mirror of
https://github.com/evroon/bracket.git
synced 2026-07-31 02:10:50 -04:00
master
1389 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Copilot
|
8fb557aa81 |
Fix SQLAlchemy and operator misuse causing broken query predicates and cross-tournament access (#1721)
Python's `and` operator is unsafe with SQLAlchemy clause elements: in
SQLAlchemy 2.0 it raises `TypeError` (routes return 500); in older
versions it short-circuits to the right-hand operand, silently dropping
the `id = X` filter and enabling cross-tournament entity access.
## Changes
**`routes/util.py`**
- `team_dependency`: replace `and` with `&`
- `round_dependency` / `match_dependency`: `rounds` and `matches` have
no direct `tournament_id`; replace the broken `and` chain with proper
JOINs through `stage_items → stages` to enforce tournament scoping
**`routes/courts.py`**
- `create_court` post-insert fetch: replace `and` with `&`
**`tests/.../teams_test.py`**
- Add `test_cross_tournament_team_access_denied`: asserts that a `PUT`
on tournament A's URL using a `team_id` belonging to tournament B
returns 404
```python
# Before (BROKEN — evaluates to just the right-hand side)
teams.select().where(teams.c.id == team_id and teams.c.tournament_id == tournament_id)
# After (CORRECT)
teams.select().where((teams.c.id == team_id) & (teams.c.tournament_id == tournament_id))
# round_dependency — no tournament_id on rounds table, use JOIN
rounds.select()
.join(stage_items, rounds.c.stage_item_id == stage_items.c.id)
.join(stages, stage_items.c.stage_id == stages.c.id)
.where((rounds.c.id == round_id) & (stages.c.tournament_id == tournament_id))
```
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
|
||
|
Copilot
|
3606868b98 |
frontend: replace Prettier stack with oxfmt (#1750)
This PR migrates formatting in `frontend/` from Prettier to `oxfmt`,
including script wiring and dependency cleanup. It removes the Prettier
plugin/config path so formatting is handled by a single tool.
- **Script migration**
- Renamed/rewired formatting scripts in `frontend/package.json`:
- `prettier:check` → `format:check` (`oxfmt --check .`)
- `prettier:write` → `format:write` (`oxfmt .`)
- Updated dependent scripts:
- `test` now runs `pnpm run format:write`
- `openapi-ts` now runs `pnpm run format:write` after generation
- **Dependency cleanup**
- Removed `prettier-plugin-organize-imports` from `dependencies`
- Removed `prettier` from `devDependencies`
- Added `oxfmt` (latest stable at update time)
- **Config removal**
- Deleted `frontend/.prettierrc.js` (no longer used after migration)
- **Lockfile alignment**
- Updated `frontend/pnpm-lock.yaml` to reflect the dependency and script
ecosystem change
```json
{
"scripts": {
"format:check": "oxfmt --check .",
"format:write": "oxfmt .",
"openapi-ts": "openapi-ts && pnpm run format:write",
"test": "tsc && pnpm run format:write"
}
}
```
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Erik Vroon <11857441+evroon@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
||
|
dependabot[bot]
|
986d1ff836 |
Bump postcss from 8.5.10 to 8.5.18 in /frontend (#1746)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to 8.5.18. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.18</h2> <ul> <li>Restricted loading previous source maps file to the <code>opts.from</code> folder for security reasons (use <code>unsafeMap: true</code> to disable the check).</li> </ul> <h2>8.5.17</h2> <ul> <li>Fixed <code>Maximum call stack size exceeded</code> error.</li> <li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li> <li>Fixed <code>Input#origin()</code> for unmapped end position (by <a href="https://github.com/chatman-media"><code>@chatman-media</code></a>).</li> </ul> <h2>8.5.16</h2> <ul> <li>Fixed <code>Input#origin()</code> position (by <a href="https://github.com/mizdra"><code>@mizdra</code></a>).</li> <li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed putting parent-less node in <code>nodes</code> of new node (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> <li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.18</h2> <ul> <li>Restricted loading previous source maps file to the <code>opts.from</code> folder for security reasons (use <code>unsafeMap: true</code> to disable the check).</li> </ul> <h2>8.5.17</h2> <ul> <li>Fixed <code>Maximum call stack size exceeded</code> error.</li> <li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li> <li>Fixed <code>Input#origin()</code> for unmapped end position (by <a href="https://github.com/chatman-media"><code>@chatman-media</code></a>).</li> </ul> <h2>8.5.16</h2> <ul> <li>Fixed <code>Input#origin()</code> position (by <a href="https://github.com/mizdra"><code>@mizdra</code></a>).</li> <li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed putting parent-less node in <code>nodes</code> of new node (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> <li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
cfdc741478 |
Bump axios from 1.15.2 to 1.18.0 in /frontend (#1738)
Bumps [axios](https://github.com/axios/axios) from 1.15.2 to 1.18.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v1.18.0 — June 13, 2026</h2> <p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p> </li> <li> <p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p> </li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p> </li> <li> <p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/drori12"><code>@drori12</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li> <li><strong><a href="https://github.com/eyupcanakman"><code>@eyupcanakman</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> <li><strong><a href="https://github.com/Adi-Beker"><code>@Adi-Beker</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full Changelog</a></p> <h2>v1.17.0 — June 1, 2026</h2> <p>This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li> <li><strong>Release Publishing:</strong> Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<strong><a href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>HTTP Compression:</strong> Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Authentication Handling:</strong> Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li> <li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li> <li><strong>React Native FormData:</strong> Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h2>v1.18.0 — June 13, 2026</h2> <p>This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.</p> <h2>🔒 Security Fixes</h2> <ul> <li> <p><strong>Redirect Header Safety:</strong> Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (<strong><a href="https://redirect.github.com/axios/axios/issues/10892">#10892</a></strong>)</p> </li> <li> <p><strong>URL And Request Hardening:</strong> Rejects malformed <code>http:</code> and <code>https:</code> URLs that omit <code>//</code> with <code>ERR_INVALID_URL</code>, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local <code>NO_PROXY</code> matching. (<strong><a href="https://redirect.github.com/axios/axios/issues/11000">#11000</a></strong>)</p> </li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Status Validation:</strong> Added <code>transitional.validateStatusUndefinedResolves</code> so applications can opt in to treating <code>validateStatus: undefined</code> like the option was omitted, while <code>validateStatus: null</code> remains the explicit way to accept every status. (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li> <p><strong>Documentation:</strong> Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the <code>proxy</code> request config as Node.js-only in the advanced docs. (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10988">#10988</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10992">#10992</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</p> </li> <li> <p><strong>Dependencies:</strong> Bumped <code>@babel/core</code>, <code>@babel/preset-env</code>, <code>@commitlint/cli</code>, <code>@commitlint/config-conventional</code>, <code>@rollup/plugin-babel</code>, <code>@rollup/plugin-commonjs</code>, <code>@vitest/browser</code>, <code>@vitest/browser-playwright</code>, <code>eslint</code>, <code>lint-staged</code>, <code>rollup</code>, <code>vitest</code>, and <code>actions/checkout</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10989">#10989</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10996">#10996</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10997">#10997</a></strong>)</p> </li> <li> <p><strong>Release Metadata:</strong> Prepared the 1.18.0 release by updating package metadata and the runtime <code>VERSION</code> value. (<strong><a href="https://redirect.github.com/axios/axios/issues/11003">#11003</a></strong>)</p> </li> </ul> <h2>🌟 New Contributors</h2> <p>We are thrilled to welcome our new contributors. Thank you for helping improve axios:</p> <ul> <li><strong><a href="https://github.com/drori12"><code>@drori12</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10984">#10984</a></strong>)</li> <li><strong><a href="https://github.com/eyupcanakman"><code>@eyupcanakman</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10899">#10899</a></strong>)</li> <li><strong><a href="https://github.com/Adi-Beker"><code>@Adi-Beker</code></a></strong> (<strong><a href="https://redirect.github.com/axios/axios/issues/10995">#10995</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v1.17.0...v1.18.0">Full Changelog</a></p> <h2>v1.17.0 — June 1, 2026</h2> <p>This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.</p> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Config Hardening:</strong> Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<strong><a href="https://redirect.github.com/axios/axios/issues/10901">#10901</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10922">#10922</a></strong>)</li> <li><strong>Release Publishing:</strong> Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<strong><a href="https://redirect.github.com/axios/axios/issues/10926">#10926</a></strong>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li><strong>HTTP Compression:</strong> Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/6792">#6792</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10920">#10920</a></strong>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li><strong>Authentication Handling:</strong> Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<strong><a href="https://redirect.github.com/axios/axios/issues/10929">#10929</a></strong>, <strong><a href="https://redirect.github.com/axios/axios/issues/10896">#10896</a></strong>)</li> <li><strong>Proxy TLS:</strong> Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<strong><a href="https://redirect.github.com/axios/axios/issues/10957">#10957</a></strong>)</li> <li><strong>React Native FormData:</strong> Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<strong><a href="https://redirect.github.com/axios/axios/issues/10898">#10898</a></strong>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
79120544ab |
Bump vite from 8.0.8 to 8.0.16 in /frontend (#1711)
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.0.8 to 8.0.16. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v8.0.16</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.16/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.15</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.15/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.14</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.14/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.13</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.13/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.12</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.11</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.11/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.10</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.10/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.0.9</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.9/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.0.15...v8.0.16">8.0.16</a> (2026-06-01)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>deps:</strong> reject UNC paths for launch-editor-middleware (<a href="https://redirect.github.com/vitejs/vite/issues/22571">#22571</a>) (<a href=" |
||
|
dependabot[bot]
|
5d66ee82df |
Bump @types/node from 25.5.0 to 26.0.1 in /docs (#1684)
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.5.0 to 26.0.1. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
842e2a3201 |
Bump actions/setup-node from 6.3.0 to 6.4.0 (#1687)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.3.0 to 6.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-node/releases">actions/setup-node's releases</a>.</em></p> <blockquote> <h2>v6.4.0</h2> <h2>What's Changed</h2> <h3>Dependency updates:</h3> <ul> <li>Upgrade <a href="https://github.com/actions"><code>@actions</code></a> dependencies by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li> <li>Update Node.js versions in versions.yml and bump package to v6.4.0 by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1533">actions/setup-node#1533</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1525">actions/setup-node#1525</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6...v6.4.0">https://github.com/actions/setup-node/compare/v6...v6.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
Erik Vroon
|
3fd89048b1 | Always run frontend workflow (#1749) | ||
|
dependabot[bot]
|
6b397d0016 |
Bump @types/node from 25.5.0 to 26.0.1 in /frontend (#1685)
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.5.0 to 26.0.1. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> |
||
|
dependabot[bot]
|
3f88a98afa |
Bump lucide-react from 1.7.0 to 1.21.0 in /docs (#1683)
Bumps [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) from 1.7.0 to 1.21.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lucide-icons/lucide/releases">lucide-react's releases</a>.</em></p> <blockquote> <h2>Version 1.21.0</h2> <h2>What's Changed</h2> <ul> <li>ci(release.yml): Remove new-version in release flow by <a href="https://github.com/ericfennis"><code>@ericfennis</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4478">lucide-icons/lucide#4478</a></li> <li>ci(release.yml): Fix workflow and remove <code>version</code> scripts in package scripts by <a href="https://github.com/ericfennis"><code>@ericfennis</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4479">lucide-icons/lucide#4479</a></li> <li>fix(docs): rename navigation category label by <a href="https://github.com/Hsiii"><code>@Hsiii</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4483">lucide-icons/lucide#4483</a></li> <li>feat(icons): added <code>broken-bone</code> icon by <a href="https://github.com/Patolord"><code>@Patolord</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4131">lucide-icons/lucide#4131</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Hsiii"><code>@Hsiii</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4483">lucide-icons/lucide#4483</a></li> <li><a href="https://github.com/Patolord"><code>@Patolord</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4131">lucide-icons/lucide#4131</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/lucide-icons/lucide/compare/1.20.0...1.21.0">https://github.com/lucide-icons/lucide/compare/1.20.0...1.21.0</a></p> <h2>Version 1.20.0</h2> <h2>What's Changed</h2> <ul> <li>fix(icons): decreased size of arrows inside <code>square-arrow-*</code> icons by <a href="https://github.com/jguddas"><code>@jguddas</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3926">lucide-icons/lucide#3926</a></li> <li>chore(tags): Add tags to <code>search-</code> icons by <a href="https://github.com/jamiemlaw"><code>@jamiemlaw</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4099">lucide-icons/lucide#4099</a></li> <li>feat(icons): added <code>save-check</code> icon by <a href="https://github.com/Konixy"><code>@Konixy</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3120">lucide-icons/lucide#3120</a></li> <li>feat(icons): added <code>tag-plus</code> and <code>tag-x</code> icons by <a href="https://github.com/adam-kov"><code>@adam-kov</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3980">lucide-icons/lucide#3980</a></li> <li>feat(icons): added <code>banknote-check</code> icon by <a href="https://github.com/mfjramirezf"><code>@mfjramirezf</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3956">lucide-icons/lucide#3956</a></li> <li>feat(icons): added <code>clock-arrow-in</code> icon by <a href="https://github.com/jguddas"><code>@jguddas</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/2403">lucide-icons/lucide#2403</a></li> <li>feat(icons): added <code>summary</code> icon by <a href="https://github.com/jpjacobpadilla"><code>@jpjacobpadilla</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3114">lucide-icons/lucide#3114</a></li> <li>feat(icons): added <code>user-round-arrow-in</code> icon by <a href="https://github.com/jguddas"><code>@jguddas</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/2283">lucide-icons/lucide#2283</a></li> <li>feat(icons): added <code>clock-arrow-out</code> icon by <a href="https://github.com/jguddas"><code>@jguddas</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/2404">lucide-icons/lucide#2404</a></li> <li>docs(docs): fix broken Svelte package source link in README by <a href="https://github.com/SRKrukowski"><code>@SRKrukowski</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4468">lucide-icons/lucide#4468</a></li> <li>chore(deps-dev): bump <code>@angular/compiler</code> from 21.2.5 to 21.2.17 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4474">lucide-icons/lucide#4474</a></li> <li>chore(deps-dev): bump <code>@angular/core</code> from 21.2.5 to 21.2.17 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4470">lucide-icons/lucide#4470</a></li> <li>chore(deps-dev): bump vitest from 4.0.12 to 4.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4429">lucide-icons/lucide#4429</a></li> <li>chore(deps-dev): bump markdown-it from 14.1.1 to 14.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4475">lucide-icons/lucide#4475</a></li> <li>chore(deps-dev): bump <code>@angular/common</code> from 21.2.5 to 21.2.17 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4471">lucide-icons/lucide#4471</a></li> <li>feat(icons): added <code>pencil-sparkles</code> icon by <a href="https://github.com/jennieboops"><code>@jennieboops</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4445">lucide-icons/lucide#4445</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Konixy"><code>@Konixy</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3120">lucide-icons/lucide#3120</a></li> <li><a href="https://github.com/adam-kov"><code>@adam-kov</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3980">lucide-icons/lucide#3980</a></li> <li><a href="https://github.com/mfjramirezf"><code>@mfjramirezf</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3956">lucide-icons/lucide#3956</a></li> <li><a href="https://github.com/SRKrukowski"><code>@SRKrukowski</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4468">lucide-icons/lucide#4468</a></li> <li><a href="https://github.com/jennieboops"><code>@jennieboops</code></a> made their first contribution in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4445">lucide-icons/lucide#4445</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/lucide-icons/lucide/compare/1.19.0...1.20.0">https://github.com/lucide-icons/lucide/compare/1.19.0...1.20.0</a></p> <h2>Version 1.19.0</h2> <h2>What's Changed</h2> <ul> <li>chore(deps): upgrade pnpm to version 11.6.0 by <a href="https://github.com/ericfennis"><code>@ericfennis</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4458">lucide-icons/lucide#4458</a></li> <li>feat(icons): added <code>star-*</code> icons by <a href="https://github.com/RajnishKMehta"><code>@RajnishKMehta</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/3918">lucide-icons/lucide#3918</a></li> <li>chore(suggest-tags): Update metadata suggestion script by <a href="https://github.com/ericfennis"><code>@ericfennis</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4462">lucide-icons/lucide#4462</a></li> <li>feat(icons): added <code>save-pen</code> icon by <a href="https://github.com/vaporvee"><code>@vaporvee</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4179">lucide-icons/lucide#4179</a></li> <li>feat(icons): added <code>wrench-off</code> icon by <a href="https://github.com/nilsjonsson"><code>@nilsjonsson</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4434">lucide-icons/lucide#4434</a></li> <li>feat(icons): added <code>ad</code> icon by <a href="https://github.com/jamiemlaw"><code>@jamiemlaw</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4323">lucide-icons/lucide#4323</a></li> <li>feat(icons): added <code>eye-dashed</code> icon by <a href="https://github.com/karsa-mistmere"><code>@karsa-mistmere</code></a> in <a href="https://redirect.github.com/lucide-icons/lucide/pull/4415">lucide-icons/lucide#4415</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
7f972399a8 |
Bump postcss from 8.5.10 to 8.5.18 in /docs (#1744)
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to 8.5.18. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.18</h2> <ul> <li>Restricted loading previous source maps file to the <code>opts.from</code> folder for security reasons (use <code>unsafeMap: true</code> to disable the check).</li> </ul> <h2>8.5.17</h2> <ul> <li>Fixed <code>Maximum call stack size exceeded</code> error.</li> <li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li> <li>Fixed <code>Input#origin()</code> for unmapped end position (by <a href="https://github.com/chatman-media"><code>@chatman-media</code></a>).</li> </ul> <h2>8.5.16</h2> <ul> <li>Fixed <code>Input#origin()</code> position (by <a href="https://github.com/mizdra"><code>@mizdra</code></a>).</li> <li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed putting parent-less node in <code>nodes</code> of new node (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> <li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.18</h2> <ul> <li>Restricted loading previous source maps file to the <code>opts.from</code> folder for security reasons (use <code>unsafeMap: true</code> to disable the check).</li> </ul> <h2>8.5.17</h2> <ul> <li>Fixed <code>Maximum call stack size exceeded</code> error.</li> <li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li> <li>Fixed <code>Input#origin()</code> for unmapped end position (by <a href="https://github.com/chatman-media"><code>@chatman-media</code></a>).</li> </ul> <h2>8.5.16</h2> <ul> <li>Fixed <code>Input#origin()</code> position (by <a href="https://github.com/mizdra"><code>@mizdra</code></a>).</li> <li>Fixed <code>raws</code> after rehydrating a JSON AST (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed putting parent-less node in <code>nodes</code> of new node (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> <li>Fixed computing <code>offset</code> in <code>positionBy()</code> (by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>rangeBy()</code> on <code>index: 0</code> (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.15</h2> <ul> <li>Fixed declaration parsing performance (by <a href="https://github.com/homanp"><code>@homanp</code></a>).</li> </ul> <h2>8.5.14</h2> <ul> <li>Fixed custom syntax regression (by <a href="https://github.com/43081j"><code>@43081j</code></a>).</li> </ul> <h2>8.5.13</h2> <ul> <li>Fixed <code>postcss-scss</code> commend regression.</li> </ul> <h2>8.5.12</h2> <ul> <li>Fixed reading any file via user-generated CSS.</li> <li>Added <code>opts.unsafeMap</code> to disable checks.</li> </ul> <h2>8.5.11</h2> <ul> <li>Fixed nested brackets parsing performance (by <a href="https://github.com/offset"><code>@offset</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
2663a70283 |
Bump actions/setup-python from 6 to 6.3.0 (#1722)
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 6.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-python/releases">actions/setup-python's releases</a>.</em></p> <blockquote> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add RHEL support and include Linux distro in cache keys by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li> <li>Fix pip cache error handling on Windows by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li> <li>Upgrade actions dependencies by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li>Upgrade dependency versions and test workflow configuration by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li> </ul> <h3>Documentation</h3> <ul> <li>Update advanced-usage.md by <a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li><a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0">https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0</a></p> <h2>v6.2.0</h2> <h2>What's Changed</h2> <h3>Dependency Upgrades</h3> <ul> <li>Upgrade dependencies to Node 24 compatible versions by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1259">actions/setup-python#1259</a></li> <li>Upgrade urllib3 from 2.5.0 to 2.6.3 in <code>/__tests__/data</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1253">actions/setup-python#1253</a> and <a href="https://redirect.github.com/actions/setup-python/pull/1264">actions/setup-python#1264</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6...v6.2.0">https://github.com/actions/setup-python/compare/v6...v6.2.0</a></p> <h2>v6.1.0</h2> <h2>What's Changed</h2> <h3>Enhancements:</h3> <ul> <li>Add support for <code>pip-install</code> input by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1201">actions/setup-python#1201</a></li> <li>Add graalpy early-access and windows builds by <a href="https://github.com/timfel"><code>@timfel</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/880">actions/setup-python#880</a></li> </ul> <h3>Dependency and Documentation updates:</h3> <ul> <li>Enhanced wording and updated example usage for <code>allow-prereleases</code> by <a href="https://github.com/yarikoptic"><code>@yarikoptic</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/979">actions/setup-python#979</a></li> <li>Upgrade urllib3 from 1.26.19 to 2.5.0 and document breaking changes in v6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1139">actions/setup-python#1139</a></li> <li>Upgrade typescript from 5.4.2 to 5.9.3 and Documentation update by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1094">actions/setup-python#1094</a></li> <li>Upgrade actions/publish-action from 0.3.0 to 0.4.0 & Documentation update for pip-install input by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1199">actions/setup-python#1199</a></li> <li>Upgrade requests from 2.32.2 to 2.32.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1130">actions/setup-python#1130</a></li> <li>Upgrade prettier from 3.5.3 to 3.6.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1234">actions/setup-python#1234</a></li> <li>Upgrade <code>@types/node</code> from 24.1.0 to 24.9.1 and update macos-13 to macos-15-intel by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1235">actions/setup-python#1235</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yarikoptic"><code>@yarikoptic</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/979">actions/setup-python#979</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6...v6.1.0">https://github.com/actions/setup-python/compare/v6...v6.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/actions/setup-python/compare/v6...v6.3.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
c41a400619 |
Bump docker/login-action from 4 to 4.2.0 (#1730)
Bumps [docker/login-action](https://github.com/docker/login-action) from 4 to 4.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.2.0</h2> <ul> <li>Bump <code>@actions/core</code> from 3.0.0 to 3.0.1 in <a href="https://redirect.github.com/docker/login-action/pull/976">docker/login-action#976</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1050.0 in <a href="https://redirect.github.com/docker/login-action/pull/960">docker/login-action#960</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.86.0 to 0.90.0 in <a href="https://redirect.github.com/docker/login-action/pull/970">docker/login-action#970</a></li> <li>Bump brace-expansion from 2.0.1 to 5.0.6 in <a href="https://redirect.github.com/docker/login-action/pull/993">docker/login-action#993</a></li> <li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a href="https://redirect.github.com/docker/login-action/pull/985">docker/login-action#985</a></li> <li>Bump fast-xml-parser from 5.3.6 to 5.8.0 in <a href="https://redirect.github.com/docker/login-action/pull/963">docker/login-action#963</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 9.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/961">docker/login-action#961</a></li> <li>Bump postcss from 8.5.6 to 8.5.10 in <a href="https://redirect.github.com/docker/login-action/pull/979">docker/login-action#979</a></li> <li>Bump tar from 6.2.1 to 7.5.15 in <a href="https://redirect.github.com/docker/login-action/pull/991">docker/login-action#991</a></li> <li>Bump vite from 7.3.1 to 7.3.3 in <a href="https://redirect.github.com/docker/login-action/pull/986">docker/login-action#986</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.1.0...v4.2.0">https://github.com/docker/login-action/compare/v4.1.0...v4.2.0</a></p> <h2>v4.1.0</h2> <ul> <li>Fix scoped Docker Hub cleanup path when registry is omitted by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/945">docker/login-action#945</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1020.0 in <a href="https://redirect.github.com/docker/login-action/pull/930">docker/login-action#930</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.77.0 to 0.86.0 in <a href="https://redirect.github.com/docker/login-action/pull/932">docker/login-action#932</a> <a href="https://redirect.github.com/docker/login-action/pull/936">docker/login-action#936</a></li> <li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a href="https://redirect.github.com/docker/login-action/pull/952">docker/login-action#952</a></li> <li>Bump fast-xml-parser from 5.3.4 to 5.3.6 in <a href="https://redirect.github.com/docker/login-action/pull/942">docker/login-action#942</a></li> <li>Bump flatted from 3.3.3 to 3.4.2 in <a href="https://redirect.github.com/docker/login-action/pull/944">docker/login-action#944</a></li> <li>Bump glob from 10.3.12 to 10.5.0 in <a href="https://redirect.github.com/docker/login-action/pull/940">docker/login-action#940</a></li> <li>Bump handlebars from 4.7.8 to 4.7.9 in <a href="https://redirect.github.com/docker/login-action/pull/949">docker/login-action#949</a></li> <li>Bump http-proxy-agent and https-proxy-agent to 8.0.0 in <a href="https://redirect.github.com/docker/login-action/pull/937">docker/login-action#937</a></li> <li>Bump lodash from 4.17.23 to 4.18.1 in <a href="https://redirect.github.com/docker/login-action/pull/958">docker/login-action#958</a></li> <li>Bump minimatch from 3.1.2 to 3.1.5 in <a href="https://redirect.github.com/docker/login-action/pull/941">docker/login-action#941</a></li> <li>Bump picomatch from 4.0.3 to 4.0.4 in <a href="https://redirect.github.com/docker/login-action/pull/948">docker/login-action#948</a></li> <li>Bump undici from 6.23.0 to 6.24.1 in <a href="https://redirect.github.com/docker/login-action/pull/938">docker/login-action#938</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.0.0...v4.1.0">https://github.com/docker/login-action/compare/v4.0.0...v4.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
29fa324c7e |
Bump next from 16.2.3 to 16.2.11 in /docs (#1745)
Bumps [next](https://github.com/vercel/next.js) from 16.2.3 to 16.2.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vercel/next.js/releases">next's releases</a>.</em></p> <blockquote> <h2>v16.2.11</h2> <p>This release contains security fixes for the following advisories:</p> <p>High:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-m99w-x7hq-7vfj">Denial of Service in App Router using Server Actions</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-6gpp-xcg3-4w24">Middleware / Proxy bypass in App Router applications using Turbopack and single locale</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-p9j2-gv94-2wf4">Server-Side Request Forgery in rewrites via attacker-controlled destination hostname</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-89xv-2m56-2m9x">Server-Side Request Forgery in Server Actions on custom servers</a></li> </ul> <p>Moderate:</p> <ul> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-68g3-v927-f742">Cache confusion of response bodies for requests with bodies</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4633-3j49-mh5q">Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-q8wf-6r8g-63ch">Denial of Service in the Image Optimization API using SVGs</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-955p-x3mx-jcvp">Unauthenticated disclosure of internal Server Function endpoints</a></li> <li><a href="https://github.com/vercel/next.js/security/advisories/GHSA-4c39-4ccg-62r3">Unbounded Server Action payload in Edge runtime</a></li> </ul> <h2>v16.2.10</h2> <p>Contains no changes except publishing <code>@next/swc-wasm-web</code> which was accidentally not published since 16.2.4.</p> <h2>v16.2.9</h2> <p>Empty release to ensure <code>next@latest</code> points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.</p> <h2>v16.2.8</h2> <p>Release with no changes in an attempt to fix <code>next@latest</code> pointing at a prerelease version.</p> <h2>v16.2.7</h2> <blockquote> <p>[!NOTE] This release is backporting bug fixes. It does <strong>not</strong> include all pending features/changes on canary.</p> </blockquote> <h3>Core Changes</h3> <ul> <li>Backport documentation fixes for v16.2 (<a href="https://redirect.github.com/vercel/next.js/issues/93804">#93804</a>)</li> <li>[backport] Patch <code>playwright-core</code> to resolve <code>_finishedPromise</code> on <code>requestFailed</code> (<a href="https://redirect.github.com/vercel/next.js/issues/93920">#93920</a>)</li> <li>[backport] Fix dev mode hydration failure when page is served from HTTP cache (<a href="https://redirect.github.com/vercel/next.js/issues/93492">#93492</a>)</li> <li>[backport] Fix catch-all <code>router.query</code> corruption with <code>basePath</code> + <code>rewrites</code> (<a href="https://redirect.github.com/vercel/next.js/issues/93917">#93917</a>)</li> <li>[backport] Encode non-ASCII characters in cache tags at construction (<a href="https://redirect.github.com/vercel/next.js/issues/93918">#93918</a>)</li> <li>[backport] Fix server action forwarding loop with middleware rewrites (<a href="https://redirect.github.com/vercel/next.js/issues/93919">#93919</a>)</li> <li>[backport] Turbopack: switch from base40 to base38 hash encoding (<a href="https://redirect.github.com/vercel/next.js/issues/93932">#93932</a>)</li> <li>[ci] Disable hanging node 24 typescript tests on 16.2 backport branch (<a href="https://redirect.github.com/vercel/next.js/issues/94164">#94164</a>)</li> <li>[backport] Fix "type: module" in project dir when using standalone or adapters (<a href="https://redirect.github.com/vercel/next.js/issues/94050">#94050</a>)</li> <li>[backport] Propagate adapter preferred regions (<a href="https://redirect.github.com/vercel/next.js/issues/94200">#94200</a>)</li> <li>[16.2.x] Don't drop <code>FormData</code> entries (<a href="https://redirect.github.com/vercel/next.js/issues/94240">#94240</a>)</li> <li>[backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (<a href="https://redirect.github.com/vercel/next.js/issues/94284">#94284</a>)</li> </ul> <h3>Credits</h3> <p>Huge thanks to <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/icyJoseph"><code>@icyJoseph</code></a>, <a href="https://github.com/unstubbable"><code>@unstubbable</code></a>, <a href="https://github.com/mischnic"><code>@mischnic</code></a>, <a href="https://github.com/bgw"><code>@bgw</code></a>, <a href="https://github.com/timneutkens"><code>@timneutkens</code></a>, and <a href="https://github.com/lukesandberg"><code>@lukesandberg</code></a> for helping!</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
b012edc365 |
Bump @hey-api/openapi-ts from 0.95.0 to 0.97.3 in /frontend (#1727)
Bumps [@hey-api/openapi-ts](https://github.com/hey-api/hey-api/tree/HEAD/packages/openapi-ts) from 0.95.0 to 0.97.3. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/hey-api/hey-api/blob/main/packages/openapi-ts/CHANGELOG.md">@hey-api/openapi-ts's changelog</a>.</em></p> <blockquote> <h2>0.97.3</h2> <h3>Patch Changes</h3> <ul> <li> <p><strong>plugin(<code>@hey-api/client-axios</code>)</strong>: fix: correct return type in SSE (<a href="https://redirect.github.com/hey-api/hey-api/pull/3919">#3919</a>) (<a href=" |
||
|
dependabot[bot]
|
05811b8c14 |
Bump aiohttp from 3.14.0 to 3.14.1 in /backend (#1748)
Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.14.0 to 3.14.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst">aiohttp's changelog</a>.</em></p> <blockquote> <h1>3.14.1 (2026-06-07)</h1> <h2>Bug fixes</h2> <ul> <li> <p>Fixed a race condition in :py:class:<code>~aiohttp.TCPConnector</code> where closing the connector while a DNS resolution was in-flight could raise :py:exc:<code>AttributeError</code> instead of :py:exc:<code>~aiohttp.ClientConnectionError</code> -- by :user:<code>goingforstudying-ctrl</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12497</code>.</p> </li> <li> <p>Fixed <code>CancelledError</code> not closing a connection -- by :user:<code>aiolibsbot</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12795</code>.</p> </li> <li> <p>Tightened up some websocket parser checks -- by :user:<code>Dreamsorcerer</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12817</code>.</p> </li> <li> <p>Fixed :class:<code>~aiohttp.CookieJar</code> dropping the host-only flag of cookies when persisted with :meth:<code>~aiohttp.CookieJar.save</code> and reloaded with :meth:<code>~aiohttp.CookieJar.load</code>, so a cookie set without a <code>Domain</code> attribute is again scoped to the exact host that set it after a reload; the absolute expiration deadline is now persisted as well, so a reloaded cookie keeps its original lifetime instead of being rescheduled from the load time. :meth:<code>~aiohttp.CookieJar.load</code> now replaces the jar contents rather than merging onto prior state, and loaded cookies pass through the same acceptance rules as :meth:<code>~aiohttp.CookieJar.update_cookies</code>, so a cookie for an IP-address host is dropped when loaded into a jar created without <code>unsafe=True</code> -- by :user:<code>bdraco</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12824</code>.</p> </li> <li> <p>Scoped :class:<code>~aiohttp.DigestAuthMiddleware</code> credentials to the origin of the first request it handles, so a redirect to a different origin no longer triggers a digest response computed from the configured credentials; a challenge from another origin is only answered when that origin falls within a protection space advertised by the anchor origin through the RFC 7616 <code>domain</code> directive -- by :user:<code>bdraco</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>12825</code>.</p> </li> <li> <p>Fixed the C HTTP parser not enforcing <code>max_line_size</code> on a request target or response reason phrase that is split across multiple reads; each fragment was checked on its own, so an accumulated line could exceed the limit without raising <code>LineTooLong</code>. The accumulated length is now checked, matching the pure-Python parser -- by :user:<code>bdraco</code>.</p> <p><em>Related issues and pull requests on GitHub:</em></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
23ebf88d8a |
Bump python-multipart from 0.0.27 to 0.0.31 in /backend (#1747)
Bumps [python-multipart](https://github.com/Kludex/python-multipart) from 0.0.27 to 0.0.31. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/releases">python-multipart's releases</a>.</em></p> <blockquote> <h2>Version 0.0.31</h2> <h2>What's Changed</h2> <ul> <li>Speed up multipart header parsing and callback dispatch by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/295">Kludex/python-multipart#295</a></li> <li>Bound header field name size before validating by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/296">Kludex/python-multipart#296</a></li> <li>Validate Content-Length is non-negative in parse_form by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/297">Kludex/python-multipart#297</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.30...0.0.31">https://github.com/Kludex/python-multipart/compare/0.0.30...0.0.31</a></p> <h2>Version 0.0.30</h2> <h2>What's Changed</h2> <ul> <li>Treat only <code>&</code> as the urlencoded field separator by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/290">Kludex/python-multipart#290</a></li> <li>Ignore RFC 2231 extended parameters in <code>parse_options_header</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/291">Kludex/python-multipart#291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30">https://github.com/Kludex/python-multipart/compare/0.0.29...0.0.30</a></p> <h2>Version 0.0.29</h2> <h2>What's Changed</h2> <ul> <li>Handle malformed RFC 2231 continuations in <code>parse_options_header</code> by <a href="https://github.com/manunio"><code>@manunio</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/270">Kludex/python-multipart#270</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29">https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29</a></p> <h2>Version 0.0.28</h2> <h2>What's Changed</h2> <ul> <li>Speed up partial-boundary tail scan via <code>bytes.find</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/281">Kludex/python-multipart#281</a></li> <li>Cap multipart boundary length at 256 bytes by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/python-multipart/pull/282">Kludex/python-multipart#282</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28">https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md">python-multipart's changelog</a>.</em></p> <blockquote> <h2>0.0.31 (2026-06-04)</h2> <ul> <li>Speed up multipart header parsing and callback dispatch <a href="https://redirect.github.com/Kludex/python-multipart/pull/295">#295</a>.</li> <li>Bound header field name size before validating <a href="https://redirect.github.com/Kludex/python-multipart/pull/296">#296</a>.</li> <li>Validate <code>Content-Length</code> is non-negative in <code>parse_form</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/297">#297</a>.</li> </ul> <h2>0.0.30 (2026-05-31)</h2> <ul> <li>Parse <code>application/x-www-form-urlencoded</code> bodies per the WHATWG URL standard, treating only <code>&</code> as a field separator <a href="https://redirect.github.com/Kludex/python-multipart/pull/290">#290</a>.</li> <li>Ignore RFC 2231/5987 extended parameters (<code>name*</code>, <code>filename*</code>) in <code>parse_options_header</code>, keeping the plain parameter authoritative per <a href="https://datatracker.ietf.org/doc/html/rfc7578#section-4.2">RFC 7578 §4.2</a> <a href="https://redirect.github.com/Kludex/python-multipart/pull/291">#291</a>.</li> </ul> <h2>0.0.29 (2026-05-17)</h2> <ul> <li>Handle malformed RFC 2231 continuations in <code>parse_options_header</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/270">#270</a>.</li> </ul> <h2>0.0.28 (2026-05-10)</h2> <ul> <li>Speed up partial-boundary tail scan via <code>bytes.find</code> <a href="https://redirect.github.com/Kludex/python-multipart/pull/281">#281</a>.</li> <li>Cap multipart boundary length at 256 bytes <a href="https://redirect.github.com/Kludex/python-multipart/pull/282">#282</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
6f8997bc26 |
Bump codecov/codecov-action from 6 to 7 (#1729)
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/releases">codecov/codecov-action's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <p>⚠️ Due to migration issues with keybase, we are unable to update our keys under the <code>codecovsecurity</code> account. We have deleted the account and are using <code>codecovsecops</code> with the original gpg key</p> <h2>What's Changed</h2> <ul> <li>ci: remove Enforce License Compliance workflow by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1950">codecov/codecov-action#1950</a></li> <li>chore(release): 7.0.0 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1957">codecov/codecov-action#1957</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0">https://github.com/codecov/codecov-action/compare/v6.0.1...v7.0.0</a></p> <h2>v6.0.2</h2> <p>This is a copy of the <code>v7.0.0</code> release to make updates easier</p> <h2>What's Changed</h2> <ul> <li>ci: remove Enforce License Compliance workflow by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1950">codecov/codecov-action#1950</a></li> <li>chore(release): 7.0.0 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1957">codecov/codecov-action#1957</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2">https://github.com/codecov/codecov-action/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>fix: prevent template injection in run: steps (VULN-1652) by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1947">codecov/codecov-action#1947</a></li> <li>chore(release): 6.0.1 by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1949">codecov/codecov-action#1949</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1">https://github.com/codecov/codecov-action/compare/v6.0.0...v6.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md">codecov/codecov-action's changelog</a>.</em></p> <blockquote> <h2>v5.5.2</h2> <h3>What's Changed</h3> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2">https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2</a></p> <h2>v5.5.1</h2> <h3>What's Changed</h3> <ul> <li>fix: overwrite pr number on fork by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1871">codecov/codecov-action#1871</a></li> <li>build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1868">codecov/codecov-action#1868</a></li> <li>build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1867">codecov/codecov-action#1867</a></li> <li>fix: update to use local app/ dir by <a href="https://github.com/thomasrockhu-codecov"><code>@thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1872">codecov/codecov-action#1872</a></li> <li>docs: fix typo in README by <a href="https://github.com/datalater"><code>@datalater</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1866">codecov/codecov-action#1866</a></li> <li>Document a <code>codecov-cli</code> version reference example by <a href="https://github.com/webknjaz"><code>@webknjaz</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1774">codecov/codecov-action#1774</a></li> <li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1861">codecov/codecov-action#1861</a></li> <li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1833">codecov/codecov-action#1833</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1">https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1</a></p> <h2>v5.5.0</h2> <h3>What's Changed</h3> <ul> <li>feat: upgrade wrapper to 0.2.4 by <a href="https://github.com/jviall"><code>@jviall</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1864">codecov/codecov-action#1864</a></li> <li>Pin actions/github-script by Git SHA by <a href="https://github.com/martincostello"><code>@martincostello</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1859">codecov/codecov-action#1859</a></li> <li>fix: check reqs exist by <a href="https://github.com/joseph-sentry"><code>@joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1835">codecov/codecov-action#1835</a></li> <li>fix: Typo in README by <a href="https://github.com/spalmurray"><code>@spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1838">codecov/codecov-action#1838</a></li> <li>docs: Refine OIDC docs by <a href="https://github.com/spalmurray"><code>@spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1837">codecov/codecov-action#1837</a></li> <li>build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1829">codecov/codecov-action#1829</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0">https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0</a></p> <h2>v5.4.3</h2> <h3>What's Changed</h3> <ul> <li>build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by <code>@app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1822">codecov/codecov-action#1822</a></li> <li>fix: OIDC on forks by <a href="https://github.com/joseph-sentry"><code>@joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1823">codecov/codecov-action#1823</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3">https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3</a></p> <h2>v5.4.2</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/codecov/codecov-action/compare/v6...v7">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
8a2d2f70b6 |
Bump docker/build-push-action from 7 to 7.2.0 (#1731)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7 to 7.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/build-push-action/releases">docker/build-push-action's releases</a>.</em></p> <blockquote> <h2>v7.2.0</h2> <ul> <li>Bump <code>@actions/core</code> from 3.0.0 to 3.0.1 in <a href="https://redirect.github.com/docker/build-push-action/pull/1525">docker/build-push-action#1525</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.87.0 to 0.90.0 in <a href="https://redirect.github.com/docker/build-push-action/pull/1517">docker/build-push-action#1517</a></li> <li>Bump brace-expansion from 2.0.2 to 5.0.6 in <a href="https://redirect.github.com/docker/build-push-action/pull/1534">docker/build-push-action#1534</a></li> <li>Bump fast-xml-builder from 1.1.4 to 1.2.0 in <a href="https://redirect.github.com/docker/build-push-action/pull/1529">docker/build-push-action#1529</a></li> <li>Bump fast-xml-parser from 5.5.7 to 5.8.0 in <a href="https://redirect.github.com/docker/build-push-action/pull/1521">docker/build-push-action#1521</a></li> <li>Bump postcss from 8.5.6 to 8.5.10 in <a href="https://redirect.github.com/docker/build-push-action/pull/1526">docker/build-push-action#1526</a></li> <li>Bump tar from 6.2.1 to 7.5.15 in <a href="https://redirect.github.com/docker/build-push-action/pull/1533">docker/build-push-action#1533</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/build-push-action/compare/v7.1.0...v7.2.0">https://github.com/docker/build-push-action/compare/v7.1.0...v7.2.0</a></p> <h2>v7.1.0</h2> <ul> <li>Git context <a href="https://docs.docker.com/build/concepts/context/#url-queries">query format</a> support by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/build-push-action/pull/1505">docker/build-push-action#1505</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.79.0 to 0.87.0 by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/build-push-action/pull/1505">docker/build-push-action#1505</a></li> <li>Bump brace-expansion from 1.1.12 to 1.1.13 in <a href="https://redirect.github.com/docker/build-push-action/pull/1500">docker/build-push-action#1500</a></li> <li>Bump fast-xml-parser from 5.4.2 to 5.5.7 in <a href="https://redirect.github.com/docker/build-push-action/pull/1489">docker/build-push-action#1489</a></li> <li>Bump flatted from 3.3.3 to 3.4.2 in <a href="https://redirect.github.com/docker/build-push-action/pull/1491">docker/build-push-action#1491</a></li> <li>Bump glob from 10.3.12 to 10.5.0 in <a href="https://redirect.github.com/docker/build-push-action/pull/1490">docker/build-push-action#1490</a></li> <li>Bump handlebars from 4.7.8 to 4.7.9 in <a href="https://redirect.github.com/docker/build-push-action/pull/1497">docker/build-push-action#1497</a></li> <li>Bump lodash from 4.17.23 to 4.18.1 in <a href="https://redirect.github.com/docker/build-push-action/pull/1510">docker/build-push-action#1510</a></li> <li>Bump picomatch from 4.0.3 to 4.0.4 in <a href="https://redirect.github.com/docker/build-push-action/pull/1496">docker/build-push-action#1496</a></li> <li>Bump undici from 6.23.0 to 6.24.1 in <a href="https://redirect.github.com/docker/build-push-action/pull/1486">docker/build-push-action#1486</a></li> <li>Bump vite from 7.3.1 to 7.3.2 in <a href="https://redirect.github.com/docker/build-push-action/pull/1509">docker/build-push-action#1509</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0">https://github.com/docker/build-push-action/compare/v7.0.0...v7.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
c9733d2ecc |
Bump react-router from 7.14.0 to 8.3.0 in /frontend (#1743)
Bumps [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) from 7.14.0 to 8.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/remix-run/react-router/releases">react-router's releases</a>.</em></p> <blockquote> <h2>v8.3.0</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830</a></p> <h2>v8.2.0</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820</a></p> <h2>v8.1.0</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810</a></p> <h2>v8.0.1</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801</a></p> <h2>v8.0.0</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800</a></p> <h2>v7.18.1</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181">https://github.com/remix-run/react-router/blob/v7/CHANGELOG.md#v7181</a></p> <h2>v7.18.0</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7180</a></p> <h2>v7.17.0</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7170</a></p> <h2>v7.16.0</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7160">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7160</a></p> <h2>v7.15.1</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7151">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7151</a></p> <h2>v7.15.0</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7150</a></p> <h2>v7.14.2</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7142">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7142</a></p> <h2>v7.14.1</h2> <p>See the changelog for release notes: <a href="https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7141">https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7141</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md">react-router's changelog</a>.</em></p> <blockquote> <h2>v8.3.0</h2> <h3>Patch Changes</h3> <ul> <li>Encode path params in <code>href</code>/<code>generatePath</code> per RFC 3986 path-segment rules instead of <code>encodeURIComponent</code> (<a href="https://redirect.github.com/remix-run/react-router/pull/15310">#15310</a>) <ul> <li>Characters that are valid literally in a path segment (<code>$ & + , ; = : @</code> — RFC 3986 <code>pchar</code>) are no longer percent-encoded, so values like a semver build <code>1.0.0+1</code> interpolate unchanged instead of becoming <code>1.0.0%2B1</code></li> <li>Structural/unsafe characters (<code>/ ? # %</code>, whitespace, non-ASCII) are still escaped exactly as before</li> </ul> </li> <li>Use <code>crypto.randomUUID()</code> for <code>createMemorySessionStorage</code> session ids (<a href="https://redirect.github.com/remix-run/react-router/pull/15302">#15302</a>) <ul> <li><code>createMemorySessionStorage</code> is only intended for local development and testing - sessions are lost when the server restarts</li> </ul> </li> <li>Fix <code>NavLink</code> not applying its <code>pending</code> state when <code>to</code> has a trailing slash (<a href="https://redirect.github.com/remix-run/react-router/pull/15300">#15300</a>)</li> <li>Preserve RSC route component metadata so routes with a <code>clientLoader</code> can skip unnecessary server requests once their components have rendered while still fetching missing server-rendered elements (<a href="https://redirect.github.com/remix-run/react-router/pull/15323">#15323</a>)</li> <li>Harden RSC CSRF code paths (<a href="https://redirect.github.com/remix-run/react-router/pull/15311">#15311</a>)</li> <li>Fix server crash (<code>TypeError: Invalid state: Unable to enqueue</code>) when a request is aborted while the RSC HTML stream has a pending flush (<a href="https://redirect.github.com/remix-run/react-router/pull/15286">#15286</a>) <ul> <li>Handle cancellation of the <code>injectRSCPayload</code> readable side, clear the pending flush, and cancel the underlying RSC payload stream</li> </ul> </li> </ul> <h3>Unstable Changes</h3> <p>⚠️ <em><a href="https://reactrouter.com/community/api-development-strategy#unstable-flags">Unstable features</a> are not recommended for production use</em></p> <ul> <li> <p>Detect stale RSC clients during lazy route discovery and reload the destination document (<a href="https://redirect.github.com/remix-run/react-router/pull/15318">#15318</a>)</p> <h4>Migration</h4> <p>Apps using the default RSC Framework entry do not need to make any changes. Apps with a custom <code>entry.rsc.tsx</code> should import the generated client version and pass it to <code>unstable_matchRSCServerRequest</code>:</p> <pre lang="tsx"><code>import clientVersion from "virtual:react-router/unstable_rsc/client-version"; <p>return unstable_matchRSCServerRequest({<br /> // ...<br /> clientVersion,<br /> });<br /> </code></pre></p> </li> <li> <p>Add CSP nonce support to RSC document rendering (<a href="https://redirect.github.com/remix-run/react-router/pull/15320">#15320</a>)</p> <ul> <li>Add <code>nonce</code> options to <code>unstable_routeRSCServerRequest</code> and <code>unstable_RSCStaticRouter</code></li> <li>Forward the nonce to the HTML renderer and apply it to injected RSC payload scripts and nonce-aware framework components</li> </ul> <p>To adopt nonce-based CSP, update your <code>entry.ssr.tsx</code> (run <code>react-router reveal entry.ssr</code> first in RSC Framework Mode) to generate a fresh nonce for each request. Pass it to <code>routeRSCServerRequest</code>, spread the <code>renderHTML</code> options into React's HTML renderer, pass <code>options.nonce</code> to <code>RSCStaticRouter</code>, and use the same nonce in the <code>Content-Security-Policy</code> response header:</p> <pre lang="tsx"><code>const nonce = crypto.randomUUID(); const response = await routeRSCServerRequest({ request, serverResponse, createFromReadableStream, nonce, async renderHTML(getPayload, options) { const payload = getPayload(); return renderHTMLToReadableStream( </code></pre> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
5bd2a5bd24 |
Bump pyrefly from 1.0.0 to 1.1.1 in /backend (#1741)
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 1.0.0 to 1.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/pyrefly/releases">pyrefly's releases</a>.</em></p> <blockquote> <h2>Pyrefly v1.1.1</h2> <p><em>Release date: June 18, 2026</em></p> <p>Pyrefly v1.1.1 is a patch release with a single bug fix.</p> <hr /> <h2>🐛 Bug fixes</h2> <ul> <li><strong><a href="https://redirect.github.com/facebook/pyrefly/issues/3867">#3867</a>:</strong> Fixed a regression introduced in 1.1.0 where <code>isinstance()</code> narrowing of a union variable silently stopped working when an earlier sibling branch in the same <code>if</code>/<code>elif</code>/<code>else</code> chain narrowed a different variable with <code>isinstance()</code> and returned. The later narrowing left the union untouched, producing false <code>missing-attribute</code> errors on code that checked correctly in 1.0.0.</li> </ul> <p>Thank-you to all our contributors who found these bugs and reported them! Did you know this is one of the most helpful contributions you can make to an open-source project? If you find any bugs in Pyrefly we want to know about them! Please open a bug report issue <a href="https://github.com/facebook/pyrefly/issues">here</a>.</p> <hr /> <h2>📦 Upgrade</h2> <pre lang="bash"><code>pip install --upgrade pyrefly==1.1.1 </code></pre> <h3>How to safely upgrade your codebase</h3> <p>Upgrading the version of Pyrefly you're using or a third-party library you depend on can reveal new type errors in your code. Fixing them all at once is often unrealistic. We've written scripts to help you temporarily silence them. After upgrading, follow these steps:</p> <ol> <li><code>pyrefly check --suppress-errors</code></li> <li>Run your code formatter of choice</li> <li><code>pyrefly check --remove-unused-ignores</code></li> <li>Repeat until you achieve a clean formatting run and a clean type check.</li> </ol> <p>This will add <code># pyrefly: ignore</code> comments to your code, enabling you to silence errors and return to fix them later. This can make the process of upgrading a large codebase much more manageable.</p> <p>Read more about error suppressions in the <a href="https://pyrefly.org/en/docs/error-suppressions/">Pyrefly documentation</a>.</p> <h2>Pyrefly v1.1.0</h2> <p><em>Release date: June 17, 2026</em></p> <p>Pyrefly v1.1.0 bundles <strong>250 commits</strong> from <strong>25 contributors</strong>.</p> <hr /> <h2>✨ New & Improved</h2> <h3>Type Checking</h3> <ul> <li>Pyrefly now correctly narrows <code>TypedDict</code> types after <code>isinstance(x, dict)</code> checks, treating them as runtime <code>dict</code> instances while preserving field information in the positive branch.</li> <li>Type narrowing for bounded and constrained <code>TypeVar</code>s has been significantly improved. <code>isinstance</code> checks now correctly narrow <code>Self</code> and bounded type variables via their disjoint-base representatives, and negative narrowing on bounded TypeVars no longer produces false positives.</li> <li>Constrained <code>TypeVar</code>s are now preserved through method calls and binary operations, so <code>T & int</code> where <code>T: (int, str)</code> correctly returns <code>T & int</code> instead of losing the TypeVar.</li> <li>Classes decorated with <code>@dataclass(slots=True)</code> are now recognized as PEP 800 disjoint bases when they synthesize non-empty <code>__slots__</code>, enabling proper multiple-inheritance conflict detection and type narrowing.</li> <li>Pyrefly now detects when methods override parent class methods without using the <code>@override</code> decorator, and a new quick fix can automatically add the decorator for you.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
878d0b4ce2 |
Bump fastapi from 0.136.0 to 0.138.0 in /backend (#1740)
Bumps [fastapi](https://github.com/fastapi/fastapi) from 0.136.0 to 0.138.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastapi/fastapi/releases">fastapi's releases</a>.</em></p> <blockquote> <h2>0.138.0</h2> <h3>Features</h3> <ul> <li>✨ Add support for <code>app.frontend("/", directory="dist")</code> and <code>router.frontend("/", directory="dist")</code>. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15800">#15800</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>. <ul> <li>Read the docs: <a href="https://fastapi.tiangolo.com/tutorial/frontend/">Frontend</a>.</li> </ul> </li> </ul> <h3>Docs</h3> <ul> <li>📝 Fix typo in release notes. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15807">#15807</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>📝 Add <code>app.frontend()</code> instructions to Agent Library Skill. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15805">#15805</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>📝 Update release notes link. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15802">#15802</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>✏️ Update white space characters in bigger apps. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15801">#15801</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>✏️ Fix grammar, typos, and broken links in docs. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15694">#15694</a> by <a href="https://github.com/YuriiMotov"><code>@YuriiMotov</code></a>.</li> </ul> <h3>Translations</h3> <ul> <li>🌐 Enable Hindi docs translations. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15554">#15554</a> by <a href="https://github.com/YuriiMotov"><code>@YuriiMotov</code></a>.</li> </ul> <h3>Internal</h3> <ul> <li>🐛 Fix failing test, update format for raised errors. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15804">#15804</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>👷 Fix test-alls-green. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15803">#15803</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🔧 Enable checking <code>release-notes.md</code> for typos. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15796">#15796</a> by <a href="https://github.com/YuriiMotov"><code>@YuriiMotov</code></a>.</li> <li>📝 Tweak wording about deploying to FastAPI Cloud. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15793">#15793</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🔨 Use <code>gpt-5.5</code> model in <code>translate.py</code>, specify <code>-chat</code> to avoid warnings. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15792">#15792</a> by <a href="https://github.com/YuriiMotov"><code>@YuriiMotov</code></a>.</li> </ul> <h2>0.137.2</h2> <h3>Features</h3> <ul> <li>✨ Add <code>iter_route_contexts()</code> for advanced use cases that used to use <code>router.routes</code> (e.g. Jupyverse). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15785">#15785</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> </ul> <h3>Translations</h3> <ul> <li>🌐 Fix broken Markdown in Korean custom response docs. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15774">#15774</a> by <a href="https://github.com/kooqooo"><code>@kooqooo</code></a>.</li> <li>🌐 Update translations for fr (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15761">#15761</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for zh-hant (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15760">#15760</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for de (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15759">#15759</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for ko (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15757">#15757</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for uk (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15756">#15756</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for zh (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15755">#15755</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for tr (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15754">#15754</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for pt (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15753">#15753</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for es (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15752">#15752</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for ja (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15751">#15751</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🌐 Update translations for ru (update-outdated). PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15758">#15758</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> </ul> <h3>Internal</h3> <ul> <li>🔧 Update sponsors: add BairesDev. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15787">#15787</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> <li>🔨 Update sponsors script to simplify previews. PR <a href="https://redirect.github.com/fastapi/fastapi/pull/15786">#15786</a> by <a href="https://github.com/tiangolo"><code>@tiangolo</code></a>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
4ad9494c7e |
Bump sentry-sdk from 2.62.0 to 2.63.0 in /backend (#1739)
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from 2.62.0 to 2.63.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's releases</a>.</em></p> <blockquote> <h2>2.63.0</h2> <h3>Bug Fixes 🐛</h3> <h4>Fastapi</h4> <ul> <li>Prevent double wrapping of sync handlers on FastAPI >= 0.137 by <a href="https://github.com/jhonny-on"><code>@jhonny-on</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6569">#6569</a></li> <li>Use effective_route_context path for prefixed routers by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6572">#6572</a></li> </ul> <h4>Other</h4> <ul> <li>(asgi) Gate query string and client IP behind send_default_pii by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6501">#6501</a></li> <li>(serializer) Avoid creating reference cycles on every call by <a href="https://github.com/Malkiz223"><code>@Malkiz223</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6563">#6563</a></li> <li>(user) Set <code>user.ip_address</code> on telemetry if present by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6555">#6555</a></li> <li>Remove 0000 trace_id fallbacks by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6570">#6570</a></li> <li>MANIFEST.in: Graft tests directory. by <a href="https://github.com/charlesroelli"><code>@charlesroelli</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6237">#6237</a></li> </ul> <h3>Internal Changes 🔧</h3> <ul> <li>(fastapi) Verify request info capture with POST endpoints by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6287">#6287</a></li> <li>(starlette) Verify request info capture with POST endpoints by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6269">#6269</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's changelog</a>.</em></p> <blockquote> <h2>2.63.0</h2> <h3>Bug Fixes 🐛</h3> <h4>Fastapi</h4> <ul> <li>Prevent double wrapping of sync handlers on FastAPI >= 0.137 by <a href="https://github.com/jhonny-on"><code>@jhonny-on</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6569">#6569</a></li> <li>Use effective_route_context path for prefixed routers by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6572">#6572</a></li> </ul> <h4>Other</h4> <ul> <li>(asgi) Gate query string and client IP behind send_default_pii by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6501">#6501</a></li> <li>(serializer) Avoid creating reference cycles on every call by <a href="https://github.com/Malkiz223"><code>@Malkiz223</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6563">#6563</a></li> <li>(user) Set <code>user.ip_address</code> on telemetry if present by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6555">#6555</a></li> <li>Remove 0000 trace_id fallbacks by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6570">#6570</a></li> <li>MANIFEST.in: Graft tests directory. by <a href="https://github.com/charlesroelli"><code>@charlesroelli</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6237">#6237</a></li> </ul> <h3>Internal Changes 🔧</h3> <ul> <li>(fastapi) Verify request info capture with POST endpoints by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6287">#6287</a></li> <li>(starlette) Verify request info capture with POST endpoints by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6269">#6269</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
edce9f8b43 |
Bump starlette from 1.2.1 to 1.3.1 in /backend (#1737)
Bumps [starlette](https://github.com/Kludex/starlette) from 1.2.1 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.3.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>StarletteDeprecationWarning</code> instead of <code>DeprecationWarning</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3119">Kludex/starlette#3119</a></li> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3329">Kludex/starlette#3329</a></li> <li>Enforce <code>FormParser</code> limits in parser callbacks by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3331">Kludex/starlette#3331</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.3.0...1.3.1">https://github.com/Kludex/starlette/compare/1.3.0...1.3.1</a></p> <h2>Version 1.3.0</h2> <h2>What's Changed</h2> <ul> <li>Clamp oversized suffix ranges in <code>FileResponse</code> by <a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files by <a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li>Add <code>httpx2</code> to the <code>full</code> extra by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3323">Kludex/starlette#3323</a></li> <li>Adjust testclient typing and warnings by <a href="https://github.com/waketzheng"><code>@waketzheng</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3322">Kludex/starlette#3322</a></li> <li>Fix IndexError in URL.replace() on a URL with no authority by <a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li>Annotate URLPath protocol parameter with Literal by <a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li>avoid collapsing exception groups from user code by <a href="https://github.com/graingert"><code>@graingert</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/2830">Kludex/starlette#2830</a></li> <li>Use <code>removeprefix</code> to strip weak ETag indicator in <code>is_not_modified</code> by <a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> <li>Build <code>request.url</code> from structured components by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3326">Kludex/starlette#3326</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/jiyujie2006"><code>@jiyujie2006</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3307">Kludex/starlette#3307</a></li> <li><a href="https://github.com/N3XT3R1337"><code>@N3XT3R1337</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3191">Kludex/starlette#3191</a></li> <li><a href="https://github.com/leestana01"><code>@leestana01</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3319">Kludex/starlette#3319</a></li> <li><a href="https://github.com/LeSingh1"><code>@LeSingh1</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3317">Kludex/starlette#3317</a></li> <li><a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3204">Kludex/starlette#3204</a></li> <li><a href="https://github.com/Chang-LeHung"><code>@Chang-LeHung</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3285">Kludex/starlette#3285</a></li> <li><a href="https://github.com/gnosyslambda"><code>@gnosyslambda</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3193">Kludex/starlette#3193</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.1...1.3.0">https://github.com/Kludex/starlette/compare/1.2.1...1.3.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.3.1 (June 12, 2026)</h2> <h4>Fixed</h4> <ul> <li>Enforce <code>max_fields</code> and <code>max_part_size</code> in <code>FormParser</code> <a href="https://redirect.github.com/encode/starlette/pull/3329">#3329</a>.</li> <li>Enforce <code>FormParser</code> limits in parser callbacks <a href="https://redirect.github.com/encode/starlette/pull/3331">#3331</a>.</li> </ul> <h2>1.3.0 (June 11, 2026)</h2> <h4>Added</h4> <ul> <li>Add <code>httpx2</code> to the <code>full</code> extra <a href="https://redirect.github.com/encode/starlette/pull/3323">#3323</a>.</li> <li>Annotate the <code>URLPath</code> <code>protocol</code> parameter with <code>Literal</code> <a href="https://redirect.github.com/encode/starlette/pull/3285">#3285</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Build <code>request.url</code> from structured components <a href="https://redirect.github.com/encode/starlette/pull/3326">#3326</a>.</li> <li>Clamp oversized suffix ranges in <code>FileResponse</code> <a href="https://redirect.github.com/encode/starlette/pull/3307">#3307</a>.</li> <li>Catch <code>OSError</code> alongside <code>MultiPartException</code> when closing temp files <a href="https://redirect.github.com/encode/starlette/pull/3191">#3191</a>.</li> <li>Avoid collapsing exception groups raised from user code <a href="https://redirect.github.com/encode/starlette/pull/2830">#2830</a>.</li> <li>Use <code>removeprefix</code> to strip the weak <code>ETag</code> indicator in <code>is_not_modified</code> <a href="https://redirect.github.com/encode/starlette/pull/3193">#3193</a>.</li> <li>Fix <code>IndexError</code> in <code>URL.replace()</code> on a URL with no authority <a href="https://redirect.github.com/encode/starlette/pull/3317">#3317</a>.</li> <li>Adjust <code>testclient</code> typing and warnings <a href="https://redirect.github.com/encode/starlette/pull/3322">#3322</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
9ee493a8b2 |
Bump sentry-sdk from 2.61.0 to 2.62.0 in /backend (#1736)
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from 2.61.0 to 2.62.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's releases</a>.</em></p> <blockquote> <h2>2.62.0</h2> <h3>New Features ✨</h3> <ul> <li> <p>Add integration for <code>aiomysql</code> by <a href="https://github.com/tonal"><code>@tonal</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/4703">#4703</a></p> <p>We're adding support for the <code>aiomysql</code> package. To enable the integration, add it to your <code>integrations</code> list:</p> <pre lang="python"><code>import sentry_sdk from sentry_sdk.integrations.aiomysql import AioMySQLIntegration <p>sentry_sdk.init( traces_sample_rate=1.0, integrations=[AioMySQLIntegration()], ) </code></pre></p> </li> <li> <p>Support HTTPX2 by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6463">#6463</a></p> <p>We're adding out-of-the-box support for HTTPX2. As long as use the package, the Sentry integration will be enabled automatically and you should see your requests instrumented in Sentry.</p> <pre lang="python"><code>import httpx2 import sentry_sdk <p>sentry_sdk.init(...)</p> <p>with sentry_sdk.start_transaction(name="testing_sentry"): httpx2.get("<a href="https://sentry.io/">https://sentry.io/</a>") </code></pre></p> </li> </ul> <h3>Bug Fixes 🐛</h3> <ul> <li>(arq) Never capture control flow exceptions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6507">#6507</a></li> <li>(client) Guard against dotless qualified_name in _setup_instrumentation by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6452">#6452</a></li> <li>(pydantic-ai) Only use hooks when <code>ModelRequestContext.model</code> exists by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6480">#6480</a></li> <li>(rq) Restore <code>functools.wraps()</code> for patched functions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6532">#6532</a></li> <li>(tracing_utils) Handle baggage values containing '=' in from_incoming_header by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6450">#6450</a></li> <li>(utils) Handle image_url string shorthand in _is_image_type_with_blob_content by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6478">#6478</a></li> </ul> <h3>Internal Changes 🔧</h3> <ul> <li>(arq) Only pin <code>fakeredis<2.36.0</code> in tests by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6444">#6444</a></li> <li>(flaky) Change env for flaky test detector by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6492">#6492</a></li> <li>(pydantic-ai) Create event loop before invoking sync methods by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6475">#6475</a></li> <li>Use <code>package-ecosystem: uv</code> in dependabot by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6522">#6522</a></li> <li>🤖 Update test matrix with new releases (06/08) by <a href="https://github.com/github-actions"><code>@github-actions</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6519">#6519</a></li> <li>Raise minimum supported <code>aiomysql</code> version and update text matrix by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6496">#6496</a></li> <li>Deprecate OpenTelemetryIntegration in favor of OTLPIntegration and no-op for span first by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6494">#6494</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's changelog</a>.</em></p> <blockquote> <h2>2.62.0</h2> <h3>New Features ✨</h3> <ul> <li> <p>Add integration for <code>aiomysql</code> by <a href="https://github.com/tonal"><code>@tonal</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/4703">#4703</a></p> <p>We're adding support for the <code>aiomysql</code> package. To enable the integration, add it to your <code>integrations</code> list:</p> <pre lang="python"><code>import sentry_sdk from sentry_sdk.integrations.aiomysql import AioMySQLIntegration <p>sentry_sdk.init( traces_sample_rate=1.0, integrations=[AioMySQLIntegration()], ) </code></pre></p> </li> <li> <p>Support HTTPX2 by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6463">#6463</a></p> <p>We're adding out-of-the-box support for HTTPX2. As long as use the package, the Sentry integration will be enabled automatically and you should see your requests instrumented in Sentry.</p> <pre lang="python"><code>import httpx2 import sentry_sdk <p>sentry_sdk.init(...)</p> <p>with sentry_sdk.start_transaction(name="testing_sentry"): httpx2.get("<a href="https://sentry.io/">https://sentry.io/</a>") </code></pre></p> </li> </ul> <h3>Bug Fixes 🐛</h3> <ul> <li>(arq) Never capture control flow exceptions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6507">#6507</a></li> <li>(client) Guard against dotless qualified_name in _setup_instrumentation by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6452">#6452</a></li> <li>(pydantic-ai) Only use hooks when <code>ModelRequestContext.model</code> exists by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6480">#6480</a></li> <li>(rq) Restore <code>functools.wraps()</code> for patched functions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6532">#6532</a></li> <li>(tracing_utils) Handle baggage values containing '=' in from_incoming_header by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6450">#6450</a></li> <li>(utils) Handle image_url string shorthand in _is_image_type_with_blob_content by <a href="https://github.com/devteamaegis"><code>@devteamaegis</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6478">#6478</a></li> </ul> <h3>Internal Changes 🔧</h3> <ul> <li>(arq) Only pin <code>fakeredis<2.36.0</code> in tests by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6444">#6444</a></li> <li>(flaky) Change env for flaky test detector by <a href="https://github.com/sl0thentr0py"><code>@sl0thentr0py</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6492">#6492</a></li> <li>(pydantic-ai) Create event loop before invoking sync methods by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6475">#6475</a></li> <li>Use <code>package-ecosystem: uv</code> in dependabot by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6522">#6522</a></li> <li>🤖 Update test matrix with new releases (06/08) by <a href="https://github.com/github-actions"><code>@github-actions</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6519">#6519</a></li> <li>Raise minimum supported <code>aiomysql</code> version and update text matrix by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6496">#6496</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
279f66be12 |
Bump pytest from 9.0.3 to 9.1.0 in /backend (#1735)
Bumps [pytest](https://github.com/pytest-dev/pytest) from 9.0.3 to 9.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytest-dev/pytest/releases">pytest's releases</a>.</em></p> <blockquote> <h2>9.1.0</h2> <h1>pytest 9.1.0 (2026-06-13)</h1> <h2>Removals and backward incompatible breaking changes</h2> <ul> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14533">#14533</a>: When using <code>--doctest-modules</code>, autouse fixtures with <code>module</code>, <code>package</code> or <code>session</code> scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.</p> <p>If this is undesirable, move the fixture definition to a <code>conftest.py</code> file if possible.</p> <p>Technical explanation for those interested: When using <!-- raw HTML omitted -->--doctest-modules<!-- raw HTML omitted -->, pytest possibly collects Python modules twice, once as <code>pytest.Module</code> and once as a <code>DoctestModule</code> (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the <code>DoctestModule</code> collects a fixture, it is now visible to it only, and not to the <code>Module</code>. This means that both need to register the fixtures independently.</p> </li> </ul> <h2>Deprecations (removal in next major release)</h2> <ul> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/10819">#10819</a>: Added a deprecation warning for class-scoped fixtures defined as instance methods (without <code>@classmethod</code>). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use <code>@classmethod</code> decorator instead -- by <code>yastcher</code>.</p> <p>See <code>10819</code> and <code>14011</code>.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/12882">#12882</a>: Calling <code>request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue></code> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.</p> <p>See <code>dynamic-fixture-request-during-teardown</code> for details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13409">#13409</a>: Using non-<code>~collections.abc.Collection</code> iterables (such as generators, iterators, or custom iterable objects) for the <code>argvalues</code> parameter in <code>@pytest.mark.parametrize <pytest.mark.parametrize ref></code> and <code>metafunc.parametrize <pytest.Metafunc.parametrize></code> is now deprecated.</p> <p>These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running <code>pytest.main()</code> multiple times, using class-level parametrize decorators, or collecting tests multiple times.</p> <p>See <code>parametrize-iterators</code> for details and suggestions.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/13946">#13946</a>: The private <code>config.inicfg</code> attribute is now deprecated. Use <code>config.getini() <pytest.Config.getini></code> to access configuration values instead.</p> <p>See <code>config-inicfg</code> for more details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14004">#14004</a>: Passing <code>baseid</code> to <code>~pytest.FixtureDef</code> or <code>nodeid</code> strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.</p> <p>Use the <code>node</code> parameter instead for fixture scoping. This enables more robust node-based matching instead of string prefix matching. If you've used <code>nodeid=None</code>, pass <code>node=session</code> instead.</p> <p>This will be removed in pytest 10.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14335">#14335</a>: The method of configuring hooks using markers, deprecated since pytest 7.2, is now scheduled to be removed in pytest 10. See <code>hook-markers</code> for more details.</p> </li> <li> <p><a href="https://redirect.github.com/pytest-dev/pytest/issues/14434">#14434</a>: The <code>--pastebin</code> option is now deprecated.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
d5f5a40986 |
Bump aiohttp from 3.13.4 to 3.14.0 in /backend (#1732)
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
7cb4638f61 |
Bump uvicorn from 0.48.0 to 0.49.0 in /backend (#1733)
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.48.0 to 0.49.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/releases">uvicorn's releases</a>.</em></p> <blockquote> <h2>Version 0.49.0</h2> <h2>What's Changed</h2> <ul> <li>Bump httptools minimum version to 0.8.0 by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2962">Kludex/uvicorn#2962</a></li> <li>Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2971">Kludex/uvicorn#2971</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/uvicorn/compare/0.48.0...0.49.0">https://github.com/Kludex/uvicorn/compare/0.48.0...0.49.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's changelog</a>.</em></p> <blockquote> <h2>0.49.0 (June 3, 2026)</h2> <h3>Changed</h3> <ul> <li>Bump <code>httptools</code> minimum version to 0.8.0 (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2962">#2962</a>)</li> <li>Consume duplicate forwarding headers in <code>ProxyHeadersMiddleware</code> (reverses the 0.48.0 behavior of ignoring them) (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2971">#2971</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
8a6d86980f |
Bump uvicorn from 0.47.0 to 0.48.0 in /backend (#1726)
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.47.0 to 0.48.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/releases">uvicorn's releases</a>.</em></p> <blockquote> <h2>Version 0.48.0</h2> <h2>What's Changed</h2> <ul> <li>Default <code>ssl_ciphers</code> to <code>None</code> and use OpenSSL defaults by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2940">Kludex/uvicorn#2940</a></li> <li>Ignore duplicate forwarding headers in <code>ProxyHeadersMiddleware</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2944">Kludex/uvicorn#2944</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/uvicorn/compare/0.47.0...0.48.0">https://github.com/Kludex/uvicorn/compare/0.47.0...0.48.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's changelog</a>.</em></p> <blockquote> <h2>0.48.0 (May 24, 2026)</h2> <h3>Changed</h3> <ul> <li>Default <code>ssl_ciphers</code> to <code>None</code> and use OpenSSL defaults (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2940">#2940</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Ignore duplicate forwarding headers in <code>ProxyHeadersMiddleware</code> (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2944">#2944</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
8376072d5f |
Bump starlette from 1.1.0 to 1.2.1 in /backend (#1725)
Bumps [starlette](https://github.com/Kludex/starlette) from 1.1.0 to 1.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.2.1</h2> <h2>What's Changed</h2> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module by <a href="https://github.com/leifwar"><code>@leifwar</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li>Add assert error for requires() when request param is not Request type by <a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/leifwar"><code>@leifwar</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3304">Kludex/starlette#3304</a></li> <li><a href="https://github.com/diskeu"><code>@diskeu</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3243">Kludex/starlette#3243</a></li> <li><a href="https://github.com/KeeganOP"><code>@KeeganOP</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3298">Kludex/starlette#3298</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.2.0...1.2.1">https://github.com/Kludex/starlette/compare/1.2.0...1.2.1</a></p> <h2>Version 1.2.0</h2> <h2>What's Changed</h2> <ul> <li>Support httpx2 in the test client by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3291">Kludex/starlette#3291</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.1.0...1.2.0">https://github.com/Kludex/starlette/compare/1.1.0...1.2.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.2.1 (May 31, 2026)</h2> <h4>Fixed</h4> <ul> <li>Use <code>httpx2</code> for type checking in the <code>testclient</code> module <a href="https://redirect.github.com/encode/starlette/pull/3304">#3304</a>.</li> <li>Add assert error for <code>requires()</code> when the request parameter is not a <code>Request</code> type <a href="https://redirect.github.com/encode/starlette/pull/3298">#3298</a>.</li> </ul> <h2>1.2.0 (May 28, 2026)</h2> <h4>Added</h4> <ul> <li>Support httpx2 in the test client <a href="https://redirect.github.com/encode/starlette/pull/3291">#3291</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
0c8f1eb2de |
Bump sentry-sdk from 2.60.0 to 2.61.0 in /backend (#1724)
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from 2.60.0 to 2.61.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's releases</a>.</em></p> <blockquote> <h2>2.61.0</h2> <h3>New Features ✨</h3> <ul> <li> <p>Add <code>server.address</code> to transformed spans when <code>stream_gen_ai_spans=True</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6307">#6307</a></p> </li> <li> <p>Allow integrations to define control flow exceptions by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6425">#6425</a></p> </li> <li> <p>Disable string truncation for events by default by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6290">#6290</a></p> <p>Following a previous significant increase of the string truncation limit, we've now completely removed the limit by default. In case you have large strings in your events, you should now be able to see them.</p> <p>In rare cases, if you have really long strings (or a lot of them), you might see envelopes being dropped because of their size. If that happens, you can set the <code>max_value_length</code> <code>init</code> option to the previous value of <code>100_000</code>:</p> <pre lang="python"><code>sentry_sdk.init( ..., max_value_length=100_000, ) </code></pre> </li> </ul> <h3>Bug Fixes 🐛</h3> <h4>Langchain</h4> <ul> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6301">#6301</a></li> <li>Catch <code>TypeError</code> on <code>langchain.agents</code> import by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6268">#6268</a></li> </ul> <h4>Openai Agents</h4> <ul> <li>Handle <code>starting_agent</code> keyword argument in runner patches by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6428">#6428</a></li> <li>Remove hosted MCP tool spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6391">#6391</a></li> <li>Use <code>name</code>, not <code>description</code> in <code>start_span</code> by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6323">#6323</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6303">#6303</a></li> </ul> <h4>Pydantic AI</h4> <ul> <li>Stop setting tokens on Invoke Agent spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6320">#6320</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6302">#6302</a></li> <li>Remove <code>Agent.run_stream_events()</code> patch by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6281">#6281</a></li> </ul> <h4>Strawberry</h4> <ul> <li>Wrap yields in try-except to ensure span cleanup by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6381">#6381</a></li> <li>Fix <code>AttributeError</code> on <code>graphql_span</code> in <code>resolve</code> by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6289">#6289</a></li> </ul> <h4>Other</h4> <ul> <li>(anthropic) Do not set <code>gen_ai.response.model</code> to <code>None</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6312">#6312</a></li> <li>(asyncpg) Use Sentry span attribute name conventions by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6306">#6306</a></li> <li>(boto3) Guard setting method by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6288">#6288</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's changelog</a>.</em></p> <blockquote> <h2>2.61.0</h2> <h3>New Features ✨</h3> <ul> <li> <p>Add <code>server.address</code> to transformed spans when <code>stream_gen_ai_spans=True</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6307">#6307</a></p> </li> <li> <p>Allow integrations to define control flow exceptions by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6425">#6425</a></p> </li> <li> <p>Disable string truncation for events by default by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6290">#6290</a></p> <p>Following a previous significant increase of the string truncation limit, we've now completely removed the limit by default. In case you have large strings in your events, you should now be able to see them.</p> <p>In rare cases, if you have really long strings (or a lot of them), you might see envelopes being dropped because of their size. If that happens, you can set the <code>max_value_length</code> <code>init</code> option to the previous value of <code>100_000</code>:</p> <pre lang="python"><code>sentry_sdk.init( ..., max_value_length=100_000, ) </code></pre> </li> </ul> <h3>Bug Fixes 🐛</h3> <h4>Langchain</h4> <ul> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6301">#6301</a></li> <li>Catch <code>TypeError</code> on <code>langchain.agents</code> import by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6268">#6268</a></li> </ul> <h4>Openai Agents</h4> <ul> <li>Handle <code>starting_agent</code> keyword argument in runner patches by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6428">#6428</a></li> <li>Remove hosted MCP tool spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6391">#6391</a></li> <li>Use <code>name</code>, not <code>description</code> in <code>start_span</code> by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6323">#6323</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6303">#6303</a></li> </ul> <h4>Pydantic AI</h4> <ul> <li>Stop setting tokens on Invoke Agent spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6320">#6320</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6302">#6302</a></li> <li>Remove <code>Agent.run_stream_events()</code> patch by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6281">#6281</a></li> </ul> <h4>Strawberry</h4> <ul> <li>Wrap yields in try-except to ensure span cleanup by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6381">#6381</a></li> <li>Fix <code>AttributeError</code> on <code>graphql_span</code> in <code>resolve</code> by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6289">#6289</a></li> </ul> <h4>Other</h4> <ul> <li>(anthropic) Do not set <code>gen_ai.response.model</code> to <code>None</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6312">#6312</a></li> <li>(asyncpg) Use Sentry span attribute name conventions by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6306">#6306</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
8aa1bb1c36 |
Bump pytest-asyncio from 1.3.0 to 1.4.0 in /backend (#1723)
Bumps [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) from 1.3.0 to 1.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pytest-dev/pytest-asyncio/releases">pytest-asyncio's releases</a>.</em></p> <blockquote> <h2>pytest-asyncio v1.4.0</h2> <h1><a href="https://github.com/pytest-dev/pytest-asyncio/tree/1.4.0">1.4.0</a> - 2026-05-26</h1> <h2>Deprecated</h2> <ul> <li>Overriding the <em>event_loop_policy</em> fixture is deprecated. Use the <code>pytest_asyncio_loop_factories</code> hook instead. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1419">#1419</a>)</li> </ul> <h2>Added</h2> <ul> <li> <p>Added the <code>pytest_asyncio_loop_factories</code> hook to parametrize asyncio tests with custom event loop factories.</p> <p>The hook returns a mapping of factory names to loop factories, and <code>pytest.mark.asyncio(loop_factories=[...])</code> selects a subset of configured factories per test. When a single factory is configured, test names are unchanged.</p> <p>Synchronous <code>@pytest_asyncio.fixture</code> functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via <code>asyncio.run()</code> or <code>asyncio.set_event_loop(None)</code>). (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1164">#1164</a>)</p> </li> </ul> <h2>Changed</h2> <ul> <li>Improved the readability of the warning message that is displayed when <code>asyncio_default_fixture_loop_scope</code> is unset (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1298">#1298</a>)</li> <li>Only import <code>asyncio.AbstractEventLoopPolicy</code> for type checking to avoid raising a DeprecationWarning. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1394">#1394</a>)</li> <li>Updated minimum supported pytest version to v8.4.0. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1397">#1397</a>)</li> </ul> <h2>Fixed</h2> <ul> <li>Fixed a <code>ResourceWarning: unclosed event loop</code> warning that could occur when a synchronous test called <code>asyncio.run()</code> or otherwise unset the current event loop after pytest-asyncio had run an async test or fixture. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/724">#724</a>)</li> </ul> <h2>Notes for Downstream Packagers</h2> <ul> <li>Added dependency on <code>sphinx-tabs >= 3.5</code> to organize documentation examples into tabs. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1395">#1395</a>)</li> </ul> <h2>pytest-asyncio v1.4.0a2</h2> <h1><a href="https://github.com/pytest-dev/pytest-asyncio/tree/1.4.0a2">1.4.0a2</a> - 2026-05-02</h1> <h2>Deprecated</h2> <ul> <li>Overriding the <em>event_loop_policy</em> fixture is deprecated. Use the <code>pytest_asyncio_loop_factories</code> hook instead. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1419">#1419</a>)</li> </ul> <h2>Added</h2> <ul> <li> <p>Added the <code>pytest_asyncio_loop_factories</code> hook to parametrize asyncio tests with custom event loop factories.</p> <p>The hook returns a mapping of factory names to loop factories, and <code>pytest.mark.asyncio(loop_factories=[...])</code> selects a subset of configured factories per test. When a single factory is configured, test names are unchanged on pytest 8.4+.</p> <p>Synchronous <code>@pytest_asyncio.fixture</code> functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via <code>asyncio.run()</code> or <code>asyncio.set_event_loop(None)</code>). (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1164">#1164</a>)</p> </li> </ul> <h2>Changed</h2> <ul> <li>Improved the readability of the warning message that is displayed when <code>asyncio_default_fixture_loop_scope</code> is unset (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1298">#1298</a>)</li> <li>Only import <code>asyncio.AbstractEventLoopPolicy</code> for type checking to avoid raising a DeprecationWarning. (<a href="https://redirect.github.com/pytest-dev/pytest-asyncio/issues/1394">#1394</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
1d5e71fc20 |
Bump starlette from 1.0.1 to 1.1.0 in /backend (#1720)
Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.1 to 1.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.1.0</h2> <h2>What's Changed</h2> <ul> <li>Use <code>"application/octet-stream"</code> as the <code>FileResponse</code> media type fallback by <a href="https://github.com/ATOM00blue"><code>@ATOM00blue</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3283">Kludex/starlette#3283</a></li> <li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3286">Kludex/starlette#3286</a></li> <li>Reject absolute paths in <code>StaticFiles.lookup_path</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3287">Kludex/starlette#3287</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ATOM00blue"><code>@ATOM00blue</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3283">Kludex/starlette#3283</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.0.1...1.1.0">https://github.com/Kludex/starlette/compare/1.0.1...1.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.1.0 (May 23, 2026)</h2> <h4>Added</h4> <ul> <li>Use <code>"application/octet-stream"</code> as the <code>FileResponse</code> media type fallback <a href="https://redirect.github.com/encode/starlette/pull/3283">#3283</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Only dispatch standard HTTP verbs in <code>HTTPEndpoint</code> <a href="https://redirect.github.com/encode/starlette/pull/3286">#3286</a>.</li> <li>Reject absolute paths in <code>StaticFiles.lookup_path</code> <a href="https://redirect.github.com/encode/starlette/pull/3287">#3287</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
611dfdbcfc |
Bump pydantic-settings from 2.14.0 to 2.14.2 in /backend (#1719)
Bumps [pydantic-settings](https://github.com/pydantic/pydantic-settings) from 2.14.0 to 2.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic-settings/releases">pydantic-settings's releases</a>.</em></p> <blockquote> <h2>v2.14.2</h2> <h2>What's Changed</h2> <p>This is a security patch release.</p> <ul> <li>Prevent <code>NestedSecretsSettingsSource</code> from following symlinks outside <code>secrets_dir</code> by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/889">pydantic/pydantic-settings#889</a></li> <li>Prepare release 2.14.2 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/890">pydantic/pydantic-settings#890</a></li> </ul> <h3>Security</h3> <p>Fixes <a href="https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j">GHSA-4xgf-cpjx-pc3j</a>: <code>NestedSecretsSettingsSource</code> with <code>secrets_nested_subdir=True</code> could follow a symbolic link inside <code>secrets_dir</code> pointing outside it, reading out-of-tree files into settings values and bypassing the <code>secrets_dir_max_size</code> cap. Affected versions: <code>>= 2.12.0, < 2.14.2</code>.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2">https://github.com/pydantic/pydantic-settings/compare/v2.14.1...v2.14.2</a></p> <h2>v2.14.1</h2> <h2>What's Changed</h2> <ul> <li>Bump the python-packages group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/850">pydantic/pydantic-settings#850</a></li> <li>Bump the python-packages group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/854">pydantic/pydantic-settings#854</a></li> <li>Bump the github-actions group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/853">pydantic/pydantic-settings#853</a></li> <li>Bump the python-packages group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/856">pydantic/pydantic-settings#856</a></li> <li>Fix field named <code>cls</code> conflicting with classmethod parameter by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/858">pydantic/pydantic-settings#858</a></li> <li>Prepare release 2.14.1 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/859">pydantic/pydantic-settings#859</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1">https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
9077b2d0a0 |
Bump uvicorn from 0.46.0 to 0.47.0 in /backend (#1718)
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.46.0 to 0.47.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/releases">uvicorn's releases</a>.</em></p> <blockquote> <h2>Version 0.47.0</h2> <h2>What's Changed</h2> <ul> <li>Eagerly import the ASGI app in the parent process by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2919">Kludex/uvicorn#2919</a></li> <li>Add <code>ssl_context_factory</code> for custom <code>SSLContext</code> configuration by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2920">Kludex/uvicorn#2920</a></li> <li>Treat <code>fd=0</code> as a valid file descriptor with reload/workers by <a href="https://github.com/eltoder"><code>@eltoder</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2927">Kludex/uvicorn#2927</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/uvicorn/compare/0.46.0...0.47.0">https://github.com/Kludex/uvicorn/compare/0.46.0...0.47.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's changelog</a>.</em></p> <blockquote> <h2>0.47.0 (May 14, 2026)</h2> <h3>Added</h3> <ul> <li>Add <code>ssl_context_factory</code> for custom <code>SSLContext</code> configuration (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2920">#2920</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Eagerly import the ASGI app in the parent process (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2919">#2919</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Treat <code>fd=0</code> as a valid file descriptor with reload/workers (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2927">#2927</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
8c80246c97 |
Bump mypy from 2.0.0 to 2.1.0 in /backend (#1717)
Bumps [mypy](https://github.com/python/mypy) from 2.0.0 to 2.1.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's changelog</a>.</em></p> <blockquote> <h1>Mypy Release Notes</h1> <h2>Next Release</h2> <h2>Mypy 2.1</h2> <p>We’ve just uploaded mypy 2.1.0 to the Python Package Index (<a href="https://pypi.org/project/mypy/">PyPI</a>). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:</p> <pre><code>python3 -m pip install -U mypy </code></pre> <p>You can read the full documentation for this release on <a href="http://mypy.readthedocs.io">Read the Docs</a>.</p> <h3>librt.vecs: Fast Growable Array Type for Mypyc</h3> <p>The new <code>librt.vecs</code> module provides an efficient growable array type <code>vec</code> that is optimized for mypyc use. It provides fast, packed arrays with integer and floating point value types, which can be <strong>several times faster</strong> than <code>list</code>, and tens of times faster than <code>array.array</code> in code compiled using mypyc. It also supports nested <code>vec</code> objects and non-value-type items, such as <code>vec[vec[str]]</code>.</p> <p>Refer to the <a href="https://mypyc.readthedocs.io/en/latest/librt_vecs.html">documentation</a> for the details.</p> <p>Contributed by Jukka Lehtosalo.</p> <h3>librt.random: Fast Pseudo-Random Number Generation</h3> <p>The new <code>librt.random</code> module provides fast pseudo-random number generation that is optimized for code compiled using mypyc. It can be 3x to 10x faster than the stdlib <code>random</code> module in compiled code.</p> <p>Refer to the <a href="https://mypyc.readthedocs.io/en/latest/librt_random.html">documentation</a> for the details.</p> <p>Contributed by Jukka Lehtosalo (PR <a href="https://redirect.github.com/python/mypy/pull/21433">21433</a>).</p> <h3>Mypyc Improvements</h3> <ul> <li>Enable incremental self-compilation (Vaggelis Danias, PR <a href="https://redirect.github.com/python/mypy/pull/21369">21369</a>)</li> <li>Make compilation order with multiple files consistent (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21419">21419</a>)</li> <li>Fix crash on accessing <code>StopAsyncIteration</code> (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21406">21406</a>)</li> <li>Fix incremental compilation with <code>separate</code> flag (Vaggelis Danias, PR <a href="https://redirect.github.com/python/mypy/pull/21299">21299</a>)</li> </ul> <h3>Fixes to Crashes</h3> <ul> <li>Fix crash on partial type with <code>--allow-redefinition</code> and <code>global</code> declaration (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21428">21428</a>)</li> <li>Fix broken awaitable generator patching (Ivan Levkivskyi, PR <a href="https://redirect.github.com/python/mypy/pull/21435">21435</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
284d2eceb6 |
Bump pyrefly from 0.64.1 to 1.0.0 in /backend (#1716)
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 0.64.1 to 1.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/pyrefly/releases">pyrefly's releases</a>.</em></p> <blockquote> <h2>Pyrefly v1.0.0</h2> <p><strong>Status: STABLE</strong> <em>Release date: 12 May 2026</em></p> <h2>Pyrefly v1.0.0 is here!</h2> <p>We're thrilled to announce that Pyrefly has reached its stable 1.0.0 release! Since our <a href="https://github.com/facebook/pyrefly/releases/tag/0.42.0">beta release</a> in November 2025, we've fixed hundreds of bugs, improved performance, and added lots of new functionality. Pyrefly is already the default type checker for Instagram at Meta and has been adopted by other large production codebases like PyTorch and JAX. Today, we're making it official: Pyrefly is production ready.</p> <p>This would not have been possible without our amazing open-source community. To everyone who filed GitHub issues, submitted pull requests, gave us feedback at conferences, or joined us on Discord: thank you. Your contributions shaped this release.</p> <p>These release notes cover the major highlights since our beta release. For the full history, see our <a href="https://github.com/facebook/pyrefly/releases">past weekly release notes</a>.</p> <hr /> <h2>Performance Improvements</h2> <p>We've continued to push Pyrefly's performance since the <a href="https://pyrefly.org/blog/2026/02/06/performance-improvements/">speed improvements we shared in February</a>. Since beta:</p> <ul> <li><strong>2–125x faster updated diagnostics</strong> after saving a file (no, that’s not a typo!). Thanks to fine-grained dependency tracking and streaming diagnostics, updates now consistently arrive in milliseconds</li> <li><strong>20–36% faster full type checking</strong> on large projects like PyTorch and Pandas</li> <li><strong>2–3x faster initial indexing</strong> when Pyrefly first scans your project</li> <li><strong>40–60% less memory usage</strong> during both indexing and incremental type checking</li> </ul> <p>(Tested on an M4 Macbook Pro using open-source benchmarks from <a href="https://github.com/lolpack/type_coverage_py">type_coverage_py</a> and <a href=" |
||
|
dependabot[bot]
|
0de812c8b9 |
Bump sentry-sdk from 2.59.0 to 2.60.0 in /backend (#1715)
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from 2.59.0 to 2.60.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's releases</a>.</em></p> <blockquote> <h2>2.60.0</h2> <p>Adds a new <code>stream_gen_ai_spans</code> option that controls how <code>gen_ai</code> spans are sent to Sentry. When set, the SDK extracts all <code>gen_ai</code> spans out of a transaction and sends them as v2 envelope items.</p> <p>Enable this option if <code>gen_ai</code> spans are being dropped because the transaction payload exceeds size limits.</p> <pre lang="python"><code>import sentry_sdk <p>sentry_sdk.init(<br /> dsn='https://<a href="mailto:examplePublicKey@o0.ingest.sentry.io">examplePublicKey@o0.ingest.sentry.io</a>/0',<br /> stream_gen_ai_spans=True,<br /> )<br /> </code></pre></p> <h3>New Features ✨</h3> <ul> <li>(asyncpg) Add cursor span support via BaseCursor method patching by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6252">#6252</a></li> <li>(integrations) Pass along the conversation ID for openai <code>responses</code> calls by <a href="https://github.com/constantinius"><code>@constantinius</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6199">#6199</a></li> <li>(wsgi,asgi) Introduce substitute values for filtered fields in span-streaming mode by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6178">#6178</a></li> <li>Remove truncation when <code>stream_gen_ai_spans</code> is enabled by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6260">#6260</a></li> <li>Add option to send GenAI spans in the new span format by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6079">#6079</a></li> </ul> <h3>Bug Fixes 🐛</h3> <h4>Openai</h4> <ul> <li>Guard against <code>choices=None</code> by <a href="https://github.com/cla7aye15I4nd"><code>@cla7aye15I4nd</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6216">#6216</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6192">#6192</a></li> <li>Only finish relevant spans in Responses patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6191">#6191</a></li> <li>Only finish relevant spans in Chat Completions patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6190">#6190</a></li> </ul> <h4>Other</h4> <ul> <li>(stdlib) Instrument response body read for chunked HTTP responses by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6202">#6202</a></li> <li>(typing) Add <code>@sentry_sdk.traces.trace</code> overloads to fix typing by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6236">#6236</a></li> <li>Use proto version 2 to fix backfilled user agent and IP by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6256">#6256</a></li> <li>Make sure <code>http.server</code> spans are segments by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6230">#6230</a></li> <li>Handle mypy 2.0 related failures by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6218">#6218</a></li> </ul> <h3>Internal Changes 🔧</h3> <h4>Django</h4> <ul> <li>Check transaction annotations on transaction events by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6251">#6251</a></li> <li>Reload middleware on test teardown by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6249">#6249</a></li> </ul> <h4>Openai</h4> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's changelog</a>.</em></p> <blockquote> <h2>2.60.0</h2> <p>Adds a new <code>stream_gen_ai_spans</code> option that controls how <code>gen_ai</code> spans are sent to Sentry. When set, the SDK extracts all <code>gen_ai</code> spans out of a transaction and sends them as v2 envelope items.</p> <p>Enable this option if <code>gen_ai</code> spans are being dropped because the transaction payload exceeds size limits.</p> <pre lang="python"><code>import sentry_sdk <p>sentry_sdk.init(<br /> dsn='https://<a href="mailto:examplePublicKey@o0.ingest.sentry.io">examplePublicKey@o0.ingest.sentry.io</a>/0',<br /> stream_gen_ai_spans=True,<br /> )<br /> </code></pre></p> <h3>New Features ✨</h3> <ul> <li>(asyncpg) Add cursor span support via BaseCursor method patching by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6252">#6252</a></li> <li>(integrations) Pass along the conversation ID for openai <code>responses</code> calls by <a href="https://github.com/constantinius"><code>@constantinius</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6199">#6199</a></li> <li>(wsgi,asgi) Introduce substitute values for filtered fields in span-streaming mode by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6178">#6178</a></li> <li>Remove truncation when <code>stream_gen_ai_spans</code> is enabled by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6260">#6260</a></li> <li>Add option to send GenAI spans in the new span format by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6079">#6079</a></li> </ul> <h3>Bug Fixes 🐛</h3> <h4>Openai</h4> <ul> <li>Guard against <code>choices=None</code> by <a href="https://github.com/cla7aye15I4nd"><code>@cla7aye15I4nd</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6216">#6216</a></li> <li>Stop setting transaction status when child span fails by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6192">#6192</a></li> <li>Only finish relevant spans in Responses patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6191">#6191</a></li> <li>Only finish relevant spans in Chat Completions patches by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6190">#6190</a></li> </ul> <h4>Other</h4> <ul> <li>(stdlib) Instrument response body read for chunked HTTP responses by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6202">#6202</a></li> <li>(typing) Add <code>@sentry_sdk.traces.trace</code> overloads to fix typing by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6236">#6236</a></li> <li>Use proto version 2 to fix backfilled user agent and IP by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6256">#6256</a></li> <li>Make sure <code>http.server</code> spans are segments by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6230">#6230</a></li> <li>Handle mypy 2.0 related failures by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6218">#6218</a></li> </ul> <h3>Internal Changes 🔧</h3> <h4>Django</h4> <ul> <li>Check transaction annotations on transaction events by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6251">#6251</a></li> <li>Reload middleware on test teardown by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6249">#6249</a></li> </ul> <h4>Openai</h4> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
d9c06d0d5d |
Bump click from 8.3.0 to 8.4.0 in /backend (#1714)
Bumps [click](https://github.com/pallets/click) from 8.3.0 to 8.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pallets/click/releases">click's releases</a>.</em></p> <blockquote> <h2>8.4.0</h2> <p>This is the Click 8.4.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.</p> <p>We encourage everyone to upgrade. You can read more about our <a href="https://palletsprojects.com/versions">Version Support Policy</a> on our website.</p> <p>PyPI: <a href="https://pypi.org/project/click/8.4.0/">https://pypi.org/project/click/8.4.0/</a> Changes: <a href="https://click.palletsprojects.com/page/changes/#version-8-4-0">https://click.palletsprojects.com/page/changes/#version-8-4-0</a> Milestone <a href="https://github.com/pallets/click/milestone/30">https://github.com/pallets/click/milestone/30</a></p> <ul> <li> <p><code>ParamType</code> typing improvements. <a href="https://redirect.github.com/pallets/click/issues/3371">#3371</a></p> <ul> <li>:class:<code>ParamType</code> is now a generic abstract base class, parameterized by its converted value type.</li> <li>:meth:<code>~ParamType.convert</code> return types are narrowed on all concrete types (<code>str</code> for :class:<code>STRING</code>, <code>int</code> for :class:<code>INT</code>, etc.).</li> <li>:meth:<code>~ParamType.to_info_dict</code> returns specific :class:<code>~typing.TypedDict</code> subclasses instead of <code>dict[str, Any]</code>.</li> <li>:class:<code>CompositeParamType</code> and the number-range base are now generic with abstract methods.</li> </ul> </li> <li> <p>Refactor <code>convert_type</code> to extract type inference into a private <code>_guess_type</code> helper, and add :func:<code>typing.overload</code> signatures. <a href="https://redirect.github.com/pallets/click/issues/3372">#3372</a></p> </li> <li> <p><code>Parameter</code> typing improvements. <a href="https://redirect.github.com/pallets/click/issues/2805">#2805</a></p> <ul> <li>:class:<code>Parameter</code> is now an abstract base class, making explicit that it cannot be instantiated directly.</li> <li>:attr:<code>Parameter.name</code> is now <code>str</code> instead of <code>str | None</code>. When <code>expose_value=False</code>, the name is set to <code>""</code> instead of <code>None</code>.</li> <li>The <code>ctx</code> parameter of :meth:<code>Parameter.get_error_hint</code> is now typed as <code>Context | None</code>, matching the runtime behavior.</li> </ul> </li> <li> <p>Split string values from <code>default_map</code> for parameters with <code>nargs > 1</code> or :class:<code>Tuple</code> type, matching environment variable behavior. <a href="https://redirect.github.com/pallets/click/issues/2745">#2745</a> <a href="https://redirect.github.com/pallets/click/issues/3364">#3364</a></p> </li> <li> <p>Auto-detect <code>type=UNPROCESSED</code> for <code>flag_value</code> of non-basic types (not <code>str</code>, <code>int</code>, <code>float</code>, or <code>bool</code>), so programmer-provided Python objects like classes and enum members are passed through unchanged instead of being stringified. Previously <code>type=click.UNPROCESSED</code> had to be set explicitly. <a href="https://redirect.github.com/pallets/click/issues/2012">#2012</a> <a href="https://redirect.github.com/pallets/click/issues/3363">#3363</a></p> </li> <li> <p>The error hint now uses <code>Command.get_help_option_names</code> to pick non-shadowed help option names, so <code>Try '... -h'</code> no longer points to a subcommand option that shadows <code>-h</code>. All surviving names are shown (<code>-h/--help</code>). <a href="https://redirect.github.com/pallets/click/issues/2790">#2790</a> <a href="https://redirect.github.com/pallets/click/issues/3208">#3208</a></p> </li> <li> <p>Fix readline functionality on non-Windows platforms. Prompt text is now passed directly to readline instead of being printed separately, allowing proper backspace, line editing, and line wrapping behavior. <a href="https://redirect.github.com/pallets/click/issues/2968">#2968</a></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pallets/click/blob/main/CHANGES.md">click's changelog</a>.</em></p> <blockquote> <h2>Version 8.4.0</h2> <p>Released 2026-05-17</p> <ul> <li> <p>{class}<code>ParamType</code> typing improvements. {pr}<code>3371</code></p> <ul> <li>{class}<code>ParamType</code> is now a generic abstract base class, parameterized by its converted value type.</li> <li>{meth}<code>~ParamType.convert</code> return types are narrowed on all concrete types (<code>str</code> for {class}<code>STRING</code>, <code>int</code> for {class}<code>INT</code>, etc.).</li> <li>{meth}<code>~ParamType.to_info_dict</code> returns specific {class}<code>~typing.TypedDict</code> subclasses instead of <code>dict[str, Any]</code>.</li> <li>{class}<code>CompositeParamType</code> and the number-range base are now generic with abstract methods.</li> </ul> </li> <li> <p>Refactor <code>convert_type</code> to extract type inference into a private <code>_guess_type</code> helper, and add {func}<code>typing.overload</code> signatures. {pr}<code>3372</code></p> </li> <li> <p>{class}<code>Parameter</code> typing improvements. {pr}<code>2805</code></p> <ul> <li>{class}<code>Parameter</code> is now an abstract base class, making explicit that it cannot be instantiated directly.</li> <li>{attr}<code>Parameter.name</code> is now <code>str</code> instead of <code>str | None</code>. When <code>expose_value=False</code>, the name is set to <code>""</code> instead of <code>None</code>.</li> <li>The <code>ctx</code> parameter of {meth}<code>Parameter.get_error_hint</code> is now typed as <code>Context | None</code>, matching the runtime behavior.</li> </ul> </li> <li> <p>Split string values from <code>default_map</code> for parameters with <code>nargs > 1</code> or {class}<code>Tuple</code> type, matching environment variable behavior. {issue}<code>2745</code> {pr}<code>3364</code></p> </li> <li> <p>Auto-detect <code>type=UNPROCESSED</code> for <code>flag_value</code> of non-basic types (not <code>str</code>, <code>int</code>, <code>float</code>, or <code>bool</code>), so programmer-provided Python objects like classes and enum members are passed through unchanged instead of being stringified. Previously <code>type=click.UNPROCESSED</code> had to be set explicitly. {issue}<code>2012</code> {pr}<code>3363</code></p> </li> <li> <p>The error hint now uses {meth}<code>Command.get_help_option_names</code> to pick non-shadowed help option names, so <code>Try '... -h'</code> no longer points to a subcommand option that shadows <code>-h</code>. The longest surviving name is shown (<code>--help</code> over <code>-h</code>) for readability. {issue}<code>2790</code> {pr}<code>3208</code></p> </li> <li> <p>Fix readline functionality on non-Windows platforms. Prompt text is now passed directly to readline instead of being printed separately, allowing proper backspace, line editing, and line wrapping behavior. {issue}<code>2968</code> {pr}<code>2969</code></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
3ccaafd6cd |
Bump pyjwt from 2.12.0 to 2.13.0 in /backend (#1712)
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.12.0 to 2.13.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.13.0</h2> <h1>PyJWT 2.13.0 — Security Release</h1> <p>This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.</p> <h2>Security</h2> <ul> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"><code>GHSA-xgmm-8j9v-c9wx</code></a> — JWK JSON accepted as HMAC secret (algorithm confusion).</strong> <code>HMACAlgorithm.prepare_key</code> previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in <code>algorithms=[…]</code> and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. <em>Reported by <a href="https://github.com/aradona91"><code>@aradona91</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f"><code>GHSA-jq35-7prp-9v3f</code></a> — Algorithm allow-list bypass with <code>PyJWK</code> / <code>PyJWKClient</code>.</strong> When verifying with a <code>PyJWK</code>, the caller's <code>algorithms=[…]</code> allow-list was checked against the token header <code>alg</code> as a string only; actual verification used the algorithm bound to the <code>PyJWK</code>. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header <code>alg</code> to match the <code>PyJWK</code>'s algorithm before verification. <em>Reported by <a href="https://github.com/sushi-gif"><code>@sushi-gif</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39"><code>GHSA-w7vc-732c-9m39</code></a> — DoS via base64 decode of unused payload segment when <code>b64=false</code>.</strong> For detached-payload JWS (<code>b64=false</code>), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied <code>detached_payload</code>. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. <em>Reported by <a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4"><code>GHSA-993g-76c3-p5m4</code></a> — <code>PyJWKClient</code> accepts non-HTTP(S) URIs.</strong> <code>PyJWKClient.fetch_data</code> passed its URI to <code>urllib.request.urlopen</code>, which by default also handles <code>file://</code>, <code>ftp://</code>, and <code>data:</code> schemes. An application that fed an attacker-influenced URI into <code>PyJWKClient</code> could be coerced into reading local files or reaching other unintended schemes. <code>PyJWKClient</code> now rejects any URI whose scheme isn't <code>http</code> or <code>https</code>. <em>Reported by <a href="https://github.com/KEIJOT"><code>@KEIJOT</code></a>.</em></p> </li> <li> <p><strong><a href="https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8"><code>GHSA-fhv5-28vv-h8m8</code></a> — <code>PyJWKClient</code> cache wiped on fetch error.</strong> A <code>finally</code>-block <code>put(jwk_set=None)</code> cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. <em>Reported by <a href="https://github.com/eddieran"><code>@eddieran</code></a>.</em></p> </li> </ul> <h2>Fixed</h2> <ul> <li>Reject empty HMAC keys outright in <code>HMACAlgorithm.prepare_key</code> with <code>InvalidKeyError</code> instead of accepting them with only a warning. Defends against the <code>os.getenv("JWT_SECRET", "")</code> footgun. <em>Thanks to <a href="https://github.com/SnailSploit"><code>@SnailSploit</code></a> and <a href="https://github.com/spartan8806"><code>@spartan8806</code></a> for the reports.</em></li> <li>Forward per-call <code>options</code> (including <code>enforce_minimum_key_length</code>) from <code>PyJWT.decode</code> through to <code>PyJWS._verify_signature</code>. The option was previously silently dropped between the two layers, so it only took effect when set on the <code>PyJWT</code> instance. <em>Thanks to <a href="https://github.com/WLUB"><code>@WLUB</code></a> for the report.</em></li> <li><strong>RFC 7797 §3 compliance for <code>b64=false</code>:</strong> the encoder now auto-adds <code>"b64"</code> to <code>crit</code>, and the decoder rejects tokens that set <code>b64=false</code> without listing it in <code>crit</code>. <em>Thanks to <a href="https://github.com/MachineLearning-Nerd"><code>@MachineLearning-Nerd</code></a> for the report.</em></li> </ul> <h2>Changed</h2> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups, by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1152">#1152</a>.</li> </ul> <h2>Upgrade notes</h2> <p>Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:</p> <ul> <li><strong>Empty HMAC keys now raise.</strong> If your app passed <code>""</code> or <code>b""</code> as a secret (often via a missing env var, e.g. <code>os.getenv("JWT_SECRET", "")</code>), <code>encode</code>/<code>decode</code> will now raise <code>InvalidKeyError</code>. This is the intended behavior — fix the configuration.</li> <li><strong><code>PyJWK</code> decoding now requires the token's <code>alg</code> to match the JWK's algorithm.</strong> Previously a mismatch was silently honored if the header <code>alg</code> appeared in the allow-list. Tokens that relied on this mismatch will now fail with <code>InvalidAlgorithmError</code>.</li> <li><strong><code>PyJWKClient</code> now rejects non-HTTP(S) URIs at construction time.</strong> Tests or dev environments that fetched JWKS from <code>file://</code> URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct <code>PyJWKSet.from_dict(...)</code> directly).</li> <li><strong><code>b64=false</code> tokens are now strictly RFC 7515 / 7797 compliant.</strong> Tokens with a non-empty compact-form payload segment, or that omit <code>"b64"</code> from <code>crit</code>, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.</li> <li><strong><code>enforce_minimum_key_length</code> set per-call now takes effect.</strong> Callers who passed <code>options={"enforce_minimum_key_length": True}</code> to <code>jwt.decode()</code> previously got no enforcement; they will now get <code>InvalidKeyError</code> on undersized keys, as documented.</li> </ul> <p><strong>Full changelog:</strong> <a href="https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0">https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0</a></p> <h2>2.12.1</h2> <h2>What's Changed</h2> <ul> <li>Add typing_extensions dependency for Python < 3.11 by <a href="https://github.com/jpadilla"><code>@jpadilla</code></a> in <a href="https://redirect.github.com/jpadilla/pyjwt/pull/1151">jpadilla/pyjwt#1151</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1">https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0></code>__</h2> <p>Security</p> <pre><code> - Reject JWK JSON documents passed as raw HMAC secrets in ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that the existing PEM/SSH guard did not cover. Reported by @aradona91 in `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__. - Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during verification so the caller's ``algorithms=[...]`` allow-list cannot be bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__. - Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker- influenced URIs cannot read local files or reach unintended schemes via urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__. - Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``. The previous ``finally``-block ``put(None)`` pattern cleared the cache on any transient outage, turning one bad JWKS request into application- wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__. - Skip the unconditional base64 decode of the compact-form payload segment when ``b64=false`` is set in the protected header, and require that segment to be empty (RFC 7515 Appendix F detached form). Closes an unauthenticated DoS amplifier. Reported by @thesmartshadow in `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__. <p>Fixed</p> <pre><code> - Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with ``InvalidKeyError`` instead of accepting them with only a warning. Thanks to @SnailSploit and @spartan8806 for independently flagging the footgun. - Forward per-call ``options`` (including ``enforce_minimum_key_length``) from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the option actually takes effect when set at the call site rather than only on the ``PyJWT`` instance. Thanks to @WLUB for the report. - RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects tokens that set ``b64=false`` without listing it in ``crit``. Thanks to @MachineLearning-Nerd for the report. Changed </code></pre> <ul> <li>Migrate the <code>dev</code>, <code>docs</code>, and <code>tests</code> package extras to dependency groups by <a href="https://github.com/kurtmckee"><code>@kurtmckee</code></a> in <code>[#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;</code>__</li> </ul> <p><code>v2.12.1 &lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1&gt;</code>__ </tr></table> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
e0a455995f |
Bump mypy from 1.20.0 to 2.0.0 in /backend (#1709)
Bumps [mypy](https://github.com/python/mypy) from 1.20.0 to 2.0.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's changelog</a>.</em></p> <blockquote> <h1>Mypy Release Notes</h1> <h2>Next Release</h2> <h2>Mypy 2.1</h2> <p>We’ve just uploaded mypy 2.1.0 to the Python Package Index (<a href="https://pypi.org/project/mypy/">PyPI</a>). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:</p> <pre><code>python3 -m pip install -U mypy </code></pre> <p>You can read the full documentation for this release on <a href="http://mypy.readthedocs.io">Read the Docs</a>.</p> <h3>librt.vecs: Fast Growable Array Type for Mypyc</h3> <p>The new <code>librt.vecs</code> module provides an efficient growable array type <code>vec</code> that is optimized for mypyc use. It provides fast, packed arrays with integer and floating point value types, which can be <strong>several times faster</strong> than <code>list</code>, and tens of times faster than <code>array.array</code> in code compiled using mypyc. It also supports nested <code>vec</code> objects and non-value-type items, such as <code>vec[vec[str]]</code>.</p> <p>Refer to the <a href="https://mypyc.readthedocs.io/en/latest/librt_vecs.html">documentation</a> for the details.</p> <p>Contributed by Jukka Lehtosalo.</p> <h3>librt.random: Fast Pseudo-Random Number Generation</h3> <p>The new <code>librt.random</code> module provides fast pseudo-random number generation that is optimized for code compiled using mypyc. It can be 3x to 10x faster than the stdlib <code>random</code> module in compiled code.</p> <p>Refer to the <a href="https://mypyc.readthedocs.io/en/latest/librt_random.html">documentation</a> for the details.</p> <p>Contributed by Jukka Lehtosalo (PR <a href="https://redirect.github.com/python/mypy/pull/21433">21433</a>).</p> <h3>Mypyc Improvements</h3> <ul> <li>Enable incremental self-compilation (Vaggelis Danias, PR <a href="https://redirect.github.com/python/mypy/pull/21369">21369</a>)</li> <li>Make compilation order with multiple files consistent (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21419">21419</a>)</li> <li>Fix crash on accessing <code>StopAsyncIteration</code> (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21406">21406</a>)</li> <li>Fix incremental compilation with <code>separate</code> flag (Vaggelis Danias, PR <a href="https://redirect.github.com/python/mypy/pull/21299">21299</a>)</li> </ul> <h3>Fixes to Crashes</h3> <ul> <li>Fix crash on partial type with <code>--allow-redefinition</code> and <code>global</code> declaration (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21428">21428</a>)</li> <li>Fix broken awaitable generator patching (Ivan Levkivskyi, PR <a href="https://redirect.github.com/python/mypy/pull/21435">21435</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
4f1dc6ae80 |
Bump pyrefly from 0.63.1 to 0.64.1 in /backend (#1710)
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 0.63.1 to 0.64.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/pyrefly/releases">pyrefly's releases</a>.</em></p> <blockquote> <h2>Pyrefly v0.64.1</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/facebook/pyrefly/compare/0.64.0...0.64.1">https://github.com/facebook/pyrefly/compare/0.64.0...0.64.1</a></p> <h2>Pyrefly v0.64.0</h2> <p><strong>Status : BETA</strong> <em>Release date: May 05, 2026</em></p> <p>Pyrefly v0.64.0 bundles <strong>190 commits</strong> from <strong>20 contributors</strong>.</p> <hr /> <h2>✨ New & Improved</h2> <table> <thead> <tr> <th>Area</th> <th>What's new</th> </tr> </thead> <tbody> <tr> <td><strong>Type Checking</strong></td> <td>- You can now pass generic or overloaded callables to higher-order functions and Pyrefly will preserve their structure in the return type. For example, <code>identity(identity)</code> now correctly returns a generic callable instead of degrading to <code>Unknown</code>. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Same-scope class rebinds (like <code>Real = Dummy</code> after <code>class Real</code>) are now checked against the original class as if it were an implicit <code>type[Real]</code> annotation, preventing silent type changes and fixing spurious constructor-call errors. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Generic classes with missing type arguments in lax mode now default to <code>Any</code> instead of raising variance errors, improving consistency with how we handle other incomplete types. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Pydantic <code>field_validator</code> decorators with <code>mode='before'</code> and <code>mode='plain'</code> are now supported, allowing validators to accept broader input types before coercion. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Spurious unpack diagnostics are no longer emitted when the right-hand side involves <code>Never</code> (e.g. <code>a, b, c = never()</code> or <code>a, b = (never(), 1)</code>). The unpack solver is now <code>Never</code>-aware, recognizing that the producing expression cannot complete and any error message at the unpack site would be misleading. <!-- raw HTML omitted --><!-- raw HTML omitted -->- <code>assert</code> statements now check that <code>__bool__</code> is callable on the test expression, matching the behavior already in place for <code>if</code>, <code>while</code>, and ternary expressions (and aligning with mypy and pyright).</td> </tr> <tr> <td><strong>Language Server</strong></td> <td>- The language server now advertises both <code>source.fixAll</code> and <code>source.fixAll.pyrefly</code> code action kinds, enabling selective fix-on-save configuration across editors that implement the LSP protocol. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Document highlights now correctly distinguish between read and write references, setting <code>DocumentHighlightKind::WRITE</code> for assignments and declarations. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Go-to-definition on relative imports in site-packages files now correctly resolves to the package source instead of returning null when a <code>pyproject.toml</code> exists at the project root. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Notebook cell index resolution has been fixed to prevent mismatches between code cells and markdown cells, eliminating panics and incorrect byte offset calculations in Jupyter notebooks. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Cross-module "find references" (external references) is now enabled by default, returning references across the entire project rather than just the current file. <!-- raw HTML omitted --><!-- raw HTML omitted -->- A new quick fix turns the existing "Did you mean <code>Foo.BAR</code>?" diagnostic note for missing enum members into a code action that replaces the offending string literal with the proper enum member access. <!-- raw HTML omitted --><!-- raw HTML omitted -->- A new <code># pyrefly: ignore</code> quick fix inserts a suppression comment for the diagnostic at the cursor, automatically merging into an existing pyrefly-ignore directive on the same line or on a comment-only line above when present. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Numeric parameter defaults now preserve their source spelling (e.g. <code>0o777</code>, <code>0xFF</code>, <code>0b101</code>) in hover and signature display rather than being normalized to decimal. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Code actions documentation has been added to the IDE Supported Features page, covering quick fixes and <code>source.fixAll.pyrefly</code> configuration.</td> </tr> <tr> <td><strong>Onboarding & VS Code Extension</strong></td> <td>- A redesigned unconfigured-project experience: when no <code>pyrefly.toml</code> is found, Pyrefly auto-detects nearby <code>mypy.ini</code>, <code>pyrightconfig.json</code>, or <code>[tool.mypy]</code>/<code>[tool.pyright]</code> sections in <code>pyproject.toml</code> and synthesizes an in-memory configuration migrated from those settings (using the <code>legacy</code> or <code>default</code> preset respectively). With no detectable configuration, the new <code>basic</code> preset is used. <!-- raw HTML omitted --><!-- raw HTML omitted -->- A new <code>python.pyrefly.typeCheckingMode</code> workspace setting (auto / off / basic / legacy / default / strict, default <code>auto</code>) lets users pick a preset for files not covered by an explicit Pyrefly configuration, directly from the VS Code settings UI. The legacy <code>python.pyrefly.displayTypeErrors</code> setting is now deprecated, with values transparently mapped to the new model. <!-- raw HTML omitted --><!-- raw HTML omitted -->- A new <code>python.pyrefly.disableTypeErrors</code> workspace setting provides a clean per-workspace kill switch for diagnostics, independent of the type-checking mode. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The VS Code status bar has been redesigned: it now shows the active preset (e.g. "Pyrefly (Legacy)", "Pyrefly (Basic)") and the tooltip explains why that preset was chosen and links to the relevant docs. <!-- raw HTML omitted --><!-- raw HTML omitted -->- After a <code>pyrefly check</code> on an unconfigured project, the CLI now prints a short upsell to <strong>stderr</strong> explaining what configuration was synthesized and pointing at <code>pyrefly init</code>. The message is routed to stderr so machine-readable stdout formats (e.g. <code>--output-format json</code>) remain untouched.</td> </tr> <tr> <td><strong>Configuration</strong></td> <td>- Configuration presets (<code>off</code>, <code>basic</code>, <code>legacy</code>, <code>default</code>, <code>strict</code>) are now available via the <code>preset</code> option, providing named collections of error severities and behavior settings as a base configuration that user settings can override. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The <code>legacy</code> preset is now used by <code>pyrefly init</code> for mypy migration, disabling checks mypy doesn't have and setting looser inference defaults. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The <code>implicit-any</code> error code has been split into sub-kinds (<code>implicit-any-attribute</code>, <code>implicit-any-empty-container</code>, <code>implicit-any-parameter</code>, <code>implicit-any-type-argument</code>) with <code>implicit-any</code> as the parent, allowing finer-grained control over where implicit <code>Any</code> is flagged. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The <code>unbound-name</code> error is now disabled in the <code>legacy</code> preset to match mypy's default behavior, which does not flag possibly-undefined variables.</td> </tr> <tr> <td><strong>Error Reporting</strong></td> <td>- A new <code>incompatible-overload-residual</code> error kind has been introduced for cases where all branches of an overloaded callable are pruned during higher-order function analysis, making it easier to configure these errors independently. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Error messages for all-pruned overload residuals now describe the incompatibility in terms of "solved type variables" rather than "solved type constraints" for better clarity. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The <code>pyrefly suppress</code> command now correctly handles removal of unused ignores via the <code>--remove-unused</code> flag, which was previously broken.</td> </tr> <tr> <td><strong>Factory Boy Support</strong></td> <td>- Pyrefly now infers the correct model return types for <code>create()</code>, <code>build()</code>, <code>create_batch()</code>, and <code>build_batch()</code> methods on <code>DjangoModelFactory</code> subclasses by reading the inner <code>Meta.model</code> attribute. <!-- raw HTML omitted --><!-- raw HTML omitted -->- False-positive <code>bad-override</code> errors on the inner <code>Meta</code> class in factory-boy factories are now suppressed, matching how we handle Django and Marshmallow.</td> </tr> <tr> <td><strong>Reporting</strong></td> <td>- The <code>pyrefly report</code> JSON output now includes a <code>path</code> field on each <code>ModuleReport</code>, for compatibility with typestats and similar tooling.</td> </tr> <tr> <td><strong>Performance</strong></td> <td>- Deeply-nested dict literals no longer cause exponential memory growth during type inference. A depth-25 dict literal that previously consumed ~7.7 GB now uses ~239 MB by computing the union of field types on demand instead of storing it redundantly. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Callable residual finalization has been optimized to avoid redundant type cloning and traversals, reducing memory churn in attribute-heavy code. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Eliminated some bugs that caused Pyrefly to unnecessarily analyze dependencies, improving latency and memory use, especially in the IDE.</td> </tr> </tbody> </table> <hr /> <h2>🐛 bug fixes</h2> <p>We closed <strong>15</strong> bug issues this release 👏</p> <ul> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3057">#3057</a>: Fixed an issue where string concatenation with the <code>+</code> operator was incorrectly flagging <code>str</code> as not assignable to <code>LiteralString</code> attributes. Pyrefly now preserves <code>LiteralString</code> style when adding two explicit string literals and uses implicit style otherwise.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/105">#105</a>: Fixed premature type pinning in function calls where arguments were incorrectly narrowed before all constraints were solved. For example, <code>foo(x, y)</code> with <code>x: int | None</code> and <code>y: int | None</code> no longer incorrectly narrows <code>x</code> to <code>None</code> when passed to a generic <code>foo[T](https://github.com/facebook/pyrefly/blob/HEAD/a: T, b: T)</code>.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3198">#3198</a>: Fixed <code>pyrefly suppress --remove-unused</code> which was not actually removing unused error suppressions. The command now correctly processes the <code>--remove-unused</code> flag.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3024">#3024</a>: The language server now advertises <code>source.fixAll.pyrefly</code> in addition to <code>source.fixAll</code>, allowing users to selectively enable or disable Pyrefly's fix-all actions in editors that support LSP code action kinds.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2819">#2819</a>: Fixed incorrect variance errors when using generic classes like Pydantic's <code>RootModel</code> in lax mode. Missing type arguments now degrade to <code>Any</code> instead of raising errors, matching our handling of other incomplete types.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3000">#3000</a>: Fixed "find references" failures in Cursor and other editors caused by relative imports in site-packages not resolving correctly when a <code>pyproject.toml</code> existed at the project root.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2563">#2563</a>: Fixed go-to-definition on relative imports in virtual environment site-packages, which was returning null because the project root's import path was matching before the more specific site-package prefix.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3193">#3193</a>: Fixed an error where <code>list["A|B"]</code> was incorrectly rejected as <code>not-a-type</code>. Type argument subscripts are now bound as type expressions even in value context, allowing forward-ref strings to be parsed.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3286">#3286</a>: Fixed exponential memory blowup when type-checking deeply-nested dict literals, which could cause VSCode to be killed by the OS. Memory usage for a depth-25 dict dropped from ~7.7 GB to ~239 MB.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3261">#3261</a>: Fixed a false positive <code>bad-class-definition</code> when a dataclass field was assigned inside a <code>@classmethod</code> or <code>__init_subclass__</code>. Pyrefly was incorrectly extracting these as dataclass fields, even though Python's <code>dataclasses.dataclass</code> ignores them at runtime.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2914">#2914</a>: <code>assert</code> statements now flag a non-callable <code>__bool__</code> on the test expression, closing a gap that previously only caught the issue inside <code>if</code>, <code>while</code>, and ternary expressions.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2867">#2867</a>: Fixed <code>urlunparse</code> being inferred as returning <code>Literal[b'']</code> instead of <code>str</code>. The fix reworks <code>as_superclass</code> so tuple-like <code>NamedTuple</code> subclasses are upcast through their erased tuple element types, which stops <code>ParseResult</code> from spuriously matching <code>Iterable[None]</code> and selecting the bytes overload.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3266">#3266</a>: Added a quick fix for the existing "Did you mean <code>Foo.BAR</code>?" diagnostic note for missing enum members, turning the suggestion into a code action that rewrites the surrounding string literal.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3230">#3230</a>: Numeric parameter defaults now preserve their original spelling (e.g. <code>0o777</code>) in hover and signature display rather than being normalized to a decimal value.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3302">#3302</a>: Added a <code>path</code> field to the <code>pyrefly report</code> JSON <code>ModuleReport</code>, restoring compatibility with typestats.</li> </ul> <p>Thank-you to all our contributors who found these bugs and reported them! Did you know this is one of the most helpful contributions you can make to an open-source project? If you find any bugs in Pyrefly we want to know about them! Please open a bug report issue <a href="https://github.com/facebook/pyrefly/issues">here</a></p> <hr /> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
9a47d9cf6a |
Bump gunicorn from 25.3.0 to 26.0.0 in /backend (#1708)
Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 25.3.0 to 26.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/benoitc/gunicorn/releases">gunicorn's releases</a>.</em></p> <blockquote> <h2>26.0.0</h2> <h2>Breaking Changes</h2> <ul> <li><strong>Eventlet worker removed</strong>: The <code>eventlet</code> worker class has been dropped. Migrate to <code>gevent</code>, <code>gthread</code>, or <code>tornado</code>.</li> </ul> <h2>New Features</h2> <ul> <li><strong>ASGI Framework Compatibility Suite</strong>: New end-to-end compatibility test harness covering Starlette, FastAPI, Litestar, Quart, Sanic, and BlackSheep. Current grid passes 438/444 tests (98%).</li> <li><strong>ASGI Test Suite Expansion</strong>: 134 additional ASGI unit tests covering protocol semantics, lifespan, websockets, and chunked framing.</li> </ul> <h2>Security</h2> <ul> <li><strong>HTTP/1.1 Request-Target Validation</strong> (RFC 9112 sections 3.2.3, 3.2.4): <ul> <li>Reject <code>authority-form</code> request-target outside <code>CONNECT</code></li> <li>Reject <code>asterisk-form</code> request-target outside <code>OPTIONS</code></li> <li>Reject <code>relative-reference</code> request-targets</li> </ul> </li> <li><strong>Header Field Hardening</strong> (RFC 9110): <ul> <li>Reject control characters in header field-value (section 5.5)</li> <li>Reject forbidden trailer field-names (section 6.5.1)</li> <li>Reject <code>Content-Length</code> list form (RFC 9112 section 6.3)</li> </ul> </li> <li><strong>Request Smuggling Hardening</strong>: <ul> <li>Tighten keepalive gate and scope <code>finish_body</code> byte cap</li> <li>Keep <code>_body_receiver</code> alive across the keepalive smuggling gate so pipelined requests cannot re-enter a closed body</li> <li>Address parser/protocol findings from a six-point WSGI/ASGI audit</li> </ul> </li> <li><strong>PROXY Protocol (ASGI)</strong>: Enforce <code>proxy_allow_ips</code> and tighten v1/v2 parsing in the ASGI callback parser.</li> <li><strong>Connection Draining</strong>: Drain the connection on close per RFC 9112 section 9.6 to prevent reset-on-close truncation.</li> </ul> <h2>Bug Fixes</h2> <ul> <li><strong>Body Framing on HEAD/204/304</strong>: <ul> <li>Keep <code>Content-Length</code> on HEAD and 304 responses (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3621">#3621</a>)</li> <li>Drop body framing on HEAD/204/304 even when the framework set it</li> <li>Warn once when an ASGI app emits a body for a no-body response</li> </ul> </li> <li><strong>HTTP/2 ASGI</strong>: <ul> <li>Fix <code>_handle_stream_ended</code> to set <code>_body_complete</code> in the async HTTP/2 handler so request bodies finalize correctly on stream end</li> <li>Add <code>InvalidChunkExtension</code> mapping and fast-parser support in ASGI tests (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3565">#3565</a>)</li> </ul> </li> <li><strong>HTTP/1.1 100-Continue</strong>: Stop adding <code>Transfer-Encoding: chunked</code> to 100-Continue interim responses.</li> <li><strong>WebSocket Close Handshake</strong> (RFC 6455): <ul> <li>Comply with the close handshake state machine</li> <li>Close the transport after the close handshake completes</li> <li>Fix binary send when the <code>text</code> key is <code>None</code></li> </ul> </li> <li><strong>Early Hints</strong>: Validate headers in the <code>early_hints</code> callback to match <code>process_headers</code>; pass only the header name to <code>InvalidHeader</code> (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3588">#3588</a>).</li> <li><strong>ASGI Framework Fixes</strong>: <ul> <li>Fix ASGI disconnect handling for Django-style apps</li> <li>Fix Litestar request handling (use raw ASGI receive for body/headers)</li> <li>Fix Litestar HTTP endpoints for compatibility tests</li> <li>Fix Quart headers endpoint to normalize keys to lowercase</li> <li>Fix Quart WebSocket close test app (missing <code>accept()</code>)</li> <li>Fix duplicate <code>Transfer-Encoding</code> header for BlackSheep streaming</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
280a573976 |
Bump starlette from 1.0.0 to 1.0.1 in /backend (#1706)
Bumps [starlette](https://github.com/Kludex/starlette) from 1.0.0 to 1.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.0.1</h2> <h2>What's Changed</h2> <ul> <li>Ignore malformed <code>Host</code> header when constructing <code>request.url</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3279">Kludex/starlette#3279</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.0.0...1.0.1">https://github.com/Kludex/starlette/compare/1.0.0...1.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.0.1 (May 21, 2026)</h2> <h4>Fixed</h4> <ul> <li>Ignore malformed <code>Host</code> header when constructing <code>request.url</code> <a href="https://redirect.github.com/encode/starlette/pull/3279">#3279</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
0b8e32af0a |
Bump sentry-sdk from 2.58.0 to 2.59.0 in /backend (#1704)
Bumps [sentry-sdk](https://github.com/getsentry/sentry-python) from 2.58.0 to 2.59.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's releases</a>.</em></p> <blockquote> <h2>2.59.0</h2> <h3>New Features ✨</h3> <h4>Langchain</h4> <ul> <li>Record <code>run_name</code> as <code>gen_ai.function_id</code> on Invoke Agent Spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5926">#5926</a></li> <li>Record <code>run_name</code> in <code>on_tool_start</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5925">#5925</a></li> <li>Record <code>run_name</code> in <code>on_chat_model_start</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5924">#5924</a></li> </ul> <h4>Other</h4> <ul> <li>(ci) Cancel in-progress PR workflows on new commit push by <a href="https://github.com/joshuarli"><code>@joshuarli</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5994">#5994</a></li> <li>(consts) Add updated span convention constants to SPANDATA by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6093">#6093</a></li> <li>(fastapi) Support span streaming in active thread tracking by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6118">#6118</a></li> <li>(httpx) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6084">#6084</a></li> <li>(huggingface_hub) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6124">#6124</a></li> <li>(mcp) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6131">#6131</a></li> <li>Add <code>db.driver.name</code> spans to database integrations by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6082">#6082</a></li> </ul> <h3>Bug Fixes 🐛</h3> <p>We've put additional data that might contain sensitive information, like GraphQL documents, behind the <code>send_default_pii</code> option.</p> <h4>Httpx</h4> <ul> <li>Consistently early-exit when adding request source by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6151">#6151</a></li> <li>Set <code>code.namespace</code> and <code>code.function</code> instead of <code>code.function.name</code> in span streaming by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6150">#6150</a></li> </ul> <h4>Langchain</h4> <ul> <li>Record <code>run_name</code> as <code>gen_ai.function_id</code> for text completions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6073">#6073</a></li> <li>Set agent name as <code>gen_ai.agent.name</code> for chat and tool spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5877">#5877</a></li> </ul> <h4>Other</h4> <ul> <li>(asgi) Use <code>inspect.iscoroutinefunction</code> on Python 3.14+ by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6135">#6135</a></li> <li>(batcher) Reset lock and flusher in child after fork by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6163">#6163</a></li> <li>(google_genai) Redact binary data in inline_data and fix multi-part message extraction by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5977">#5977</a></li> <li>(grpc) Add isolation_scope to async server interceptor by <a href="https://github.com/robinvd"><code>@robinvd</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5940">#5940</a></li> <li>(metrics,logs) Don't attach <code>span_id</code> if no active span by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6162">#6162</a></li> <li>(monitor) Release <code>Monitor._thread_lock</code> after fork (<a href="https://redirect.github.com/getsentry/sentry-python/issues/6148">#6148</a>) by <a href="https://github.com/vokracko"><code>@vokracko</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6159">#6159</a></li> <li>(openai-agents) Resolve agent from <code>bindings</code> for openai-agents >= 0.14 by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6102">#6102</a></li> <li>(profiler) Stop nulling buffer on teardown by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6075">#6075</a></li> <li>(quart) Use <code>inspect.iscoroutinefunction</code> when Quart does by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6133">#6133</a></li> <li>(security) Prevent GitHub script injection in update-tox workflow by <a href="https://github.com/fix-it-felix-sentry"><code>@fix-it-felix-sentry</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6171">#6171</a></li> <li>(starlette/fastapi) Use <code>inspect.iscoroutinefunction</code> when Starlette does by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6134">#6134</a></li> <li>(tornado) Make sure context manager doesn't double yield by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6152">#6152</a></li> <li>Introduce <code>_get_current_streamed_span()</code> to keep types backwards compatible by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6177">#6177</a></li> </ul> <h3>Internal Changes 🔧</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md">sentry-sdk's changelog</a>.</em></p> <blockquote> <h2>2.59.0</h2> <h3>New Features ✨</h3> <h4>Langchain</h4> <ul> <li>Record <code>run_name</code> as <code>gen_ai.function_id</code> on Invoke Agent Spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5926">#5926</a></li> <li>Record <code>run_name</code> in <code>on_tool_start</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5925">#5925</a></li> <li>Record <code>run_name</code> in <code>on_chat_model_start</code> by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5924">#5924</a></li> </ul> <h4>Other</h4> <ul> <li>(ci) Cancel in-progress PR workflows on new commit push by <a href="https://github.com/joshuarli"><code>@joshuarli</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5994">#5994</a></li> <li>(consts) Add updated span convention constants to SPANDATA by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6093">#6093</a></li> <li>(fastapi) Support span streaming in active thread tracking by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6118">#6118</a></li> <li>(httpx) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6084">#6084</a></li> <li>(huggingface_hub) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6124">#6124</a></li> <li>(mcp) Migrate to span first by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6131">#6131</a></li> <li>Add <code>db.driver.name</code> spans to database integrations by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6082">#6082</a></li> </ul> <h3>Bug Fixes 🐛</h3> <p>We've put additional data that might contain sensitive information, like GraphQL documents, behind the <code>send_default_pii</code> option.</p> <h4>Httpx</h4> <ul> <li>Consistently early-exit when adding request source by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6151">#6151</a></li> <li>Set <code>code.namespace</code> and <code>code.function</code> instead of <code>code.function.name</code> in span streaming by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6150">#6150</a></li> </ul> <h4>Langchain</h4> <ul> <li>Record <code>run_name</code> as <code>gen_ai.function_id</code> for text completions by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6073">#6073</a></li> <li>Set agent name as <code>gen_ai.agent.name</code> for chat and tool spans by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5877">#5877</a></li> </ul> <h4>Other</h4> <ul> <li>(asgi) Use <code>inspect.iscoroutinefunction</code> on Python 3.14+ by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6135">#6135</a></li> <li>(batcher) Reset lock and flusher in child after fork by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6163">#6163</a></li> <li>(google_genai) Redact binary data in inline_data and fix multi-part message extraction by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5977">#5977</a></li> <li>(grpc) Add isolation_scope to async server interceptor by <a href="https://github.com/robinvd"><code>@robinvd</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/5940">#5940</a></li> <li>(metrics,logs) Don't attach <code>span_id</code> if no active span by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6162">#6162</a></li> <li>(monitor) Release <code>Monitor._thread_lock</code> after fork (<a href="https://redirect.github.com/getsentry/sentry-python/issues/6148">#6148</a>) by <a href="https://github.com/vokracko"><code>@vokracko</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6159">#6159</a></li> <li>(openai-agents) Resolve agent from <code>bindings</code> for openai-agents >= 0.14 by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6102">#6102</a></li> <li>(profiler) Stop nulling buffer on teardown by <a href="https://github.com/ericapisani"><code>@ericapisani</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6075">#6075</a></li> <li>(quart) Use <code>inspect.iscoroutinefunction</code> when Quart does by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6133">#6133</a></li> <li>(security) Prevent GitHub script injection in update-tox workflow by <a href="https://github.com/fix-it-felix-sentry"><code>@fix-it-felix-sentry</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6171">#6171</a></li> <li>(starlette/fastapi) Use <code>inspect.iscoroutinefunction</code> when Starlette does by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6134">#6134</a></li> <li>(tornado) Make sure context manager doesn't double yield by <a href="https://github.com/sentrivana"><code>@sentrivana</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6152">#6152</a></li> <li>Introduce <code>_get_current_streamed_span()</code> to keep types backwards compatible by <a href="https://github.com/alexander-alderman-webb"><code>@alexander-alderman-webb</code></a> in <a href="https://redirect.github.com/getsentry/sentry-python/pull/6177">#6177</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
119d097795 |
Bump pyrefly from 0.62.0 to 0.63.1 in /backend (#1703)
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 0.62.0 to 0.63.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/pyrefly/releases">pyrefly's releases</a>.</em></p> <blockquote> <h2>Pyrefly v0.63.1</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/facebook/pyrefly/compare/0.63.0...0.63.1">https://github.com/facebook/pyrefly/compare/0.63.0...0.63.1</a></p> <h2>Pyrefly v0.63.0</h2> <p><strong>Status : BETA</strong> <em>Release date: April 27, 2026</em></p> <p>Pyrefly v0.63.0 bundles <strong>129 commits</strong> from <strong>26 contributors</strong>.</p> <hr /> <h2>✨ New & Improved</h2> <table> <thead> <tr> <th>Area</th> <th>What's new</th> </tr> </thead> <tbody> <tr> <td><strong>Type Checking</strong></td> <td>- Enum member types are preserved even when the metaclass conflicts with <code>EnumMeta</code>, reducing noise in projects using custom metaclasses with enums. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Constrained <code>TypeVar</code>s no longer get pinned to a specific constraint when matched against <code>Any</code>, preventing false positives. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Self/cls annotations on all methods and classmethods are validated to ensure they reference the defining class or a superclass, catching more annotation errors.</td> </tr> <tr> <td><strong>Language Server</strong></td> <td>- The LSP now reports <code>unused-ignore</code> diagnostics when configured to do so, helping you clean up stale suppression comments. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Completions for attribute override definitions are available in class bodies, surfacing base-class members filtered by fuzzy match. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The LSP server no longer crashes on Jupyter notebook cell URIs (<code>vscode-notebook-cell:</code>), with full support for resolving notebook cell paths and position offsets. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Workspace symbol search uses the correct location for re-exported symbols, preventing panics on multi-byte UTF-8 characters. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Inlay hints are clickable for built-in types like <code>tuple</code>, <code>dict</code>, and <code>str</code>, enabling go-to-definition directly from hint overlays.</td> </tr> <tr> <td><strong>Error Messages</strong></td> <td>- A new <code>unnecessary-type-conversion</code> lint warns when <code>str()</code>, <code>int()</code>, or <code>float()</code> is called on an argument that is already of that exact type.</td> </tr> <tr> <td><strong>Reporting & Coverage</strong></td> <td>- Public symbol filtering is available via <code>pyrefly report --public-only</code>, using cross-module tracing to report only public symbols.</td> </tr> <tr> <td><strong>Performance</strong></td> <td>- TypedDict subset checks are now cached on the Solver, reducing CPU time by ~5.3x and wall time by ~6.7x on pydantic (from 9.5s to 1.4s).</td> </tr> <tr> <td><strong>Configuration & Initialization</strong></td> <td>- <code>pyrefly init</code> supports <code>--dry-run</code> for safe previews without writing files, and <code>--print-config</code> for machine-readable TOML output.</td> </tr> </tbody> </table> <hr /> <h2>🐛 bug fixes</h2> <p>We closed <strong>9</strong> bug issues this release 👏</p> <ul> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3099">#3099</a>: Fixed an issue where property setters and deleters inflated typable counts in <code>pyrefly report</code> by incorrectly counting their trivial <code>-> None</code> return types.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3098">#3098</a>: Fixed an issue where overloads in <code>pyrefly report</code> were not deduplicated, causing parameters and callable signatures to be counted multiple times and inflate coverage metrics.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3067">#3067</a>: Fixed an issue where the type display path was dropping the unpack marker (<code>*</code>) for direct <code>TypeVarTuple</code> arguments, causing <code>Shape</code> to render bare instead of <code>*Shape</code>.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3040">#3040</a>: Fixed an issue where properties on metaclasses were not taking precedence over properties on the class during class-level attribute access, causing false <code>bad-assignment</code> and <code>bad-return</code> errors.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3150">#3150</a>: Fixed an issue where type aliases were inflating type coverage in <code>pyrefly report</code> by being counted as typable entities.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3041">#3041</a>: Fixed a panic during workspace/symbol requests on re-exported symbols with multi-byte UTF-8 characters, caused by using the canonical module's byte offset against the re-exporting file's buffer.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3109">#3109</a>: Added a new <code>unnecessary-type-conversion</code> lint that warns when <code>str()</code>, <code>int()</code>, or <code>float()</code> is called on an argument that is already of that exact type, making the conversion redundant.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3187">#3187</a>: Fixed a panic in <code>pyrefly report</code> when <code>@no_type_check</code> decorator was used, caused by a missing key lookup for skipped parameter annotations.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3090">#3090</a>: Improved the unused-coroutine error message when an <code>await</code> expression already has <code>await</code> but produces a coroutine due to an incorrect return type annotation on the function definition.</li> </ul> <p>Thank-you to all our contributors who found these bugs and reported them! Did you know this is one of the most helpful contributions you can make to an open-source project? If you find any bugs in Pyrefly we want to know about them! Please open a bug report issue <a href="https://github.com/facebook/pyrefly/issues">here</a></p> <hr /> <h2>📦 Upgrade</h2> <pre lang="bash"><code>pip install --upgrade pyrefly==0.63.0 </code></pre> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
6b4fbb0fbe |
Bump node from 25-alpine to 26-alpine (#1699)
Bumps node from 25-alpine to 26-alpine. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
1e1e1788e6 |
Bump uvicorn from 0.44.0 to 0.46.0 in /backend (#1698)
Bumps [uvicorn](https://github.com/Kludex/uvicorn) from 0.44.0 to 0.46.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/releases">uvicorn's releases</a>.</em></p> <blockquote> <h2>Version 0.46.0</h2> <h2>What's Changed</h2> <ul> <li>Support <code>ws_max_size</code> in <code>wsproto</code> implementation by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2915">Kludex/uvicorn#2915</a></li> <li>Support <code>ws_ping_interval</code> and <code>ws_ping_timeout</code> in <code>wsproto</code> implementation by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2916">Kludex/uvicorn#2916</a></li> <li>Use <code>bytearray</code> for incoming WebSocket message buffer in websockets-sansio by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2917">Kludex/uvicorn#2917</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/uvicorn/compare/0.45.0...0.46.0">https://github.com/Kludex/uvicorn/compare/0.45.0...0.46.0</a></p> <h2>Version 0.45.0</h2> <h2>What's Changed</h2> <ul> <li>Preserve forwarded client ports in proxy headers middleware by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2903">Kludex/uvicorn#2903</a></li> <li>Accept <code>os.PathLike</code> for <code>log_config</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2905">Kludex/uvicorn#2905</a></li> <li>Accept <code>log_level</code> strings case-insensitively by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2907">Kludex/uvicorn#2907</a></li> <li>Raise helpful <code>ImportError</code> when PyYAML is missing for YAML log config by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2906">Kludex/uvicorn#2906</a></li> <li>Revert empty context for ASGI runs by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2911">Kludex/uvicorn#2911</a></li> <li>Add <code>--reset-contextvars</code> flag to isolate ASGI request context by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2912">Kludex/uvicorn#2912</a></li> <li>Revert "Emit <code>http.disconnect</code> on server shutdown for streaming responses" (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2829">#2829</a>) by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2913">Kludex/uvicorn#2913</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Krishnachaitanyakc"><code>@Krishnachaitanyakc</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/uvicorn/pull/2870">Kludex/uvicorn#2870</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/uvicorn/compare/0.44.0...0.45.0">https://github.com/Kludex/uvicorn/compare/0.44.0...0.45.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md">uvicorn's changelog</a>.</em></p> <blockquote> <h2>0.46.0 (April 23, 2026)</h2> <h3>Added</h3> <ul> <li>Support <code>ws_max_size</code> in <code>wsproto</code> implementation (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2915">#2915</a>)</li> <li>Support <code>ws_ping_interval</code> and <code>ws_ping_timeout</code> in <code>wsproto</code> implementation (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2916">#2916</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Use <code>bytearray</code> for incoming WebSocket message buffer in <code>websockets-sansio</code> (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2917">#2917</a>)</li> </ul> <h2>0.45.0 (April 21, 2026)</h2> <h3>Added</h3> <ul> <li>Add <code>--reset-contextvars</code> flag to isolate ASGI request context (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2912">#2912</a>)</li> <li>Accept <code>os.PathLike</code> for <code>log_config</code> (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2905">#2905</a>)</li> <li>Accept <code>log_level</code> strings case-insensitively (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2907">#2907</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Revert "Emit <code>http.disconnect</code> on server shutdown for streaming responses" (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2913">#2913</a>)</li> <li>Revert "Explicitly start ASGI run with empty context" (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2911">#2911</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Preserve forwarded client ports in proxy headers middleware (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2903">#2903</a>)</li> <li>Raise helpful <code>ImportError</code> when PyYAML is missing for YAML log config (<a href="https://redirect.github.com/Kludex/uvicorn/issues/2906">#2906</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
38efd1e2b9 |
Bump pydantic-settings from 2.13.0 to 2.14.0 in /backend (#1697)
Bumps [pydantic-settings](https://github.com/pydantic/pydantic-settings) from 2.13.0 to 2.14.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic-settings/releases">pydantic-settings's releases</a>.</em></p> <blockquote> <h2>v2.14.0</h2> <h2>What's Changed</h2> <ul> <li>Fix parsing env vars into Optional Strict types by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/792">pydantic/pydantic-settings#792</a></li> <li>Fix RecursionError with mutually recursive models in CLI by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/794">pydantic/pydantic-settings#794</a></li> <li>Fix env_file from model_config ignored in CliApp.run() (<a href="https://redirect.github.com/pydantic/pydantic-settings/issues/795">#795</a>) by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/796">pydantic/pydantic-settings#796</a></li> <li>Update dependencies by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/798">pydantic/pydantic-settings#798</a></li> <li>Add Dependabot configuration by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/801">pydantic/pydantic-settings#801</a></li> <li>Bump samuelcolvin/check-python-version from 4.1 to 5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/802">pydantic/pydantic-settings#802</a></li> <li>Bump actions/upload-artifact from 4 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/803">pydantic/pydantic-settings#803</a></li> <li>Bump actions/checkout from 4 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/804">pydantic/pydantic-settings#804</a></li> <li>Bump astral-sh/setup-uv from 5 to 7 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/805">pydantic/pydantic-settings#805</a></li> <li>Bump actions/setup-python from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/806">pydantic/pydantic-settings#806</a></li> <li>Ignore chardet and group GitHub Actions in Dependabot by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/808">pydantic/pydantic-settings#808</a></li> <li>Bump actions/download-artifact from 4 to 8 in the github-actions group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/809">pydantic/pydantic-settings#809</a></li> <li>Bump the python-packages group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/810">pydantic/pydantic-settings#810</a></li> <li>Support reading .env files from FIFOs (e.g. 1Password Environments) by <a href="https://github.com/JacobHayes"><code>@JacobHayes</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/776">pydantic/pydantic-settings#776</a></li> <li>Fix AliasChoices ignored when changing provider priority by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/813">pydantic/pydantic-settings#813</a></li> <li>fix: resolve KeyError in run_subcommand for underscore field names by <a href="https://github.com/bradykieffer"><code>@bradykieffer</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/799">pydantic/pydantic-settings#799</a></li> <li>Bump the python-packages group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/814">pydantic/pydantic-settings#814</a></li> <li>Fix <code>Literal[numeric Enum]</code> coercion for CLI and env vars by <a href="https://github.com/m9810223"><code>@m9810223</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/811">pydantic/pydantic-settings#811</a></li> <li>Fix nested discriminated unions not discovered by env/CLI providers by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/816">pydantic/pydantic-settings#816</a></li> <li>Bump the python-packages group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/820">pydantic/pydantic-settings#820</a></li> <li>CLI ensure env nested max split internally. by <a href="https://github.com/kschwab"><code>@kschwab</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/821">pydantic/pydantic-settings#821</a></li> <li>Bump the python-packages group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/824">pydantic/pydantic-settings#824</a></li> <li>Migrate <code>boto3-stubs</code> to <code>types-boto3</code> by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/831">pydantic/pydantic-settings#831</a></li> <li>Fix CLI not recognizing field name with validate_by_name and AliasChoices by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/826">pydantic/pydantic-settings#826</a></li> <li>Allow customisation of the dotevn setting source to filter variables by <a href="https://github.com/CaselIT"><code>@CaselIT</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/832">pydantic/pydantic-settings#832</a></li> <li>Bump the python-packages group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/833">pydantic/pydantic-settings#833</a></li> <li>Introduce yamlfmt by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/836">pydantic/pydantic-settings#836</a></li> <li>Bump boto3 from 1.42.82 to 1.42.83 in the python-packages group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/837">pydantic/pydantic-settings#837</a></li> <li>Introduce zizmor by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/838">pydantic/pydantic-settings#838</a></li> <li>Fix CliPositionalArg[list[CustomType]] crash for custom types by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/839">pydantic/pydantic-settings#839</a></li> <li>Add note about Mypy plugin for <code>BaseSettings.__init__()</code> by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/842">pydantic/pydantic-settings#842</a></li> <li>Fix <code>cli_ignore_unknown_args=True</code> not working on subcommands by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/844">pydantic/pydantic-settings#844</a></li> <li>Bump the python-packages group with 4 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/847">pydantic/pydantic-settings#847</a></li> <li>Fix CLI descriptions lost under <code>python -OO</code> by falling back to <code>json_schema_extra</code> by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/843">pydantic/pydantic-settings#843</a></li> <li>Prepare release 2.14.0 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/848">pydantic/pydantic-settings#848</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/802">pydantic/pydantic-settings#802</a></li> <li><a href="https://github.com/JacobHayes"><code>@JacobHayes</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/776">pydantic/pydantic-settings#776</a></li> <li><a href="https://github.com/bradykieffer"><code>@bradykieffer</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/799">pydantic/pydantic-settings#799</a></li> <li><a href="https://github.com/CaselIT"><code>@CaselIT</code></a> made their first contribution in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/832">pydantic/pydantic-settings#832</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic-settings/compare/v2.13.1...v2.14.0">https://github.com/pydantic/pydantic-settings/compare/v2.13.1...v2.14.0</a></p> <h2>v2.13.1</h2> <h2>What's Changed</h2> <ul> <li>Fix regression for bool fields since 2.13.0 by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/784">pydantic/pydantic-settings#784</a></li> <li>Fix RecursionError with self-referential models in CliApp by <a href="https://github.com/hramezani"><code>@hramezani</code></a> in <a href="https://redirect.github.com/pydantic/pydantic-settings/pull/783">pydantic/pydantic-settings#783</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|
dependabot[bot]
|
4fb0d150f5 |
Bump pyrefly from 0.61.1 to 0.62.0 in /backend (#1696)
Bumps [pyrefly](https://github.com/facebook/pyrefly) from 0.61.1 to 0.62.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facebook/pyrefly/releases">pyrefly's releases</a>.</em></p> <blockquote> <h2>Pyrefly v0.62.0</h2> <p><strong>Status : BETA</strong> <em>Release date: April 20, 2026</em></p> <p>Pyrefly v0.62.0 bundles <strong>87 commits</strong> from <strong>23 contributors</strong>.</p> <hr /> <h2>✨ New & Improved</h2> <table> <thead> <tr> <th>Area</th> <th>What's new</th> </tr> </thead> <tbody> <tr> <td><strong>Type Checking</strong></td> <td>- <code>TypeVarTuple</code> inference has been changed to be consistent with <code>TypeVar</code>, per a recent change to the typing spec. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Errors logged during speculative union checks and overload calls are now reverted, eliminating a source of confusing false positives. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Union-typed decorators that return fully unknown types (either <code>Unknown</code> or callables with all-unknown signatures) preserve the original function signature instead of replacing it with <code>Unknown</code>, reducing false positives by ~23% on TensorFlow.</td> </tr> <tr> <td><strong>Language Server</strong></td> <td>- Semantic tokens and completions work for <code>inmemory://</code> documents on Windows. <!-- raw HTML omitted --><!-- raw HTML omitted -->- LSP server crashes from out-of-range line numbers in client requests are prevented by clamping positions to the buffer's valid range.</td> </tr> <tr> <td><strong>Error Reporting</strong></td> <td>- Error kinds can now have sub-kinds that can be disabled using their shared prefix. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Invariance checks for mutable attributes (corresponding to mypy's <code>mutable-override</code> opt-in behavior) have been moved to a new <code>bad-override-mutable-attribute</code> error code that is a sub-kind of <code>bad-override</code>. <!-- raw HTML omitted --><!-- raw HTML omitted -->- The <code>bad-param-name-override</code> error has been renamed to <code>bad-override-param-name</code> and made a sub-kind of <code>bad-override</code>. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Sub-configs that define <code>[errors]</code> inherit the root config's error severity overrides for any codes they don't explicitly set.</td> </tr> <tr> <td><strong>Configuration</strong></td> <td>- When migrating from mypy via <code>pyrefly init</code>, <code>bad-override-mutable-attribute</code> is disabled by default to match mypy's behavior. <!-- raw HTML omitted --><!-- raw HTML omitted -->- Project excludes (e.g., <code>project-excludes = ["**/*.ipynb"]</code>) no longer block discovery of <code>.py</code> files when the default <code>project-includes</code> contains both <code>**/*.py*</code> and <code>**/*.ipynb</code>.</td> </tr> </tbody> </table> <hr /> <h2>🐛 bug fixes</h2> <p>We closed 12 bug issues this release 👏</p> <ul> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3118">#3118</a>: Fixed incorrect stub package recommendations for typeshed third-party libraries. Pyrefly now suggests the correct package name (e.g., <code>types-python-dateutil</code> for the <code>dateutil</code> module, not <code>types-dateutil</code>) by extracting the module→package mapping from the bundled typeshed archive, preventing potential typosquatting.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3081">#3081</a>: Fixed NewType wrappers with NoneType bases being incorrectly rejected or treated inconsistently. <code>NewType("NewNoneType", NoneType)</code> is now accepted as a valid nominal type declaration, and plain <code>None</code> is correctly rejected where <code>NewNoneType</code> is required.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3052">#3052</a>: Fixed false positive <code>unexpected-keyword</code> errors for named parameters before <code>*args: P.args</code>. Functions like <code>call_with_retry(f, max_attempts=10, *args: P.args, **kwargs: P.kwargs)</code> now correctly allow <code>max_attempts</code> to be passed as a keyword argument, matching mypy and pyright behavior.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3110">#3110</a>: Fixed LSP server crashes when the client sends a position with a line number beyond the end of the buffer (e.g., after a <code>DidChangeTextDocument</code> race where the file was truncated). Out-of-range positions now map to EOF instead of panicking.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2912">#2912</a>: Fixed false positive <code>bad-argument-type</code> for <code>list(null_values.items())</code> when the return type hint is a union like <code>Sequence[str] | list[tuple[str, str]]</code>. Pyrefly now tries constructing the class with each union member independently and unions the results, ensuring the inferred type is assignable to the hint.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2644">#2644</a>: Fixed false positive <code>bad-argument-type</code> when calling a method with <code>AnyStr</code>. Placeholder variables used during overload resolution are now saved and restored around overload calls, preventing <code>AnyStr</code> from being incorrectly specialized to <code>str</code> and polluting subsequent checks.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/2872">#2872</a>: Fixed false positive <code>invalid-type-var</code> for generic functions captured as closure default arguments. The <code>Visit</code> implementation for <code>DefaultValue</code> now calls <code>visit</code> instead of <code>recurse</code>, ensuring type-level visitors see the <code>Type</code> node stored in the default value.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3159">#3159</a>: Fixed incorrect type inference for <code>.value</code> on enum members with non-data-type mixins. Mixins that don't define <code>__new__</code> (e.g., <code>class Meta: pass</code>) are no longer treated as data type mixins, so <code>Foo.bar.value</code> correctly returns <code>Literal[1]</code> instead of <code>Meta</code>.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3161">#3161</a>: Fixed false positive <code>bad-argument-type</code> for overloaded functions with vararg unpacking (e.g., <code>*args: *tuple[int, str]</code>). Type check errors for unpacked varargs are now sent to <code>call_errors</code> instead of <code>arg_errors</code>, so they don't cause the overload to be incorrectly rejected.</li> <li><a href="https://redirect.github.com/facebook/pyrefly/issues/3047">#3047</a>: Fixed false positive <code>bad-specialization</code> when matching a type variable against a union like <code>N | Iterable[N]</code>. Pyrefly now uses snapshot-based rollback when trying each union member, ensuring specialization errors from one branch don't leak into the final result if another branch succeeds without errors.</li> <li>And more! <a href="https://redirect.github.com/facebook/pyrefly/issues/3122">#3122</a>, <a href="https://redirect.github.com/facebook/pyrefly/issues/3080">#3080</a>, <a href="https://redirect.github.com/facebook/pyrefly/issues/3074">#3074</a></li> </ul> <p>Thank-you to all our contributors who found these bugs and reported them! Did you know this is one of the most helpful contributions you can make to an open-source project? If you find any bugs in Pyrefly we want to know about them! Please open a bug report issue <a href="https://github.com/facebook/pyrefly/issues">here</a></p> <hr /> <h2>📦 Upgrade</h2> <pre lang="bash"><code>pip install --upgrade pyrefly==0.62.0 </code></pre> <h3>How to safely upgrade your codebase</h3> <p>Upgrading the version of Pyrefly you're using or a third-party library you depend on can reveal new type errors in your code. Fixing them all at once is often unrealistic. We've written scripts to help you temporarily silence them. After upgrading, follow these steps:</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |