Skip to content

Bump the pip group across 1 directory with 13 updates#100

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-e0e34a1472
Open

Bump the pip group across 1 directory with 13 updates#100
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-e0e34a1472

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Dec 2, 2025

Copy link
Copy Markdown
Contributor

Bumps the pip group with 13 updates in the / directory:

Package From To
brotli 1.1.0 1.2.0
certifi 2023.11.17 2024.7.4
cryptography 41.0.7 44.0.1
fonttools 4.46.0 4.61.0
h11 0.14.0 0.16.0
idna 3.6 3.7
jinja2 3.1.2 3.1.6
orjson 3.9.10 3.9.15
pillow 10.1.0 10.3.0
protobuf 3.20.3 4.25.8
requests 2.31.0 2.32.4
tqdm 4.66.1 4.66.3
urllib3 2.1.0 2.5.0

Updates brotli from 1.1.0 to 1.2.0

Release notes

Sourced from brotli's releases.

v1.2.0

SECURITY

  • python: added Decompressor::can_accept_more_data method and optional output_buffer_limit argument Decompressor::process; that allows mitigation of unexpectedly large output; reported by Charles Chan (https://github.com/charleswhchan)

Added

  • decoder / encoder: added static initialization to reduce binary size
  • python: allow limiting decoder output (see SECURITY section)
  • CLI: brcat alias; allow decoding concatenated brotli streams
  • kt: pure Kotlin decoder
  • cgo: support "raw" dictionaries
  • build: Bazel modules

Removed

  • java: dropped finalize() for native entities

Fixed

  • java: in compress pass correct length to native encoder

Improved

  • build: install man pages
  • build: updated / fixed / refined Bazel buildfiles
  • encoder: faster encoding
  • cgo: link via pkg-config
  • python: modernize extension / allow multi-phase module initialization

Changed

  • decoder / encoder: static tables use "small" model (allows 2GiB+ binaries)

v1.2.0 RC2

What's Changed (compared to RC1)

v1.2.0 RC1

IMPORTANT: though this is a pre-release for v1.2.0, it is expected that some changes will be added before release; most notably concerning build files: patches applied by Alpine, Debian, Conan, VCPKG will be partially/fully integrated.

SECURITY

  • python: added Decompressor::can_accept_more_data method and optional output_buffer_limit argument Decompressor::process; that allows mitigation of unexpectedly large output; reported by Charles Chan (https://github.com/charleswhchan)

Added

  • decoder / encoder: added static initialization to reduce binary size
  • python: allow limiting decoder output (see SECURITY section)

... (truncated)

Changelog

Sourced from brotli's changelog.

[1.2.0] - 2025-10-27

SECURITY

  • python: added Decompressor::can_accept_more_data method and optional output_buffer_limit argument Decompressor::process; that allows mitigation of unexpectedly large output; reported by Charles Chan (https://github.com/charleswhchan)

Added

  • decoder / encoder: added static initialization to reduce binary size
  • python: allow limiting decoder output (see SECURITY section)
  • CLI: brcat alias; allow decoding concatenated brotli streams
  • kt: pure Kotlin decoder
  • cgo: support "raw" dictionaries
  • build: Bazel modules

Removed

  • java: dropped finalize() for native entities

Fixed

  • java: in compress pass correct length to native encoder

Improved

  • build: install man pages
  • build: updated / fixed / refined Bazel buildfiles
  • encoder: faster encoding
  • cgo: link via pkg-config
  • python: modernize extension / allow multi-phase module initialization

Changed

  • decoder / encoder: static tables use "small" model (allows 2GiB+ binaries)
Commits

Updates certifi from 2023.11.17 to 2024.7.4

Commits

Updates cryptography from 41.0.7 to 44.0.1

Changelog

Sourced from cryptography's changelog.

44.0.1 - 2025-02-11


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.1.
* We now build ``armv7l`` ``manylinux`` wheels and publish them to PyPI.
* We now build ``manylinux_2_34`` wheels and publish them to PyPI.

.. _v44-0-0:


44.0.0 - 2024-11-27

  • BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL < 3.9.
  • Deprecated Python 3.7 support. Python 3.7 is no longer supported by the Python core team. Support for Python 3.7 will be removed in a future cryptography release.
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  • macOS wheels are now built against the macOS 10.13 SDK. Users on older versions of macOS should upgrade, or they will need to build cryptography themselves.
  • Enforce the :rfc:5280 requirement that extended key usage extensions must not be empty.
  • Added support for timestamp extraction to the :class:~cryptography.fernet.MultiFernet class.
  • Relax the Authority Key Identifier requirements on root CA certificates during X.509 verification to allow fields permitted by :rfc:5280 but forbidden by the CA/Browser BRs.
  • Added support for :class:~cryptography.hazmat.primitives.kdf.argon2.Argon2id when using OpenSSL 3.2.0+.
  • Added support for the :class:~cryptography.x509.Admissions certificate extension.
  • Added basic support for PKCS7 decryption (including S/MIME 3.2) via :func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der, :func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem, and :func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime.

.. _v43-0-3:

43.0.3 - 2024-10-18


* Fixed release metadata for ``cryptography-vectors``

.. _v43-0-2:


43.0.2 - 2024-10-18

  • Fixed compilation when using LibreSSL 4.0.0.

.. _v43-0-1:

... (truncated)

Commits

Updates fonttools from 4.46.0 to 4.61.0

Release notes

Sourced from fonttools's releases.

4.61.0

  • [varLib.main]: SECURITY Only use basename(vf.filename) to prevent path traversal attacks when running fonttools varLib command-line script, or code which invokes fonttools.varLib.main(). Fixes CVE-2025-66034, see: GHSA-768j-98cg-p3fv.
  • [feaLib] Sort BaseLangSysRecords by tag (#3986).
  • Drop support for EOL Python 3.9 (#3982).
  • [instancer] Support --remove-overlaps for fonts with CFF2 table (#3975).
  • [CFF2ToCFF] Add --remove-overlaps option (#3976).
  • [feaLib] Raise an error for rsub with NULL target (#3979).
  • [bezierTools] Fix logic bug in curveCurveIntersections (#3963).
  • [feaLib] Error when condition sets have the same name (#3958).
  • [cu2qu.ufo] skip processing empty glyphs to support sparse kerning masters (#3956).
  • [unicodedata] Update to Unicode 17. Require unicodedata2 >= 17.0.0 when installed with 'unicode' extra.

4.60.1

  • [ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).
  • [ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).
  • [subset] Don't try to subset BASE table; pass it through by default instead (#3949).
  • [subset] Remove empty BaseRecord entries in MarkBasePos lookups (#3897, #3892).
  • [subset] Add pruning for MarkLigPos and MarkMarkPos lookups (#3946).
  • [subset] Remove duplicate features when subsetting (#3945).
  • [Docs] Added documentation for the visitor module (#3944).

4.60.0

  • [pointPen] Allow reverseFlipped parameter of DecomposingPointPen to take a ReverseFlipped enum value to control whether/how to reverse contour direction of flipped components, in addition to the existing True/False. This allows to set ReverseFlipped.ON_CURVE_FIRST to ensure that the decomposed outline starts with an on-curve point before being reversed, for better consistency with other segment-oriented contour transformations. The change is backward compatible, and the default behavior hasn't changed (#3934).

  • [filterPen] Added ContourFilterPointPen, base pen for buffered contour operations, and OnCurveStartPointPen filter to ensure contours start with an on-curve point (#3934).

  • [cu2qu] Fixed difference in cython vs pure-python complex division by real number (#3930).

  • [varLib.avar] Refactored and added some new sub-modules and scripts (#3926).

    • varLib.avar.build module to build avar (and a missing fvar) binaries into a possibly empty TTFont,
    • varLib.avar.unbuild module to print a .designspace snippet that would generate the same avar binary,
    • varLib.avar.map module to take TTFont and do the mapping, in user/normalized space,
    • varLib.avar.plan module moved from varLib.avarPlanner.

    The bare fonttools varLib.avar script is deprecated, in favour of fonttools varLib.avar.build (or unbuild).

  • [interpolatable] Clarify linear_sum_assignment backend options and minimal dependency usage (#3927).

  • [post] Speed up build_psNameMapping (#3923).

  • [ufoLib] Added typing annotations to fontTools.ufoLib (#3875).

4.59.2

  • [varLib] Clear USE_MY_METRICS component flags when inconsistent across masters (#3912).
  • [varLib.instancer] Avoid negative advance width/height values when instatiating HVAR/VVAR, (unlikely in well-behaved fonts) (#3918).
  • [subset] Fix shaping behaviour when pruning empty mark sets (#3915, harfbuzz/harfbuzz#5499).
  • [cu2qu] Fixed dot() product of perpendicular vectors not always returning exactly 0.0 in all Python implementations (#3911)
  • [varLib.instancer] Implemented fully-instantiating avar2 fonts (#3909).
  • [feaLib] Allow float values in VariableScalar's axis locations (#3906, #3907).
  • [cu2qu] Handle special case in calc_intersect for degenerate cubic curves where 3 to 4 control points are equal (#3904).

4.59.1

  • [featureVars] Update OS/2.usMaxContext if possible after addFeatureVariationsRaw (#3894).
  • [vhmtx] raise TTLibError('not enough data...') when hmtx/vmtx are truncated (#3843, #3901).
  • [feaLib] Combine duplicate features that have the same set of lookups regardless of the order in which those lookups are added to the feature (#3895).

... (truncated)

Changelog

Sourced from fonttools's changelog.

4.61.0 (released 2025-11-28)

  • [varLib.main]: SECURITY Only use basename(vf.filename) to prevent path traversal attacks when running fonttools varLib command, or code which invokes fonttools.varLib.main(). Fixes CVE-2025-66034, see: GHSA-768j-98cg-p3fv.
  • [feaLib] Sort BaseLangSysRecords by tag (#3986).
  • Drop support for EOL Python 3.9 (#3982).
  • [instancer] Support --remove-overlaps for fonts with CFF2 table (#3975).
  • [CFF2ToCFF] Add --remove-overlaps option (#3976).
  • [feaLib] Raise an error for rsub with NULL target (#3979).
  • [bezierTools] Fix logic bug in curveCurveIntersections (#3963).
  • [feaLib] Error when condition sets have the same name (#3958).
  • [cu2qu.ufo] skip processing empty glyphs to support sparse kerning masters (#3956).
  • [unicodedata] Update to Unicode 17. Require unicodedata2 >= 17.0.0 when installed with 'unicode' extra.

4.60.1 (released 2025-09-29)

  • [ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).
  • [ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).
  • [subset] Don't try to subset BASE table; pass it through by default instead (#3949).
  • [subset] Remove empty BaseRecord entries in MarkBasePos lookups (#3897, #3892).
  • [subset] Add pruning for MarkLigPos and MarkMarkPos lookups (#3946).
  • [subset] Remove duplicate features when subsetting (#3945).
  • [Docs] Added documentation for the visitor module (#3944).

4.60.0 (released 2025-09-17)

  • [pointPen] Allow reverseFlipped parameter of DecomposingPointPen to take a ReverseFlipped enum value to control whether/how to reverse contour direction of flipped components, in addition to the existing True/False. This allows to set ReverseFlipped.ON_CURVE_FIRST to ensure that the decomposed outline starts with an on-curve point before being reversed, for better consistency with other segment-oriented contour transformations. The change is backward compatible, and the default behavior hasn't changed (#3934).
  • [filterPen] Added ContourFilterPointPen, base pen for buffered contour operations, and OnCurveStartPointPen filter to ensure contours start with an on-curve point (#3934).
  • [cu2qu] Fixed difference in cython vs pure-python complex division by real number (#3930).
  • [varLib.avar] Refactored and added some new sub-modules and scripts (#3926).
    • varLib.avar.build module to build avar (and a missing fvar) binaries into a possibly empty TTFont,
    • varLib.avar.unbuild module to print a .designspace snippet that would generate the same avar binary,
    • varLib.avar.map module to take TTFont and do the mapping, in user/normalized space,
    • varLib.avar.plan module moved from varLib.avarPlanner. The bare fonttools varLib.avar script is deprecated, in favour of fonttools varLib.avar.build (or unbuild).
  • [interpolatable] Clarify linear_sum_assignment backend options and minimal dependency usage (#3927).
  • [post] Speed up build_psNameMapping (#3923).

... (truncated)

Commits
  • e691e3b Release 4.61.0
  • c2d540f Update NEWS.rst
  • 3859753 Update NEWS.rst
  • 26eb070 black
  • 5ff73af Merge commit from fork
  • a696d5b varLib: only use the basename(vf.filename)
  • b00bc45 varLib_test: test path traversal in variable-font filename
  • 066512e Merge pull request #3986 from cmyr/base-minmax-sorting
  • ce78973 [feaLib] Sort BasLangSysRecords by tag
  • 5bb37dc Merge pull request #3983 from fonttools/dependabot/pip/brotli-1.2.0
  • Additional commits viewable in compare view

Updates h11 from 0.14.0 to 0.16.0

Commits

Updates idna from 3.6 to 3.7

Release notes

Sourced from idna's releases.

v3.7

What's Changed

  • Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Full Changelog: kjd/idna@v3.6...v3.7

Changelog

Sourced from idna's changelog.

3.7 (2024-04-11) ++++++++++++++++

  • Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Commits
  • 1d365e1 Release v3.7
  • c1b3154 Merge pull request #172 from kjd/optimize-contextj
  • 0394ec7 Merge branch 'master' into optimize-contextj
  • cd58a23 Merge pull request #152 from elliotwutingfeng/dev
  • 5beb28b More efficient resolution of joiner contexts
  • 1b12148 Update ossf/scorecard-action to v2.3.1
  • d516b87 Update Github actions/checkout to v4
  • c095c75 Merge branch 'master' into dev
  • 60a0a4c Fix typo in GitHub Actions workflow key
  • 5918a0e Merge branch 'master' into dev
  • Additional commits viewable in compare view

Updates jinja2 from 3.1.2 to 3.1.6

Release notes

Sourced from jinja2's releases.

3.1.6

This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Jinja2/3.1.6/ Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6

  • The |attr filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. GHSA-cpwx-vrp4-4pq7

3.1.5

This is the Jinja 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Jinja2/3.1.5/ Changes: https://jinja.palletsprojects.com/changes/#version-3-1-5 Milestone: https://github.com/pallets/jinja/milestone/16?closed=1

  • The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. GHSA-q2x7-8rv6-6q7h
  • Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. #1792, GHSA-gmj6-6f8f-6699
  • Sandbox does not allow clear and pop on known mutable sequence types. #2032
  • Calling sync render for an async template uses asyncio.run. #1952
  • Avoid unclosed auto_aiter warnings. #1960
  • Return an aclose-able AsyncGenerator from Template.generate_async. #1960
  • Avoid leaving root_render_func() unclosed in Template.generate_async. #1960
  • Avoid leaving async generators unclosed in blocks, includes and extends. #1960
  • The runtime uses the correct concat function for the current environment when calling block references. #1701
  • Make |unique async-aware, allowing it to be used after another async-aware filter. #1781
  • |int filter handles OverflowError from scientific notation. #1921
  • Make compiling deterministic for tuple unpacking in a {% set ... %} call. #2021
  • Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. #2025
  • Fix copy/pickle support for the internal missing object. #2027
  • Environment.overlay(enable_async) is applied correctly. #2061
  • The error message from FileSystemLoader includes the paths that were searched. #1661
  • PackageLoader shows a clearer error message when the package does not contain the templates directory. #1705
  • Improve annotations for methods returning copies. #1880
  • urlize does not add mailto: to values like @a@b. #1870
  • Tests decorated with @pass_context can be used with the |select filter. #1624
  • Using set for multiple assignment (a, b = 1, 2) does not fail when the target is a namespace attribute. #1413
  • Using set in all branches of {% if %}{% elif %}{% else %} blocks does not cause the variable to be considered initially undefined. #1253

3.1.4

This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.

PyPI: https://pypi.org/project/Jinja2/3.1.4/ Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4

  • The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj

3.1.3

This is a fix release for the 3.1.x feature branch.

  • Fix for GHSA-h5c8-rqwp-cp95. You are affected if you are using xmlattr and passing user input as attribute keys.

... (truncated)

Changelog

Sourced from jinja2's changelog.

Version 3.1.6

Released 2025-03-05

  • The |attr filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. :ghsa:cpwx-vrp4-4pq7

Version 3.1.5

Released 2024-12-21

  • The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. :ghsa:q2x7-8rv6-6q7h
  • Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. :issue:1792, :ghsa:gmj6-6f8f-6699
  • Sandbox does not allow clear and pop on known mutable sequence types. :issue:2032
  • Calling sync render for an async template uses asyncio.run. :pr:1952
  • Avoid unclosed auto_aiter warnings. :pr:1960
  • Return an aclose-able AsyncGenerator from Template.generate_async. :pr:1960
  • Avoid leaving root_render_func() unclosed in Template.generate_async. :pr:1960
  • Avoid leaving async generators unclosed in blocks, includes and extends. :pr:1960
  • The runtime uses the correct concat function for the current environment when calling block references. :issue:1701
  • Make |unique async-aware, allowing it to be used after another async-aware filter. :issue:1781
  • |int filter handles OverflowError from scientific notation. :issue:1921
  • Make compiling deterministic for tuple unpacking in a {% set ... %} call. :issue:2021
  • Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. :issue:2025
  • Fix copy/pickle support for the internal missing object. :issue:2027
  • Environment.overlay(enable_async) is applied correctly. :pr:2061
  • The error message from FileSystemLoader includes the paths that were searched. :issue:1661
  • PackageLoader shows a clearer error message when the package does not contain the templates directory. :issue:1705
  • Improve annotations for methods returning copies. :pr:1880
  • urlize does not add mailto: to values like @a@b. :pr:1870

... (truncated)

Commits

Updates orjson from 3.9.10 to 3.9.15

Release notes

Sourced from orjson's releases.

3.9.15

Fixed

  • Implement recursion limit of 1024 on orjson.loads().
  • Use byte-exact read on str formatting SIMD path to avoid crash.

3.9.14

Fixed

  • Fix crash serializing str introduced in 3.9.11.

Changed

  • Build now depends on Rust 1.72 or later.

3.9.13

Fixed

  • Serialization str escape uses only 128-bit SIMD.
  • Fix compatibility with CPython 3.13 alpha 3.

Changed

  • Publish musllinux_1_2 instead of musllinux_1_1 wheels.
  • Serialization uses small integer optimization in CPython 3.12 or later.

3.9.12

Fixed

  • Minimal musllinux_1_1 build due to sporadic CI failure.

Changed

  • Update benchmarks in README.

3.9.11

Changed

  • Improve performance of serializing. str is significantly faster. Documents using dict, list, and tuple are somewhat faster.
Changelog

Sourced from orjson's changelog.

3.9.15 - 2024-02-23

Fixed

  • Implement recursion limit of 1024 on orjson.loads().
  • Use byte-exact read on str formatting SIMD path to avoid crash.

3.9.14 - 2024-02-14

Fixed

  • Fix crash serializing str introduced in 3.9.11.

Changed

  • Build now depends on Rust 1.72 or later.

3.9.13 - 2024-02-03

Fixed

  • Serialization str escape uses only 128-bit SIMD.
  • Fix compatibility with CPython 3.13 alpha 3.

Changed

  • Publish musllinux_1_2 instead of musllinux_1_1 wheels.
  • Serialization uses small integer optimization in CPython 3.12 or later.

3.9.12 - 2024-01-18

Changed

  • Update benchmarks in README.

Fixed

  • Minimal musllinux_1_1 build due to sporadic CI failure.

3.9.11 - 2024-01-18

Changed

  • Improve performance of serializing. str is significantly faster. Documents using dict, list, and tuple are somewhat faster.
Commits
  • a348f59 3.9.15
  • b0e4d2c yyjson 0eca326, recursion limit
  • 5067ead impl_escape_unchecked() byte exact read
  • e04ea73 cargo update, build misc
  • ba8c701 3.9.14
  • a2f7b7b impl_format_simd!() lift create from loop, rotate left
  • 528220f format_escaped_str() fast and slow paths depending on page boundary
  • 29884e6 Fix buffer overread in format_escaped_str
  • c825472 cargo update
  • 4eb4f00 3.9.13
  • Additional commits viewable in compare view

Updates pillow from 10.1.0 to 10.3.0

Release notes

Sourced from pillow's releases.

10.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html

Deprecations

  • Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() #7927 [@​hugovk]
  • Deprecate ImageCms constants and versions() function #7702 [@​nulano]

Changes

... (truncated)

Changelog

Sourced from pillow's changelog.

10.3.0 (2024-04-01)

  • CVE-2024-28219: Use strncpy to avoid buffer overflow #7928 [radarhere, hugovk]

  • Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() #7927 [radarhere, hugovk]

  • Raise ValueError if seeking to greater than offset-sized integer in TIFF #7883 [radarhere]

  • Add --report argument to __main__.py to omit supported formats #7818 [nulano, radarhere, hugovk]

  • Added RGB to I;16, I;16L, I;16B and I;16N conversion #7918, #7920 [radarhere]

  • Fix editable installation with custom build backend and configuration options #7658 [nulano, radarhere]

  • Fix putdata() for I;16N on big-endian #7209 [Yay295, hugovk, radarhere]

  • Determine MPO size from markers, not EXIF data #7884 [radarhere]

  • Improved conversion from RGB to RGBa, LA and La #7888 [radarhere]

  • Support FITS images with GZIP_1 compression #7894 [radarhere]

  • Use I;16 mode for 9-bit JPEG 2000 images #7900 [scaramallion, radarhere]

  • Raise ValueError if kmeans is negative #7891 [radarhere]

  • Remove TIFF tag OSUBFILETYPE when saving using libtiff #7893 [radarhere]

  • Raise ValueError for negative values when loading P1-P3 PPM images #7882 [radarhere]

  • Added reading of JPEG2000 palettes #7870 [radarhere]

  • Added alpha_quality argument when saving WebP images #7872 [radarhere]

... (truncated)

Commits
  • 5c89d88 10.3.0 version bump
  • 63cbfcf Update CHANGES....

    Description has been truncated

@dependabot
Bump the pip group across 1 directory with 13 updates
71c07ea 
Bumps the pip group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [brotli](https://github.com/google/brotli) | `1.1.0` | `1.2.0` |
| [certifi](https://github.com/certifi/python-certifi) | `2023.11.17` | `2024.7.4` |
| [cryptography](https://github.com/pyca/cryptography) | `41.0.7` | `44.0.1` |
| [fonttools](https://github.com/fonttools/fonttools) | `4.46.0` | `4.61.0` |
| [h11](https://github.com/python-hyper/h11) | `0.14.0` | `0.16.0` |
| [idna](https://github.com/kjd/idna) | `3.6` | `3.7` |
| [jinja2](https://github.com/pallets/jinja) | `3.1.2` | `3.1.6` |
| [orjson](https://github.com/ijl/orjson) | `3.9.10` | `3.9.15` |
| [pillow](https://github.com/python-pillow/Pillow) | `10.1.0` | `10.3.0` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `3.20.3` | `4.25.8` |
| [requests](https://github.com/psf/requests) | `2.31.0` | `2.32.4` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.66.1` | `4.66.3` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.1.0` | `2.5.0` |



Updates `brotli` from 1.1.0 to 1.2.0
- [Release notes](https://github.com/google/brotli/releases)
- [Changelog](https://github.com/google/brotli/blob/master/CHANGELOG.md)
- [Commits](google/brotli@go/cbrotli/v1.1.0...v1.2.0)

Updates `certifi` from 2023.11.17 to 2024.7.4
- [Commits](certifi/python-certifi@2023.11.17...2024.07.04)

Updates `cryptography` from 41.0.7 to 44.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@41.0.7...44.0.1)

Updates `fonttools` from 4.46.0 to 4.61.0
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.46.0...4.61.0)

Updates `h11` from 0.14.0 to 0.16.0
- [Commits](python-hyper/h11@v0.14.0...v0.16.0)

Updates `idna` from 3.6 to 3.7
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst)
- [Commits](kjd/idna@v3.6...v3.7)

Updates `jinja2` from 3.1.2 to 3.1.6
- [Release notes](https://github.com/pallets/jinja/releases)
- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)
- [Commits](pallets/jinja@3.1.2...3.1.6)

Updates `orjson` from 3.9.10 to 3.9.15
- [Release notes](https://github.com/ijl/orjson/releases)
- [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md)
- [Commits](ijl/orjson@3.9.10...3.9.15)

Updates `pillow` from 10.1.0 to 10.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@10.1.0...10.3.0)

Updates `protobuf` from 3.20.3 to 4.25.8
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](protocolbuffers/protobuf@v3.20.3...v4.25.8)

Updates `requests` from 2.31.0 to 2.32.4
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.31.0...v2.32.4)

Updates `tqdm` from 4.66.1 to 4.66.3
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.66.1...v4.66.3)

Updates `urllib3` from 2.1.0 to 2.5.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.1.0...2.5.0)

---
updated-dependencies:
- dependency-name: brotli
  dependency-version: 1.2.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: certifi
  dependency-version: 2024.7.4
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: cryptography
  dependency-version: 44.0.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: fonttools
  dependency-version: 4.61.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: h11
  dependency-version: 0.16.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: idna
  dependency-version: '3.7'
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: jinja2
  dependency-version: 3.1.6
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: orjson
  dependency-version: 3.9.15
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pillow
  dependency-version: 10.3.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: protobuf
  dependency-version: 4.25.8
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: requests
  dependency-version: 2.32.4
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tqdm
  dependency-version: 4.66.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: urllib3
  dependency-version: 2.5.0
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Dec 2, 2025
This was referenced Dec 2, 2025
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants