chore(deps): bump the python group across 1 directory with 16 updates

[dependabot]

Updates the requirements on gitpython, uvicorn, sqlalchemy, alembic, psycopg, pydantic, pyjwt, anthropic, ansible-core, cryptography, authlib, idna, ruff, mypy, hypothesis and mutmut to permit the latest version.
Updates gitpython to 3.1.62

Release notes

Sourced from gitpython's releases.

3.1.62

What's Changed

• prepare next release by @​Byron in gitpython-developers/GitPython#2222
• Keep bare-repository worktrees non-bare by @​Byron in gitpython-developers/GitPython#2224
• Reject unsafe submodule checkout paths by @​Byron in gitpython-developers/GitPython#2225
• build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.0 to 0.16.5 in the pre-commit group by @​dependabot[bot] in gitpython-developers/GitPython#2226
• fix: join backslash line continuations when reading config values by @​nkbeast in gitpython-developers/GitPython#2227

New Contributors

• @​nkbeast made their first contribution in gitpython-developers/GitPython#2227

Full Changelog: gitpython-developers/GitPython@3.1.61...3.1.62

Commits

• db47516 prepare new release
• 10ec385 get better commit messages from agents
• b754897 test: cover subdirectory discovery and pathspec commands in bare-repo worktre...
• 9ebf8b6 Merge pull request #2227 from nkbeast/fix-config-backslash-continuation
• a15f791 fix: parse joined config values as a whole
• 60dd946 fix: ignore continuation markers in config comments
• 075a664 fix: join backslash line continuations when reading config values
• 62d1e2f Merge pull request #2226 from gitpython-developers/dependabot/pre_commit/pre-...
• 23d0e92 build(deps): bump https://github.com/astral-sh/ruff-pre-commit
• 8a14adc Merge pull request #2225 from gitpython-developers/submodule-path-hardening
• Additional commits viewable in compare view

Updates uvicorn to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)
• Remove duplicate Content-Type and Content-Length headers from WebSocket denial responses on the websockets-sansio implementation, and deliver non-UTF-8 denial bodies intact (#3041)

0.52.0 (July 29, 2026)

This release adds an experimental HTTP/1.1 implementation backed by zttp, a sans-IO HTTP parser I've been developing on the side: a core written in Zig, with bindings to Python. It has been running under a fuzzer for some weeks now, and has been through multiple rounds of security auditing.

It is still experimental, so don't put it in front of production traffic yet. Try it with --http zttp, and please send any feedback to the issue tracker.

Added

... (truncated)

Commits

• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• 098b206 Remove timing race from SIGHUP supervisor test (#3127)
• 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
• 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
• fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
• fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
• Additional commits viewable in compare view

Updates sqlalchemy to 2.0.54

Release notes

Sourced from sqlalchemy's releases.

2.0.54

Released: September 15, 2026

platform

• [platform] [change] Binary wheels are no longer built for Python 3.7. PyPI now rejects wheel files whose filename does not begin with the normalized project name, and the packaging tools that can be installed on Python 3.7 do not produce such a filename. As a result, SQLAlchemy 2.0.44 was the last release to publish Python 3.7 wheels to PyPI, and releases 2.0.45 and later have been available on Python 3.7 only as a source distribution; the wheel builds for Python 3.7 are now removed. Python 3.7 remains supported by the 2.0 series.

• [platform] [bug] Fixed issue where the Cython extensions were compiled without the freethreading_compatible directive, so that they did not declare themselves as safe to run without the GIL. On a free-threaded Python interpreter such as Python 3.13t or 3.14t, importing SQLAlchemy would cause the interpreter to re-enable the GIL, emitting a RuntimeWarning. The directive is now set when building for Python 3.13 and above, and a test has been added which confirms that importing SQLAlchemy on a free-threaded build does not enable the GIL.

  References: #13592

Commits

• See full diff in compare view

Updates alembic to 1.20.0

Release notes

Sourced from alembic's releases.

1.20.0

Released: September 11, 2026

usecase

• [usecase] [batch] Added a warning for the case where an unnamed CHECK constraint on a reflected table is omitted from a batch "recreate" operation. An unnamed CHECK constraint can't be reliably carried over in a batch recreate as it may refer to columns that are being dropped or changed. This omission was previously a silent operation. The presence of any ~sqlalchemy.schema.CheckConstraint in Operations.batch_alter_table.table_args is taken to indicate that the case has been accommodated, and no warning is emitted.

  References: #1846

• [usecase] [autogenerate] Autogenerate now renders a warning comment above any rendered Operations.drop_constraint() directive for which the constraint name is None, as is the case when a constraint that has no name in the model is dropped, most typically within the downgrade() function of a migration that adds an unnamed constraint. A warning is also emitted on the console when the migration script is generated. The directive requires a non-None name in order to be able to emit a "DROP CONSTRAINT" command.

  References: #916

bug

• [bug] [batch] Fixed bug in batch mode where adding a column with a type that generates its own CHECK constraint, such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum with ~sqlalchemy.types.Boolean.create_constraint set to True, would emit the constraint twice when the table was recreated, once under the name generated by the naming convention in use and once under the name given to the type. The constraint is now emitted once, using the same name that would be used outside of batch mode.

  References: #1768

• [bug] [batch] Fixed bug in batch mode where a CHECK constraint generated by a type such as ~sqlalchemy.types.Boolean or ~sqlalchemy.types.Enum would lose the name established for it by the naming convention in use when the table was recreated, as the constraint was regenerated against the temporary table used for the recreate operation. The naming convention is now resolved against the name of the table being replaced.

... (truncated)

Commits

• See full diff in compare view

Updates psycopg to 3.3.5

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).
• Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).
• Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).
• Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).
• Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).
• Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).
• Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).
• Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).

Psycopg 3.3.5 ^^^^^^^^^^^^^

• Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
• Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
• Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).
• Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).
• Raise !DataError instead of !ValueError when ~psycopg.rows.namedtuple_row receives duplicate column names (:ticket:[#1348](https://github.com/psycopg/psycopg/issues/1348)).
• Raise !DataError on inconsistent copy data (:tickets:[#1359](https://github.com/psycopg/psycopg/issues/1359), [#1360](https://github.com/psycopg/psycopg/issues/1360)).
• Handle client encodings aliases (:ticket:[#1363](https://github.com/psycopg/psycopg/issues/1363)).
• Fix building C extension with Cython 3.3.

Psycopg 3.3.4

... (truncated)

Commits

• ea542c9 chore: bump psycopg package version to 3.3.5
• 8d31e47 chore(deps): bump the actions group across 1 directory with 4 updates
• 268f863 Merge pull request #1370 from Sanjays2402/fix/truncated-binary-copy-error
• a412fa4 docs: put together different issues fixed around copy parsing
• f757307 fix: clearer error messages according to truncated copy message part
• b1f17c4 test: move existing COPY format parsing tests into a single module
• 21eba57 test: drop useless parametrization of copy binary parsigh test
• 6780e17 fix(copy): handle truncated binary row headers
• 2f2fcfb Merge pull request #1364 from DylanYoung/fix_client_encoding_aliases
• ccc351e refactor: don't store the encodings raw table as a dict
• Additional commits viewable in compare view

Updates pydantic to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #13096

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

• Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

... (truncated)

Commits

• 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
• 558379f Bump twine to v7.0.0
• 2cfd5d3 Do not check for docs build
• a735bee Fix more Clippy lints
• 7eed4a1 Fix Clippy 0.1.95 warnings
• b353bbb Prepare release v2.13.5
• 63d2ccc Count validated model fields once in smart unions
• a53ec2e Speed up PyPy CI tests
• d65e0f9 Workaround circular import error in Mypy
• 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
• Additional commits viewable in compare view

Updates pyjwt to 2.14.0

Release notes

Sourced from pyjwt's releases.

PyJWT 2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security

- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.
Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
Fixed



Raise the documented PyJWTError subclass instead of leaking a

TypeError when the exp, nbf, or iat claim decodes to a

non-numeric, non-string value such as a list, dict, or null.

v2.13.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0&gt;__
Security

... (truncated)

Commits

• c6fe464 release: prepare v2.14.0
• f541302 style: apply Ruff formatting
• 801cd12 fix: reject public JWK container HMAC keys
• af8181c fix: reject empty HMAC keys from JWKs
• ba4853a Throttle repeated PyJWKClient refreshes
• 2798504 fix: reject DER public keys as HMAC secrets
• 8b4e233 fix: reject loader-accepted PEM variants
• 1f8180a fix: format JWS tests
• cff1ac5 Fix redirect handler return annotation
• 0a795b8 Reject redirects in PyJWKClient fetches
• Additional commits viewable in compare view

Updates anthropic to 1.6.0

Release notes

Sourced from anthropic's releases.

v1.6.0

1.6.0 (2026-09-15)

Full Changelog: v1.5.0...v1.6.0

Features

• api: add auto mode tool permissions for Managed Agents (909d92f)
• api: add compaction parameter and signed compaction blocks (beta) (8689179)
• api: add enum types for workspace data-residency geo fields (3dc6dbf)
• api: add thinking_mismatch_allowed entries to input_transformations (beta) (14d1792)
• api: add url_sources to the web fetch tool (4ba7115)
• api: add workspace_id parameter to user profiles methods (1c359b2)
• client: support async credential token providers (95e93f7)

Bug Fixes

• api: mark usage iteration model as nullable (520d000)
• api: use one input transformation type for message and delta event (ae86d7d)
• client: honor Retry-After values above 60 seconds (2d03ba2)
• client: ignore invalid Retry-After values and validate maxRetries (909d92f)
• client: retry connection errors in the async client and stop blocking in the coroutine retry loop (909d92f)
• client: use the default backoff when Retry-After is out of range (3d15f04)

Chores

• deps: bump aiohttp, pygments and pytest in the dev lockfile (005ad11)
• deps: require anyio 4.1 or later (79b4175)
• docs: clarify that session_thread_id on tool use events is informational (2ac7b60)
• docs: correct the compaction beta's parameter descriptions (5048c9a)
• internal: sort the imports in beta_message.py (0a92f91)
• tests: define the model tests' type alias at module level (98c3a7a)
• tests: stop the mock server without failing a passing test run (d28aea7)

Documentation

• api: clarify usage.iterations entry typing under server-side fallback (bb06629)
• stop documenting unions with their first variant's description (7a94250)
• use markdown formatting in most docstrings (25f344f)

Changelog

Sourced from anthropic's changelog.

1.6.0 (2026-09-15)

Full Changelog: v1.5.0...v1.6.0

Features

• api: add auto mode tool permissions for Managed Agents (909d92f)
• api: add compaction parameter and signed compaction blocks (beta) (8689179)
• api: add enum types for workspace data-residency geo fields (3dc6dbf)
• api: add thinking_mismatch_allowed entries to input_transformations (beta) (14d1792)
• api: add url_sources to the web fetch tool (4ba7115)
• api: add workspace_id parameter to user profiles methods (1c359b2)
• client: support async credential token providers (95e93f7)

Bug Fixes

• api: mark usage iteration model as nullable (520d000)
• api: use one input transformation type for message and delta event (ae86d7d)
• client: honor Retry-After values above 60 seconds (2d03ba2)
• client: ignore invalid Retry-After values and validate maxRetries (909d92f)
• client: retry connection errors in the async client and stop blocking in the coroutine retry loop (909d92f)
• client: use the default backoff when Retry-After is out of range (3d15f04)

Chores

• deps: bump aiohttp, pygments and pytest in the dev lockfile (005ad11)
• deps: require anyio 4.1 or later (79b4175)
• docs: clarify that session_thread_id on tool use events is informational (2ac7b60)
• docs: correct the compaction beta's parameter descriptions (5048c9a)
• internal: sort the imports in beta_message.py (0a92f91)
• tests: define the model tests' type alias at module level (98c3a7a)
• tests: stop the mock server without failing a passing test run (d28aea7)

Documentation

• api: clarify usage.iterations entry typing under server-side fallback (bb06629)
• stop documenting unions with their first variant's description (7a94250)
• use markdown formatting in most docstrings (25f344f)

1.5.0 (2026-09-10)

Full Changelog: v1.4.0...v1.5.0

Features

• api: add auto mode tool permissions for Managed Agents (62aa21b)
• api: add content_too_large web_fetch tool error code (4b5dec6)

... (truncated)

Commits

• 7e5ca5c Merge pull request #1937 from anthropics/release-please--branches--main--chan...
• b93968b release: 1.6.0
• 5048c9a chore(docs): correct the compaction beta's parameter descriptions
• 98c3a7a chore(tests): define the model tests' type alias at module level
• 8689179 feat(api): add compaction parameter and signed compaction blocks (beta)
• ae86d7d fix(api): use one input transformation type for message and delta event
• 0a92f91 chore(internal): sort the imports in beta_message.py
• 4ba7115 feat(api): add url_sources to the web fetch tool
• d28aea7 chore(tests): stop the mock server without failing a passing test run
• 14d1792 feat(api): add thinking_mismatch_allowed entries to input_transformations (beta)
• Additional commits viewable in compare view

Updates ansible-core to 2.21.4

Release notes

Sourced from ansible-core's releases.

v2.21.4

Changelog

See the full changelog for the changes included in this release.

Release Artifacts

• Built Distribution: ansible_core-2.21.4-py3-none-any.whl - ‌2457154 bytes
  • ebe74d9c8fadcb41ad2151e031bf1e785e3098aaa015019b4e19a0a96f0dcc4f (SHA256)
• Source Distribution: ansible_core-2.21.4.tar.gz - ‌3394492 bytes
  • 81a9329f4f12cfa5008dcab5d1bf23ae69b7effc08c0f00048ab2461147ae95a (SHA256)

Commits

• 997ad6b New release v2.21.4 (#87502)
• 689832e Update Ansible release version to v2.21.4rc1.post0. (#87473)
• 9627c06 New release v2.21.4rc1 (#87470)
• 40bfd1d [stable-2.21] tempfile: sanitize prefix/suffix to prevent path traversal (#87...
• 6e90440 [backport 2.21] Use mask_url function to mask url using modules (#87361) (#87...
• ce8047f dnf-oldest: downgrade the whole dnf5 stack (#87452) (#87454)
• 5a6097f Update Ansible release version to v2.21.3.post0. (#87385)
• See full diff in compare view

Updates cryptography to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:
50.0.0 - 2026-07-31

• SECURITY ISSUE: :func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo's encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in :rfc:3218. Credit to @​X1AOxiang for reporting the issue. CVE-2026-69247
• Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm.
• Added xof() class methods to :class:~cryptography.hazmat.primitives.hashes.SHAKE128 and :class:~cryptography.hazmat.primitives.hashes.SHAKE256 for constructing algorithm instances configured for use with :class:~cryptography.hazmat.primitives.hashes.XOFHash.
• The :mod:X.509 verification <cryptography.x509.verification> APIs are now considered stable and are subject to our API stability policy.
• Added the :doc:/cobblestone recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification <https://c2sp.org/chunked-encryption>_ for streaming authenticated encryption of large messages.
• Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them.
• Added support for using :class:~cryptography.x509.Name as a field type in the :doc:/hazmat/asn1/index module.
• Loading a public key or an EC private key now rejects DER where the subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number of unused bits, instead of silently ignoring it.
• Parsing a CRL entry's InvalidityDate extension now rejects a GeneralizedTime that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field.
• :func:~cryptography.x509.ocsp.load_der_ocsp_request and :func:~cryptography.x509.ocsp.load_der_ocsp_response now reject a request or response whose version field is not v1, the only version defined by RFC 6960, matching the version validation already performed when loading

... (truncated)

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates authlib to 1.8.0

Release notes

Sourced from authlib's releases.

v1.8.0

What's Changed

• Prefer id_token_signed_response_alg client metadata to guess algs by @​azmeuk in authlib/authlib#888
• fix: Catch InvalidKeyIdError in RFC 9068 JWTBearerTokenValidator by @​liudonggalaxy in authlib/authlib#891
• fix: make leeway configurable in JWTBearerTokenValidator by @​mondi04 in authlib/authlib#903
• feat: add default jti claim to sign_jwt_bearer_assertion by @​liudonggalaxy in authlib/authlib#897
• fix(oauth): cast sub claim to string in JWTBearerTokenGenerator by @​levinKaus in authlib/authlib#911
• Declare lower bounds for dependencies by @​azmeuk in authlib/authlib#912
• feat(client): use httpx2 instead of httpx by @​levinKaus in authlib/authlib#909
• Fix RFC7523 malformed claims handling by @​azmeuk in authlib/authlib#916
• Fix httpx oauth1 binary form data by @​shc261392 in authlib/authlib#779
• fix(starlette_client): remove default= keyword from config.get calls by @​aliaksei-protchanka in authlib/authlib#770
• Added client_id parameter to AssertionClient by @​vilmar-hillow in authlib/authlib#476
• fix(oauth): save device credential with authenticated client id by @​arpitjain099 in authlib/authlib#908
• fix(oauth1): correct protocol name in InsecureTransportError description by @​RavSinghChandan in authlib/authlib#919
• fix(client): client can be flexible with jwt's header by @​lepture in authlib/authlib#922
• fix(oidc): omit claims when the value is None by @​lepture in authlib/authlib#923

New Contributors

• @​mondi04 made their first contribution in authlib/authlib#903
• @​levinKaus made their first contribution in authlib/authlib#911
• @​aliaksei-protchanka made their first contribution in authlib/authlib#770
• @​vilmar-hillow made their first contribution in authlib/authlib#476
• @​arpitjain099 made their first contribution in authlib/authlib#908
• @​RavSinghChandan made their first contribution in authlib/authlib#919

Full Changelog: authlib/authlib@v1.7.2...v1.8.0

Commits

• 1a86748 chore: release 1.8.0
• e4fb941 Merge pull request #923 from authlib/fix-921
• 9f2cd2e Merge pull request #922 from authlib/fix-902
• 5d53239 fix(oidc): omit claims when the value is None
• 772bc72 Merge pull request #919 from RavSinghChandan/fix-oauth1-insecure-transport-de...
• 11794b0 Merge pull request #908 from arpitjain099/chore/device-cred-authenticated-cli...
• 13f2eb0 fix(client): Added client_id parameter to AssertionClient (#476)
• dde5b7a fix(client): rollback
• e4aec8c fix(client): remove default= keyword from starlette client config.get calls (...
• 62f41cc fix(client): httpx oauth1 binary form data (#779)
• Additional commits viewable in compare view

Updates idna to 3.20

Release notes

Sourced from idna's releases.

v3.20

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

3.19 (2026-08-18)

• Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
• Test...

  Description has been truncated

[github-actions]

Coverage Report

✅ fleet_platform/services/ 85.4% (gate: 80%)

✅ fleet_platform/agent/ 94.8% (gate: 80%)

Gate passed

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.