Chore: Bump the uv group across 1 directory with 9 updates by dependabot[bot] · Pull Request #628 · os-climate/physrisk

dependabot · 2026-09-01T21:07:36Z

Bumps the uv group with 9 updates in the / directory:

Package	From	To
aiohttp	`3.14.0`	`3.14.3`
pillow	`12.2.0`	`12.3.0`
setuptools	`80.10.2`	`83.0.0`
bleach	`4.1.0`	`6.4.0`
mistune	`3.2.1`	`3.3.0`
msgpack	`1.1.2`	`1.2.1`
soupsieve	`2.8.3`	`2.8.4`
tornado	`6.5.5`	`6.5.8`
weasyprint	`68.1`	`69.0`

Updates aiohttp from 3.14.0 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

Related issues and pull requests on GitHub: :issue:13180.

Fixed error message construction in the C HTTP parser -- by :user:bdraco.

Related issues and pull requests on GitHub: :issue:13222.

3.14.2 (2026-07-20)

Bug fixes

Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

Related issues and pull requests on GitHub: :issue:5303.

Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

5e392ce Release v3.14.3 (#13225)
49f65d5 [PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...
240099e [PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...
d93f30a Bump version (#13202)
c1b9212 Release v3.14.2 (#13201)
380d4b5 [PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...
e1e1bee Make llhttp method array size dynamic (#13174) (#13196)
aa4cf29 [PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...
71b57b4 [PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...
64a03fb [PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...
Additional commits viewable in compare view

Updates pillow from 12.2.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Remove non-image ImageCms modes #9697 [@radarhere]

Documentation

Add release notes for SBOM and performance improvements #9747 [@radarhere]

Add security release notes #9741 [@radarhere]

Add release notes for Python 3.15 beta wheels #9696 [@radarhere]

ImageFont can also be used with ImageText #9597 [@radarhere]

Additional guidelines for security reports #9659 [@wiredfool]

Fixed typo #9636 [@radarhere]

Added CVEs to 12.2.0 release notes #9591 [@radarhere]

Revise development support information in README #9583 [@aclark4life]

Add INCIDENT_RESPONSE.md #9555 [@aclark4life]

Add STRIDE threat model to security docs #9562 [@aclark4life]

Add CVEs to 12.2.0 release notes #9556 [@radarhere]

Update README with revised security policy #9553 [@radarhere]

Update security policy #9552 [@aclark4life]

Update macOS tested Python versions #9534 [@radarhere]

Dependencies

Update dependency harfbuzz to v14.2.1 #9720 [@renovate[bot]]

Update dependency mypy to v2 #9653 [@renovate[bot]]

Update dependency cibuildwheel to v4 #9665 [@renovate[bot]]

Update github-actions #9655 [@renovate[bot]]

Update dependency libavif to v1.4.2 #9652 [@renovate[bot]]

Update dependency lcms2 to v2.19.1 #9651 [@renovate[bot]]

Update dependency check-jsonschema to v0.37.2 #9650 [@renovate[bot]]

Update google/oss-fuzz digest to d872252 #9614 [@renovate[bot]]

Update dependency lcms2 to v2.19 #9609 [@renovate[bot]]

Update dependency libpng to v1.6.58 - autoclosed #9608 [@renovate[bot]]

Update dependency harfbuzz to v14 #9610 [@renovate[bot]]

Update dependency mypy to v1.20.2 #9599 [@renovate[bot]]

Update github-actions #9611 [@renovate[bot]]

Update dependency cibuildwheel to v3.4.1 #9607 [@renovate[bot]]

Move dependency versions to single JSON and enable Renovate #9559 [@hugovk]

Updated raqm to 0.10.5 #9557 [@radarhere]

Update dependency cibuildwheel to v3.4.0 #9532 [@renovate[bot]]

Testing

Remove matrix.os from benchmark #9735 [@radarhere]

Remove references to libavif patch #9734 [@radarhere]

Add benchmark tests #9654 [@akx]

Use reshape() instead of setting NumPy array shape directly #9728 [@radarhere]

... (truncated)

Commits

bb1d8e8 12.3.0 version bump
e63fc48 Add release notes for SBOM and performance improvements (#9747)
13b701b Add release notes for #9679
5564ca7 List methods
a0920fd Speed up ImageChops operations (#9738)
07e9a6c Speed up Image.filter() (#9736)
a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
af03747 Speed up Image.resample() (#9739)
5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
Additional commits viewable in compare view

Updates setuptools from 80.10.2 to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

Require Python 3.10 or later.

Bugfixes

MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

pypa/distutils#334

v82.0.1

Bugfixes

Fix the loading of launcher manifest.xml file. (#5047)

Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

Add advice about how to improve predictability when installing sdists. (#5168)

Misc

#4941, #5157, #5169, #5175

v82.0.0

... (truncated)

Commits

6519f72 Bump version: 82.0.1 → 83.0.0
d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
a2df31e Capture removal of dry_run parameter in changelog.
00144dc Moved newsfragment to the release where it occurred.
a4a5a2b Add news fragment.
77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
a2bc3ac Fix broken intersphinx reference to build's installation docs
2d6a739 Use stacked parametrize decorators instead of itertools.product
Additional commits viewable in compare view

Updates bleach from 4.1.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

Dropped support for pypy 3.10. (#764)

Security fixes

Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

For example::

import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

outputs::

'Click'

See the advisory for details.

Fix GHSA-gj48-438w-jh9v.

Fix issue where URI sanitization wasn't happening in formaction attributes.

See the advisory for details.

Bug fixes

Add support for pypy 3.11. (#764)

Drop version max in tinycss2 pin. (#772)

This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Version 6.3.0 (October 27th, 2025)

... (truncated)

Commits

f0355a7 fix: fix last release date in CHANGES
ae4e8a2 chore: bleach 6.4.0 and final release
970df58 fix: uri-sanitization in formaction attributes
7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
913ab75 fix: reduce redundancy in workflow jobs
218c15a fix: rework pip caching
4f0b097 fix: fix tox platform restrictions
e95a79d chore: update pytest
91539d4 Bump actions/cache from 5.0.3 to 5.0.4
cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
Additional commits viewable in compare view

Updates mistune from 3.2.1 to 3.3.0

Release notes

Sourced from mistune's releases.

v3.3.0

   🐞 Bug Fixes

Resolve O(n^2) DoS in parse_link_text (CWE-400) - by bhanugoudm041 (b6b49)

Resolve O(n^2) DoS in parse_link_text (CWE-400)-Type handling/testing done - by bhanugoudm041 (b3af8)

block: Avoid quadratic ref link scans - by @lepture (2b04d)

cli: Add entrypoint and utf-8 output - by @lepture (2f244)

directives: Constrain include targets - by @lepture (1bef3)

formatting: Avoid quadratic marker scans - by @lepture (96d0f)

image: Validate figure width option - by @lepture (e3e51)

inline: Avoid bracket parsing DoS - by @lepture (25f25)

math: Reject currency patterns and cross-line matches in inline math - by @geopanther (566e1)

math: Support display and backtick math - by @lepture (1141e)

renderer: Render plugin list and table nodes - by @lepture (614b0)

renderer: Block encoded unsafe URL schemes - by @lepture (c7101)

toc: Avoid generated id collisions - by @lepture (c4093)

   🏎 Performance

Improve performance - by @lepture (bf95c)

    View changes on GitHub

Changelog

Sourced from mistune's changelog.

Version 3.3.0

Released on Jun 21, 2026

Improve CommonMark compatibility and parser performance.

Add command line entrypoint with UTF-8 output.

Support display and backtick math.

Render plugin list and table nodes in Markdown renderer.

Escape leading block markers in Markdown renderer.

Fix RST renderer for block quotes nested in lists.

Avoid generated heading ID collisions in TOC.

Harden URL, image, figure, and include directive handling.

Fix quadratic scans in inline links, reference links, and formatting markers.

Fix math escaping, currency pattern matching, and cross-line matching.

Commits

15c3b79 chore: release 3.3.0
bdc01ad tests: increase run time on pypy
7cf1814 tests: increase run time for pypy
6dfdc3d tests: add more tests
17c50f6 chore: fix mypy issues
63abe4b chore: use ruff check and format
e6c1b18 chore: resolve mypy issues
dcf8902 test(math): cover escaped math output
c4093c4 fix(toc): avoid generated id collisions
e3e51de fix(image): validate figure width option
Additional commits viewable in compare view

Updates msgpack from 1.1.2 to 1.2.1

Release notes

Sourced from msgpack's releases.

v1.2.1

What's Changed

Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies group by @dependabot[bot] in msgpack/msgpack-python#694

release v1.2.1 by @methane in msgpack/msgpack-python#698

Full Changelog: msgpack/msgpack-python@v1.2.0...v1.2.1

v1.2.0

What's Changed

relax setuptools version by @methane in msgpack/msgpack-python#652

update setuptools requirements to >=78.1.1 by @methane in msgpack/msgpack-python#653

cython: freethreading_compatible by @methane in msgpack/msgpack-python#654

drop Python 3.9 by @methane in msgpack/msgpack-python#656

update cython and cibuildwheel by @methane in msgpack/msgpack-python#658

ci: add riscv64 manylinux/musllinux wheels by @justeph in msgpack/msgpack-python#664

fix: check unpack_callback_uint32 result by @KowalskiThomas in msgpack/msgpack-python#666

fix: re-raise existing exception when available by @KowalskiThomas in msgpack/msgpack-python#667

fix: check return code in unpack_callback_int64 by @KowalskiThomas in msgpack/msgpack-python#665

Fixed README example by @vallsv in msgpack/msgpack-python#668

Bump the all-dependencies group with 6 updates by @dependabot[bot] in msgpack/msgpack-python#669

ci: use ubuntu-slim for lint by @methane in msgpack/msgpack-python#670

fix: enforce strict_map_key with object_pairs_hook by @KowalskiThomas in msgpack/msgpack-python#673

Raise DEFAULT_RECURSE_LIMIT from 511 to 1024 by @Copilot in msgpack/msgpack-python#676

fix: properly handle return codes in pack_timestamp by @KowalskiThomas in msgpack/msgpack-python#672

fix: avoid memory leak when decoding invalid nested arrays by @KowalskiThomas in msgpack/msgpack-python#671

Add missing autoreset in Packer.pack_ext_type by @bysiber in msgpack/msgpack-python#663

Add no-GIL interpreter support by @clin1234 in msgpack/msgpack-python#641

skip recursion limit test on free-threaded CPython builds by @methane in msgpack/msgpack-python#679

Fix Timestamp.from_datetime returning wrong value for pre-epoch datetimes by @bysiber in msgpack/msgpack-python#662

Add 3.15 to CI by @clin1234 in msgpack/msgpack-python#678

fix: use-after-free in get_data_from_buffer by @KowalskiThomas in msgpack/msgpack-python#677

change changelog format to markdown by @methane in msgpack/msgpack-python#680

Bump the all-dependencies group with 2 updates by @dependabot[bot] in msgpack/msgpack-python#684

Bump sys.setrecursionlimit within test_nest_limit_1024 by @clin1234 in msgpack/msgpack-python#682

Guard Packer buffer protocol hooks with Cython critical sections by @Copilot in msgpack/msgpack-python#686

Harden Unpacker.__init__ re-entry cleanup to prevent buffer/context leaks by @Copilot in msgpack/msgpack-python#687

release v1.2.0rc1 by @methane in msgpack/msgpack-python#681

Wheels CI hangs for MacOS Intel by @crusaderky in msgpack/msgpack-python#689

Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 in the all-dependencies group by @dependabot[bot] in msgpack/msgpack-python#691

release v1.2.0 by @methane in msgpack/msgpack-python#692

New Contributors

@justeph made their first contribution in msgpack/msgpack-python#664

@KowalskiThomas made their first contribution in msgpack/msgpack-python#666

@vallsv made their first contribution in msgpack/msgpack-python#668

@dependabot[bot] made their first contribution in msgpack/msgpack-python#669

@Copilot made their first contribution in msgpack/msgpack-python#676

@bysiber made their first contribution in msgpack/msgpack-python#663

@clin1234 made their first contribution in msgpack/msgpack-python#641

... (truncated)

Changelog

Sourced from msgpack's changelog.

1.2.1

Release Date: 2026-06-19

Fix a segfault when calling Unpacker.unpack() or Unpacker.skip() after an unpacking failure. But note that reusing the same Unpacker instance after an unpacking failure is not supported. Please create a new Unpacker instance instead. GHSA-6v7p-g79w-8964

1.2.0

Release Date: 2026-06-11

Support free threaded Python. #654, #686

Dropped support for Python 3.9. #656

Fix missing error checks in C code. #665, #666, #667, #672

Fix strict_map_key option didn't work for object_pairs_hook. #673

Increase DEFAULT_RECURSE_LIMIT of Unpacker to 1024. #676

Fix memory leak when Unpacker returns error for invalid input. #671

Fix Packer.pack_ext_type() ignored autoreset option. #663

Fix Timestamp.from_datetime() returning wrong value for pre-epoch datetimes. #662

Fix use-after-free in unpackb() and Unpacker.unpack() for non-contiguous input. #677

Fix possible memory leak when calling Unpacker.__init__() several times. #687

Commits

448d43f release v1.2.1 (#698)
2c56ddb Merge commit from fork
0f4f350 Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies group (#694)
11ed0a5 release v1.2.0 (#692)
c410a38 Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 (#691)
97ba6ca skip ci: remove unneeded CIBW_SKIP option
cdde1b0 Wheels CI hangs for MacOS Intel (#689)
5eb57e1 release v1.2.0rc1 (#681)
77395c1 Harden Unpacker.__init__ re-entry cleanup to prevent buffer/context leaks (...
7df7136 Guard Packer buffer protocol hooks with Cython critical sections (#686)
Additional commits viewable in compare view

Updates soupsieve from 2.8.3 to 2.8.4

Release notes

Sourced from soupsieve's releases.

2.8.4

FIX: Fix another inefficient attribute pattern (@mauriceng98).

FIX: Limit total number of selectors processed in a pattern to prevent massive selector requests (@mauriceng98).

Commits

28108ab Limit excessive selectors
ef18872 Fix test for Windows
eb43976 Merge commit from fork
3a661b2 Fix typo in pseudo-classes.md (#294)
0cb533d Update hatchling version requirement in pyproject.toml (#290)
See full diff in compare view

Updates tornado from 6.5.5 to 6.5.8

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2

... (truncated)

Commits

a55abe3 Merge pull request #3704 from bdarnell/security-6.5.8
fc79488 docs: add additional credit to release notes
7b01763 Fix test_strip_headers_on_redirect's URL-embedded-credentials cases
d72fff8 release notes and version bump for 6.5.8
b168818 auth: Formally deprecated OpenIDMixin
da28476 web: Also check for semicolons in deprecated mixed-case cookie args
8d6363e httputil: Enforce a new limit on the number of arguments in a request
de85b3f httputil: Apply multipart max_parts limit earlier
48fc2d4 Merge pull request #3633 from bdarnell/curl-reset-65
4ae1ddd Release notes and version bump for 6.5.7
Additional commits viewable in compare view

Updates weasyprint from 68.1 to 69.0

Release notes

Sourced from weasyprint's releases.

v69.0

This is a security update (CVE-2026-49452).

We strongly recommend to upgrade WeasyPrint to the latest version if you use the --presentational-hints option and render untrusted HTML with restricted CSS properties.

Read about this release on our blog.

Security

Avoid CSS injection with HTML presentational hints.

Command-line API

The --srgb option has been replaced by --output-intent=srgb. Other values are possible: device-cmyk for CMYK documents with no ICC profile, or the CSS identifier of a @color-profile rule.

Python API

The output_intent string entry replaces the srgb boolean in default options.

Features

#2357, #2700: Support logical properties

#1194, #2702: Support viewport units

#2686: Detect redirection loops early in URL fetcher

#2735, #2737: Support SVG transform angle units

#2636, #2720, #2773: Use HTML parsers for presentational hints

#2631, #2778, #2785, #2788: Allow users to set PDF output intent

Bug fixes

#2697, #2691: Avoid endless loops in grids

#2709: Be less strict for gradient rasterization in tests

#2683: Fix rendering of emojis in SVG

#2688: Always describe font using absolute sizes

#2676: Fix inheritance for svg/symbol tags referenced by use tags

#2681: Add dc:description field to PDF/A metadata

#2680: Force first grid row rendering on empty pages

#2690: Compute units in gradients used in border background

#2689: Cut flex elements with fixed height and overflowing children

#2651, #2696: Fix tests on Debian

#2698, #2699: Fix alignment of right-to-left elements with auto width and set min/max-width

#2556: Apply presentational hints to svg tags

#2706: Handle infinite border radii

#2707, #2708, #2710: Get mimetypes from Python code instead of various third-party files

#2717, #2580, #2740: Fix table break retry after padding overflow

#2769: Add year in PDF/UA-2 metadata

#2768: Allow SVG lists of numbers to be split on + character

#2770: Add namespace to Document tag in PDF 2

#2771: Never try to render SVG use tags with external sources

#2774: Fix calc in logical

... (truncated)

Changelog

Sourced from weasyprint's changelog.

Version 69.0

Released on 2026-06-02.

This is a security update (CVE-2026-49452).

We strongly recommend to upgrade WeasyPrint to the latest version if you use the --presentational-hints option and render untrusted HTML with restricted CSS properties.

Security:

Avoid CSS injection with HTML presentational hints.

Command-line API:

The --srgb option has been replaced by --output-intent=srgb. Other values are possible: device-cmyk for CMYK documents with no ICC profile, or the CSS identifier of a @color-profile rule.

Python API:

The output_intent string entry replaces the srgb boolean in default options.

Features:

[#2357](https://github.com/Kozea/WeasyPrint/issues/2357) <https://github.com/Kozea/WeasyPrint/issues/2357>, [#2700](https://github.com/Kozea/WeasyPrint/issues/2700) <https://github.com/Kozea/WeasyPrint/pull/2700>: Support logical properties

[#1194](https://github.com/Kozea/WeasyPrint/issues/1194) <https://github.com/Kozea/WeasyPrint/issues/1194>, [#2702](https://github.com/Kozea/WeasyPrint/issues/2702) <https://github.com/Kozea/WeasyPrint/pull/2702>: Support viewport units

[#2686](https://github.com/Kozea/WeasyPrint/issues/2686) <https://github.com/Kozea/WeasyPrint/issues/2686>_: Detect redirection loops early in URL fetcher

[#2735](https://github.com/Kozea/WeasyPrint/issues/2735) <https://github.com/Kozea/WeasyPrint/issues/2735>, [#2737](https://github.com/Kozea/WeasyPrint/issues/2737) <https://github.com/Kozea/WeasyPrint/pull/2737>: Support SVG transform angle units

[#2636](https://github.com/Kozea/WeasyPrint/issues/2636) <https://github.com/Kozea/WeasyPrint/issues/2636>, [#2720](https://github.com/Kozea/WeasyPrint/issues/2720) <https://github.com/Kozea/WeasyPrint/pull/2720>, [#2773](https://github.com/Kozea/WeasyPrint/issues/2773) <https://github.com/Kozea/WeasyPrint/pull/2773>_: Use HTML parsers for presentational hints

[#2631](https://github.com/Kozea/WeasyPrint/issues/2631) <https://github.com/Kozea/WeasyPrint/issues/2631>, [#2778](https://github.com/Kozea/WeasyPrint/issues/2778) <https://github.com/Kozea/WeasyPrint/pull/2778>, [#2785](https://github.com/Kozea/WeasyPrint/issues/2785) <https://github.com/Kozea/WeasyPrint/issues/2785>, [#2788](https://github.com/Kozea/WeasyPrint/issues/2788) <https://github.com/Kozea/WeasyPrint/pull/2788>: Allow users to set PDF output intent

Bug fixes:

... (truncated)

Commits

3287311 Version 69.0
6f58a9a Add security message in Changelog
2d13d3d Update test comment to indicate related issue
227f5f7 Merge pull request #2791 from Kozea/improve-var
ff72115 Improve management of variables
b419c7f Merge pull request #2788 from Kozea/fix-hints
1729ce4 Fix minor errors in presentational hints
9898e84 Merge pull request #2787 from danfitz36/fix-namespace-type-typo
15eea9f Add lang attribute to PDF/UA-2 namespace test
cb5f66c Fix /Namepace typo in PDF 2 structure-tree namespace
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the uv group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [aiohttp](https://github.com/aio-libs/aiohttp) | `3.14.0` | `3.14.3` | | [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` | | [setuptools](https://github.com/pypa/setuptools) | `80.10.2` | `83.0.0` | | [bleach](https://github.com/mozilla/bleach) | `4.1.0` | `6.4.0` | | [mistune](https://github.com/lepture/mistune) | `3.2.1` | `3.3.0` | | [msgpack](https://github.com/msgpack/msgpack-python) | `1.1.2` | `1.2.1` | | [soupsieve](https://github.com/facelessuser/soupsieve) | `2.8.3` | `2.8.4` | | [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.8` | | [weasyprint](https://github.com/Kozea/WeasyPrint) | `68.1` | `69.0` | Updates `aiohttp` from 3.14.0 to 3.14.3 - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.14.0...v3.14.3) Updates `pillow` from 12.2.0 to 12.3.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.2.0...12.3.0) Updates `setuptools` from 80.10.2 to 83.0.0 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v80.10.2...v83.0.0) Updates `bleach` from 4.1.0 to 6.4.0 - [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES) - [Commits](mozilla/bleach@v4.1.0...v6.4.0) Updates `mistune` from 3.2.1 to 3.3.0 - [Release notes](https://github.com/lepture/mistune/releases) - [Changelog](https://github.com/lepture/mistune/blob/main/docs/changes.rst) - [Commits](lepture/mistune@v3.2.1...v3.3.0) Updates `msgpack` from 1.1.2 to 1.2.1 - [Release notes](https://github.com/msgpack/msgpack-python/releases) - [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md) - [Commits](msgpack/msgpack-python@v1.1.2...v1.2.1) Updates `soupsieve` from 2.8.3 to 2.8.4 - [Release notes](https://github.com/facelessuser/soupsieve/releases) - [Commits](facelessuser/soupsieve@2.8.3...2.8.4) Updates `tornado` from 6.5.5 to 6.5.8 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.5...v6.5.8) Updates `weasyprint` from 68.1 to 69.0 - [Release notes](https://github.com/Kozea/WeasyPrint/releases) - [Changelog](https://github.com/Kozea/WeasyPrint/blob/main/docs/changelog.rst) - [Commits](Kozea/WeasyPrint@v68.1...v69.0) --- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production dependency-group: uv - dependency-name: pillow dependency-version: 12.3.0 dependency-type: direct:production dependency-group: uv - dependency-name: setuptools dependency-version: 83.0.0 dependency-type: direct:development dependency-group: uv - dependency-name: bleach dependency-version: 6.4.0 dependency-type: indirect dependency-group: uv - dependency-name: mistune dependency-version: 3.3.0 dependency-type: indirect dependency-group: uv - dependency-name: msgpack dependency-version: 1.2.1 dependency-type: indirect dependency-group: uv - dependency-name: soupsieve dependency-version: 2.8.4 dependency-type: indirect dependency-group: uv - dependency-name: tornado dependency-version: 6.5.8 dependency-type: indirect dependency-group: uv - dependency-name: weasyprint dependency-version: '69.0' dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from joemoorhouse as a code owner September 1, 2026 21:07

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 1, 2026

github-actions Bot added the chore label Sep 1, 2026

Navigation Menu

Chore: Bump the uv group across 1 directory with 9 updates - #628

Chore: Bump the uv group across 1 directory with 9 updates#628
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-2fb5f37ac6

dependabot Bot commented on behalf of github Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026

3.14.3 (2026-07-22)

Bug fixes

3.14.2 (2026-07-20)

Bug fixes

12.3.0

Removals

Documentation

Dependencies

Testing

v83.0.0

Features

Bugfixes

Deprecations and Removals

v82.0.1

Bugfixes

Improved Documentation

Misc

Version 6.4.0 (June 5th, 2026)

Version 6.3.0 (October 27th, 2025)

v3.3.0

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

Version 3.3.0

v1.2.1

What's Changed

v1.2.0

What's Changed

New Contributors

1.2.1

1.2.0

2.8.4

Release notes

v69.0

Security

Command-line API

Python API

Features

Bug fixes

Version 69.0

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants