the email address.
Changelog

Sourced from email-validator's changelog.

2.3.0 (August 26, 2025)

  • The package name is changed from using an underscore (email_validator) to a dash (email-validator) to match PyPi's normalized package name.
  • The library no longer checks that the local part is at most 64 characters because a more careful reading of RFC 5321 indicates the limit is optional and such email addresses have been found in the wild. However the check can be restored using a new strict=True parameter, and the overall 254 character email address length limit is still in place.
  • New EmailSyntaxError messages are used for some exiting syntax errors related to @-sign homoglyphs and invalid characters in internationalized domains.
  • When using allow_display_name=True, display names are now returned with Unicode NFC normalization.
  • TypeError is now raised if something other than str (or bytes) is passed as the email address.
Commits
  • 030a63a Version 2.3.0
  • e943a0f Raise TypeError when an invalid argument is passed for email, closes #155
  • f90d256 Remove local part length check unless new strict flag is given, fixes #158
  • 98800ba Add explicit checks for internationalized domain name characters invalid unde...
  • 936aead Fix final syntax checks on normalized internationalized domains checking the ...
  • 8043de4 NFC-normalize display names per UTS #39
  • bc08faa Add one-off error messages for full-width-at and small-commercial-at which ar...
  • a1c90ab Split exceptions_types.py into exceptions.py and types.py
  • dbcf07c Change package name from using underscore to dash to match PyPi normalized pa...
  • 7c22208 Support ALLOW_DISPLAY_NAME and ALLOW_EMPTY_LOCAL in the CLI (#145)
  • Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • a565c2c Bump version: 1.2.3 → 1.2.4
  • 4a7abd0 docs: add 1.2.4 release notes (#663, #698, #700)
  • f215c02 fix: dotenv get exits 0 for empty string values (#700)
  • 58f2d7c test: make test_run_with_command_flags portable and meaningful (#709)
  • e0310e5 fix: honor --no-override when expanding variables in dotenv run (#698)
  • a00cb2e docs: add CHANGELOG entry for #663 (fix #600)
  • f5485a6 fix: parse empty unquoted value with inline comment as empty string
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • Additional commits viewable in compare view

Updates requests from 2.33.0 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

Updates cryptography from 50.0.0 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.

.. _v50-0-1:


50.0.1 - 2026-08-25

  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.

.. _v50-0-0:

Commits

Updates py7zr from 1.1.3 to 1.1.4

Release notes

Sourced from py7zr's releases.

Fix multiple Vulnerbilities and bugs

Changelog

Sourced from py7zr's changelog.

v1.1.4_

Security

  • Fix arbitrary file write above the extraction directory via a symlink chain (incomplete fix of CVE-2026-23879, GHSA-jwx8-hv8g-gjjq).
    • canonical_path() cancelled .. lexically before any symlink was resolved, so link/.. was treated as the directory holding link instead of the parent of its target. A chain of symlink members extracted from the same archive could therefore redirect a later write an archive-chosen number of levels above the extraction directory, while the member name still reduced to something apparently inside it.
    • Containment is now decided on the real path: symlink components are followed first and .. is normalized only afterwards. This also covers symlink targets, which may legitimately contain .. and so cannot be rejected by name.
    • Archive member names containing a .. component are now rejected outright.
  • Fix memory exhaustion when opening a crafted archive header (GHSA-6pr6-cqpq-x889).
  • Fix extraction hang on a crafted COPY stream (GHSA-v999-q5cj-95jg).

Users are encouraged to upgrade. Details will be published in the corresponding security advisories.

Fixed

  • Raise PasswordRequired when an archive is opened in write or append mode with a crypto filter (e.g. FILTER_CRYPTO_AES256_SHA256) but no password, instead of failing later with an AttributeError. The check also covers direct use of SevenZipCompressor. (#723, #739)
  • Limit concurrent extraction workers for non-solid archives to os.cpu_count(), instead of starting one thread or process per folder. When the limit is reached, the oldest task is joined before a new one starts. (#630, #740)
  • Fix AttributeError in archiveinfo() for archives with no compressed content, such as an empty archive or one containing only empty files or directories. _get_method_names(), _is_solid() and archiveinfo() now handle header.main_streams being None. (#665, #741)
  • Fix intermittent false negatives in the relative-path check on Windows. Path.resolve() may or may not return the extended-length prefix (\\?\), and when only one of the compared paths had it, the relative_to check always failed. The prefix is now stripped before comparison. (#714, #743)
  • Fix io.UnsupportedOperation in extract() and extractall() when a WriterFactory returns a non-seekable handle, such as one from zipfile.ZipFile.open. The unnecessary seek(0) after decompression is removed, and MemIO.close() now rewinds only

... (truncated)

Commits
  • c717d21 Release version 1.1.4 to fix multiple vulnerabilities and bugs
  • c51e4f6 Merge commit from fork
  • f4204fa Merge commit from fork
  • 5c78459 Merge commit from fork
  • 23610d1 fix: raise Bad7zFile when decompression makes no progress
  • f3e4862 fix: enhance path sanitization and symlink resolution to prevent directory tr...
  • e41864c docs: update SECURITY.rst with threat model, hardening measures, and regressi...
  • 8ff8a30 docs: add guidelines for writing and organizing security regression tests
  • 0a3c81e tests: add malformed header tests into test_badheaders.py and enhance coverage
  • 3e37932 feat: add boundary checks for truncated reads in read_byte, read_uint64, ...
  • Additional commits viewable in compare view

Updates flask-socketio from 5.6.1 to 5.7.0

Updates gunicorn from 23.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

  • Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits
  • 36f2a3c gunicorn 26.2.0
  • cbba350 test: cover the h2c edge paths that had none
  • 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
  • 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
  • 5853551 Merge pull request #3712 from Rotzbua/patch-1
  • 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
  • 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
  • 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
  • 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
  • 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
  • Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

  • #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
  • #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
  • #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
  • #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

  • #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

    If this is undesirable, move the fixture definition to a conftest.py file if possible.

    Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

  • #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

    See 10819 and 14011.

  • #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

    See dynamic-fixture-request-during-teardown for details.

  • #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

    These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

    See parametrize-iterators for details and suggestions.

  • #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

    See config-inicfg for more details.

  • #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits
  • cf470ec Prepare release version 9.1.1
  • e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
  • 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
  • 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
  • b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
  • 9a567e0 [automated] Update plugin list (#14617) (#14618)
  • ef8b299 Merge pull request #14620 from pytest-dev/patchbac...

    Description has been truncated

@dependabot
dependabot Bot requested a review from Ayinkx as a code owner October 22, 2026 03:04
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 22, 2026
@dependabot dependabot Bot changed the title chore(deps-pip): bump the pip group with 12 updates chore(deps-pip): bump the pip group across 1 directory with 12 updates Oct 23, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/pip-077667a862 branch from 57905a2 to 43a4bef Compare October 23, 2026 14:40
@dependabot
chore(deps-pip): bump the pip group across 1 directory with 12 updates
7b99c68 
Bumps the pip group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.41` | `2.1.6` |
| [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.10` | `2.9.13` |
| [flask-wtf](https://github.com/pallets-eco/flask-wtf) | `1.2.2` | `1.3.0` |
| [wtforms](https://github.com/pallets-eco/wtforms) | `3.2.1` | `3.2.2` |
| [email-validator](https://github.com/JoshData/python-email-validator) | `2.2.0` | `2.3.0` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.4` |
| [requests](https://github.com/psf/requests) | `2.33.0` | `2.34.2` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.2` |
| [py7zr](https://github.com/miurahr/py7zr) | `1.1.3` | `1.1.4` |
| [flask-socketio](https://code.miguelgrinberg.com/miguelgrinberg/flask-socketio) | `5.6.1` | `5.7.0` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `23.0.0` | `26.2.0` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` |



Updates `sqlalchemy` from 2.0.41 to 2.1.6
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `psycopg2-binary` from 2.9.10 to 2.9.13
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.10...2.9.13)

Updates `flask-wtf` from 1.2.2 to 1.3.0
- [Release notes](https://github.com/pallets-eco/flask-wtf/releases)
- [Changelog](https://github.com/pallets-eco/flask-wtf/blob/main/docs/changes.rst)
- [Commits](pallets-eco/flask-wtf@v1.2.2...v1.3.0)

Updates `wtforms` from 3.2.1 to 3.2.2
- [Release notes](https://github.com/pallets-eco/wtforms/releases)
- [Changelog](https://github.com/pallets-eco/wtforms/blob/main/CHANGES.rst)
- [Commits](pallets-eco/wtforms@3.2.1...3.2.2)

Updates `email-validator` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/JoshData/python-email-validator/releases)
- [Changelog](https://github.com/JoshData/python-email-validator/blob/main/CHANGELOG.md)
- [Commits](JoshData/python-email-validator@v2.2.0...v2.3.0)

Updates `python-dotenv` from 1.2.2 to 1.2.4
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.4)

Updates `requests` from 2.33.0 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.0...v2.34.2)

Updates `cryptography` from 50.0.0 to 50.0.2
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.2)

Updates `py7zr` from 1.1.3 to 1.1.4
- [Release notes](https://github.com/miurahr/py7zr/releases)
- [Changelog](https://github.com/miurahr/py7zr/blob/master/docs/Changelog.rst)
- [Commits](miurahr/py7zr@v1.1.3...v1.1.4)

Updates `flask-socketio` from 5.6.1 to 5.7.0

Updates `gunicorn` from 23.0.0 to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@23.0.0...26.2.0)

Updates `pytest` from 9.0.3 to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.3...9.1.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: email-validator
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: flask-socketio
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: flask-wtf
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: py7zr
  dependency-version: 1.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: sqlalchemy
  dependency-version: 2.1.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: wtforms
  dependency-version: 3.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/pip-077667a862 branch from 43a4bef to 7b99c68 Compare October 26, 2026 07:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Ayinkx Ayinkx Awaiting requested review from Ayinkx Ayinkx is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants