Search code, repositories, users, issues, pull requests...

What's Changed

Fix the readme links by @azmeuk in #886
Allow non-recommended algorithms in ClientSecretJWT and PrivateKey by @azmeuk in #887
Validate BCP47 language tags with a regex by @azmeuk in #873
Fix RFC7523 signing with non RSA keys by @azmeuk in #884

Full Changelog: authlib/authlib@v1.7.1...v1.7.2

`v1.7.1`

What's Changed

Fix authlib.jose deprecation warning poping from _joserfc_helpers by @azmeuk in #881
Fix redirecting to unvalidated redirect_uri on InvalidScopeError in OpenIDImplicitGrant and OpenIDHybridGrant.

Full Changelog: authlib/authlib@v1.7.0...v1.7.1

`v1.7.0`

What's Changed

Authorization and token endpoints request empty scope parameter management by @azmeuk in #847
Support from Python 3.10 to 3.14 by @azmeuk in #850
Allow composition of AuthorizationServerMetadata by @azmeuk in #853
Make require_oauth parenthesis optional by @azmeuk in #855
Fix expires_at behavior when its value is 0 by @azmeuk in #854
Migration to joserfc by @lepture in #852
RP-initiated logout by @frohrlich in #849
Fix get_jwt_config by @lepture in #858
chore(ci): Update PyPy version from 3.10 to 3.11 by @cclauss in #863
fix: remove "none" from default authlib.jose.jwt algorithms by @lepture in #860
fix: normalize resolve_client_public_key method by @lepture in #861
Implement rfc9700 PKCE downgrade countermeasure by @azmeuk in #864
Use correct syntax for tox.requires in tox.ini by @alex-ball in #868
Set client session User-Agent when fetching server metadata and JWKs by @alex-ball in #867
fix: use the real application object for Flask by @nblock in #869
Accept the issuer URL as a valid audience by @azmeuk in #865
Don't nest InvalidTokenError extra attribute by @azmeuk in #872
Documentation overhaul by @azmeuk in #875
Update README.md docs.authlib.org/en/latest => docs.authlib.org/en/stable by @guillett in #876
Merge release/1.6 branch by @lepture in #877

New Contributors

@frohrlich made their first contribution in #849
@cclauss made their first contribution in #863
@alex-ball made their first contribution in #868
@nblock made their first contribution in #869
@guillett made their first contribution in #876

Full Changelog: authlib/authlib@v1.6.10...v1.7.0

joke2k/faker (Faker)

Add French social security numbers with Corsican codes (#2373). Thanks @dancergraham.
Fix typos in docstrings and comments (#2387). Thanks @Labib-Bin-Salam.

`v40.22.0`

Add mr_IN person, address, and phone_number providers (#2367). Thanks @RedZapdos123.
Fix flaky test_optional by using seed and larger sample size (#2376). Thanks @tejasae-afk.

`v40.21.0`

Add banks list for en_GB locale (#2363). Thanks @osolomientsev.

`v40.20.0`

Add pan and gstin generators to en_IN SSN provider (#2357). Thanks @RedZapdos123.
Improve barcode provider test coverage (#2382). Thanks @lphuc2250gma.
Bump liskin/gh-problem-matcher-wrap from 3 to 4 (#2381). Thanks @dependabot[bot].

`v40.19.1`

Fix shared state mutation in en_IN pincode_in_state (#2369). Thanks @RedZapdos123.

`v40.19.0`

Add uuid1 and uuid7 providers to misc provider (#2344). Thanks @Krishnachaitanyakc.

`v40.18.0`

See CHANGELOG.md.

`v40.17.0`

Add am_ET phone_number provider for Ethiopia. Thanks @jasur-py.

`v40.16.0`

Fix duplicate phone number prefix 145 in zh_CN locale. Thanks @r266-tec.

`v40.15.0`

Add job providers for ar_DZ and fr_DZ locales (#2352). Thanks @othmane099.
Add company providers for ar_DZ and fr_DZ locales (#2351). Thanks @othmane099.
Add geo providers for ar_DZ and fr_DZ locales (#2350). Thanks @othmane099.
Add currency providers for ar_DZ and fr_DZ locales (#2349). Thanks @othmane099.
Add date_time provider for ar_DZ locale (#2348). Thanks @othmane099.
Add ssn providers for ar_DZ and fr_DZ locales (#2347). Thanks @othmane099.

`v40.14.1`

Fix UnicodeEncodeError in CLI docs on non-UTF consoles (#2362). Thanks @RedZapdos123.

`v40.14.0`

Fix: update placekitten URL to placekittens (#2364). Thanks @reory.

`v40.13.0`

Fix: Ensure deterministic locale selection in multi-locale mode. Thanks @just6660 and @patakk.

`v40.12.0`

Add address providers for ar_DZ and fr_DZ locales (#2341). Thanks @othmane099.

`v40.11.1`

Fix: rebind deepcopy proxies to copied Faker instances. Thanks @SunS1eep1ng.

`v40.11.0`

Add major Swiss banks to de_CH bank provider. Thanks @raphael-s.

`v40.10.0`

Fix: mixed-gender names in es_MX locale. Thanks @rodrigobnogueira.

`v40.9.0`

Fix pt_PT postalcode format in address provider. Thanks @filipemattar.

`v40.8.1`

Fix mutable default providers. Thanks @Dhi13man.

`v40.8.0`

Add free email domains to hu_HU locale. Thanks @majorzoltan80.

`v40.7.0`

Improve Polish address grammar: categorize street types and prefixes. Thanks @Francooo2221.

`v40.6.0`

Add country names to he_IL locale. Thanks @Moo64c.

`v40.5.1`

Fix _get_local_timezone() missing return statement. Thanks @bysiber.

`v40.5.0`

Add missing formats and remove duplicates in user_name_formats. Thanks @WannaFight.

aio-libs/aiohappyeyeballs (aiohappyeyeballs)

`v2.7.1`

Performance improvements

Use defaultdict to help with performance (e10f335)

Refactoring

Simplify _interleave_addrinfos family grouping (fdf6548)
Collapse collect-then-remove pattern in utils helpers (0dd3fd1)
Merge identical except blocks in _connect_sock cleanup (b7c186e)

`v2.6.2`

Bug fixes

Clear error on empty addr_infos in start_connection (55dd76a)

Testing

Stop verify_no_lingering_tasks from leaking an event loop (ce43beb)

Refactoring

Optimize obtaining event-loop down to 1 line (02a7029)

agronholm/anyio (anyio)

`v4.14.2`

Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @greymoth-jp).
Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @gaoflow)
Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)

`v4.14.1`

Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @EmmanuelNiyonshuti)
Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @nyxst4ck)

`v4.14.0`

Added support for Python 3.15
Added an asynchronous implementation of the itertools module (#998; PR by @11kkw)
Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @nullwiz)
Added support for custom capacity limiters in async path and file I/O functions and classes
Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)
Changed TaskGroup.start_soon() to return a TaskHandle
Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)
Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope
Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @EmmanuelNiyonshuti)
Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @EmmanuelNiyonshuti)
Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @SAY-5)
Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:
- TaskGroup.start_soon()
- TaskGroup.start()
- anyio.from_thread.run()
This reverts an earlier change from v3.7.0 which was made in error. (#1153)
Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @gschaffner)
Changed several classes (and their subclasses) to have __slots__ (with __weakref__):
- anyio.CancelScope
- anyio.CapacityLimiter
- anyio.Condition
- anyio.Event
- anyio.Lock
- anyio.ResourceGuard
- anyio.Semaphore
Fixed cancellation exception escaping a cancel scope when triggered via check_cancelled() in a worker thread (#1113)
Fixed TaskGroup raising AttributeError instead of a clear error when entered more than once (#1109; PR by @bahtya)
Fixed lost type information when passing arguments to lru_cache (#1104; PR by @Graeme22)
Fixed test resumption after KeyboardInterrupt in async generator fixtures on the asyncio backend (#1060; PR by @EmmanuelNiyonshuti)
Fixed import of __main__ in to_process workers when entrypoint script doesn't end in .py, such as when using console_script entrypoints. (#1027; PR by @tapetersen)
Fixed SocketListener.from_socket() returning a TCP listener for AF_UNIX listening sockets, causing accept() to fail with ENOTSUP (#1132; PR by @kudato)
Fixed UDPSocket.aclose() and ConnectedUDPSocket.aclose() on asyncio returning before the underlying socket FD was actually released (#1147; PR by @matias-arrelid)
Fixed trio backend test runner hanging indefinitely instead of raising an error when dynamically accessing an async fixture via request.getfixturevalue (#1148; PR by @EmmanuelNiyonshuti)
Fixed cancelling tasks started through a BlockingPortal after the portal has been stopped (#1013; PR by @puneetdixit200)
Fixed backend_options being ignored when running the Trio backend via anyio.run(); the options are now passed as keyword arguments to trio.run() again, as documented (a regression from AnyIO 3) (#1161; PR by @Zac-HD)
Fixed asyncio Lock and Semaphore deadlocks caused by cancelled waiters left queued during release (#1145; PR by @rasmusfaber, @x42005e1f and @agronholm)

`v4.13.0`

Dropped support for Python 3.9
Added a ttl parameter to the anyio.functools.lru_cache wrapper (#1073; PR by @Graeme22)
Widened the type annotations of file I/O streams to accept IO[bytes] instead of just BinaryIO (#1078)
Fixed anyio.Path not being compatible with Python 3.15 due to the removal of pathlib.Path.is_reserved() and the addition of pathlib.Path.__vfspath__() (#1061; PR by @veeceey)
Fixed the BrokenResourceError raised by the asyncio SocketStream not having the original exception as its cause (#1055; PR by @veeceey)
Fixed the TypeError raised when using "func" as a parameter name in pytest.mark.parametrize when using the pytest plugin (#1068; PR by @JohnnyDeuss)
Fixed the pytest plugin not running tests that had the anyio marker added programmatically via pytest_collection_modifyitems (#422; PR by @chbndrhnns)
Fixed cancellation exceptions leaking from a CancelScope on asyncio when they are contained in an exception group alongside non-cancellation exceptions (#1091; PR by @gschaffner)
Fixed Condition.wait() not passing on a notification when the task is cancelled but already received a notification
Fixed inverted condition in the process pool shutdown phase which would cause still-running pooled processes not to be terminated (#1074; PR by @bysiber)

mozilla/bleach (bleach)

`v6.4.0`

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future
releases including for security issues.
See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

Dropped support for pypy 3.10. (#764)

Security fixes

Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

Fix XSS issue with sanitize_uri_value where disallowed schemes with
Unicode invisible characters wouldn't be rejected.

For example::

import bleach
payload1 = 'Click'
result1 = bleach.clean(payload1)
print(repr(result1))

outputs::

'Click'

See the advisory for details.
Fix GHSA-gj48-438w-jh9v.

Fix issue where URI sanitization wasn't happening in formaction attributes.

See the advisory for details.

Bug fixes

Add support for pypy 3.11. (#764)
Drop version max in tinycss2 pin. (#772)

This removes one of the things we had to keep checking and updating. Users
now own the responsibility for correctness with the version of tinycss2
they're using.

boto/boto3 (boto3)

`v1.43.47`

=======

api-change:es: [botocore] Adds support for the EngineMode and UseCase parameters on Amazon Elasticsearch Service domains, enabling GENERAL or OPTIMIZED engine modes and SEARCH, VECTOR, OBSERVABILITY, or MIXED usecases when creating and updating domain configurations.
api-change:gamelift: [botocore] Amazon GameLift Servers now includes fleet expiration for managed fleets. A managed fleet expires one year after creation, transitioning to EXPIRED status, emitting a FLEET EXPIRED event, and scaling to zero instances. Expired fleets cannot host new game sessions or increase capacity.
api-change:guardduty: [botocore] GuardDuty AI Protection is now publicly available. Findings include Bedrock guardrail details, model details, observation numbers, and continuous scan details. GuardrailArn and GuardrailVersion are deprecated in favor of the guardrails list.
api-change:lambda: [botocore] Add Java 8, 11 and 17 on AL2023 (java8.al2023, java11.al2023, java17.al2023) support to AWS Lambda.
api-change:redshift-serverless: [botocore] Add support for preserving datasharing, zero-ETL and S3 event integrations on snapshot restore to serverless namespace.

`v1.43.46`

=======

api-change:cloudwatch: [botocore] CloudWatch now assigns a unique identifier to each anomaly detector. PutAnomalyDetector and DescribeAnomalyDetectors return this AnomalyDetectorId, which you can use to describe or delete a specific anomaly detector directly.
api-change:ec2: [botocore] New Amazon EC2 instances. M9g, M9gd, C9g, and C9gd on AWS Graviton5. C8in, M8in, and R8in add 600 Gbps network. C8ib, M8ib, and R8ib add 300 Gbps EBS. C8ine, M8ine, M8idn, R8idn, M8idb, and R8idb round out Intel Xeon 6. Mac-m3ultra with Apple M3 Ultra. G7 with NVIDIA RTX PRO 4500 Blackwell GPUs.
api-change:inspector2: [botocore] Support for 3 day and 7 day ECR re-scan durations
api-change:lambda: [botocore] Added TelemetryConfig support for Managed Instances Capacity Provider, enabling customers to configure system log level and custom log group for managed instance logging.
api-change:license-manager: [botocore] Added the ResetUsage field to the CreateLicenseVersion API. When set to true, the entitlement usage counts for the license are reset to 0. If it is false or not specified, entitlement usage is left unchanged.
api-change:quicksight: [botocore] Provides CreateKnowledgeBase and UpdateKnowledgeBase APIs
api-change:sagemaker: [botocore] Release support for g4d, c6g, c7g, c8g instance types for SageMaker HyperPod

`v1.43.45`

=======

api-change:connect: [botocore] Amazon Connect - Added DeleteContactData API to support PII deletion of customer endpoint, additional email recipients and email subject.
api-change:ec2: [botocore] Added support for additional override parameters in CreateFleet, including LaunchTemplateSpecificationUserData, KeyName, IamInstanceProfile, and MetadataOptions. The CreateFleet response now also includes SubnetId, AvailabilityZone, and AvailabilityZoneId for launched instances.
api-change:guardduty: [botocore] Adding "AI Analyst" enum value for detector
api-change:ivs: [botocore] adds support for AWS IVS ad configuration APIs to allow for a postRollConfiguration object on

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Africa/Johannesburg)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-02-15T05:12:01Z

👋 Thanks for your contribution!

🏷️ Auto-applied labels: backend, dependencies, renovate

Labels determine which CI workflows run. They update automatically with new commits.

sonarqubecloud · 2026-05-11T13:57:02Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-05-11T17:58:23Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-06-10T17:44:22Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-06-10T22:03:13Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-07-14T22:32:36Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code