[dependabot]

Bumps pymongo from 4.18.3 to 4.19.0.

Release notes

Sourced from pymongo's releases.

PyMongo 4.19.0

Release notes: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52147

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.19.0 (2026/10/14)

PyMongo 4.19 brings a number of changes including:

.. warning:: PyMongo 4.19 drops support for Python 3.9 and 3.10 and removes PyPy support: Python 3.11+ is now required.

• Added support for Python 3.15.
• Dropped support for Python 3.9 and 3.10.
• Removed support for PyPy.
• Removed the deprecated Algorithm.RANGEPREVIEW and QueryType.RANGEPREVIEW members (PYTHON-6009_).
• Added support for running the synchronous and asynchronous clients in subinterpreters, including inside concurrent.futures.InterpreterPoolExecutor (Python 3.14+). Only in subinterpreters, which do not allow daemon threads, the synchronous client's monitor threads now start as non-daemon threads and are stopped and joined when the interpreter is torn down. Monitor threads in the main interpreter remain daemon threads and shutdown behavior is unchanged. Note that because these threads are non-daemon, a subinterpreter may block on teardown until any in-flight monitor work completes.
• Added support for routing Key Management Service (KMS) requests for Client-Side Field Level Encryption and Queryable Encryption through an HTTP proxy, using the new kms_connect_callback option on :class:~pymongo.encryption_options.AutoEncryptionOpts, :class:~pymongo.encryption.ClientEncryption, and :class:~pymongo.asynchronous.encryption.AsyncClientEncryption. The callback opens the connection and the driver performs the KMS TLS handshake over it, so verification still targets the KMS host rather than the proxy. For an ordinary HTTP proxy, pass :class:~pymongo.encryption_options.HTTPProxyKMSConnect or :class:~pymongo.encryption_options.AsyncHTTPProxyKMSConnect instead of writing a callback. Both helpers accept custom CONNECT headers, e.g. Proxy-Authorization for proxies that require authentication.
• Added the srv_host_validator keyword argument to :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient, an alternative to srvAllowedHostsSuffix for deployments whose acceptable SRV hosts cannot be expressed as a single suffix. The callback is invoked once per SRV-returned host and must return a boolean: True to accept the host and False to reject it. During initial DNS discovery a non-boolean return raises an error; during SRV polling it is treated as a rejection. It is mutually exclusive with srvAllowedHostsSuffix and, because it takes a callable, cannot be set in a connection string. See the :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient documentation for security considerations.
• srvAllowedHostsSuffix may now be set to a single label reserved for private or special use, such as localhost, test, or internal.

... (truncated)

Commits

• a58b4f4 Prep 4.19 Release (#3122)
• 3242611 PYTHON-6147 Add CSFLE HTTP proxy KMS connect helpers (#3101)
• b5a7f26 PYTHON-6009 Remove deprecated Algorithm.RANGEPREVIEW and QueryType.RANGEPREVI...
• f3f19df PYTHON-6170 [BF] AWS ECS test container cannot install uv (#3120)
• a740cdf PYTHON-6063 Remove PyPy support (#3119)
• ed74401 PYTHON-6138 followup -- Drop Python 3.9 and 3.10 Support (#3118)
• e0b11bf PYTHON-6163 Pure-Python decode_all silently accepts 1-byte invalid BSON (#3117)
• b5a36cc PYTHON-6111 C extension accepts BSON documents where element data overlaps th...
• 1f64ecd PYTHON-6158 Clean up version-gated code paths (#3112)
• 0cc64d6 PYTHON-6161 Fix mod_wsgi CI: run apt-get update before install (#3115)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pixelated	Ignored	Preview	Oct 28, 2026 3:01pm UTC

[github-actions]

px Advisor Review

Risk: unknown

No summary available

No findings.