deps(deps): bump the python-minor-and-patch group across 1 directory with 8 updates

[dependabot]

Bumps the python-minor-and-patch group with 8 updates in the / directory:

Package	From	To
simplejson	4.1.1	4.1.2
django-flexible-reports	0.4.2	0.5.0
nh3	0.3.6	0.3.7
cryptography	50.0.0	50.0.1
gunicorn	26.0.0	26.2.0
django-oauth-toolkit	3.4.0	3.4.1
pytest-rerunfailures	16.5	16.6
ruff	0.16.3	0.16.5

Updates simplejson from 4.1.1 to 4.1.2

Release notes

Sourced from simplejson's releases.

v4.1.2

What's Changed

• Fix control character error position when content precedes the control char by @​gaoflow in simplejson/simplejson#379
• Report the offending char, not the backslash, for invalid \X escapes by @​gaoflow in simplejson/simplejson#380
• Handle non-finite Decimals like floats in the encoder by @​apoorvdarshan in simplejson/simplejson#381
• Report the comma position for illegal trailing comma errors by @​dylanpulver in simplejson/simplejson#382

New Contributors

• @​gaoflow made their first contribution in simplejson/simplejson#379
• @​apoorvdarshan made their first contribution in simplejson/simplejson#381
• @​dylanpulver made their first contribution in simplejson/simplejson#382

Full Changelog: simplejson/simplejson@v4.1.1...v4.1.2

Changelog

Sourced from simplejson's changelog.

Version 4.1.2 released 2026-08-26

• Fix control character error position when content precedes the control char simplejson/simplejson#379
• Report the offending char, not the backslash, for invalid \X escapes simplejson/simplejson#380
• Handle non-finite Decimals like floats in the encoder simplejson/simplejson#381
• Parse failures due to trailing commas are now reported consistently across implementations simplejson/simplejson#382

Version 4.1.1 released 2026-04-24

• The build_wheels_py27 CI job now also builds Python 2.7 wheels for Windows AMD64 and Windows x86, joining the existing Py2.7 manylinux1 / manylinux2010 x86_64 wheels. This unblocks offline / --no-index installs on Py2.7-on-Windows (the original reporter's case), which previously had no matching binary wheel on PyPI, fell through to the sdist, and failed on the PEP 517 isolated-build step complaining that setuptools>=42 was not in the wheelhouse. simplejson/simplejson#377

Version 4.1.0 released 2026-04-22

• The C extension now accelerates encoding when indent= is set. Previously the encoder fell back to the pure-Python implementation whenever a non-None indent was passed; now the C encoder emits the newline-plus-indent prefix, the level-aware item separator, and the closing indent directly. A representative nested-dict workload benchmarks about 4-5x faster end-to-end, and the indent=0 and empty-container edge cases continue to match the Python output byte-for-byte.

• The C extension now emits PEP 678 exc.add_note() annotations on serialization failures, matching the pure-Python encoder. A chained error on {'a': [1, object(), 3]} produces the same three notes (when serializing object object, when serializing list item 1, when serializing dict item 'a') whether the speedups are loaded or not, so the add_note assertions in test_errors.py no longer need indent=2 to force the Python path.

Version 4.0.1 released 2026-04-18

• Skip uploading Pyodide/wasm wheels to PyPI, which rejects them with "unsupported platform tag 'pyodide_2024_0_wasm32'". The wheels are still built in CI and preserved as workflow artifacts. simplejson/simplejson#375

... (truncated)

Commits

• d1fe71a Add missing changelog entries (#384)
• aa1f2c4 Update CHANGES for v4.1.2 (#383)
• b84ad54 Report the comma position for illegal trailing comma errors (#382)
• b0fe1ef Handle non-finite Decimals like floats in the encoder (fixes #149) (#381)
• fa8feea Report the offending char, not the backslash, for invalid \X escapes (#380)
• bded822 Fix control character error position when content precedes the control char (...
• See full diff in compare view

Updates django-flexible-reports from 0.4.2 to 0.5.0

Release notes

Sourced from django-flexible-reports's releases.

v0.5.0

• Added Report.set_order_by(*fields), a third render-time setter alongside set_base_queryset() and set_context(). It overrides the ordering stored on every table of the report for one render, and takes ORM field names rather than the column labels ColumnOrder uses — so a report can be sorted by a field that no column displays, which the stored ordering cannot express. ColumnOrder is left untouched and keeps serving as the default; calling the setter with no arguments falls back to it.

Changelog

Sourced from django-flexible-reports's changelog.

0.5.0 (2026-08-19)

• Added Report.set_order_by(*fields), a third render-time setter alongside set_base_queryset() and set_context(). It overrides the ordering stored on every table of the report for one render, and takes ORM field names rather than the column labels ColumnOrder uses — so a report can be sorted by a field that no column displays, which the stored ordering cannot express. ColumnOrder is left untouched and keeps serving as the default; calling the setter with no arguments falls back to it.

Commits

• a9ee294 release: 0.5.0
• e3b2183 Merge pull request #14 from mpasternak/feat/set-order-by
• dbf4c2b test: pin header-click ordering against the set_order_by override
• 31ec542 feat: Report.set_order_by() overrides a report's stored ordering
• See full diff in compare view

Updates nh3 from 0.3.6 to 0.3.7

Release notes

Sourced from nh3's releases.

v0.3.7

What's Changed

• Expose ammonia's id_prefix option via id_prefix kwarg by @​gghez in messense/nh3#134
• Don’t depend on deprecated pyo3/generate-import-lib feature by @​musicinmybrain in messense/nh3#136
• Validate tag_attribute_values conflict with attributes by @​Mohammadjavad2412 in messense/nh3#135
• Bump ammonia from 4.1.2 to 4.1.3 by @​dependabot[bot] in messense/nh3#137
• Bump ammonia from 4.1.3 to 4.1.4 by @​dependabot[bot] in messense/nh3#139
• Bump pyo3 from 0.29.0 to 0.29.2 by @​dependabot[bot] in messense/nh3#140

New Contributors

• @​musicinmybrain made their first contribution in messense/nh3#136
• @​Mohammadjavad2412 made their first contribution in messense/nh3#135

Full Changelog: messense/nh3@v0.3.6...v0.3.7

Commits

• 74f36b8 Bump pyo3 from 0.29.0 to 0.29.2 (#140)
• 5cb1a16 Update ammonia and bump version to 0.3.7
• 5bc937a Bump ammonia from 4.1.3 to 4.1.4 (#139)
• 5816c84 Bump actions/setup-python from 6 to 7 in the github-actions group (#138)
• 7718812 Bump ammonia from 4.1.2 to 4.1.3 (#137)
• 567c411 Validate tag_attribute_values conflict with attributes (#135)
• c23021c Don’t depend on deprecated pyo3/generate-import-lib feature (#136)
• 0343d0b Bump actions/checkout from 6 to 7 in the github-actions group (#132)
• 0573fe4 Expose ammonia's id_prefix option via id_prefix kwarg (#134)
• See full diff in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates gunicorn from 26.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

• 36f2a3c gunicorn 26.2.0
• cbba350 test: cover the h2c edge paths that had none
• 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
• 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
• 5853551 Merge pull request #3712 from Rotzbua/patch-1
• 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
• 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
• 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
• 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
• 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
• Additional commits viewable in compare view

Updates django-oauth-toolkit from 3.4.0 to 3.4.1

Release notes

Sourced from django-oauth-toolkit's releases.

3.4.1

This release is dominated by security hardening of redirect URI matching, token revocation and refresh token handling. Several entries below change behavior that was previously accepted, and they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the Upgrading guide collects everything you need to act on in one place, so start there. Of particular note: redirect URIs are now matched exactly per RFC 9700 §2.1, so a request may no longer carry query parameters, path parameters, credentials or a fragment that the registered URI does not have; REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token is presented rather than only by the cleartokens sweep; and the built-in templates now link a stylesheet shipped with the package instead of a CDN, so run collectstatic or the pages render unstyled.

Added

• #681 Redirect URI mismatches are now diagnosed on the oauth2_provider logger at DEBUG, reporting the requested URI, every registered candidate it was compared against, and which component of each one differed (scheme, hostname, port, path, query). The same detail is emitted for post_logout_redirect_uri and for the token endpoint's comparison against the URI recorded on the grant. The error response is unchanged: the registered URIs are never disclosed to the requester, only to the server's log. See "Debugging redirect URI mismatches" in the documentation. Note that AbstractApplication.redirect_uri_allowed() and post_logout_redirect_uri_allowed() now call the new check_redirect_to_uri_allowed() (same verdict, plus the mismatch reasons) instead of redirect_to_uri_allowed(), so code that wrapped or patched the latter to influence those methods must target the former.
• #634 A system check (oauth2_provider.W011) that warns when the AccessToken and RefreshToken models are swapped into different apps, and a new "Extending the token models" documentation section explaining how to swap the interrelated token models together.
• #1623 Documentation ("Content Security Policy and the authorization form") on completing the authorization-code flow under a strict form-action Content Security Policy, which Chromium enforces against the post-authorization redirect to the client's redirect_uri.
• #410 Documentation ("Resource scope syntax") clarifying that TokenHasResourceScope checks each required_scopes entry suffixed with the READ_SCOPE/WRITE_SCOPE setting value (defaults read/write, e.g. music:read, music:write), so a bare music scope is rejected; with the default settings-based scopes backend the suffixed scopes must be declared in SCOPES.
• #1157 An "Upgrading" documentation page collecting the breaking changes and upgrade steps for every release that needs them — 2.0, 3.0 and this release — linked from the documentation index, so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has no section there, so a gap between two versions is an answer rather than an omission.
• #452 Documentation ("Custom scopes backend") explaining how to replace the default settings-driven scopes backend via SCOPES_BACKEND_CLASS, including a worked model-based example that stores scopes in the database.
• #1045 Tutorial ("Managing applications and tokens in the Django admin") walking through the admin site for applications and issued tokens, including client-secret hashing, credential masking, and that tokens cannot be created by hand.
• #403 Translatable (gettext_lazy) verbose_name labels on every field of the Application, Grant, AccessToken, RefreshToken, IDToken and DeviceGrant models, so the Django admin and the authorization UI can be localized. Migration

... (truncated)

Changelog

Sourced from django-oauth-toolkit's changelog.

[3.4.1] - 2026-08-21

This release is dominated by security hardening of redirect URI matching, token revocation and refresh token handling. Several entries below change behavior that was previously accepted, and they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the Upgrading guide collects everything you need to act on in one place, so start there. Of particular note: redirect URIs are now matched exactly per RFC 9700 §2.1, so a request may no longer carry query parameters, path parameters, credentials or a fragment that the registered URI does not have; REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token is presented rather than only by the cleartokens sweep; and the built-in templates now link a stylesheet shipped with the package instead of a CDN, so run collectstatic or the pages render unstyled.

Added

• #681 Redirect URI mismatches are now diagnosed on the oauth2_provider logger at DEBUG, reporting the requested URI, every registered candidate it was compared against, and which component of each one differed (scheme, hostname, port, path, query). The same detail is emitted for post_logout_redirect_uri and for the token endpoint's comparison against the URI recorded on the grant. The error response is unchanged: the registered URIs are never disclosed to the requester, only to the server's log. See "Debugging redirect URI mismatches" in the documentation. Note that AbstractApplication.redirect_uri_allowed() and post_logout_redirect_uri_allowed() now call the new check_redirect_to_uri_allowed() (same verdict, plus the mismatch reasons) instead of redirect_to_uri_allowed(), so code that wrapped or patched the latter to influence those methods must target the former.
• #634 A system check (oauth2_provider.W011) that warns when the AccessToken and RefreshToken models are swapped into different apps, and a new "Extending the token models" documentation section explaining how to swap the interrelated token models together.
• #1623 Documentation ("Content Security Policy and the authorization form") on completing the authorization-code flow under a strict form-action Content Security Policy, which Chromium enforces against the post-authorization redirect to the client's redirect_uri.
• #410 Documentation ("Resource scope syntax") clarifying that TokenHasResourceScope checks each required_scopes entry suffixed with the READ_SCOPE/WRITE_SCOPE setting value (defaults read/write, e.g. music:read, music:write), so a bare music scope is rejected; with the default settings-based scopes backend the suffixed scopes must be declared in SCOPES.
• #1157 An "Upgrading" documentation page collecting the breaking changes and upgrade steps for every release that needs them — 2.0, 3.0 and this release — linked from the documentation index, so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has no section there, so a gap between two versions is an answer rather than an omission.
• #452 Documentation ("Custom scopes backend") explaining how to replace the default settings-driven scopes backend via SCOPES_BACKEND_CLASS, including a worked model-based example that stores scopes in the database.
• #1045 Tutorial ("Managing applications and tokens in the Django admin") walking through the admin site for applications and issued tokens, including client-secret hashing, credential masking, and that tokens cannot be created by hand.
• #403 Translatable (gettext_lazy) verbose_name labels on every field of the Application, Grant, AccessToken, RefreshToken, IDToken and DeviceGrant models, so the Django admin and the authorization UI can be localized. Migration

... (truncated)

Commits

• db6c4f5 chore: 3.4.1 release (#1820)
• 9c70975 fix: enforce device grant confirmation ownership (#1819)
• 28bf64c perf: revoke refresh token families as a set on reuse detection (#1810)
• f797b8a fix(validators): stop honoring revoked refresh tokens in the grace window (#1...
• 11024a0 chore(deps): bump cryptography in the uv group across 1 directory (#1807)
• 1e19d4d Log why a redirect URI failed to match (#1814)
• 4f18e0e feat(templates): serve default styles from a bundled stylesheet (#1815)
• ae05be9 feat(models): make model field labels translatable (#1812)
• 2b1a322 fix(models): associate Application validation errors with their fields (#1811)
• 0915396 fix(dcr): honour hashed token storage for registration access tokens (#1799)
• Additional commits viewable in compare view

Updates pytest-rerunfailures from 16.5 to 16.6

Changelog

Sourced from pytest-rerunfailures's changelog.

16.6 (2026-08-17)

Features ++++++++

• Add a repeatable --rerun-exclude-path option to exclude test files or directories from reruns. ([#232](https://github.com/pytest-dev/pytest-rerunfailures/issues/232) <https://github.com/pytest-dev/pytest-rerunfailures/issues/232>_)

Bug Fixes +++++++++

• Fix a regression in version 16.5 which made --pdb unusable even when no reruns were configured. ([#342](https://github.com/pytest-dev/pytest-rerunfailures/issues/342) <https://github.com/pytest-dev/pytest-rerunfailures/issues/342>_)

Commits

• 257d92a Preparing release 16.6
• 44cc385 Fix regression making --pdb unusable without configured reruns (#343)
• bb86346 Add path exclusion for reruns (#344)
• d428dee Back to development: 16.6
• See full diff in compare view

Updates ruff from 0.16.3 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

... (truncated)

Commits

• 9e4938c Bump 0.16.5 (#28110)
• aad0e90 Allow rules without codes (#28049)
• 5fdab73 Update preview default rules and categories (#27877)
• 29c8e5b Document rule acceptance guidelines (#27910)
• 50a4d7f Document the new category selectors (#27906)
• ada8795 Introduce category selectors (#27666)
• d894723 [ty] Infer lambda parameters through callable type aliases (#28109)
• 2685fde [ty] Narrow functional enum members in == and match (#28103)
• efcffd2 [ty] Intersection simplifications with subtype-related generic specialization...
• eb78048 [ty] Bump ecosystem-analyzer for HTML escaping (#28104)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions