Skip to content

chore(deps): bump the python group with 10 updates - #272

Merged
ChristianHandy merged 1 commit into
mainfrom
dependabot/pip/python-85752e9b9a
Nov 8, 2026
Merged

chore(deps): bump the python group with 10 updates#272
ChristianHandy merged 1 commit into
mainfrom
dependabot/pip/python-85752e9b9a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the python group with 10 updates:

Package From To
flask-compress 1.25 1.26
tzdata 2026.5 2026.6
cyclonedx-bom 7.5.0 7.6.0
filelock 4.2.4 4.2.6
jsonpointer 3.5 3.6
msgpack 1.2.3 1.2.4
platformdirs 4.13.5 4.14.2
pytest 9.1.1 9.2.0
python-dateutil 3.0.0 4.0.0
ruff 0.17.2 0.17.3

Updates flask-compress from 1.25 to 1.26

Changelog

Sourced from flask-compress's changelog.

1.26 (2026-10-29)

  • tolerate CPython builds where optional compression modules are unavailable, fixes #85:
    • log warnings for missing modules
    • default COMPRESS_ALGORITHM and COMPRESS_ALGORITHM_STREAMING to the algorithms available in the current environment
    • fail explicitly when either option contains an unsupported algorithm
  • modernize GitHub Actions workflows
Commits
  • 7fee90f Bump to version 1.26
  • aaaa319 Skip Windows+PyPy combination in CI for now
  • fe9d74c Modernize GitHub Actions, do not rely on setup-python anymore
  • 88c34a5 Use PyPy 3.12 in tox/CI
  • db2c363 Improve testing of default algorithms supported
  • ffa4389 Update documentation regarding missing compression modules
  • cdff1ad Add warning when a compression is not available
  • 943ab7b Default the compression algorithms to the supported ones
  • 7629413 Update README with mention of optional stdlib modules
  • 42461d7 Pre-commit autoupdate
  • Additional commits viewable in compare view

Updates tzdata from 2026.5 to 2026.6

Release notes

Sourced from tzdata's releases.

2026.6: Release of upstream tzdata 2026f

Version 2026.6

Upstream version 2026f released 2026-10-28T06:16:49+00:00

Briefly:

Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07. No more leap seconds, and leap second tables no longer expire. Improve 1965/1966 data for Brazil.

Changes to future timestamps

Cuba will not fall back to -05 on 2026-11-01 and instead plans to maintain -04 through 2027-11-07.

Changes to past timestamps

In 1965 Brazil ended DST on 03-31 at 24:00 not 00:00, and in 1966 it ended DST on 03-01 at 01:00 not 00:00. (Thanks to Daniel Dias Rodrigues.)

Changes to documentation and commentary

Documentation and commentary now reflect leap seconds’ demise.

Changes to commentary

Discussion on timekeeping in northwestern Ontario has been updated to reflect that provincial regulation has been issued to allow these areas to stay aligned with America/Winnipeg and follow Manitoba’s adoption of year-round -05 after all. (Thanks to Aoun Khan, Chris Walton, and Heitor David Pinto.)

Discussion on timekeeping in Saskatchewan has been updated to document its new Time Act, 2026 which comes into force on 2026-10-30. (Thanks to Heitor David Pinto.) No change is expected.

Changelog

Sourced from tzdata's changelog.

Version 2026.6

Upstream version 2026f released 2026-10-28T06:16:49+00:00

Briefly:

Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07. No more leap seconds, and leap second tables no longer expire. Improve 1965/1966 data for Brazil.

Changes to future timestamps

Cuba will not fall back to -05 on 2026-11-01 and instead plans to maintain -04 through 2027-11-07.

Changes to past timestamps

In 1965 Brazil ended DST on 03-31 at 24:00 not 00:00, and in 1966 it ended DST on 03-01 at 01:00 not 00:00. (Thanks to Daniel Dias Rodrigues.)

Changes to documentation and commentary

Documentation and commentary now reflect leap seconds’ demise.

Changes to commentary

Discussion on timekeeping in northwestern Ontario has been updated to reflect that provincial regulation has been issued to allow these areas to stay aligned with America/Winnipeg and follow Manitoba’s adoption of year-round -05 after all. (Thanks to Aoun Khan, Chris Walton, and Heitor David Pinto.)

Discussion on timekeeping in Saskatchewan has been updated to document its new Time Act, 2026 which comes into force on 2026-10-30. (Thanks to Heitor David Pinto.) No change is expected.

Commits

Updates cyclonedx-bom from 7.5.0 to 7.6.0

Release notes

Sourced from cyclonedx-bom's releases.

v7.6.0 (2026-10-28)

Features

  • environment: Add option -E to ignore parent PYTHON* env vars (#1106, 87fc286)

What's Changed

New Contributors

Full Changelog: CycloneDX/cyclonedx-python@v7.5.0...v7.6.0

Changelog

Sourced from cyclonedx-bom's changelog.

v7.6.0 (2026-10-28)

Features

  • environment: Add option -E to ignore parent PYTHON* env vars (#1106, 87fc286)
Commits
  • 5a81ff8 chore(release): 7.6.0
  • bb67847 chore(deps): Bump python-semantic-release/python-semantic-release from 10.0.2...
  • 797a9b4 chore(deps): Bump python-semantic-release/publish-action from 10.5.3 to 10.7....
  • afdcda4 chore(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (#1124)
  • 89cf5c8 chore(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#1125)
  • d72f8c8 chore(deps): Bump zizmorcore/zizmor-action from 0.6.4 to 0.7.1 (#1130)
  • 105750e chore(deps-dev): Update uv requirement from 0.12.17 to 0.13.4 (#1133)
  • 6b7184e tests: fix pipenv runner (#1132)
  • 87fc286 feat(environment): add option -E to ignore parent PYTHON* env vars (#1106)
  • See full diff in compare view

Updates filelock from 4.2.4 to 4.2.6

Release notes

Sourced from filelock's releases.

4.2.6

Bug fixes

  • Fix a race in SoftFileLock, MarkerSoftFileLock and SoftFileLease when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (#899) by @​dxbjavid and @​gaborbernat.

PyPI release

Full Changelog

4.2.5

Bug fixes

  • acquire and acquire raise TypeError for a blocking that is not a bool, as the constructor and the blocking setter already do. A truthy value such as the string "false" used to count as True, so a call meant as a single attempt waited for the instance's timeout, and without a limit at the default -1 (#870) by @​simpleqt and @​gaborbernat.
  • A SoftFileLock acquisition whose first read of its new marker's identity failed reads it again before rolling back. On Windows the rollback could otherwise not recognize the marker it had created, and the empty marker it left blocked the path for every later acquisition, since no contender breaks an empty marker (#869) by @​simpleqt and @​gaborbernat.
  • A fork() child of a process holding a SoftFileLease starts from an unheld claim. It used to inherit the parent's token, last compromise and heartbeat, so token and compromise reported a claim the child never held while is_locked reported it unheld (#868) by @​dxbjavid and @​gaborbernat.
  • A nested acquire of a held FileLock or SoftFileLock no longer creates the lock file's parent directory. After a rename of that directory during the hold, the nested acquire recreated the old name, and when a file had taken the name it raised FileExistsError and left the hold's recursion count incremented (#878) by @​0x5t4l1n and @​gaborbernat.
  • Fix ReadWriteLock failing every acquire with "link directory ... was replaced while opening" in a group-writable directory whose inherited ACL, such as an NFSv4 one on ZFS, opens the link directory to the group. The lock now closes the empty link directory to its owner, and where the filesystem refuses that, such as ZFS with aclmode=restricted, it names the directory to make writable by its owner only (#898) by @​gaborbernat.
  • Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease raising OverflowError out of acquire(), or never reclaiming a dead holder's lock, when a stranded restore claim beside the lock names a process number outside 1..2**31-1 or spells it in non-ASCII digits. Such a claim is now ignored, as no filelock writes one (#871) by @​dxbjavid and @​gaborbernat.
  • Fix soft locks on Windows keeping the marker of a holder that has exited while another process still holds a handle to it, such as a parent's subprocess.Popen after wait() or multiprocessing.Process after join(). Acquiring such a lock with the default timeout=-1 waited forever (#874) by @​nk-batman21.
  • Fix the read-only reopen of a lock file this account cannot write resolving a relative path against the working directory of the moment. A chdir between the refused O_RDWR open and the reopen made the acquisition wait on a file that is not there, or probe one in another directory. The reopen now uses the path the acquisition pinned (#889) by @​dxbjavid and @​gaborbernat.
  • Handle EMLINK, the error FreeBSD reports when a no-follow open refuses a symlink, in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership there rather than a transient refresh error (#866) by @​pacocartones and @​gaborbernat.
  • Resolving ReadWriteLock or AsyncReadWriteLock raises the ImportError when a module other than Python's sqlite3 is missing, as in a frozen application that left out a filelock submodule. The names are None only without SQLite (#880) by @​pintu544 and @​gaborbernat.

Documentation

Packaging

  • Releases now run on the shared tox-dev/github-workflows pipeline, with a locked release toolchain and generated GitHub Release notes (#885) by @​gaborbernat.

New Contributors

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-9:

4.2.9 (2026-11-04)

.. _release-4-2-9-fixed:

Fixed

  • :class:~filelock.ReadWriteLock, :class:~filelock.SoftReadWriteLock and their async wrappers now raise :class:TypeError for a blocking that is not a :class:bool, in the constructor and on acquire, as :class:~filelock.FileLock already does. Before, blocking=0 waited out the full timeout on a contended :class:~filelock.ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (:pr:908) by :user:abhishekcpp007 and :user:gaborbernat.

.. _release-4-2-8:

4.2.8 (2026-11-04)

.. _release-4-2-8-documentation:

Documentation

  • Clarify the platform-specific locking primitive and range used by descriptor locks, and correct the guidance on interoperating with byte-range lock protocols such as conda's repodata lock (:pr:905) by :user:boyfeiyu.

.. _release-4-2-7:

4.2.7 (2026-11-02)

.. _release-4-2-7-fixed:

Fixed

... (truncated)

Commits
  • f71acb1 release 4.2.6
  • 77eb01a 🐛 fix(soft): restore raced stale markers (#899)
  • b0cc007 release 4.2.5
  • 21bc250 🐛 fix(rw): close a link directory an ACL opened (#898)
  • 715a8de 📝 docs(security): add a threat model and align the policy (#896)
  • b0f1b73 🧪 test: tolerate a preloaded sqlite3 (#894)
  • a2e26ac 🧪 test: count descriptors behind an incomplete /dev/fd (#877)
  • 160141c 🐛 fix(import): raise for a missing read-write module (#880)
  • cb18d9e 🐛 fix(win32): reclaim a soft lock from an exited holder (#874)
  • adbcde9 🐛 fix(lease): reset the claim in a fork child (#868)
  • Additional commits viewable in compare view

Updates jsonpointer from 3.5 to 3.6

Release notes

Sourced from jsonpointer's releases.

3.6

What's Changed

New Contributors

Full Changelog: stefankoegl/python-json-pointer@v3.5...v3.6

Commits
  • c8f3f8b bump version to 3.6
  • f87b1a1 Merge pull request #98 from ShahadatTest/fix/close-cli-inputs
  • 1239370 Close owned CLI input files after reading
  • 694694d Merge pull request #97 from UmutAlisoglu/codex/document-pointer-prefix-direction
  • d6ba526 Clarify the direction of pointer containment checks
  • See full diff in compare view

Updates msgpack from 1.2.3 to 1.2.4

Release notes

Sourced from msgpack's releases.

v1.2.4

What's Changed

New Contributors

Full Changelog: msgpack/msgpack-python@v1.2.3...v1.2.4

Changelog

Sourced from msgpack's changelog.

1.2.4

Release Date: 2026-10-27

  • Limit container preallocation to 10000 items to prevent excessive memory allocation from deeply nested, large array or map headers. Larger containers grow as their contents are decoded; max_array_len and max_map_len still limit their total size. See GHSA-j8c6-9vc5-hj6x.
  • Pass a list of pairs to object_pairs_hook in the pure Python unpacker, ensuring that the entire map is consumed even if the hook does not iterate over its argument. #744
  • Leave the next object unread when read_array_header() or read_map_header() raises ValueError for a mismatched type in the pure Python unpacker. #748
  • Return bytes from Unpacker.read_bytes() in the pure Python implementation, matching the C extension. #747
  • Update GitHub Actions dependencies, including cibuildwheel to 4.3.1. #749
Commits

Updates platformdirs from 4.13.5 to 4.14.2

Release notes

Sourced from platformdirs's releases.

4.14.2

Bug fixes

New Contributors

PyPI release

Full Changelog

4.14.0

Features

  • Accept a keyword-only ensure_exists in the module-level media directory functions, such as user_documents_path, to create a directory set through XDG_*_DIR or user-dirs.dirs (#656) by @​darrenhuai and @​gaborbernat.

Bug fixes

  • Return the media and fonts directories under root's home for root with use_site_for_root, ignoring the invoking user's XDG_*_DIR, user-dirs.dirs and XDG_DATA_HOME, and create no inherited media directory under ensure_exists (#661) by @​gaborbernat.
  • Raise ValueError from site_data_dir and site_config_dir under multipath=True when appname or version contains os.pathsep, rather than returning a string that splits into a directory outside the site base (#662) by @​gaborbernat.
  • Parse an unquoted user-dirs.dirs value with a long run of blanks in linear time, rather than in time quadratic in the run's length on every Unix media directory lookup (#663) by @​gaborbernat.
  • Treat a relative HOME as unset on Unix, macOS and iOS, taking the home from the password database or raising RuntimeError, rather than resolving user directories against the working directory (#664) by @​gaborbernat.
  • Refuse a symlink as XDG_RUNTIME_DIR in user_runtime_dir when the value ends with / or /., which made the check follow the link (#665) by @​gaborbernat.
  • Redirect user_*_dir calls with use_site_for_root=True when the effective uid is 0, so a setuid-root process gets the site directories, and name and check the runtime directory by the effective uid (#666) by @​gaborbernat.
  • Apply the XDG_RUNTIME_DIR check of the Unix user_runtime_dir to the macOS one, so it no longer uses a directory that is a symlink, owned by another user or not mode 0700 (#667) by @​gaborbernat.
  • Reject an XDG_RUNTIME_DIR below a parent that another user can replace, such as their own entry in /tmp, instead of creating the runtime directory through it (#668) by @​gaborbernat.
  • Stop accepting a Unix runtime directory that another user creates between the owner check and its use: ensure_exists and place_runtime_file create it before checking it, and find_runtime_file checks it again after a hit (#669) by @​gaborbernat.
  • Raise PermissionError on macOS when ensure_exists would create the site cache through a /Library/Caches/$appname that is a symlink, not a directory, or owned by a user other than root and the current one (#670) by @​gaborbernat.
  • With ensure_exists, raise FileExistsError when a configured media directory such as user_documents_dir is a regular file or a symlink to one, instead of returning the file's path. Dangling symlinks are still returned unchanged (#672) by @​rupayon123 and @​gaborbernat.

New Contributors

PyPI release

Full Changelog

4.13.7

Bug fixes

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-14-5:

4.14.5 (2026-11-04)

.. _release-4-14-5-fixed:

Fixed

  • Resolve the temporary :func:~platformdirs.user_runtime_dir fallback to /runtime-<uid> instead of //runtime-<uid> when the temporary directory is / (:pr:687) by :user:darrenhuai and :user:gaborbernat.

.. _release-4-14-4:

4.14.4 (2026-11-04)

.. _release-4-14-3:

4.14.3 (2026-11-01)

.. _release-4-14-3-fixed:

Fixed

  • Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (:pr:679) by :user:mikegit123git and :user:gaborbernat.

.. _release-4-14-2:

4.14.2 (2026-10-31)

.. _release-4-14-2-fixed:

... (truncated)

Commits
  • 1d34ad1 release 4.14.2
  • 3b870de 🐛 fix(xdg): deduplicate directory spellings (#677)
  • 17c6932 release 4.14.1
  • d7abc29 fix: restore Pyodide imports without an effective user ID (#676)
  • c40ff0b release 4.14.0
  • 18620ed 🐛 fix(unix): check XDG_RUNTIME_DIR parents (#668)
  • 3a5e7d0 🐛 fix(api): raise when a media dir is a file (#672)
  • 790ff18 🐛 fix(unix): decide root redirect by effective uid (#666)
  • 7753a02 🔒 fix(macos): refuse planted site cache entries (#670)
  • 9f5ff8a 🐛 fix(macos): pass missing_ok to runtime dir check (#674)
  • Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

  • #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

  • #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

    Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

  • #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

    • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
    • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

    pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

  • #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

  • #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

  • #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

    They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

  • #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

  • #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

  • #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
  • #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
  • #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

  • #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits
  • ae1d0ff Prepare release version 9.2.0
  • 143ce31 pre-commit: exclude codespell on generated release announcements
  • 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
  • a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
  • 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
  • 41d12cd docs: clarify typing for yield fixtures
  • b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
  • 16f87a7 docs: improve getting-started.rst test execution description
  • 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
  • ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
  • Additional commits viewable in compare view

Updates python-dateutil from 3.0.0 to 4.0.0

Release notes

Sourced from python-dateutil's releases.

4.0.0

dateutil 4.0 requires Python 3.11 or later and no longer depends on six. Apart from that, the changes in this release are bug fixes, but note that isoparse is now stricter about the numeric fields it accepts (see below).

Deprecations

  • Dropped support for Python versions older than 3.11 and removed the dependency on six, along with Python 2 compatibility helpers that were never part of the public API, such as dateutil.tz.tzname_in_python2. (gh pr #1625)

Bugfixes

  • parser.isoparse, and the isoparser methods parse_isodate, parse_isotime and parse_tzstr, now require each numeric field to be exactly the expected number of ASCII digits. Strings that were previously accepted, such as 20200728121240 (read as 21:24), 2014- 4-21 and 2_14-04-21, and offsets such as +-1:00, now raise ValueError. tzical applies the same check to TZOFFSETFROM and TZOFFSETTO. Reported by @​janos-gonye (gh issue #1074). Fixed by @​varun3257 (gh pr #1617).
  • Fixed an issue where iterating over a cached rrule or rruleset could hang forever if another iterator over the same rule had already completed the cache, for example when a cached rrule was included twice in an rruleset. Reported by @​bysiber (gh pr #1455). Fixed by @​pganssle (gh pr #1655).
  • Unpickling a tzutc now gives the dateutil.tz.UTC singleton, and unpickling a tzoffset gives the same object as calling tzoffset(name, offset). Previously unpickling bypassed the singleton-generation logic. Reported and fixed by @​masipcat (gh issue #1051, gh pr #1053).
  • relativedelta(yearday=366) now resolves to December 31 in leap years. Previously it gave December 30, the same date as yearday=365. Reported and fixed by @​Master-Norna (gh pr #1583).

Misc

  • The build backend is now Hatchling, and the package metadata is in pyproject.toml. Versions are still derived from Git tags and exposed as dateutil.__version__. This mainly affects people building dateutil from source. (gh pr #1637, #1638)
  • Changes to CI, tests and release tooling that do not affect users of the package: gh pr #1636, #1644, #1645, #1646, #1648, #1649, #1650.
Changelog

Sourced from python-dateutil's changelog.

Version 4.0.0 (2026-11-01)

dateutil 4.0 requires Python 3.11 or later and no longer depends on six. Apart from that, the changes in this release are bug fixes, but note that isoparse is now stricter about the numeric fields it accepts (see below).

Deprecations

  • Dropped support for Python versions older than 3.11 and removed the dependency on six, along with Python 2 compatibility helpers that were never part of the public API, such as dateutil.tz.tzname_in_python2. (gh pr #1625)

Bugfixes

  • parser.isoparse, and the isoparser methods parse_isodate, parse_isotime and parse_tzstr, now require each numeric field to be exactly the expected number of ASCII digits. Strings that were previously accepted, such as 20200728121240 (read as 21:24), 2014- 4-21 and 2_14-04-21, and offsets such as +-1:00, now raise ValueError. tzical applies the same check to TZOFFSETFROM and TZOFFSETTO. Reported by @​janos-gonye (gh issue #1074). Fixed by @​varun3257 (gh pr #1617).
  • Fixed an issue where iterating over a cached rrule or rruleset could hang forever if another iterator over the same rule had already completed the cache, for example when a cached rrule was included twice in an rruleset. Reported by @​bysiber (gh pr #1455). Fixed by @​pganssle (gh pr #1655).
  • Unpickling a tzutc now gives the dateutil.tz.UTC singleton, and unpickling a tzoffset gives the same object as calling tzoffset(name, offset). Previously unpickling bypassed the singleton-generation logic. Reported and fixed by @​masipcat (gh issue #1051, gh pr #1053).
  • relativedelta(yearday=366) now resolves to December 31 in leap years. Previously it gave December 30, the same date as yearday=365. Reported and fixed by @​Master-Norna (gh pr #1583).

Misc

  • The build backend is now Hatchling, and the package metadata is in pyproject.toml. Versions are still derived from Git tags and exposed as dateutil.__version__. This mainly affects people building dateutil from source. (gh pr #1637, #1638)
  • Changes to CI, tests and release tooling that do not affect users of the

... (truncated)

Commits
  • a78cbd8 Prepare release 4.0.0
  • d23ff76 Fix yearday=366 resolving to Dec 30 in leap years
  • 5391455 Return the cached instances when unpickling tzutc and tzoffset
  • 6f13622 Reject non-digit characters in isoparse and tzical numeric fields
  • 6e1864c Release the rrule cache lock on every exit from a refill (#1655)
  • 71d92da Skip coverage collection on PyPy in CI
  • d9cad2f Run the tests in parallel with pytest-xdist (#1649)
  • 433c98b Add news fragment for

@dependabot
chore(deps): bump the python group with 10 updates
aed44c1 
Bumps the python group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [flask-compress](https://github.com/colour-science/flask-compress) | `1.25` | `1.26` |
| [tzdata](https://github.com/python/tzdata) | `2026.5` | `2026.6` |
| [cyclonedx-bom](https://github.com/CycloneDX/cyclonedx-python) | `7.5.0` | `7.6.0` |
| [filelock](https://github.com/tox-dev/filelock) | `4.2.4` | `4.2.6` |
| [jsonpointer](https://github.com/stefankoegl/python-json-pointer) | `3.5` | `3.6` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.3` | `1.2.4` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.13.5` | `4.14.2` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` |
| [python-dateutil](https://github.com/dateutil/dateutil) | `3.0.0` | `4.0.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.2` | `0.17.3` |


Updates `flask-compress` from 1.25 to 1.26
- [Changelog](https://github.com/colour-science/flask-compress/blob/master/CHANGELOG.md)
- [Commits](colour-science/flask-compress@v1.25...v1.26)

Updates `tzdata` from 2026.5 to 2026.6
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.5...2026.6)

Updates `cyclonedx-bom` from 7.5.0 to 7.6.0
- [Release notes](https://github.com/CycloneDX/cyclonedx-python/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md)
- [Commits](CycloneDX/cyclonedx-python@v7.5.0...v7.6.0)

Updates `filelock` from 4.2.4 to 4.2.6
- [Release notes](https://github.com/tox-dev/filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@4.2.4...4.2.6)

Updates `jsonpointer` from 3.5 to 3.6
- [Release notes](https://github.com/stefankoegl/python-json-pointer/releases)
- [Commits](stefankoegl/python-json-pointer@v3.5...v3.6)

Updates `msgpack` from 1.2.3 to 1.2.4
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.2.3...v1.2.4)

Updates `platformdirs` from 4.13.5 to 4.14.2
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.13.5...4.14.2)

Updates `pytest` from 9.1.1 to 9.2.0
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.1.1...9.2.0)

Updates `python-dateutil` from 3.0.0 to 4.0.0
- [Release notes](https://github.com/dateutil/dateutil/releases)
- [Changelog](https://github.com/dateutil/dateutil/blob/master/NEWS)
- [Commits](dateutil/dateutil@3.0.0...4.0.0)

Updates `ruff` from 0.17.2 to 0.17.3
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.2...0.17.3)

---
updated-dependencies:
- dependency-name: flask-compress
  dependency-version: '1.26'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: tzdata
  dependency-version: '2026.6'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: cyclonedx-bom
  dependency-version: 7.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: filelock
  dependency-version: 4.2.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: jsonpointer
  dependency-version: '3.6'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: msgpack
  dependency-version: 1.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: platformdirs
  dependency-version: 4.14.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-dateutil
  dependency-version: 4.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.17.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from ChristianHandy as a code owner November 8, 2026 08:25
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 8, 2026
@github-actions

github-actions Bot commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
pip/flask-compress >= 1.26 UnknownUnknown

Scanned Files

  • requirements.txt

@github-actions

github-actions Bot commented Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🟢 Ready to merge

  • All required checks passed and there are no merge conflicts. A maintainer still reviews the change before merging.

Commit aed44c1; updated whenever a check finishes.

What this pull request changes

3 files, +139 / -139 lines.

Area Files Added Deleted
Dependencies 3 +139 -139
Changed files
  • requirements-dev-lock.txt (modified, +132 / -132)
  • requirements-lock.txt (modified, +6 / -6)
  • requirements.txt (modified, +1 / -1)

Required checks

Check Result
pytest (Python 3.11) ✅ passed
pytest (Python 3.12) ✅ passed
pytest (Python 3.13) ✅ passed
Analyze (python) ✅ passed
Safe to merge ✅ passed
AI assistance ✅ passed

Other checks: 11 passed, 0 failed, 1 running.

@ChristianHandy
ChristianHandy merged commit 96ecfb9 into main Nov 8, 2026
18 checks passed
@ChristianHandy
ChristianHandy deleted the dependabot/pip/python-85752e9b9a branch November 8, 2026 19:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ChristianHandy ChristianHandy Awaiting requested review from ChristianHandy ChristianHandy is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ChristianHandy