Skip to content

chore(deps-dev): bump the other-dependencies group across 1 directory with 13 updates - #1135

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/other-dependencies-301b2e7acf
Open

chore(deps-dev): bump the other-dependencies group across 1 directory with 13 updates#1135
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/other-dependencies-301b2e7acf

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the other-dependencies group with 13 updates in the / directory:

Package From To
aiohttp 3.14.1 3.14.3
anyio 4.14.1 4.14.2
certifi 2026.6.17 2026.7.22
cryptography 49.0.0 50.0.0
h2 4.3.0 4.4.0
mypy 2.2.0 2.3.0
platformdirs 4.10.0 4.11.0
portalocker 2.10.1 4.1.0
time-machine 3.2.0 3.3.0
tomlkit 0.15.0 0.15.1
tzdata 2026.2 2026.3
wrapt 2.2.2 2.3.0
yarl 1.24.2 1.24.5

Updates aiohttp from 3.14.1 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

  • Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

    Related issues and pull requests on GitHub: :issue:13180.

  • Fixed error message construction in the C HTTP parser -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:13222.

3.14.2 (2026-07-20)

Bug fixes

  • Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

    Related issues and pull requests on GitHub: :issue:5303.

  • Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

    Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

Updates anyio from 4.14.1 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates certifi from 2026.6.17 to 2026.7.22

Commits

Updates cryptography from 49.0.0 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

Updates h2 from 4.3.0 to 4.4.0

Changelog

Sourced from h2's changelog.

4.4.0 (2026-07-23)

API Changes (Backward Incompatible)

  • Support for Python 3.9 has been removed.
  • Support for PyPy 3.9 has been removed.
  • Stream.end_stream() now raises NoSuchStreamError or StreamClosedError exceptions, instead of a generic KeyError.
  • Duplicate content-length headers with different values now raise ProtocolError. Previously, the first content-length header was accepted and later conflicting values were ignored. Thanks to Harshal Parekh for the report.
  • Parse content-length headers according to RFC9110 grammar for numbers (1*DIGIT). Thanks to Arkadiusz Marta for the report.
  • backfill from v4.3.0 Convert emitted events into Python dataclass, which introduces new constructors with required arguments. Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.

API Changes (Backward Compatible)

  • Support for Python 3.14 has been added.
  • H2Connection.receive_data now accepts any byte-like object that implements the buffer protocol, such as bytes, bytearray, and memoryview. Existing bytes callers are unaffected.
  • Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4. Ordinary CONNECT now requires :method=CONNECT and :authority, and forbids :scheme/:path. Extended CONNECT (e.g., WebSocket) requires :scheme, :path, :authority plus :protocol. (PR #1309)
  • Fix incorrect substring matching of secure header in cookie and :method.

Bugfixes

  • Fix to allow sending 0 bytes on a stream even if the flow control window is negative.
  • Reject non-zero SETTINGS_ENABLE_PUSH values received from servers.
Commits
  • 6cce763 v4.4.0
  • dfafda3 Bump pytest from 8.4.2 to 9.0.3 (#1320)
  • b45207c dependencies and packaging++
  • c40145f parse content-length headers according to RFC9110 grammar for numbers (1*DI...
  • efc8fea cleanup double-dependency
  • aba9ad6 fix: reject conflicting content-length headers (#1317)
  • 1cd9ce0 Reject client enable-push settings (#1318)
  • dc5da5c add changelog, update tests
  • bdf0b95 Broaden receive data buffer types
  • b08b9d7 Allow sending 0-byte DATA frames when flow-control window is negative
  • Additional commits viewable in compare view

Updates mypy from 2.2.0 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

  • Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
  • Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
  • Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
  • Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
  • Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
  • 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
  • 24c237d [mypyc] Improve documentation of Final (#21713)
  • b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
  • cbcb51a Narrow for frozendict membership check (#21709)
  • af2bc0f Sync typeshed (#21707)
  • Additional commits viewable in compare view

Updates platformdirs from 4.10.0 to 4.11.0

Release notes

Sourced from platformdirs's releases.

4.11.0

What's Changed

Full Changelog: tox-dev/platformdirs@4.10.1...4.11.0

4.10.1

What's Changed

Full Changelog: tox-dev/platformdirs@4.10.0...4.10.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.0 (2026-07-21)

  • Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

4.10.1 (2026-07-18)

  • Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

4.10.0 (2026-05-28)

  • Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491
  • Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490
  • Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

4.9.6 (2026-04-09)

  • Fix macOS XDG variables leaking across :func:~platformdirs.user_config_dir, :func:~platformdirs.user_data_dir, and :func:~platformdirs.user_state_dir when only some are set :pr:473 - by :user:Goddesen
  • Avoid duplicate site directories in Unix :meth:~platformdirs.PlatformDirs.iter_config_dirs and :meth:~platformdirs.PlatformDirs.iter_data_dirs when use_site_for_root is active :pr:469 - by :user:viccie30

4.9.4 (2026-03-05)

  • Respect XDG_CONFIG_HOME when reading the user-dirs configuration :pr:453 - by :user:bysiber
  • Create the directory in Android :func:~platformdirs.user_log_dir and :func:~platformdirs.user_runtime_dir when ensure_exists is set :pr:452 - by :user:bysiber

... (truncated)

Commits
  • 2140495 Release 4.11.0
  • a562df9 👷 ci: run the test suite against Python 3.15 (#512)
  • 7c764c4 [pre-commit.ci] pre-commit autoupdate (#511)
  • 2e74013 Release 4.10.1
  • 3076722 📝 docs(changelog): rebuild against release history (#510)
  • 42751ce 🚀 ci(release): towncrier changelog + publish on tag push (#509)
  • d2e5756 fix(windows): stop leaking ctypes pointer types on repeated calls (#507)
  • 4f52c4f build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 in the all group (#506)
  • f68e56f build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 in the all group (#504)
  • 806560b build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 in the all group (#502)
  • Additional commits viewable in compare view

Updates portalocker from 2.10.1 to 4.1.0

Release notes

Sourced from portalocker's releases.

v4.1.0

4.1.0:

  • Documentation release. No runtime behaviour changed; the only edits to executable code replaced two ... bodies on the abstract LockBase.acquire/LockBase.release stubs with docstrings.
  • Every module, class, function, private helper and dunder method in the package now carries a Google-style docstring. ruff's pydocstyle rules are enabled for portalocker/ with no exemptions
  • Added seven narrative guides: quickstart, lock types, platform behaviour, Redis locks, the combine CLI, troubleshooting, and a 3.x to 4.0.0 migration guide. The API reference moved under docs/api/ and a changelog page was added
  • docs/platforms.rst documents the advisory-versus-mandatory distinction, flock versus lockf, msvcrt versus pywin32, and the networked-filesystem caveats that cause most locking confusion
  • docs/cli.rst documents the combiner's ASCII-only requirement on portalocker/*.py, README.rst and LICENSE, which was previously only discoverable by reading __main__.py
  • Doctests now run for docs/*.rst and README.rst as well as the package, so every documented example is executed on each supported platform and interpreter. No # doctest: +SKIP remains anywhere
  • Fixed the README telling readers to unlock a filehandle it had already closed, which raised ValueError: I/O operation on closed file
  • Fixed the README demonstrating BoundedSemaphore without a name, which the library itself deprecates in favour of NamedBoundedSemaphore
  • Removed the obsolete Python 2 installation section from the README

v4.0.0

4.0.0:

  • Fixed open_atomic() replacing a destination created while its context was open on POSIX; publication now raises FileExistsError and preserves the concurrent winner (#114)
  • Python 3.10 or later is now required; Python 3.9 (EOL) support dropped
  • pywin32 is no longer installed by default on Windows; the msvcrt-based locker is the default and works dependency-free for exclusive locks. Shared locks on Windows require portalocker[win32], and an informative ImportError is raised otherwise (#104)
  • POSIX lock exceptions now populate .strerror and pass the message as a second positional argument, matching the Windows exception contract. This changes the str() output of these exceptions on POSIX from the bare OSError text to a 2-tuple repr
  • LockBase is now generic over the acquire return type (typing-only change; downstream Lock subclasses are unaffected)
  • Added PidFileLock for pidfile-based locking (#106)
  • Added PidFileLock.fail_closed() for ownership-only contexts; contention raises AlreadyLocked before entering the body and exposes the competing PID through AlreadyLocked.holder_pid when readable (#118)
  • Packaging switched to the uv_build backend; releases are published to

... (truncated)

Changelog

Sourced from portalocker's changelog.

4.1.0:

  • Documentation release. No runtime behaviour changed; the only edits to executable code replaced two ... bodies on the abstract LockBase.acquire/LockBase.release stubs with docstrings.
  • Every module, class, function, private helper and dunder method in the package now carries a Google-style docstring. ruff's pydocstyle rules are enabled for portalocker/ with no exemptions
  • Added seven narrative guides: quickstart, lock types, platform behaviour, Redis locks, the combine CLI, troubleshooting, and a 3.x to 4.0.0 migration guide. The API reference moved under docs/api/ and a changelog page was added
  • docs/platforms.rst documents the advisory-versus-mandatory distinction, flock versus lockf, msvcrt versus pywin32, and the networked-filesystem caveats that cause most locking confusion
  • docs/cli.rst documents the combiner's ASCII-only requirement on portalocker/*.py, README.rst and LICENSE, which was previously only discoverable by reading __main__.py
  • Doctests now run for docs/*.rst and README.rst as well as the package, so every documented example is executed on each supported platform and interpreter. No # doctest: +SKIP remains anywhere
  • Fixed the README telling readers to unlock a filehandle it had already closed, which raised ValueError: I/O operation on closed file
  • Fixed the README demonstrating BoundedSemaphore without a name, which the library itself deprecates in favour of NamedBoundedSemaphore
  • Removed the obsolete Python 2 installation section from the README

4.0.0:

  • Fixed open_atomic() replacing a destination created while its context was open on POSIX; publication now raises FileExistsError and preserves the concurrent winner (#114)
  • Python 3.10 or later is now required; Python 3.9 (EOL) support dropped
  • pywin32 is no longer installed by default on Windows; the msvcrt-based locker is the default and works dependency-free for exclusive locks. Shared locks on Windows require portalocker[win32], and an informative ImportError is raised otherwise (#104)
  • POSIX lock exceptions now populate .strerror and pass the message as a second positional argument, matching the Windows exception contract. This changes the str() output of these exceptions on POSIX from the bare OSError text to a 2-tuple repr
  • LockBase is now generic over the acquire return type (typing-only change; downstream Lock subclasses are unaffected)
  • Added PidFileLock for pidfile-based locking (#106)
  • Added PidFileLock.fail_closed() for ownership-only contexts; contention raises AlreadyLocked before entering the body and exposes the competing PID through AlreadyLocked.holder_pid when readable (#118)
  • Packaging switched to the uv_build backend; releases are published to PyPI through GitHub Actions Trusted Publishing
  • python -m portalocker combine: --output-file now opens lazily;

... (truncated)

Commits
  • 5bf95b2 bumped the version to 4.1.0 and documented the release in the changelog
  • 505156d Merge branch 'feature/elaborate-documentation' into develop
  • 16772fd Bump the actions group with 5 updates (#134)
  • 430e863 Update uv-build requirement in the actions group (#133)
  • 2436b0b gave the redis doctests the timeout their contention scenarios need
  • 62ca97f documented the whole package and added seven narrative guides
  • cf1e80d 4.0.0:
  • 4172e4b Merge pull request #132 from wolph/release/4.0.0-integration
  • 34fa2ee fix: address release review feedback
  • 42a0d85 Merge master into develop before v4.0.0
  • Additional commits viewable in compare view

Updates time-machine from 3.2.0 to 3.3.0

Changelog

Sourced from time-machine's changelog.

3.3.0 (2026-07-31)

  • Support Python 3.15.

    PR [#631](https://github.com/adamchainz/time-machine/issues/631) <https://github.com/adamchainz/time-machine/pull/631>__.

  • Mock datetime.date.today() directly, for Python 3.15 support.

    Previously time-machine was mocked only indirectly, since CPython implemented it by calling cls.fromtimestamp(time.time()). Python 3.15 added a fast path that reads the system clock directly (CPython Issue [#130980](https://github.com/adamchainz/time-machine/issues/130980) <https://github.com/python/cpython/pull/130980>__), so time travel no longer affected it, which the new mock fixes. Consequently, there are new :ref:escape hatch <escape-hatch> functions: escape_hatch.datetime.date.today() and escape_hatch.datetime.datetime.today().

    Thanks to Miro Hrončok and Karolina Surma for the report in Issue [#610](https://github.com/adamchainz/time-machine/issues/610) <https://github.com/adamchainz/time-machine/issues/610>, Lumír 'Frenzy' Balhar for the fix in PR [#618](https://github.com/adamchainz/time-machine/issues/618) <https://github.com/adamchainz/time-machine/pull/618>, and Maurycy Pawłowski-Wieroński for review

  • Support isolated subinterpreters, as created by |concurrent.interpreters|__ on Python 3.14+. Previously, importing time-machine in an isolated subinterpreter failed with an ImportError.

    .. |concurrent.interpreters| replace:: concurrent.interpreters __ https://docs.python.org/3.14/library/concurrent.interpreters.html

    PR [#644](https://github.com/adamchainz/time-machine/issues/644) <https://github.com/adamchainz/time-machine/pull/644>__.

  • Move the intermediary functions that patched functions call from Python to C. This change reduces the overhead of calling patched functions like time.time() while time travelling, making them around 10-20% faster.

    PR [#643](https://github.com/adamchainz/time-machine/issues/643) <https://github.com/adamchainz/time-machine/pull/643>__.

  • Fix returning datetime subclasses from their now() and utcnow() methods while time travelling. Previously, time-machine would always return a plain datetime.datetime instance, rather than the subclass.

    PR [#643](https://github.com/adamchainz/time-machine/issues/643) <https://github.com/adamchainz/time-machine/pull/643>__.

  • Fix hiding of the DeprecationWarning from |datetime.utcnow()|__ on Python 3.12+ while time travelling. Previously, the mocked version of the function did not raise the warning at all, so deprecated calls could pass unnoticed in tests. The warning is attributed to the calling code, like the real function does.

    .. |datetime.utcnow()| replace:: datetime.utcnow() __ https://docs.python.org/3/library/datetime.html#datetime.datetime.utcnow

    The :ref:escape hatch <escape-hatch> function escape_hatch.datetime.datetime.utcnow() also now attributes its warning to the calling code, rather than to a line within time-machine.

    PR [#649](https://github.com/adamchainz/time-machine/issues/649) <https://github.com/adamchainz/time-machine/pull/>. Thanks to Tamir Duberstein for the report in Issue [#445](https://github.com/adamchainz/time-machine/issues/445) <https://github.com/adamchainz/time-machine/issues/445> and Anders Kaseorg for the initial implementation in PR [#486](https://github.com/adamchainz/time-machine/issues/486) <https://github.com/adamchainz/time-machine/pull/486>__.

  • Fix the standard |uuid|__ library functions uuid1(), uuid6(), and uuid7() to correctly generate values for the destination when time travels backwards. These functions cache the timestamp of the value they generated most recently, and never generate a value stamped before it. Previously, after time-travelling backwards, these functions would keep generating values stamped for the cached timestamp, rather than the new destination. The caches are now reset whenever time travel starts, stops, or moves backwards.

... (truncated)

Commits
  • 206d32e Version 3.3.0
  • adfd496 Support isolated subinterpreters (#644)
  • 4e1a98d Reorder changelog
  • 5ad9391 Raise the DeprecationWarning for utcnow() while time travelling (#649)
  • facaaa0 Reset uuid module's cached timestamps when time travelling backwards (#648)
  • 811eaec Make Migration CLI rewrite freeze_time from-imports with several names (#647)
  • 4eae77b Refactor Migration CLI call rewriting into a shared function (#646)
  • c21eab5 Fix Migration CLI rewriting relative freezegun imports (#645)
  • 58b9fed Make Migration CLI update freeze_time() decorators on async functions (#640)
  • 9d0474b Make Migration CLI update freeze_time() calls that pass tick (#636)
  • Additional commits viewable in compare view

Updates tomlkit from 0.15.0 to 0.15.1

Release notes

Sourced from tomlkit's releases.

0.15.1

What's Changed

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 5, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 5, 2026 02:45
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 5, 2026
@dependabot
chore(deps-dev): bump the other-dependencies group across 1 directory…
2c02d2e 
… with 13 updates

Bumps the other-dependencies group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.14.1` | `3.14.3` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.1` | `4.14.2` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.6.17` | `2026.7.22` |
| [cryptography](https://github.com/pyca/cryptography) | `49.0.0` | `50.0.0` |
| [h2](https://github.com/python-hyper/h2) | `4.3.0` | `4.4.0` |
| [mypy](https://github.com/python/mypy) | `2.2.0` | `2.3.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.10.0` | `4.11.0` |
| [portalocker](https://github.com/wolph/portalocker) | `2.10.1` | `4.1.0` |
| [time-machine](https://github.com/adamchainz/time-machine) | `3.2.0` | `3.3.0` |
| [tomlkit](https://github.com/python-poetry/tomlkit) | `0.15.0` | `0.15.1` |
| [tzdata](https://github.com/python/tzdata) | `2026.2` | `2026.3` |
| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `2.2.2` | `2.3.0` |
| [yarl](https://github.com/aio-libs/yarl) | `1.24.2` | `1.24.5` |



Updates `aiohttp` from 3.14.1 to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.14.1...v3.14.3)

Updates `anyio` from 4.14.1 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.1...4.14.2)

Updates `certifi` from 2026.6.17 to 2026.7.22
- [Commits](certifi/python-certifi@2026.06.17...2026.07.22)

Updates `cryptography` from 49.0.0 to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@49.0.0...50.0.0)

Updates `h2` from 4.3.0 to 4.4.0
- [Changelog](https://github.com/python-hyper/h2/blob/master/CHANGELOG.rst)
- [Commits](python-hyper/h2@v4.3.0...v4.4.0)

Updates `mypy` from 2.2.0 to 2.3.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.2.0...v2.3.0)

Updates `platformdirs` from 4.10.0 to 4.11.0
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.10.0...4.11.0)

Updates `portalocker` from 2.10.1 to 4.1.0
- [Release notes](https://github.com/wolph/portalocker/releases)
- [Changelog](https://github.com/wolph/portalocker/blob/develop/CHANGELOG.rst)
- [Commits](wolph/portalocker@v2.10.1...v4.1.0)

Updates `time-machine` from 3.2.0 to 3.3.0
- [Changelog](https://github.com/adamchainz/time-machine/blob/main/docs/changelog.rst)
- [Commits](adamchainz/time-machine@3.2.0...3.3.0)

Updates `tomlkit` from 0.15.0 to 0.15.1
- [Release notes](https://github.com/python-poetry/tomlkit/releases)
- [Changelog](https://github.com/python-poetry/tomlkit/blob/master/CHANGELOG.md)
- [Commits](python-poetry/tomlkit@0.15.0...0.15.1)

Updates `tzdata` from 2026.2 to 2026.3
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.2...2026.3)

Updates `wrapt` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/GrahamDumpleton/wrapt/releases)
- [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst)
- [Commits](GrahamDumpleton/wrapt@2.2.2...2.3.0)

Updates `yarl` from 1.24.2 to 1.24.5
- [Release notes](https://github.com/aio-libs/yarl/releases)
- [Changelog](https://github.com/aio-libs/yarl/blob/master/CHANGES.rst)
- [Commits](aio-libs/yarl@v1.24.2...v1.24.5)

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: other-dependencies
- dependency-name: anyio
  dependency-version: 4.14.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: other-dependencies
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: other-dependencies
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: other-dependencies
- dependency-name: h2
  dependency-version: 4.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: other-dependencies
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: other-dependencies
- dependency-name: platformdirs
  dependency-version: 4.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: other-dependencies
- dependency-name: portalocker
  dependency-version: 4.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: other-dependencies
- dependency-name: time-machine
  dependency-version: 3.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: other-dependencies
- dependency-name: tomlkit
  dependency-version: 0.15.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: other-dependencies
- dependency-name: tzdata
  dependency-version: '2026.3'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: other-dependencies
- dependency-name: wrapt
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: other-dependencies
- dependency-name: yarl
  dependency-version: 1.24.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: other-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/other-dependencies-301b2e7acf branch from e5e9c7d to 2c02d2e Compare August 5, 2026 17:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants