[dependabot]

Bumps peewee from 3.14.10 to 3.18.3.

Release notes

Sourced from peewee's releases.

3.18.3

• Fix potential regex DoS vulnerability in FTS5 query validation code (#3005).

View commits

3.18.2

Cython 3.1 removes some Python 2 stuff we referenced -- this resolves the
issue. Couple other very minor fixes.

View commits

3.18.1

This was just to fix a packaging problem caused by twine.

@​pypa is such a bunch of clowns. I swear.

View commits

3.18.0

The behavior of postgresql_ext.BinaryJSONField.contains() has changed. Previously, passing a string to this method would perform a JSON key exists check (? operator) instead of JSON contains (@> operator). As of 3.18.0, this special-case has been removed and the contains() method always uses the JSONB contains operator (@>). For the old behavior of checking whether a key exists, use the BinaryJSONField.has_key() method. See #2984 for discussion.

• Add options to URL-unquote user and password when using the db_url helpers, see #2974 for discussion.
• Support using postgresql:// URLs when connecting to psycopg3.

View commits

3.17.9

• Fix incorrect handling of fk constraint name in migrator.
• Fix test-only issue that can occur in Python 3.14a4.

View commits

3.17.8

• Fix regression in behavior of delete_instance() when traversing nullable foreign-keys, #2952. Introduced in 3.17.6. Recommended that you update.
• Fix bug where joins not cloned when going from join-less -> joined query, refs #2941.

3.17.7

• Add db_url support for psycopg3 via psycopg3://.
• Ensure double-quotes are escaped properly when introspecting constraints.
• A few documentation-related fixes.

View commits

... (truncated)

Changelog

Sourced from peewee's changelog.

3.18.3

• Fix potential regex DoS vulnerability in FTS5 query validation code (#3005).

View commits

3.18.2

Cython 3.1 removes some Python 2 stuff we referenced -- this resolves the issue. Couple other very minor fixes.

View commits

3.18.1

@​pypa is such a bunch of clowns. I swear.

View commits

3.18.0

The behavior of postgresql_ext.BinaryJSONField.contains() has changed. Previously, passing a string to this method would perform a JSON key exists check (? operator) instead of JSON contains (@> operator). As of 3.18.0, this special-case has been removed and the contains() method always uses the JSONB contains operator (@>). For the old behavior of checking whether a key exists, use the BinaryJSONField.has_key() method. See #2984 for discussion.

• Add options to URL-unquote user and password when using the db_url helpers, see #2974 for discussion.
• Support using postgresql:// URLs when connecting to psycopg3.

View commits

3.17.9

• Fix incorrect handling of fk constraint name in migrator.
• Fix test-only issue that can occur in Python 3.14a4.

View commits

3.17.8

• Fix regression in behavior of delete_instance() when traversing nullable foreign-keys, #2952. Introduced in 3.17.6. Recommended that you update.
• Fix bug where joins not cloned when going from join-less -> joined query, refs #2941.

... (truncated)

Commits

• 2883e8b 3.18.3
• 2e11d32 Add insert_many + chunked regression test.
• 9f015ae Preserve parameters for ReconnectMixin.begin
• efc7d12 Fix issue w/github actions not having timezone definitions.
• 4525f22 Support postgres json-path on sub-expressions.
• dd8caac Fix populating relation on self-referential FK in model_to_dict.
• dee3e85 Add small test-cases for validation of query
• 372ad0c Avoid a nested repetition in FTS5 query validation.
• 1e07f9e 3.18.2
• caabbab Ensure backslashes are escaped properly in db filename (pwiz)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #2531.