Bump the python group across 1 directory with 15 updates

[dependabot]

Bumps the python group with 15 updates in the / directory:

Package	From	To
click	8.4.2	8.5.0
flask-security-too	5.7.1	5.8.2
flask-caching	2.4.1	2.5.1
sqlalchemy	2.0.51	2.0.52
psycopg2-binary	2.9.12	2.9.13
cryptography	50.0.0	50.0.1
python-dotenv	1.2.2	1.2.3
pytz	2026.2	2026.3.post1
orjson	3.11.9	3.12.0
gunicorn	26.0.0	26.2.0
stripe	15.3.0	15.6.1
chargebee	3.25.0	3.28.0
redis	8.0.1	8.1.0
ruff	0.15.21	0.16.7
pre-commit	4.6.0	4.6.2

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). {pr}3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
• {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
• The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits

• 8b19813 Release version 8.5.0
• 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
• 131c86a Add FAQ entry about UnicodeEncodeError on Windows
• e1fd594 Add support of pathlib.Path to edit (#3781)
• a1d8785 Add support of pathlib.Path to edit
• 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
• a6256bf Forwards all user's parameters set in PAGER
• 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
• 9835b0f Resolve the pager command once, in _pager_contextmanager
• f36d58b Refactor pager stream handling (#3767)
• Additional commits viewable in compare view

Updates flask-security-too from 5.7.1 to 5.8.2

Changelog

Sourced from flask-security-too's changelog.

Version 5.8.2

Released August 11, 2026

Fixes +++++

• (:pr:1265) Fix for GHSA-f66q-9rf6-8795 - WebAuthn reauthentication freshness bypass. (tonghuaroot)
• (:issue:1263) :py:data:SECURITY_CACHE_CONTROL directives were added to every application response instead of just responses from Flask-Security endpoints as documented. (Ceirced)
• (:issue:1212) Newly introduced :py:meth:.UserMixin.is_locked logic is inverted.
• (:issue:1244) Fix login form remember me checkbox.

Backwards Compatibility Concerns +++++++++++++++++++++++++++++++++

• The fix for the inverted is_locked logic will require any application using it to invert their logic.

Version 5.8.1

Released May 21, 2026

Fixes +++++

• (:issue:1222) Fix for GHSA-w2j7-f3c6-g8cw - Possible open-redirect with ALLOW_SUBDOMAIN option.
• (:issue:1215) Fix for GHSA-97r5-pg8x-p63p - possible oauth bypass in /verify

Version 5.8.0

Released April 15, 2026

Features & Improvements +++++++++++++++++++++++

• (:pr:1170) Add API :py:meth:.UserMixin.check_tf_required to allow applications to control which users require two-factor authentication.
• (:issue:1178) Add Cache-Control headers.
• (:issue:1165) Add support for using Social Login (OAuth) for verification.
• (:issue:1188) Add tracking of failed authentication attempts via :py:meth:.UserMixin.track_failed_authn and signal :py:data:user_failed_authn
• (:issue:1192) Add API for application to decide if a particular user account is locked.

Fixes +++++

• (:issue:1179) Fix verify_password for bcrypt 5.0 (mephi42)
• (:issue:1200) Fix username_recovery w.r.t. inactive and non-confirmed users
• (:issue:1189) Return additional fields for JSON responses with QR codes

... (truncated)

Commits

• 6fde5dd Release 5.8.2
• c0337ba Backport login remember form checkbox to 5.8.2 (#1268)
• 30e193a Backport #1244 to 5.8.2
• 55e04a0 Fix login form remember checkbox
• 96a68fd Fix inverted is_locked logic - backport to 5.8.2 (#1267)
• 5cda6d8 Fix inverted is_locked logic.
• c8dda27 Backport CACHE_CONTROL fix to 5.8.2 (#1266)
• d21b918 Backport CACHE_CONTROL fix #1263
• 462578e fix(caching): put cache headers only on responses from fs
• 1ca15c4 58webbypass (#1265)
• Additional commits viewable in compare view

Updates flask-caching from 2.4.1 to 2.5.1

Release notes

Sourced from flask-caching's releases.

2.5.1

This is the Flask-Caching 2.5.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask-Caching/2.5.1/ Changes: https://flask-caching.readthedocs.io/en/latest/changelog/#version-2-5-1

2.5.0

Note: This release will invalidate your caches because we changed the default hash_method from hashlib.md5 to hashlib.sha256. This can be changed back via CACHE_HASH_METHOD if you wish to still use the old hash_method!

Added / Improved

• Specifying timeouts now also works with datetime.timedelta. #266
• Add config option CACHE_SERIALIZER to set the cachelib serializer the backend uses. #209
• cachelib backends can now be configured directly via CACHE_TYPE="cachelib.ValkeyCache. #668
• Send Signals for cache hits and misses. #237 and #667
• Add Cache.delete_cached() and extend make_cache_key() with path and query_args arguments to make deleting views decorated with cached(query_string=True) possible. #243
• Add CACHE_HASH_METHOD to set the hash method used for the cache keys of @cached and @memoize.
• Add an is_stale option to @cached and @memoize. It is called on a cache hit with the cached value. Unlike forced_update it uses the value itself to check whether the cache is stale. Can be used in combination with forced_update #392
• @cached and @memoize now preserve the wrapped function's signature and expose uncached, cache_timeout, make_cache_key delete_memoized to type checkers.
• Add CACHE_FILE_HASH_METHOD config option to FileSystemCache to allow using a different hash function for cache keys. #660
• Add pool_size and pool_blocking to make MemcachedCache backends thread-safe. #663
• Document that CACHE_REDIS_HOST accepts an already created redis.Redis client instead of a host name, which allows sharing a connection pool with other extensions and the application. #629
• Clarify docs about decorator order regarding @staticmethod and @classmethod when memoizing. #440
• Modify SimpleCache docs as it's now thread-safe using an RLock for all operations. #663

Changed

• Drop support for Python 3.10 and require cachelib 0.17.0+
• Remove the deprecated lowercase CACHE_TYPE names (null, simple, filesystem, redis, redissentinel, rediscluster, uwsgi, memcached, gaememcached, saslmemcached and spreadsaslmemcached)
• Use hashlib.sha256 instead of hashlib.md5 for hashing the cache keys. This changes the generated keys, so entries cached by an earlier version become obsolete. If you wish to still use hashlib.md5 set the config CACHE_HASH_METHOD = hashlib.md5. #563
• @cached and @memoize now go through the public Cache proxy methods (get, set, has, delete, delete_many, get_many and set_many) instead of calling the backend directly. #417
• CACHE_IGNORE_ERRORS is now used by every backend instead of only SimpleCache and FileSystemCache.
• The delete_many method is now used from cachelib. A key that does not exist counts as deleted, and with CACHE_IGNORE_ERRORS set to False a RuntimeError is raised if the key could not be deleted.
• Call @memoize forced_update callbacks once per decorated function call instead of once while making the key and again before cache lookup. #387
• @cached now caches an HTTPException raised by the view (i.e. through abort()). This exception will now be re-raises on a cache hit. Use response_filter, to keep the exception out of the cache. #444
• The {% cache %} Jinja tag no longer propagates backend errors. If the cache is unavailable, the block is rendered normally instead of raising, matching the existing behavior of @memoize. #564 #565

Fixed

• Include key_prefix when building @cached(query_string=True) cache keys. #302
• Fix a @memoize cache-key collision when a parameter has a falsy default (e.g. 0, "", False): calling with the default was keyed the same as passing None, returning the wrong cached result. #656
• Fix @cached(response_hit_indication=True) appending a new after_request function to the app on every request.
• Fix a view returning an iterator of strings, for example when using flask.stream_template it previously returned a list of JSON strings instead of the rendered template. #511
• Fix __caching_id__ never being usable. @memoize silently ignored that and ran the function uncached.
• delete_memoized now takes the instance from a bound method, so cache.delete_memoized(obj.method, 1) deletes the cache for obj.method(1) instead of silently deleting nothing. The current behaviour by passing the instance keeps working as well. #554
• Fix @memoize invalidating a function's entire cache by not updating the memoize version key's timeout. It is now refreshed each time an entry is written, with that entry's own timeout. #531

New Contributors

• @​uttam12331 made their first contribution in pallets-eco/flask-caching#656
• @​deepakganesh78 made their first contribution in pallets-eco/flask-caching#655

... (truncated)

Changelog

Sourced from flask-caching's changelog.

Version 2.5.1

Released 2026-09-04

• @cached no longer treats view arguments named path or query_args as the explicit make_cache_key() arguments of the same name. :issue:679

Version 2.5.0

Released 2026-08-24

• Specifying timeouts now also works with datetime.timedelta. :issue:266
• Add config option CACHE_SERIALIZER to set the cachelib serializer the backend uses. :issue:209
• cachelib backends can now be configured directly via CACHE_TYPE="cachelib.ValkeyCache. :pr:668
• @cached and @memoize now go through the public Cache proxy methods (get, set, has, delete, delete_many, get_many and set_many) instead of calling the backend directly. :issue:417
• Document that CACHE_REDIS_HOST accepts an already created redis.Redis client instead of a host name, which allows sharing a connection pool with other extensions and the application. :issue:629
• Send Signals for cache hits and misses. :pr:[#237](https://github.com/pallets-eco/flask-caching/issues/237) and :pr:667
• Include key_prefix when building @cached(query_string=True) cache keys. :issue:302
• Add Cache.delete_cached() and extend make_cache_key() with path and query_args arguments to make deleting views decorated with cached(query_string=True) possible. :issue:243
• Use hashlib.sha256 instead of hashlib.md5 for hashing the cache keys. This changes the generated keys, so entries cached by an earlier version become obsolete. If you wish to still use hashlib.md5 set the config CACHE_HASH_METHOD = hashlib.md5. :pr:563
• Add CACHE_HASH_METHOD to set the hash method used for the cache keys of @cached and @memoize.
• Drop support for Python 3.10 and require cachelib 0.17.0+
• CACHE_IGNORE_ERRORS is now used by every backend instead of only SimpleCache and FileSystemCache.
• The delete_many method is now used from cachelib. A key that does not exist counts as deleted, and with CACHE_IGNORE_ERRORS set to False a RuntimeError is raised if the key could not be deleted.
• Clarify docs about decorator order regarding @staticmethod and @classmethod when memoizing. :issue:440
• Remove the deprecated lowercase CACHE_TYPE names (null, simple, filesystem, redis, redissentinel, rediscluster, uwsgi, memcached, gaememcached, saslmemcached and spreadsaslmemcached)
• Call @memoize forced_update callbacks once per decorated function

... (truncated)

Commits

• f1ccf5b Merge pull request #682 from pallets-eco/release-v2.5.1
• 45320ad release version 2.5.1
• cd48c77 Fix 'path' and 'query_args' variable in cache key. Fixes #679
• 5330047 fix docs not building
• 3933b3f Allow flit_core 4.x
• 8dd912a Update publish workflow
• 01f0e3f Version 2.5.0
• 66a8e05 Improve exception handling for the cached decorator. Fixes #444
• b09952d Bump cachelib to 0.17.0
• fca9ac2 Convert str to int instead of casting
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

• [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

  References: #13477

orm

• [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

  References: #13439

• [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

  References: #13485

• [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

• See full diff in compare view

Updates psycopg2-binary from 2.9.12 to 2.9.13

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
• Fix parsing of malformed bytea input.
• Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
• Add a pyproject.toml file to declare a PEP 517 build backend (:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
• Drop support for Python 3.9.

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.14.
• Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
• Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
• Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.13.
• Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
• Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8

... (truncated)

Commits

• f650e7a chore: bump to release 2.9.13
• 368c8a1 chore!: drop support for Python 3.9
• 9b39e65 chore: drop scaleway build support
• 2ca7041 fix: fix handling of PostgreSQL 18 exceptions
• 5385c02 Build CPython 3.15 wheels
• 1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
• 433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
• 8fb80bc fix: fix parsing of malformed int64 input in arrays
• f98014a fix: fix parsing of malformed bytea input
• 822b79c chore: bump dependencies in binary package
• Additional commits viewable in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates pytz from 2026.2 to 2026.3.post1

Commits

• 661bca9 Bump version numbers to 2026.3.post1 for python2 fix
• 1e31a16 Log python version running tests, force python2
• b3ca7c3 Unix line endings
• b55039a Replace non-ASCII character in comment to fix build with Python 2
• 5420ee2 Replace non-ASCII character in comment
• 2c139e8 Merge branch 'fix/localize-overflow-at-datetime-extremes' of https://github.c...
• c843864 Run zdump tests quietly
• 518500c Reduce noise when collecting zdump info dumps
• 081f935 Merge branch 'kytta-fix-dst' into 2026c
• 8c9d69b Merge branch 'master' into 2026c
• Additional commits viewable in compare view

Updates orjson from 3.11.9 to 3.12.0

Release notes

Sourced from orjson's releases.

3.12.0

Changed

• Serialization implementation substantially rewritten.
• Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
• No longer publish PyPI wheels for ppc64le and s390x.

Changelog

Sourced from orjson's changelog.

3.12.0 - 2026-08-14

Changed

• Serialization implementation substantially rewritten.
• Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
• No longer publish PyPI wheels for ppc64le and s390x.

Commits

• 6737895 3.12.0
• c2a6e8f JsonWriter, iterators
• 6a2d7a7 yyjson 1ea2fb0
• 97bf170 build update
• See full diff in compare view

Updates gunicorn from 26.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

• 36f2a3c gunicorn 26.2.0
• cbba350 test: cover the h2c edge paths that had none
• 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
• 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
• 5853551 Merge pull request #3712 from Rotzbua/patch-1
• 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
• 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
• 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
• 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
• 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
• Additional commits viewable in compare view

Updates stripe from 15.3.0 to 15.6.1

Release notes

Sourced from stripe's releases.

v15.6.1

• #1896 Harden API requestor code against malicious URLs
• #1898 Use cryptographically secure boundaries for multipart file uploads
• #1860 Dispatch discriminated union fields to their variant class

See the changelog for more details.

v15.6.0

This release changes the pinned API version to 2026-08-26.dahlia.

• #1881 Add new EventNotificationHandler class for better thin event management

  • We've been putting a lot of time into rethinking the event handling experience in the SDKs. This new class is the culmination of that effort.
  • They're designed for a tight coupling with both StripeClient and the fully-typed nature of thin events. This delivers painless event destination upgrades, in-editor checks for common mistakes, and better code modularity.
  • Now that we've released thin event notifications for v1 objects, these new handlers are our recommended path for all integrations using thin event notifications.
  • See more detailed docs here: https://docs.stripe.com/webhooks/event-notification-handlers
  • As part of this work, we've widened some of the types our webhook-related methods take so they play more nicely with the types commonly returned by popular web frameworks (#1888)

• #1876 Update generated code

  • Add support for new resource billing.FeedbackOption
  • Add support for create, deactivate, list, modify, and retrieve methods on resource billing.FeedbackOption
  • Add support for payment_method_settings on AccountSession.Component and AccountSessionCreateParamsComponent
  • Add support for feedback_options on BillingPortal.Configuration.Feature.SubscriptionCancel.CancellationReason, billing_portal.ConfigurationCreateParamsFeatureSubscriptionCancelCancellationReason, and billing_portal.ConfigurationModifyParamsFeatureSubscriptionCancelCancellationReason
  • Add support for new value customer_update on enums BillingPortal.Session.Flow.type and billing_portal.SessionCreateParamsFlowDatum.type
  • Add support for customer_update on BillingPortal.Session.Flow
  • Add support for funding_source_group on Charge.PaymentMethodDetail.Card.Wallet.Link and Charge.PaymentMethodDetail.Link
  • Add support for funding_types_blocked on Checkout.Session.PaymentMethodOption.Card.Restriction and checkout.SessionCreateParamsPaymentMethodOptionCardRestriction
  • Add support for metadata on ConfirmationToken
  • Add support for active_entitlements and customer_portal on CustomerSession.Component and CustomerSessionCreateParamsComponent
  • Add support for country on FinancialConnections.Session.Filter
  • Add support for frozen_fields on InvoiceItem
  • Add support for billie on Invoice.PaymentSetting.PaymentMethodOption, InvoiceCreateParamsPaymentSettingPaymentMethodOption, InvoiceModifyParamsPaymentSettingPaymentMethodOption, Subscription.PaymentSetting.PaymentMethodOption, SubscriptionCreateParamsPaymentSettingPaymentMethodOption, and SubscriptionModifyParamsPaymentSettingPaymentMethodOption
  • Add support for new value billie on enums Invoice.PaymentSetting.payment_method_types, InvoiceCreateParamsPaymentSetting.payment_method_types, InvoiceModifyParamsPaymentSetting.payment_method_types, Subscription.PaymentSetting.payment_method_types, SubscriptionCreateParamsPaymentSetting.payment_method_types, and SubscriptionModifyParamsPaymentSetting.payment_method_types
  • ⚠️ Remove support for cryptogram on PaymentAttemptRecord.PaymentMethodDetail.Card.ThreeDSecure and PaymentRecord.PaymentMethodDetail.Card.ThreeDSecure
  • Add support for new value touch_n_go on enums PaymentIntent.allowed_payment_method_types, PaymentIntentConfirmParams.allowed_payment_method_types, PaymentIntentCreateParams.allowed_payment_method_types, PaymentIntentModifyParams.allowed_payment_method_types, SetupIntent.allowed_payment_method_types, SetupIntentConfirmParams.allowed_payment_method_types, SetupIntentCreateParams.allowed_payment_method_types, and SetupIntentModifyParams.allowed_payment_method_types
  • Change PaymentIntent.allowed_payment_method_types and SetupIntent.allowed_payment_method_types to be required
  • Add support for application_fee_amount, application_fee_percent, on_behalf_of, and transfer_data on PaymentLinkModifyParams
  • Add support for feedback_option on Subscription.CancellationDetail, SubscriptionCancelParamsCancellationDetail, and SubscriptionModifyParamsCancellationDetail
  • Add support for igic on Tax.Registration.CountryOption.At, Tax.Registration.CountryOption.Be, Tax.Registration.CountryOption.Bg, Tax.Registration.CountryOption.Cy, Tax.Registration.CountryOption.Cz, Tax.Registration.CountryOption.De, Tax.Registration.CountryOption.Dk, Tax.Registration.CountryOption.E, Tax.Registration.CountryOption.Ee, Tax.Registration.CountryOption.Fi, Tax.Registration.CountryOption.Fr, Tax.Registration.CountryOption.Gr, Tax.Registration.CountryOption.Hr, Tax.Registration.CountryOption.Hu, Tax.Registration.CountryOption.Ie, Tax.Registration.CountryOption.It, Tax.Registration.CountryOption.Lt, Tax.Registration.CountryOption.Lu, Tax.Registration.CountryOption.Lv, Tax.Registration.CountryOption.Mt, Tax.Registration.CountryOption.Nl, Tax.Registration.CountryOption.Pl, Tax.Registration.CountryOption.Pt, Tax.Registration.CountryOption.Ro, Tax.Registration.CountryOption.Se, Tax.Registration.CountryOption.Si, Tax.Registration.CountryOption.Sk, tax.RegistrationCreateParamsCountryOptionAt, tax.RegistrationCreateParamsCountryOptionBe, tax.RegistrationCreateParamsCountryOptionBg, tax.RegistrationCreateParamsCountryOptionCy, tax.RegistrationCreateParamsCountryOptionCz, tax.RegistrationCreateParamsCountryOptionDe, tax.RegistrationCreateParamsCountryOptionDk, tax.RegistrationCreateParamsCountryOptionE, tax.RegistrationCreateParamsCountryOptionEe, tax.RegistrationCreateParamsCountryOptionFi, tax.RegistrationCreateParamsCountryOptionFr, tax.RegistrationCreateParamsCountryOptionGr, tax.RegistrationCreateParamsCountryOptionHr, tax.RegistrationCreateParamsCountryOptionHu, tax.RegistrationCreateParamsCountryOptionIe, tax.RegistrationCreateParamsCountryOptionIt, tax.RegistrationCreateParamsCountryOptionLt, tax.RegistrationCreateParamsCountryOptionLu, tax.RegistrationCreateParamsCountryOptionLv, tax.RegistrationCreateParamsCountryOptionMt, tax.RegistrationCreateParamsCountryOptionNl, tax.RegistrationCreateParamsCountryOptionPl, tax.RegistrationCreateParamsCountryOptionPt, tax.RegistrationCreateParamsCountryOptio...

    Description has been truncated