build: bump the all-uv-deps group in /src/ContentProcessor with 12 updates

[dependabot]

Bumps the all-uv-deps group in /src/ContentProcessor with 12 updates:

Package	From	To
azure-storage-blob	12.30.1	12.30.3
coverage	7.16.0	7.16.2
idna	3.19	3.20
msal	1.38.0	1.39.0
pandas	3.0.5	3.0.6
pyjwt	2.14.0	2.15.0
pymongo	4.18.1	4.18.2
pytest-mock	3.15.1	3.16.0
pytz	2026.3.post1	2026.4
ruff	0.16.7	0.16.9
tzdata	2026.3	2026.4
urllib3	2.7.0	2.8.0

Updates azure-storage-blob from 12.30.1 to 12.30.3

Release notes

Sourced from azure-storage-blob's releases.

azure-storage-blob_12.30.3

12.30.3 (2026-09-22)

Bugs Fixed

• Async clients now reject header names and values containing a \r or \n when sending a batch request, matching the behavior of the sync clients.

azure-storage-blob_12.30.2

12.30.2 (2026-09-16)

Bugs Fixed

• Fixed an issue where a header name or value containing a \r or \n was written directly into a batch request body. Such headers are now rejected with a ValueError.

Commits

• 8e75355 [Storage] Prepare 12.30.3 release for azure-storage-blob (#49138)
• 95fcf4d [Storage] Prepare 12.30.2 release for azure-storage-blob (#49047)
• See full diff in compare view

Updates coverage from 7.16.0 to 7.16.2

Release notes

Sourced from coverage's releases.

7.16.2

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

7.16.1

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
• Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

Changelog

Sourced from coverage's changelog.

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168_.

• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289_.

• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923_.

.. _issue 1923: coveragepy/coveragepy#1923 .. _issue 2168: coveragepy/coveragepy#2168 .. _issue 2289: coveragepy/coveragepy#2289

.. _changes_7-16-1:

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

• Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

.. _issue 1563: coveragepy/coveragepy#1563 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Commits

• 5643ae7 docs: prep for 7.16.2
• a3e969f fix: dynamic_context for @​staticmethod and @​classmethod tests (issue 1923) (#...
• 8ad7236 fix: stop counting the try/else line when a with statement raises (#2301)
• c6dab1f fix(debug): debug output doesn't mis-handle odd line separators #2296
• 08fbc32 style: Protocols should use ... for method bodies
• bc7b0e3 refactor: positional-only args are better than pragmas
• 52afd6b Document parallel tox coverage data files (#2284)
• f653aae fix: loop completion arcs on Python 3.14 (#2281)
• cc1ced4 test: PyPy still compiles comprehensions as functions
• 85a9088 chore: make upgrade
• Additional commits viewable in compare view

Updates idna from 3.19 to 3.20

Release notes

Sourced from idna's releases.

v3.20

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Commits

• d55e65e Release 3.20
• 0c0824a Pre-release 3.20rc0
• bd7c316 Note Python 3.15 support in the 3.20 changelog
• b6cce85 Merge pull request #276 from kjd/unicode-18
• 9a4bc59 Update to Unicode 18.0.0
• dfab5a0 Merge branch 'python-3.15'
• 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
• cd17392 Merge pull request #274 from kjd/fix-decode-length-check
• c5796d7 Skip the decode round-trip check for domains past encode's length limit
• d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
• Additional commits viewable in compare view

Updates msal from 1.38.0 to 1.39.0

Release notes

Sourced from msal's releases.

1.39.0

What's Changed

• Fix _is_inside_docker() false positive on systemd cgroups v2 hosts (part of #886) by @​4gust in AzureAD/microsoft-authentication-library-for-python#945
• Sanitize URLs by @​4gust in AzureAD/microsoft-authentication-library-for-python#956
• Disable broker on Intel-based Macs by @​ashok672 in AzureAD/microsoft-authentication-library-for-python#926
• Fix Azure Arc errors returned before authentication challenge by @​gladjohn in AzureAD/microsoft-authentication-library-for-python#962
• Fix Service Fabric HTTPAdapter subclass compatibility by @​4gust in AzureAD/microsoft-authentication-library-for-python#964
• Bump MSAL version to 1.39.0 by @​4gust in AzureAD/microsoft-authentication-library-for-python#966

Full Changelog: AzureAD/microsoft-authentication-library-for-python@1.38.0...1.39.0

Commits

• 20fd4d9 Bump MSAL version to 1.39.0 (#966)
• 05f5b5c Fix Service Fabric HTTPAdapter subclass compatibility (#964)
• f15f912 Fix Azure Arc pre-challenge errors (#962)
• c11159b Disable broker on Intel-based Macs (#926)
• 9bdb09e Sanitize flagged URLs (#956)
• 1416438 Fix _is_inside_docker() false positive on systemd cgroups v2 hosts (#945)
• See full diff in compare view

Updates pandas from 3.0.5 to 3.0.6

Release notes

Sourced from pandas's releases.

pandas 3.0.6

We are pleased to announce the release of pandas 3.0.6. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• 2905718 RLS: 3.0.6
• 3188ced [backport 3.0.x] BUG: read_csv(sep=None) raised TypeError instead of falling...
• f097905 DOC: cleanup 3.0.6 whatsnew + mention Python 3.15 support (#68965) (#68969)
• 4f68223 [backport 3.0.x] BUG: fix setting with bool column mask into 1-column DataFra...
• e3df0e8 [backport 3.0.x] BUG: full-slice setitem into a pyarrow-backed array shared m...
• b7735f6 Backport PR #66117 on branch 3.0.x (BUG: interpolate leaving NAs unfilled for...
• bca0b77 [backport 3.0.x] BUG: read_csv leaked the string-intern table when a column f...
• bca1e5d [backport 3.0.x] BUG: prevent external mutation of RangeIndex._data (CoW) (#6...
• c95b42c [3.0.x] CI: skip cython-lint on pre-commit.ci (#68910)
• 9cbd884 [backport 3.0.x] Backport of some already merged regression fixes (#68447)
• Additional commits viewable in compare view

Updates pyjwt from 2.14.0 to 2.15.0

Release notes

Sourced from pyjwt's releases.

2.15.0

See the 2.15.0 changelog for complete release details.

Changelog

Sourced from pyjwt's changelog.

v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>__

Security

- Wrap recursion errors from deeply nested JWT payloads in ``DecodeError``
  instead of exposing a raw ``RecursionError``.
Added

- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__
Changed



JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS
payload, so a cache hit no longer re-parses every key. JWKSetCache.put()
accepts either form and raises PyJWKSetError for anything else. As a
result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance
for as long as it stays cached, rather than a freshly built one per call in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
PyJWKClient.fetch_data() now raises
PyJWKClientError("The JWKS endpoint did not return a JSON object") when
the endpoint response is not a JSON object, instead of returning it for
get_jwk_set() to reject. Callers reaching the JWKS through
get_jwk_set() see the same error as before in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
</tr></table> 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68&quot;&gt;&lt;code&gt;1d41a64&lt;/code&gt;&lt;/a> chore: prepare 2.15.0 release</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3&quot;&gt;&lt;code&gt;9bc0665&lt;/code&gt;&lt;/a> fix: make recursive payload tests deterministic</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b&quot;&gt;&lt;code&gt;5fde08a&lt;/code&gt;&lt;/a> fix: normalize recursive JWT payload errors</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19&quot;&gt;&lt;code&gt;171062d&lt;/code&gt;&lt;/a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173&quot;&gt;#1173&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6&quot;&gt;&lt;code&gt;c9d4d53&lt;/code&gt;&lt;/a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174&quot;&gt;#1174&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53&quot;&gt;&lt;code&gt;2763752&lt;/code&gt;&lt;/a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202&quot;&gt;#1202&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5&quot;&gt;&lt;code&gt;4adcd02&lt;/code&gt;&lt;/a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201&quot;&gt;#1201&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097&quot;&gt;&lt;code&gt;9e501d9&lt;/code&gt;&lt;/a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179&quot;&gt;#1179&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2&quot;&gt;&lt;code&gt;4047c44&lt;/code&gt;&lt;/a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212&quot;&gt;#1212&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9&quot;&gt;&lt;code&gt;f4e2b59&lt;/code&gt;&lt;/a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210&quot;&gt;#1210&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />

Updates pymongo from 4.18.1 to 4.18.2

Release notes
Sourced from pymongo's releases.

PyMongo 4.18.2
Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732
CVE-2026-96749
CVE-2026-96748
CVE-2026-96747



Changelog
Sourced from pymongo's changelog.

Changes in Version 4.18.2 (2026/09/24)
Version 4.18.2 is a bug fix release.

Hardened the bson buffer size guard against signed integer overflow. (CVE-2026-96749_).
Fixed connection string parsing to percent-decode each host individually. (CVE-2026-96748_).
Client-side field level encryption now rejects a KMS endpoint ending in .sock. (CVE-2026-96747_).

.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749
.. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748
.. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747
Issues Resolved
...............
See the PyMongo 4.18.2 release notes in JIRA_ for the list of resolved issues
in this release.
.. _PyMongo 4.18.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52896



Commits

640dd23 Prep 4.18.2 release (#3066)
6a0ec65 Update changelog for CVE-2026-88029 reference (#3049)
44be553 BUMP 4.18.2.dev0
See full diff in compare view




Updates pytest-mock from 3.15.1 to 3.16.0

Release notes
Sourced from pytest-mock's releases.

v3.16.0
2026-09-27

#604: Fixed duplicate_iterators=True for async functions spied with mocker.spy.
#611: Fixed async mock assertion introspection to use awaited arguments instead of the latest call's arguments.
#606: mocker.resetall(return_value=True, side_effect=True) now also applies to non-callable mocks, such as those returned by mocker.create_autospec(SomeClass, instance=True). Previously both arguments were silently ignored for them.
#547: Added SpyType for annotating mocker.spy results.
Dropped support for EOL Python 3.9.
#147: Removed handling of RuntimeError: stop called on unstarted patcher, which can no longer occur in the supported Python versions.
Added support for Python 3.15.




Changelog
Sourced from pytest-mock's changelog.

3.16.0
2026-09-27

[#604](https://github.com/pytest-dev/pytest-mock/issues/604) <https://github.com/pytest-dev/pytest-mock/pull/604>_: Fixed duplicate_iterators=True for async functions spied with mocker.spy.
[#611](https://github.com/pytest-dev/pytest-mock/issues/611) <https://github.com/pytest-dev/pytest-mock/pull/611>_: Fixed async mock assertion introspection to use awaited arguments instead of the latest call's arguments.
[#606](https://github.com/pytest-dev/pytest-mock/issues/606) <https://github.com/pytest-dev/pytest-mock/pull/606>_: mocker.resetall(return_value=True, side_effect=True) now also applies to non-callable mocks, such as those returned by mocker.create_autospec(SomeClass, instance=True). Previously both arguments were silently ignored for them.
[#547](https://github.com/pytest-dev/pytest-mock/issues/547) <https://github.com/pytest-dev/pytest-mock/issues/547>_: Added SpyType for annotating mocker.spy results.
Dropped support for EOL Python 3.9.
[#147](https://github.com/pytest-dev/pytest-mock/issues/147) <https://github.com/pytest-dev/pytest-mock/issues/147>_: Removed handling of RuntimeError: stop called on unstarted patcher, which can no longer occur in the supported Python versions.
Added support for Python 3.15.




Commits

f3b531f Release 3.16.0
71ed673 Fix duplicate_iterators for async spies (#604)
0797e3d Fix async assertion argument introspection (#611)
e24c334 docs: import os in the opening usage example (#612)
9e7eb7b [pre-commit.ci] pre-commit autoupdate (#613)
445fd4d [pre-commit.ci] pre-commit autoupdate (#610)
a8bd0b1 Honour resetall() arguments for non-callable mocks (#606)
6559fdf [pre-commit.ci] pre-commit autoupdate (#608)
466d026 [pre-commit.ci] pre-commit autoupdate (#605)
164defe [pre-commit.ci] pre-commit autoupdate (#603)
Additional commits viewable in compare view




Updates pytz from 2026.3.post1 to 2026.4

Commits

1ac6e51 Bump version numbers to 2026.4 (2026d)
1672798 IANA 2026d
0b5995b Squashed 'tz/' changes from 71f28b9ab3..bac9223f4b
e96461b Make deprecation notice louder
3c7af58 Merge branch 'nicoleman0-fix/timezone-non-string-input' into 2026d
234a247 Merge branch 'nicoleman0-fix/fixedoffset-basetzinfo' into 2026d
8f8a588 Raise UnknownTimeZoneError for non-string zone arguments
1f0f27e Make _FixedOffset a BaseTzInfo exposing _utcoffset
See full diff in compare view




Updates ruff from 0.16.7 to 0.16.9

Release notes
Sourced from ruff's releases.

0.16.9
Release Notes
Released on 2026-09-24.
Preview features

[ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

[flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
[flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

Update LibCST-based fixes for Python 3.15 (#28616)
[flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

Fix horizontal overflow on the rules documentation page (#28699)
Update rules table with category information (#28651)
[flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
[flake8-bugbear] Document type-checker interaction (B010) (#28509)
[flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
[ruff] Mention related isort settings (RUF022) (#28719)

Contributors

@​qinpei-dev
@​sanjayrohith
@​ntBre
@​webdevsamran
@​zaniebot
@​ewdurbin
@​MichaReiser
@​spaceone
@​IbrahimKhan12
@​devtechedge
@​GruffElixir

Install ruff 0.16.9
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh



... (truncated)


Changelog
Sourced from ruff's changelog.

0.16.9
Released on 2026-09-24.
Preview features

[ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

[flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
[flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

Update LibCST-based fixes for Python 3.15 (#28616)
[flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

Fix horizontal overflow on the rules documentation page (#28699)
Update rules table with category information (#28651)
[flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
[flake8-bugbear] Document type-checker interaction (B010) (#28509)
[flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
[ruff] Mention related isort settings (RUF022) (#28719)

Contributors

@​qinpei-dev
@​sanjayrohith
@​ntBre
@​webdevsamran
@​zaniebot
@​ewdurbin
@​MichaReiser
@​spaceone
@​IbrahimKhan12
@​devtechedge
@​GruffElixir

0.16.8
Released on 2026-09-16.
Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)
[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
[flake8-simplify] Preserve operand order in SIM109 fix (#27824)



... (truncated)


Commits

0be08a2 Bump version to 0.16.9 (#28882)
b4920b7 Rename ruff_cli to ruff_command_line (#28881)
47c751b Update dependency astral-sh/uv to v0.12.18 (#28880)
8c244e5 [flake8-comprehensions] Document map/generator exception behavior (C417...
5edf5a1 Use target form in rooster.version_files (#28876)
915bb2b [ty] Prefer existing @ paths over response files in Ruff and ty (#28877)
4710e1a ci(github): update version number in placeholder of issue template (#28871)
eedfc62 [ty] Propagate outer type context through cast calls (#28855)
ceaa6a0 [ty] Contain rendered code within Markdown fences (#28869)
dba0f30 authorize ruff-pre-commit dispatch via OIDC (#28867)
Additional commits viewable in compare view




Updates tzdata from 2026.3 to 2026.4

Release notes
Sourced from tzdata's releases.

2026.4: Release of upstream tzdata 2026d
Version 2026.4
Upstream version 2026d released 2026-09-11T22:21:07+00:00
Briefly:
Canada’s Northwest Territories moved to permanent -06 on 2026-08-21. Obsolescent
settings like TZ="EST5EDT" now conform better to POSIX. Fix security,
performance and porting bugs in zic and localtime.
Changes to future timestamps
Canada’s Northwest Territories will not fall back on 2026-11-01 and will stay on
-06 year-round, matching Alberta’s recent change. Model this with its
traditional abbreviation CST.  Although the change to permanent -06 legally took
place on 2026-08-21, temporarily model the change to occur on 2026-11-01 at
02:00 for the same reason as other recent temporary hacks.  (Caution: see “NOTE
FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.) This affects only
America/Inuvik as the rest of the territory is covered by America/Edmonton, for
which the equivalent change was released in 2026c.
Changes to past timestamps
Colombia’s 1992-05-02 spring forward was at 00:00, not 24:00.
Iran’s 1979-05-26 spring forward was at 00:00, not 24:00. (Thanks to N.F. Hase.)
The backward-compatibility names EST5EDT, CST6CDT, MST7MDT, and PST8PDT now
conform better to POSIX.  For example, EST5EDT now always uses the abbreviation
"EST" for standard time (now always 5 hours behind UT) and "EDT" for daylight
saving time, whereas it formerly had different UT offsets before standard time
was introduced and sometimes used abbreviations like "LMT", "EWT" and "EPT", all
contrary to POSIX.  Also, though not required by POSIX these names now use US
federal rules rather than rules of places like New York, reverting to 2024a
behavior.  This change affects only timestamps before 1966-10-30 at 01:00
standard time.
Other data changes
The temporary hacks used for North American timekeeping changes now work around
a libstdc++ std::chrono bug in GCC 14.1-14.4, 15.1-15.2, and 16.1; see GCC bug
124851.  This data change does not affect TZif files or timestamps.  The change
does not work around the related but less serious GCC bugs 116110 and 124513.
These GCC bugs are all fixed in GCC 16.2.
Changes to documentation
URLs for release tarballs in tz-link.html have been updated to reflect their new
canonical URLs on data.iana.org.



Changelog
Sourced from tzdata's changelog.

Version 2026.4
Upstream version 2026d released 2026-09-11T22:21:07+00:00
Briefly:
Canada’s Northwest Territories moved to permanent -06 on 2026-08-21. Obsolescent
settings like TZ="EST5EDT" now conform better to POSIX. Fix security,
performance and porting bugs in zic and localtime.
Changes to future timestamps
Canada’s Northwest Territories will not fall back on 2026-11-01 and will stay on
-06 year-round, matching Alberta’s recent change. Model this with its
traditional abbreviation CST.  Although the change to permanent -06 legally took
place on 2026-08-21, temporarily model the change to occur on 2026-11-01 at
02:00 for the same reason as other recent temporary hacks.  (Caution: see “NOTE
FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.) This affects only
America/Inuvik as the rest of the territory is covered by America/Edmonton, for
which the equivalent change was released in 2026c.
Changes to past timestamps
Colombia’s 1992-05-02 spring forward was at 00:00, not 24:00.
Iran’s 1979-05-26 spring forward was at 00:00, not 24:00. (Thanks to N.F. Hase.)
The backward-compatibility names EST5EDT, CST6CDT, MST7MDT, and PST8PDT now
conform better to POSIX.  For example, EST5EDT now always uses the abbreviation
"EST" for standard time (now always 5 hours behind UT) and "EDT" for daylight
saving time, whereas it formerly had different UT offsets before standard time
was introduced and sometimes used abbreviations like "LMT", "EWT" and "EPT", all
contrary to POSIX.  Also, though not required by POSIX these names now use US
federal rules rather than rules of places like New York, reverting to 2024a
behavior.  This change affects only timestamps before 1966-10-30 at 01:00
standard time.
Other data changes
The temporary hacks used for North American timekeeping changes now work around
a libstdc++ std::chrono bug in GCC 14.1-14.4, 15.1-15.2, and 16.1; see GCC bug
124851.  This data change does not affect TZif files or timestamps.  The change
does not work around the related but less serious GCC bugs 116110 and 124513.
These GCC bugs are all fixed in GCC 16.2.
Changes to documentation
URLs for release tarballs in tz-link.html have been updated to reflect their new
canonical URLs on data.iana.org.




Commits

b4d2086 Update tzdata to version 2026d (#153)
91a9022 Switch keyserver used for tarball GPG verification (#152)
c97164f Bump the actions group with 3 updates (#150)
6c7fa78 Stop testing 3.8 and 3.9, test 3.15 and PyPy3 (#148)
d165386 Bump the Actions group with 2 updates (#149)
See full diff in compare view




Updates urllib3 from 2.7.0 to 2.8.0

Release notes
Sourced from urllib3's releases.

2.8.0
🚀 urllib3 is fundraising for HTTP/2 support
urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.
Thank you for your support.
Security
Fixed the following security issues:

The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)
HTTPResponse.stream() and read_chunked() could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)
Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)


[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.
Configure proxy CA certificates and client certificates in proxy_ssl_context, and proxy identity checks with proxy_assert_hostname or proxy_assert_fingerprint. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.


[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.

Deprecations & Removals

Deprecated using an empty collection as the Retry option allowed_methods to retry any verb. (#5044)

Features

Added Url.auth_decoded and Url.auth_decoded_joined convenience properties to the result of parse_url(). (#4945)
Added basic_auth_encoding and proxy_basic_auth_encoding parameters to urllib3.util.make_headers(). (#5092)

Bugfixes


Fixed response header handling to replace obsolete folded header lines (obs-fold) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as Set-Cookie. (#1362)


Fixed usage of proxy_ssl_context with ProxyManager when use_forwarding_for_https=True. Passing ssl_context instead of proxy_ssl_context for HTTPS proxies in this configuration now emits a FutureWarning and will raise an error in v3.0. (#2577)


Changed behavior of the default ConnectionPool.pool initialization. LifoQueue is now resolved from the queue module after the ConnectionPool is instantiated instead of using the default cached QueueCls class property. This is done because sometimes the queue.LifoQueue is monkey-patched late in the program, such as by gevent. (#3289)


Raised UnrewindableBodyError instead of ValueError when retrying a request whose body had tell() but not seek(). (#3779)


Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (#3785)


Fixed HTTPResponse.drain_conn() to discard unread response data in 64 KiB chunks (same as the default amt when doing HTTPResponse.stream(...)). (#5019)


Fixed is_ipaddress() to detect non-standard IPv4 forms accepted by socket.connect, such as hex (0x7f000001), octal (0177.0.0.1), and decimal integers (2130706433), ensuring SSL certificate verification uses the correct mode for these addresses. (#5029)


Fixed HTTPConnectionPool.urlopen raising a misleading FullPoolError instead of ValueError when called with an invalid timeout argument on a pool created with block=True. (#5059)


Fixed port-zero handling to preserve explicit :0 values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, connection_from_url(), and HTTP/2 request authority. (#5071, #5101)


Fixed a bug where PoolManager passed the assert_hostname and assert_fingerprint parameters to HTTP connection pools. (#5077)


Fixed HTTPConnectionPool.urlopen() and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (#5079)


Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (#5091)


Fixed HTTPSConnection.connect() overriding ProxyConfig.ssl_context's certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.
HTTPSConnection no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its ssl_context as a fallback when an HTTPS proxy forwards an HTTP target. (#5093)


Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (#5095)




... (truncated)


Changelog
Sourced from urllib3's changelog.

2.8.0 (2026-09-15)
Security
Fixed the following security issues:

The TLS configuration for HTTPS proxies could be ignored or overridden.
(High severity, GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77>__)
HTTPResponse.stream() and read_chunked() could buffer a chunk-size
line of unbounded length in memory. (High severity,
GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw>__)
Chunked Deflate streaming could enter an infinite loop. (Medium severity,
GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g>__)

.. caution::
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
Configure proxy CA certificates and client certificates in
proxy_ssl_context, and proxy identity checks with
proxy_assert_hostname or proxy_assert_fingerprint.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.

Deprecations & Removals

Deprecated using an empty collection as the Retry option
allowed_methods to retry any verb.
([#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044>__)

Features

Added Url.auth_decoded and Url.auth_decoded_joined convenience
properties to the result of parse_url().
([#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945>__)
Added basic_auth_encoding and proxy_basic_auth_encoding parameters to
urllib3.util.make_headers().
([#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092>__)

Bugfixes

...
Description has been truncated