chore(deps): bump the uv-version-updates group across 1 directory with 17 updates by dependabot[bot] · Pull Request #150 · zitadel/client-python

dependabot · 2026-10-29T14:16:35Z

Bumps the uv-version-updates group with 17 updates in the / directory:

Package	From	To
urllib3	`2.7.0`	`2.8.0`
python-dateutil	`2.9.0.post0`	`3.0.0`
pydantic	`2.12.5`	`2.14.1`
typing-extensions	`4.15.0`	`4.16.0`
authlib	`1.6.12`	`1.9.1`
requests	`2.33.0`	`2.34.2`
cryptography	`50.0.0`	`50.0.2`
pytest	`9.0.3`	`9.1.1`
pytest-cov	`7.0.0`	`7.1.0`
tox	`4.32.0`	`4.65.0`
types-python-dateutil	`2.9.0.20251115`	`2.9.0.20261021`
testcontainers	`4.14.1`	`4.15.0`
python-dotenv	`1.2.2`	`1.2.4`
ruff	`0.14.10`	`0.17.2`
sphinx	`7.4.7`	`8.1.3`
fawltydeps	`0.19.0`	`0.20.0`
ty	`0.0.5`	`0.0.92`

Updates urllib3 from 2.7.0 to 2.8.0

Release notes

Sourced from urllib3's releases.

2.8.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Fixed the following security issues:

The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)

HTTPResponse.stream() and read_chunked() could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)

Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)

[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.

Configure proxy CA certificates and client certificates in proxy_ssl_context, and proxy identity checks with proxy_assert_hostname or proxy_assert_fingerprint. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.

[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.

Deprecations & Removals

Deprecated using an empty collection as the Retry option allowed_methods to retry any verb. (#5044)

Features

Added Url.auth_decoded and Url.auth_decoded_joined convenience properties to the result of parse_url(). (#4945)

Added basic_auth_encoding and proxy_basic_auth_encoding parameters to urllib3.util.make_headers(). (#5092)

Bugfixes

Fixed response header handling to replace obsolete folded header lines (obs-fold) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as Set-Cookie. (#1362)

Fixed usage of proxy_ssl_context with ProxyManager when use_forwarding_for_https=True. Passing ssl_context instead of proxy_ssl_context for HTTPS proxies in this configuration now emits a FutureWarning and will raise an error in v3.0. (#2577)

Changed behavior of the default ConnectionPool.pool initialization. LifoQueue is now resolved from the queue module after the ConnectionPool is instantiated instead of using the default cached QueueCls class property. This is done because sometimes the queue.LifoQueue is monkey-patched late in the program, such as by gevent. (#3289)

Raised UnrewindableBodyError instead of ValueError when retrying a request whose body had tell() but not seek(). (#3779)

Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (#3785)

Fixed HTTPResponse.drain_conn() to discard unread response data in 64 KiB chunks (same as the default amt when doing HTTPResponse.stream(...)). (#5019)

Fixed is_ipaddress() to detect non-standard IPv4 forms accepted by socket.connect, such as hex (0x7f000001), octal (0177.0.0.1), and decimal integers (2130706433), ensuring SSL certificate verification uses the correct mode for these addresses. (#5029)

Fixed HTTPConnectionPool.urlopen raising a misleading FullPoolError instead of ValueError when called with an invalid timeout argument on a pool created with block=True. (#5059)

Fixed port-zero handling to preserve explicit :0 values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, connection_from_url(), and HTTP/2 request authority. (#5071, #5101)

Fixed a bug where PoolManager passed the assert_hostname and assert_fingerprint parameters to HTTP connection pools. (#5077)

Fixed HTTPConnectionPool.urlopen() and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (#5079)

Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (#5091)

Fixed HTTPSConnection.connect() overriding ProxyConfig.ssl_context's certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.

HTTPSConnection no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its ssl_context as a fallback when an HTTPS proxy forwards an HTTP target. (#5093)

Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (#5095)

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.8.0 (2026-09-15)

Security

Fixed the following security issues:

The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77>__)

HTTPResponse.stream() and read_chunked() could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw>__)

Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g>__)

.. caution::
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.
Configure proxy CA certificates and client certificates in
proxy_ssl_context, and proxy identity checks with
proxy_assert_hostname or proxy_assert_fingerprint.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.
Deprecations & Removals

Deprecated using an empty collection as the Retry option allowed_methods to retry any verb. ([#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044>__)

Features

Added Url.auth_decoded and Url.auth_decoded_joined convenience properties to the result of parse_url(). ([#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945>__)

Added basic_auth_encoding and proxy_basic_auth_encoding parameters to urllib3.util.make_headers(). ([#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092>__)

Bugfixes

... (truncated)

Commits

b1d30ab Release 2.8.0
9016d7e Skip test_read_chunked_with_trailing_data_does_not_hang for brotlicffi (#5258)
9101f58 Fix nox -s docs warning (#5256)
cd770b0 Merge commit from fork
ea2ad7b Merge commit from fork
0716e31 Fix loading unencrypted client keys with a password in pyOpenSSL (#5255)
43c68c8 Test pickling of InvalidChunkLength (#5247)
308b279 Share security policy between GitHub and Read the Docs (#5253)
53fa073 Add policy on duplicate pull requests (#5252)
5f2a6a8 Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (#5232)
Additional commits viewable in compare view

Updates python-dateutil from 2.9.0.post0 to 3.0.0

Release notes

Sourced from python-dateutil's releases.

3.0.0

This is the last major version of dateutil that will support any version of Python older than 3.11. The next release will be the 4.x series, which will support Python 3.11 and later. We may release fixes for serious bugs in the 3.0.x series, but there are no plans for new features there.

The biggest change in this release is a rewrite of tz.tzfile, which affects nearly every user of dateutil.tz and changes the UTC offset of nonexistent times (see below). dateutil also now depends on the tzdata package, and no longer ships its own time zone database.

Data updates

dateutil no longer bundles a copy of the IANA time zone database. Time zone data now comes from the system (see dateutil.tz.TZPATH) or, failing that, from the new tzdata dependency, so the data version is whatever version of tzdata is installed. (gh pr #1130)

Features

Rewrote tz.tzfile based on a backport of the zoneinfo module's pure-Python implementation. This adds support for Version 2 and Version 3 tzfile(5) binaries, resolving issues with timestamps beyond 2038 and "slim" format binaries. (gh issues #462, #1059, gh pr #1130)

Added dateutil.tz.TZPATH and dateutil.tz.reset_tzpath to allow for runtime configuration of the IANA time zone data search path. These replace the mutable dateutil.tz.TZPATHS list, which has been removed. (gh pr #1130)

dateutil now depends on the tzdata package, which gettz consults after the search path and before the Windows registry. On Windows this means that names that are both IANA keys and Windows time zone names, such as "UTC", now return a tzfile rather than a tzwin. (gh pr #1130)

Bugfixes

tz.tzfile now follows PEP 495 for times that fall in a gap: with fold=0 it uses the offset from before the transition, and with fold=1 the offset from after it. Previously it always used the offset from after the transition, so for example datetime(2003, 4, 6, 2, 30, tzinfo=tz.gettz("America/New_York")) had a UTC offset of -04:00, where it now has -05:00, the same as with zoneinfo. (gh pr #1130)

tz.tzfile objects for fixed-offset zones, such as tz.gettz("UTC"), now return their offset, DST offset and abbreviation when utcoffset, dst and tzname are called with None, as tz.tzutc, tz.tzoffset and zoneinfo.ZoneInfo do. This means that datetime.time objects with such a zone attached are now aware: time(12, tzinfo=tz.gettz("UTC")).isoformat() is now "12:00:00+00:00" rather than "12:00:00". (gh pr #1130)

tz.tzfile now infers dst() from the standard time on both sides of each DST period, rather than only the one before it, and does so for each transition rather than for each local time type. This fixes dst() for double summer time (e.g. in Europe/London in the 1940s), for half-hour DST (e.g. in Pacific/Rarotonga) and where the standard offset changed at the same time as a DST transition (e.g. in America/Bahia_Banderas in 2010). Against the standard offsets in the tz database source, the only remaining errors are in Europe/Paris in 1944 and 1945. (gh pr #1130)

Fixed rrulestr raising ValueError on experimental X- parameters in an RRULE line (such as GNOME Evolution's X-EVOLUTION-ENDDATE); these are now ignored as RFC 5545 permits. Fixed by @yajo (gh pr #1374)

Enabled pickling and deepcopy of cached rrule and rruleset instances. The cache setting is preserved, and cached results are regenerated on demand without copying locks or generators. Reported by @niccokunzmann (gh issue #1369). Fixed by @Jay1023CN (gh pr #1600).

Fixed relativedelta.__ne__ raising TypeError when comparing against an unsupported type such as None; it now returns True. Reported and fixed by @kevinkt1 (gh issue #1157, gh pr #1158)

Raised the minimum version of six to 1.6, fixing No module named 'six.moves' errors with older versions. Reported by @skytreader (gh issue #1415), fixed by @jdarias3 (gh pr #1424).

Deprecations

Deprecated the dateutil.zoneinfo module. The module now acts as a wrapper around the tzdata package and will be removed in a future version. Users are encouraged to migrate to dateutil.tz.gettz or the standard library's zoneinfo module. dateutil.zoneinfo.rebuild.rebuild no longer does anything, and by default raises RebuildDeprecationWarning as an error; filter the warning to call it as a no-op. (gh pr #1130)

Deprecated passing gettz a relative key that refers to a file outside of every directory on TZPATH, such as "../../etc/localtime". By default this now raises dateutil.tz.DeprecatedTzKeyWarning as an error; filter the warning to keep the old behavior for now, or pass an absolute path instead. (gh pr #1130)

Documentation changes

Added intersphinx to the docs build and cleaned up some broken links. (gh pr #1463)

Misc

Releases are now uploaded to PyPI using trusted publishing, and the built sdist and wheel are tested on all supported platforms before upload. (gh pr #1619, #1622)

Changes to CI, tests and release tooling that do not affect users of the package: gh pr #1417, #1462, #1464, #1465, #1466, #1467, #1468, #1469, #1470, #1499, #1501, #1504, #1576, #1577, #1578, #1581, #1585.

Changelog

Sourced from python-dateutil's changelog.

Version 3.0.0 (2026-10-21)

This is the last major version of dateutil that will support any version of Python older than 3.11. The next release will be the 4.x series, which will support Python 3.11 and later. We may release fixes for serious bugs in the 3.0.x series, but there are no plans for new features there.

The biggest change in this release is a rewrite of tz.tzfile, which affects nearly every user of dateutil.tz and changes the UTC offset of nonexistent times (see below). dateutil also now depends on the tzdata package, and no longer ships its own time zone database.

Data updates

dateutil no longer bundles a copy of the IANA time zone database. Time zone data now comes from the system (see dateutil.tz.TZPATH) or, failing that, from the new tzdata dependency, so the data version is whatever version of tzdata is installed. (gh pr #1130)

Features

Rewrote tz.tzfile based on a backport of the zoneinfo module's pure-Python implementation. This adds support for Version 2 and Version 3 tzfile(5) binaries, resolving issues with timestamps beyond 2038 and "slim" format binaries. (gh issues #462, #1059, gh pr #1130)

Added dateutil.tz.TZPATH and dateutil.tz.reset_tzpath to allow for runtime configuration of the IANA time zone data search path. These replace the mutable dateutil.tz.TZPATHS list, which has been removed. (gh pr #1130)

dateutil now depends on the tzdata package, which gettz consults after the search path and before the Windows registry. On Windows this means that names that are both IANA keys and Windows time zone names, such as "UTC", now return a tzfile rather than a tzwin. (gh pr #1130)

Bugfixes

tz.tzfile now follows PEP 495 for times that fall in a gap: with fold=0 it uses the offset from before the transition, and with fold=1 the offset from after it. Previously it always used the offset from after the transition, so for example datetime(2003, 4, 6, 2, 30, tzinfo=tz.gettz("America/New_York")) had a UTC offset of -04:00, where it now has -05:00, the same as with zoneinfo. (gh pr #1130)

tz.tzfile objects for fixed-offset zones, such as tz.gettz("UTC"), now return their offset, DST offset and abbreviation when utcoffset, dst and tzname are called with None, as tz.tzutc, tz.tzoffset and

... (truncated)

Commits

10f317f Prepare release 3.0.0
fabac8d Run the tests against a wheel built once on a recent Python
21b6862 Allow pickling and deepcopy of cached recurrence rules (#1600)
bd5fd88 Remove deprecated setuptools usage from the build
962f0a5 Don't fetch an unpinned setuptools_scm via setup_requires
db944cf Update the Python version classifiers
3b07521 Test on Python 3.14t, 3.15 and 3.15t
6899421 Fix dateutil/dateutil#1157
bc90ab4 Use trusted publishing to upload to PyPI
950abb6 fix(rrule): don't die on experimental properties
Additional commits viewable in compare view

Updates pydantic from 2.12.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

Avoid Python tuple allocation during model fields validation by @Viicos in #13955

Avoid unnecessary extra dict allocation in model validation by @Viicos in #13956

Fixes

Fix arguments-v3 schema with variadic keywords by @Viicos in #13954

Fix TypeError on ForwardRef on Python 3.10.0 by @Viicos in #13964

Support closed and extra_items via inheritance in TypedDict by @Viicos in #13967

Enforce the max_digits whole-digits limit in the Python Decimal validator by @Viicos in #13972

Reject out-of-range int inputs for timedelta by @Viicos in #13973

Support named tuples in Sequence validation by @Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

Add support for multiple_of constraint in fraction and timedelta core schemas by @Viicos in #13873

Add __namespace__ parameter to create_model() by @Viicos in #13895

Changes

Add an ordered-dict core schema by @Viicos in #13796

Add a counter core schema by @Viicos in #13824

Do not mutate model_config attribute by @Viicos in #13825

Reject newlines in NameEmail validation by @Viicos in #13897

Fixes

Call enum constructors in both validation modes by @Viicos in #13792

Fix documentation examples not raising and remove unused string_sub_type unused error code by @Viicos in #13821

Catch OverflowError during ByteSize validation by @Viicos in #13850

Require multiple_of constraints to be positive by @Viicos in #13862

Always pop field name and model type stacks during schema generation by @saquibjawedbit in #13859

Handle TypeError gracefully during docstring extraction by @Viicos in #13874

Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @Viicos in #13891

Don't apply ser_json_timedelta to all datetime types in serialization inference by @Viicos in #13892

Encode JSON Schema defaults with a consistent configuration by @Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

Add support for multiple_of constraint in fraction and timedelta core schemas by @Viicos in #13873

Add __namespace__ parameter to create_model() by @Viicos in #13895

Changes

Add an ordered-dict core schema by @Viicos in #13796

Add a counter core schema by @Viicos in #13824

Do not mutate model_config attribute by @Viicos in #13825

Reject newlines in NameEmail validation by @Viicos in #13897

Fixes

Call enum constructors in both validation modes by @Viicos in #13792

Fix documentation examples not raising and remove unused string_sub_type unused error code by @Viicos in #13821

Catch OverflowError during ByteSize validation by @Viicos in #13850

Require multiple_of constraints to be positive by @Viicos in #13862

Always pop field name and model type stacks during schema generation by @saquibjawedbit in #13859

Handle TypeError gracefully during docstring extraction by @Viicos in #13874

Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @Viicos in #13891

Don't apply ser_json_timedelta to all datetime types in serialization inference by @Viicos in #13892

Encode JSON Schema defaults with a consistent configuration by @Viicos in #13893

Propagate init and kw_only=False from Field() to stdlib dataclass fields by @Viicos in #13898

Respect propagated extra config in the JSON Schema of stdlib dataclasses by @Viicos in #13899

Handle OS errors during ZoneInfo validation by @Viicos in #13912

Handle exceptions during Decimal validation by @Viicos in #13940

Rebuild incomplete types during serialization inference by @Viicos in #13922

Reject large exponents in Fraction validation by @Viicos in #13944

Avoid validating URL prefix multiple times in multi host URLs by @Viicos in #13945

New Contributors

@saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

b2212c7 Prepare release v2.14.1
968fb2b Fix docs conversion table
6adc8b3 Support named tuples in Sequence validation
7637fbc Reject out-of-range int inputs for timedelta
dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
e2456d3 Support closed and extra_items via inheritance in TypedDict
317655d Harden CI security
3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
43681ab Bump samuelcolvin/check-python-version action to v5.1
d6bc53a Avoid unnecessary extra dict allocation in model validation
Additional commits viewable in compare view

Updates typing-extensions from 4.15.0 to 4.16.0

Release notes

Sourced from typing-extensions's releases.

4.16.0

No changes since 4.16.0rc2.

Changes since 4.15.0:

Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.

Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.

Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.

Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.

Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.

Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.

Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.

Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.

Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.

Add support for pickling sentinels.

Sentinels now preserve their identity when copied or deep-copied.

Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.

The default repr of a sentinel X = sentinel("X") is now X rather than <X>.

Deprecate arbitrary attribute assignments to sentinels.

Deprecate subclassing sentinels.

Add support for Python 3.15.

Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

4.16.0rc2

Changes since 4.16.0rc1:

Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

Changes since 4.15.0:

Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.

Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.

Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.

Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.

Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.

Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.

Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.

Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.

Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.

Add support for pickling sentinels.

Sentinels now preserve their identity when copied or deep-copied.

Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.

The default repr of a sentinel X = sentinel("X") is now X rather than <X>.

Deprecate arbitrary attribute assignments to sentinels.

Deprecate subclassing sentinels.

Add support for Python 3.15.

4.16.0rc1

Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.

Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.

... (truncated)

Changelog

Sourced from typing-extensions's changelog.

Release 4.16.0 (July 2, 2026)

No user-facing changes since 4.16.0rc2.

Release 4.16.0rc2 (June 25, 2026)

Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

Release 4.16.0rc1 (June 24, 2026)

Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.

Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.

Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.

Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.

Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.

Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.

Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.

Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.

Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.

Add support for pickling sentinels.

Sentinels now preserve their identity when copied or deep-copied.

Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.

The default repr of a sentinel X = sentinel("X") is now X rather than <X>.

Deprecate arbitrary attribute assignments to sentinels.

Deprecate subclassing sentinels.

Add support for Python 3.15.

Commits

f29cd28 Prepare relase 4.16.0 (#774)
4317461 Bump version to 4.16.0rc2.dev (#772)
4f71098 Prepare release 4.16.0rc2 (#771)
37ed08a Remove use of asyncio.coroutines.iscoroutinefunction() (#769)
8dcc559 Improve TypedDict documentation (#770)
224f8d5 Post-release followups for 3.16.0rc1 (#767)
777de3e Prepare release 4.16.0rc1 (#766)
890be90 Type variable tuple variance (#741)
0e05458 Pin SQLAlchemy third-party tests to pytest==9.0.3 (#765)
d277746 docs: add version compatibility table (#733)
Additional commits viewable in compare view

Updates authlib from 1.6.12 to 1.9.1

Release notes

Sourced from authlib's releases.

v1.9.1

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

Use scriv to handle the changelog by @azmeuk in authlib/authlib#954

Full Changelog: authlib/authlib@v1.9.0...v1.9.1

v1.9.0

What's Changed

feat: add Identity Assertion JWT Authorization Grant (ID-JAG) by @BinoyOza-okta in authlib/authlib#898

Fix empty signatures validation in JWS JSON deserialization by @loporto in authlib/authlib#938

fix(jose): reject boolean values for NumericDate claims by @cpruijsen in authlib/authlib#942

fix(client): avoid duplicated OAuth 1.0 parameters in signed requests by @cpruijsen in authlib/authlib#943

OAuth2 token fetch crashes with JSONDecodeError instead of a catchable error on rate-limit responses by @juneja-varun in authlib/authlib#929

docs: add i18n wrappers in conf.py and templates by @hwhsu1231 in authlib/authlib#901

fix(oauth): enforce JOSE key, scope, and audience validation by @lepture in authlib/authlib#945

AsyncOpenIDMixin.parse_id_token: return None when id_token is absent, matching the sync client by @ckarnell in authlib/authlib#924

fix(oauth): enforce nonce and JAR request validation by @lepture in authlib/authlib#949

fix(oauth): require client authentication for ID-JAG grants by @lepture in authlib/authlib#955

New Contributors

@BinoyOza-okta made their first contribution in authlib/authlib#898

@loporto made their first contribution in authlib/authlib#938

@cpruijsen made their first contribution in authlib/authlib#942

@juneja-varun made their first contribution in authlib/authlib#929

@hwhsu1231 made their first contribution in authlib/authlib#901

@ckarnell made their first contribution in authlib/authlib#924

Full Changelog: authlib/authlib@v1.8.0...v1.9.0

v1.8.0

What's Changed

Prefer id_token_signed_response_alg client metadata to guess algs by @azmeuk in authlib/authlib#888

fix: Catch InvalidKeyIdError in RFC 9068 JWTBearerTokenValidator by @liudonggalaxy in authlib/authlib#891

fix: make leeway configurable in JWTBearerTokenValidator by @mondi04 in authlib/authlib#903

feat: add default jti claim to sign_jwt_bearer_assertion by @liudonggalaxy in authlib/authlib#897

fix(oauth): cast sub claim to string in JWTBearerTokenGenerator by @levinKaus in authlib/authlib#911

Declare lower bounds for dependencies by @azmeuk in authlib/authlib#912

feat(client): use httpx2 instead of httpx by @levinKaus in authlib/authlib#909

Fix RFC7523 malformed claims handling by @azmeuk in authlib/authlib#916

Fix httpx oauth1 binary form data by @shc261392 in authlib/authlib#779

fix(starlette_client): remove default= keyword from config.get calls by @aliaksei-protchanka in authlib/authlib#770

Added client_id parameter to AssertionClient by @vilmar-hillow in authlib/authlib#476

fix(oauth): save device credential with authenticated client id by @arpitjain099 in authlib/authlib#908

fix(oauth1): correct protocol name in InsecureTransportError description by @RavSinghChandan in authlib/authlib#919

fix(client): client can be flexible with jwt's header by @lepture in authlib/authlib#922

fix(oidc): omit claims when the value is None by @lepture in ...
Description has been truncated

…h 17 updates Bumps the uv-version-updates group with 17 updates in the / directory: | Package | From | To | | --- | --- | --- | | [urllib3](https://github.com/urllib3/urllib3) | `2.7.0` | `2.8.0` | | [python-dateutil](https://github.com/dateutil/dateutil) | `2.9.0.post0` | `3.0.0` | | [pydantic](https://github.com/pydantic/pydantic) | `2.12.5` | `2.14.1` | | [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` | | [authlib](https://github.com/authlib/authlib) | `1.6.12` | `1.9.1` | | [requests](https://github.com/psf/requests) | `2.33.0` | `2.34.2` | | [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.2` | | [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` | | [pytest-cov](https://github.com/pytest-dev/pytest-cov) | `7.0.0` | `7.1.0` | | [tox](https://github.com/tox-dev/tox) | `4.32.0` | `4.65.0` | | [types-python-dateutil](https://github.com/python/typeshed) | `2.9.0.20251115` | `2.9.0.20261021` | | [testcontainers](https://github.com/testcontainers/testcontainers-python) | `4.14.1` | `4.15.0` | | [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.4` | | [ruff](https://github.com/astral-sh/ruff) | `0.14.10` | `0.17.2` | | [sphinx](https://github.com/sphinx-doc/sphinx) | `7.4.7` | `8.1.3` | | [fawltydeps](https://github.com/tweag/FawltyDeps) | `0.19.0` | `0.20.0` | | [ty](https://github.com/astral-sh/ty) | `0.0.5` | `0.0.92` | Updates `urllib3` from 2.7.0 to 2.8.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.7.0...2.8.0) Updates `python-dateutil` from 2.9.0.post0 to 3.0.0 - [Release notes](https://github.com/dateutil/dateutil/releases) - [Changelog](https://github.com/dateutil/dateutil/blob/master/NEWS) - [Commits](dateutil/dateutil@2.9.0.post0...3.0.0) Updates `pydantic` from 2.12.5 to 2.14.1 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.12.5...v2.14.1) Updates `typing-extensions` from 4.15.0 to 4.16.0 - [Release notes](https://github.com/python/typing_extensions/releases) - [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md) - [Commits](python/typing_extensions@4.15.0...4.16.0) Updates `authlib` from 1.6.12 to 1.9.1 - [Release notes](https://github.com/authlib/authlib/releases) - [Commits](authlib/authlib@v1.6.12...v1.9.1) Updates `requests` from 2.33.0 to 2.34.2 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.33.0...v2.34.2) Updates `cryptography` from 50.0.0 to 50.0.2 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@50.0.0...50.0.2) Updates `pytest` from 9.0.3 to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.3...9.1.1) Updates `pytest-cov` from 7.0.0 to 7.1.0 - [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst) - [Commits](pytest-dev/pytest-cov@v7.0.0...v7.1.0) Updates `tox` from 4.32.0 to 4.65.0 - [Release notes](https://github.com/tox-dev/tox/releases) - [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst) - [Commits](tox-dev/tox@4.32.0...4.65.0) Updates `types-python-dateutil` from 2.9.0.20251115 to 2.9.0.20261021 - [Commits](https://github.com/python/typeshed/commits) Updates `testcontainers` from 4.14.1 to 4.15.0 - [Release notes](https://github.com/testcontainers/testcontainers-python/releases) - [Changelog](https://github.com/testcontainers/testcontainers-python/blob/main/CHANGELOG.md) - [Commits](testcontainers/testcontainers-python@testcontainers-v4.14.1...testcontainers-v4.15.0) Updates `python-dotenv` from 1.2.2 to 1.2.4 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.2.2...v1.2.4) Updates `ruff` from 0.14.10 to 0.17.2 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.14.10...0.17.2) Updates `sphinx` from 7.4.7 to 8.1.3 - [Release notes](https://github.com/sphinx-doc/sphinx/releases) - [Changelog](https://github.com/sphinx-doc/sphinx/blob/v8.1.3/CHANGES.rst) - [Commits](sphinx-doc/sphinx@v7.4.7...v8.1.3) Updates `fawltydeps` from 0.19.0 to 0.20.0 - [Release notes](https://github.com/tweag/FawltyDeps/releases) - [Commits](tweag/FawltyDeps@v0.19.0...v0.20.0) Updates `ty` from 0.0.5 to 0.0.92 - [Release notes](https://github.com/astral-sh/ty/releases) - [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md) - [Commits](astral-sh/ty@0.0.5...0.0.92) --- updated-dependencies: - dependency-name: urllib3 dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-version-updates - dependency-name: python-dateutil dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: uv-version-updates - dependency-name: pydantic dependency-version: 2.14.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-version-updates - dependency-name: typing-extensions dependency-version: 4.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-version-updates - dependency-name: authlib dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-version-updates - dependency-name: requests dependency-version: 2.34.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-version-updates - dependency-name: cryptography dependency-version: 50.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: uv-version-updates - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: uv-version-updates - dependency-name: pytest-cov dependency-version: 7.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: uv-version-updates - dependency-name: tox dependency-version: 4.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: uv-version-updates - dependency-name: types-python-dateutil dependency-version: 2.9.0.20261021 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: uv-version-updates - dependency-name: testcontainers dependency-version: 4.15.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: uv-version-updates - dependency-name: python-dotenv dependency-version: 1.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: uv-version-updates - dependency-name: ruff dependency-version: 0.17.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: uv-version-updates - dependency-name: sphinx dependency-version: 8.1.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: uv-version-updates - dependency-name: fawltydeps dependency-version: 0.20.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: uv-version-updates - dependency-name: ty dependency-version: 0.0.92 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: uv-version-updates ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-29T14:23:00Z

Qodana for Python

2 new problems were found

Inspection name	Severity	Problems
`Invalid type hints definitions and usages`	🔶 Warning	1
`Unused local symbols`	◽️ Notice	1

@@ Code coverage @@
+ 75% total lines covered
917 lines analyzed, 690 lines covered
# Calculated according to the filters of your coverage tool

💡 Qodana analysis was run in the pull request mode: only the changed files were checked
☁️ View the detailed Qodana report

Contact Qodana team

Contact us at qodana-support@jetbrains.com

Or via our issue tracker: https://jb.gg/qodana-issue
Or share your feedback: https://jb.gg/qodana-discussions

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update Python (uv-managed) dependencies labels Oct 29, 2026

Navigation Menu

Repository navigation

chore(deps): bump the uv-version-updates group across 1 directory with 17 updates - #150

chore(deps): bump the uv-version-updates group across 1 directory with 17 updates#150
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-version-updates-76345f0a26

dependabot Bot commented on behalf of github Oct 29, 2026

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 29, 2026

2.8.0

🚀 urllib3 is fundraising for HTTP/2 support

Security

Deprecations & Removals

Features

Bugfixes

2.8.0 (2026-09-15)

Security

Deprecations & Removals

Features

Bugfixes

3.0.0

Data updates

Features

Bugfixes

Deprecations

Documentation changes

Misc

Version 3.0.0 (2026-10-21)

Data updates

Features

Bugfixes

v2.14.1 2026-10-11

What's Changed

Performance

Fixes

v2.14.0 2026-10-08

What's Changed

New Features

Changes

Fixes

v2.14.0 (2026-10-08)

What's Changed

New Features

Changes

Fixes

New Contributors

4.16.0

4.16.0rc2

4.16.0rc1

Release 4.16.0 (July 2, 2026)

Release 4.16.0rc2 (June 25, 2026)

Release 4.16.0rc1 (June 24, 2026)

v1.9.1

What's Changed

v1.9.0

What's Changed

New Contributors

v1.8.0

What's Changed

Uh oh!

github-actions Bot commented Oct 29, 2026

Qodana for Python

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants