Skip to content

chore(backend): bump the backend group across 1 directory with 14 updates - #29

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-5a8a8f0e2e
Open

chore(backend): bump the backend group across 1 directory with 14 updates#29
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/backend-5a8a8f0e2e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the backend group with 14 updates in the /backend directory:

Package From To
asgiref 3.12.1 3.13.0
django 6.1.1 6.1.3
django-filter 26.1 26.2
djangorestframework 3.18.1 3.18.3
drf-spectacular-sidecar 2026.9.1 2026.10.1
iniconfig 2.3.0 2.3.1
pluggy 1.6.0 1.7.0
psycopg 3.3.6 3.3.8
psycopg-binary 3.3.6 3.3.8
pyjwt 2.14.0 2.15.1
pytest 9.1.1 9.2.0
rpds-py 2026.6.3 2026.9.1
sqlparse 0.6.0 0.6.1
tzdata 2026.4 2026.6

Updates asgiref from 3.12.1 to 3.13.0

Changelog

Sourced from asgiref's changelog.

3.13.0 (2026-10-23)

  • It is now possible to nest ThreadSensitiveContext by providing an explicit executor for thread-sensitive tasks. This enables moving a block of such work away from the parent context's shared worker. (#596)

    The provided executor must run work sequentially and on a single thread, as per ThreadPoolExecutor(max_workers=1), and the calling code is responsible for managing the executor's lifecycle.

    See the README for more details.

  • Local attribute access is now 2-3x faster. Local(...) now uses one of two internal specialisations, selected by thread_critical, instead of checking the mode on every access. (#551)

    As a result Local is now marked @final and raises TypeError if subclassed. Subclassing was never supported, and could not have worked correctly with the specialised implementations.

  • asgiref.timeout.timeout is deprecated, and will be removed in a future release. Move to use asyncio.timeout() instead.

  • Added support for Python 3.15.

  • Dropped support for EOL Python 3.10.

Commits

Updates django from 6.1.1 to 6.1.3

Commits

Updates django-filter from 26.1 to 26.2

Changelog

Sourced from django-filter's changelog.

Version 26.2 (2026-10-03)

  • Added testing against Python 3.15.

  • Dropped support for Python 3.10.

  • LinkWidget will now conditionally escape provided label text.

    Filter choices are under developer control, and applications populating them from user-supplied values, including via AllValuesFilter, must filter those appropriately, as always. Nonetheless, escaping labels by default serves as defense-in-depth hardening. Apply mark_safe() to labels intended to contain HTML.

    Thanks to Sanjeev Kumar for the report.

Commits
  • daddf7b Set date and bump version for 26.2 release.
  • a3593ea Escape LinkWidget values.
  • 29be896 Update testing to add Python 3.15 and drop 3.10.
  • 5128b8f Increase the version upper limit for flit_core to 5
  • See full diff in compare view

Updates djangorestframework from 3.18.1 to 3.18.3

Release notes

Sourced from djangorestframework's releases.

3.18.3

What's Changed

Bug fixes

Full Changelog: encode/django-rest-framework@3.18.2...3.18.3

3.18.2

What's Changed

Security

Features

Bug fixes

New Contributors

Full Changelog: encode/django-rest-framework@3.18.1...3.18.2

Commits

Updates drf-spectacular-sidecar from 2026.9.1 to 2026.10.1

Commits

Updates iniconfig from 2.3.0 to 2.3.1

Release notes

Sourced from iniconfig's releases.

Version 2.3.1

Fixes

  • Parsing values with many continuation lines is now linear instead of quadratic in time (#78, regarding #77).
  • A leading UTF-8 BOM is now stripped when reading INI files. Files saved by Windows editors used to fail with ParseError (#76, thanks @​Pitchfork-and-Torch).

Internal

  • iniconfig._parse.ParsedLine.value is now a list of lines. This is private API.

Docs

Full diff: pytest-dev/iniconfig@v2.3.0...v2.3.1

What's Changed

New Contributors

Full Changelog: pytest-dev/iniconfig@v2.3.0...v2.3.1

Changelog

Sourced from iniconfig's changelog.

2.3.1

  • fix quadratic parse time for values with many continuation lines (#78, regarding #77)
  • strip a leading UTF-8 BOM when reading INI files, which previously raised ParseError (#76)
  • internal: iniconfig._parse.ParsedLine.value is now a list of lines
Commits
  • 316fbfa changelog: add BOM stripping (#76) to 2.3.1 (#81)
  • d2dcb72 Strip leading UTF-8 BOM when reading INI files (#76)
  • 40d8c03 Merge pull request #79 from MbappeWU/codex/docs-parse-inline-comments
  • 48359c3 Merge pull request #80 from pytest-dev/claude/fix-iniconfig-test-eukh2n
  • b153213 test: expect sorted all after ruff RUF022 autofix
  • 4fddfab Merge pull request #73 from pytest-dev/pre-commit-ci-update-config
  • 15852c2 [pre-commit.ci] auto fixes from pre-commit.com hooks
  • 2e68639 [pre-commit.ci] pre-commit autoupdate
  • 23c9e08 docs: use parse API in the README example
  • e038536 Merge pull request #78 from RonnyPfannschmidt/claude/dazzling-einstein-h8zq7m
  • Additional commits viewable in compare view

Updates pluggy from 1.6.0 to 1.7.0

Changelog

Sourced from pluggy's changelog.

pluggy 1.7.0 (2026-10-14)

Deprecations and Removals

  • [#632](https://github.com/pytest-dev/pluggy/issues/632) <https://github.com/pytest-dev/pluggy/issues/632>_: Hookspec methods defined without self as the first parameter now emit a :class:DeprecationWarning. Add self as the first parameter or use @staticmethod.

Features

  • [#170](https://github.com/pytest-dev/pluggy/issues/170) <https://github.com/pytest-dev/pluggy/issues/170>_: Hookspecs can now declare default values for arguments, using the usual def myhook(myarg="default") syntax. This is mainly a backward compatibility feature, to allow a hookspec to add new parameters to an existing hook without breaking existing callers. See :ref:hookspec_arg_default for details.

  • [#729](https://github.com/pytest-dev/pluggy/issues/729) <https://github.com/pytest-dev/pluggy/issues/729>_: Tracing now adds detail where str() is ambiguous: empty strings and strings containing whitespace are quoted, and enums and paths show their repr().

    A value spanning several lines is now displayed as a block instead of running into the surrounding trace.

Bug Fixes

  • [#629](https://github.com/pytest-dev/pluggy/issues/629) <https://github.com/pytest-dev/pluggy/issues/629>_: Fix hooks failing to register on Python 3.14+ when type annotations use forward references.

  • [#315](https://github.com/pytest-dev/pluggy/issues/315) <https://github.com/pytest-dev/pluggy/issues/315>_: Source archives created by git archive (including GitHub's "Source code" downloads) now carry version information, so building pluggy from them no longer fails with a missing version.

  • [#442](https://github.com/pytest-dev/pluggy/issues/442) <https://github.com/pytest-dev/pluggy/issues/442>_: With the addition of default values for hookspec arguments, we also changed the precedence of default values for hookimpl arguments. Previously, if a hookimpl function declared a default for an argument, it was always used, even if the hook call passed an explicit value. Now the precedence is changed to: hook call passed value > hookspec default value > hookimpl default value. See :ref:hookimpl_arg_defaults.

  • [#701](https://github.com/pytest-dev/pluggy/issues/701) <https://github.com/pytest-dev/pluggy/issues/701>_: Hookimpls and hookspecs are now discovered via :func:inspect.getattr_static, so properties, cached_property and other descriptors are no longer executed while scanning a plugin. Hooks declared through such a descriptor are not supported.

    As a side effect, @hookimpl/@hookspec applied above @classmethod or @staticmethod is now picked up; previously the marker sat on the wrapper where getattr() never saw it. Callables stored directly on a plugin instance -- in its __dict__ or in a __slots__ slot -- keep being called exactly as getattr() returned them, i.e. without an implicit self.

... (truncated)

Commits
  • 4c7f636 Preparing release 1.7.0
  • 21c7e16 Merge pull request #787 from pytest-dev/rm-outdated-doc
  • 628959b docs: remove outdated hookimpl default args paragraph
  • 2edab5e Merge pull request #752 from bluetech/register-none-allow
  • 6995073 Merge pull request #776 from RonnyPfannschmidt/fix/uv-lock-pytest-downgrade
  • 50c1ac9 [pre-commit.ci] pre-commit autoupdate (#781)
  • 6a7e84e Add changelog fragment for #776
  • d22cfb5 Drop tox from the dev dependency group
  • 74cbfa2 Relock pytest and tox that dependabot downgraded
  • 87f130a Merge pull request #755 from harbinresearcher/codex/entrypoint-plugin-presence
  • Additional commits viewable in compare view

Updates psycopg from 3.3.6 to 3.3.8

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.9 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Use the C implementation of the wait functions on Windows too. It was disabled because of an excessive CPU usage, fixed in Psycopg 3.2.11 (:ticket:[#645](https://github.com/psycopg/psycopg/issues/645)).
  • Limit the memory used by :sql:COPY FROM if the server consumes data slower than it is produced. Add a !flush_threshold parameter to ~copy.LibpqWriter to tune it (:ticket:[#1437](https://github.com/psycopg/psycopg/issues/1437)).
  • Don't wait on the event loop when the socket is already writable, which made pipeline mode, ~AsyncCursor.executemany() and ~AsyncCopy.write() on async connections several times slower than on sync ones (:ticket:[#1468](https://github.com/psycopg/psycopg/issues/1468)).
  • Speed up the C implementation of the sync wait function, in particular when the connection doesn't need to wait, for instance at every ~Copy.write() (:ticket:[#1484](https://github.com/psycopg/psycopg/issues/1484)).
  • Reduce the size of the binary packages.

Current release

Psycopg 3.3.8 ^^^^^^^^^^^^^

  • Revert the use of /etc/ssl as SSL directory in the binary packages on Linux and macOS: it caused the system openssl.cnf to be loaded, which could break connections, for instance on FIPS-enabled systems (:ticket:[#1476](https://github.com/psycopg/psycopg/issues/1476)).
  • Fix the size of the binary packages on Linux x86_64, increased in 3.3.7 by padding of the bundled libraries (:ticket:[#1477](https://github.com/psycopg/psycopg/issues/1477)).

Psycopg 3.3.7 ^^^^^^^^^^^^^

  • Fix segfault fetching arrays of strings or timestamps after closing the connection (:ticket:[#1428](https://github.com/psycopg/psycopg/issues/1428)).

... (truncated)

Commits
  • b9e2f35 chore: bump psycopg package version to 3.3.8
  • 53a0eb4 Merge pull request #1478 from dvarrazzo/fix-openssldir-1476
  • 0880f2e ci: fix skipping the OpenSSL build if already installed
  • d48cc84 fix(binary): don't use /etc/ssl as OpenSSL directory
  • 2ce4384 ci: only restore the libpq cache in the packages-bin workflow
  • 78bf2ad docs: add news entry for #1477
  • ae74a87 Revert "chore(deps): bump pypa/cibuildwheel"
  • 4daf632 chore: bump psycopg package version to 3.3.7
  • 7ce93bb chore(deps): bump pypa/cibuildwheel
  • 70dce7a test: run three assertions trapped after the expected exception
  • Additional commits viewable in compare view

Updates psycopg-binary from 3.3.6 to 3.3.8

Changelog

Sourced from psycopg-binary's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.9 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Use the C implementation of the wait functions on Windows too. It was disabled because of an excessive CPU usage, fixed in Psycopg 3.2.11 (:ticket:[#645](https://github.com/psycopg/psycopg/issues/645)).
  • Limit the memory used by :sql:COPY FROM if the server consumes data slower than it is produced. Add a !flush_threshold parameter to ~copy.LibpqWriter to tune it (:ticket:[#1437](https://github.com/psycopg/psycopg/issues/1437)).
  • Don't wait on the event loop when the socket is already writable, which made pipeline mode, ~AsyncCursor.executemany() and ~AsyncCopy.write() on async connections several times slower than on sync ones (:ticket:[#1468](https://github.com/psycopg/psycopg/issues/1468)).
  • Speed up the C implementation of the sync wait function, in particular when the connection doesn't need to wait, for instance at every ~Copy.write() (:ticket:[#1484](https://github.com/psycopg/psycopg/issues/1484)).
  • Reduce the size of the binary packages.

Current release

Psycopg 3.3.8 ^^^^^^^^^^^^^

  • Revert the use of /etc/ssl as SSL directory in the binary packages on Linux and macOS: it caused the system openssl.cnf to be loaded, which could break connections, for instance on FIPS-enabled systems (:ticket:[#1476](https://github.com/psycopg/psycopg/issues/1476)).
  • Fix the size of the binary packages on Linux x86_64, increased in 3.3.7 by padding of the bundled libraries (:ticket:[#1477](https://github.com/psycopg/psycopg/issues/1477)).

Psycopg 3.3.7 ^^^^^^^^^^^^^

  • Fix segfault fetching arrays of strings or timestamps after closing the connection (:ticket:[#1428](https://github.com/psycopg/psycopg/issues/1428)).

... (truncated)

Commits
  • b9e2f35 chore: bump psycopg package version to 3.3.8
  • 53a0eb4 Merge pull request #1478 from dvarrazzo/fix-openssldir-1476
  • 0880f2e ci: fix skipping the OpenSSL build if already installed
  • d48cc84 fix(binary): don't use /etc/ssl as OpenSSL directory
  • 2ce4384 ci: only restore the libpq cache in the packages-bin workflow
  • 78bf2ad docs: add news entry for #1477
  • ae74a87 Revert "chore(deps): bump pypa/cibuildwheel"
  • 4daf632 chore: bump psycopg package version to 3.3.7
  • 7ce93bb chore(deps): bump pypa/cibuildwheel
  • 70dce7a test: run three assertions trapped after the expected exception
  • Additional commits viewable in compare view

Updates pyjwt from 2.14.0 to 2.15.1

Release notes

Sourced from pyjwt's releases.

2.15.1

See the 2.15.1 changelog for complete release details.

2.15.0

See the 2.15.0 changelog for complete release details.

Changelog

Sourced from pyjwt's changelog.

v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>__

Fixed


- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`[#1209](https://github.com/jpadilla/pyjwt/issues/1209) <https://github.com/jpadilla/pyjwt/issues/1209>`__).

v2.15.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&gt;__


Security

  • Wrap recursion errors from deeply nested JWT payloads in DecodeError instead of exposing a raw RecursionError.

Added


- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__

Changed

  • JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS payload, so a cache hit no longer re-parses every key. JWKSetCache.put() accepts either form and raises PyJWKSetError for anything else. As a result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance for as long as it stays cached, rather than a freshly built one per call in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
  • PyJWKClient.fetch_data() now raises PyJWKClientError("The JWKS endpoint did not return a JSON object") when the endpoint response is not a JSON object, instead of returning it for get_jwk_set() to reject. Callers reaching the JWKS through get_jwk_set() see the same error as before in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed


- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
</tr></table>

... (truncated)

Commits
  • 7d5ef55 chore: prepare 2.15.1 release
  • 7bf3252 Accept canonical Base64URL padding in JWT segments (#1216)
  • 1d41a64 chore: prepare 2.15.0 release
  • 9bc0665 fix: make recursive payload tests deterministic
  • 5fde08a fix: normalize recursive JWT payload errors
  • 171062d utils: mention bytes in force_bytes type error (#1173)
  • c9d4d53 docs/conf: drop duplicate 'and' from read() docstring (#1174)
  • 2763752 Add support for Python 3.15 (#1202)
  • 4adcd02 Catch http.client.HTTPException in PyJWKClient.fetch_data (#1201)
  • 9e501d9 fix: correct docstring typo in _validate_jti (#1179)
  • Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

  • #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

  • #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

    Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

  • #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

    • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
    • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

    pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

  • #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

  • #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

  • #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

    They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

  • #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

  • #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

  • #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
  • #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
  • #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

  • #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits
  • ae1d0ff Prepare release version 9.2.0
  • 143ce31 pre-commit: exclude codespell on generated release announcements
  • 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
  • a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
  • 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
  • 41d12cd docs: clarify typing for yield fixtures
  • b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
  • 16f87a7 docs: improve getting-started.rst test execution description
  • 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
  • ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
  • Additional commits viewable in compare view

Updates rpds-py from 2026.6.3 to 2026.9.1

Commits
  • fc7a185 Release rpds-py version 2026.9.1
  • d19ef61 Merge pull request #311 from edgarrmondragon/pypy312
  • 47ac82f Bump PyO3 to 0.29.3 and start building PyPy 3.12 wheels
  • cf0900d Merge pull request #308 from crate-py/dependabot/github_actions/github/codeql...
  • 204fd02 Merge pull request #309 from crate-py/dependabot/github_actions/astral-sh/set...
  • 264fdef Merge pull request #310 from crate-py/pre-commit-ci-update-config
  • 5ddee5c [pre-commit.ci] pre-commit autoupdate
  • 9fe3318 Bump astral-sh/setup-uv from 10.1.0 to 10.2.0
  • 2302c70 Bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1
  • 93bbcbb Merge pull request #305 from crate-py/dependabot/github_actions/astral-sh/set...
  • Additional commits viewable in compare view

Updates sqlparse from 0.6.0 to 0.6.1

Changelog

Sourced from sqlparse's changelog.

Release 0.6.1 (Nov 01, 2026)

End of Maintenance

Version 0.6.1 marks the final release of sqlparse.

After many years of maintaining this project, I have decided to end its active development and maintenance. The increasing volume of security reports, particularly those generated through automated vulnerability research, has made the workload unsustainable for me as a sole volunteer maintainer.

No further releases, including security fixes, are planned. The source code and existing releases will remain available.

I would like to thank everyone who has contributed to sqlparse over the years.

Notable Changes

  • IMPORTANT: Dollar signs are now escaped in the php output format. PHP interpolates $var, ${expr} and {$expr} inside double-quoted strings, so SQL text containing them could inject PHP code into the generated snippet (CVE-2026-112307, pr937 by cve-zh00). See the security advisory for details: GHSA-xmww-55xg-h3vc The vulnerability was discovered by @​iRevivalx, @​Gares95, @​manus-pi, @​president-xd, @​arpitjain099 and @​Tan-JunWei. Thanks for reporting!
  • IMPORTANT: Fixes a potential denial of service attack (DOS) in format(), which consumed CPU quadratically on statements containing many quotes that are never closed. This affected format() with default options and the sqlformat command. See the security advisory for details: GHSA-3r5h-5jcg-gmgg The vulnerability was discovered by @​LinFeng-1219 and @​president-xd. Thanks for reporting!

Bug Fixes

  • Fix IndexError and ValueError in format() on some malformed statements, e.g. ( as ) with reindent=True or a CASE without its own END with reindent_aligned=True. Grouping no longer moves the brackets of a parenthesis or the CASE/END keywords into an inner group.
  • sqlformat no longer empties the file given with --in-place or --outfile when formatting fails, e.g. because a statement exceeds the grouping limits. The output file is now only written after formatting succeeded, and the error is reported like other CLI errors. Thanks to @​Joejiaojian, @​president-xd, @​hash3liZer and @​eros938 for reporting!
Commits

Updates tzdata from 2026.4 to 2026.6

Release notes

Sourced from tzdata's releases.

2026.6: Release of upstream tzdata 2026f

Version 2026.6

Upstream version 2026f released 2026-10-28T06:16:49+00:00

Briefly:

Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07. No more leap seconds, and leap second tables no longer expire. Improve 1965/1966 data for Brazil.

Changes to future timestamps

Cuba will not fall back to -05 on 2026-11-01 and instead plans to maintain -04 through 2027-11-07.

Changes to past timestamps

In 1965 Brazil ended DST on 03-31 at 24:00 not 00:00, and in 1966 it ended DST on 03-01 at 01:00 not 00:00. (Thanks to Daniel Dias Rodrigues.)

Changes to documentation and commentary

Documentation and commentary now reflect leap seconds’ demise.

Changes to commentary

Discussion on timekeeping in northwestern Ontario has been updated to reflect that provincial regulation has been issued to allow these areas to stay aligned with America/Winnipeg and follow Manitoba’s adoption of year-round -05 after all. (Thanks to Aoun Khan, Chris Walton, and Heitor David Pinto.)

Discussion on timekeeping in Saskatchewan has been updated to document its new Time Act, 2026 which comes into force on 2026-10-30. (Thanks to Heitor David Pinto.) No change is expected.

2026.5: Release of upstream tzdata 2026e

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00.

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on

... (truncated)

Changelog

Sourced from tzdata's changelog.

Version 2026.6

Upstream version 2026f released 2026-10-28T06:16:49+00:00

Briefly:

Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07. No more leap seconds, and leap second tables no longer expire. Improve 1965/1966 data for Brazil.

Changes to future timestamps

Cuba will not fall back to -05 on 2026-11-01 and instead plans to maintain -04 through 2027-11-07.

Changes to past timestamps

In 1965 Brazil ended DST on 03-31 at 24:00 not 00:00, and in 1966 it ended DST on 03-01 at 01:00 not 00:00. (Thanks to Daniel Dias Rodrigues.)

Changes to documentation and commentary

Documentation and commentary now reflect leap seconds’ demise.

Description has been truncated

@dependabot
chore(backend): bump the backend group across 1 directory with 14 upd…
6434308 
…ates

Bumps the backend group with 14 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [asgiref](https://github.com/django/asgiref) | `3.12.1` | `3.13.0` |
| [django](https://github.com/django/django) | `6.1.1` | `6.1.3` |
| [django-filter](https://github.com/carltongibson/django-filter) | `26.1` | `26.2` |
| [djangorestframework](https://github.com/encode/django-rest-framework) | `3.18.1` | `3.18.3` |
| [drf-spectacular-sidecar](https://github.com/tfranzel/drf-spectacular-sidecar) | `2026.9.1` | `2026.10.1` |
| [iniconfig](https://github.com/pytest-dev/iniconfig) | `2.3.0` | `2.3.1` |
| [pluggy](https://github.com/pytest-dev/pluggy) | `1.6.0` | `1.7.0` |
| [psycopg](https://github.com/psycopg/psycopg) | `3.3.6` | `3.3.8` |
| [psycopg-binary](https://github.com/psycopg/psycopg) | `3.3.6` | `3.3.8` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.14.0` | `2.15.1` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` |
| [rpds-py](https://github.com/crate-py/rpds) | `2026.6.3` | `2026.9.1` |
| [sqlparse](https://github.com/andialbrecht/sqlparse) | `0.6.0` | `0.6.1` |
| [tzdata](https://github.com/python/tzdata) | `2026.4` | `2026.6` |



Updates `asgiref` from 3.12.1 to 3.13.0
- [Changelog](https://github.com/django/asgiref/blob/main/CHANGELOG.txt)
- [Commits](django/asgiref@3.12.1...3.13.0)

Updates `django` from 6.1.1 to 6.1.3
- [Commits](django/django@6.1.1...6.1.3)

Updates `django-filter` from 26.1 to 26.2
- [Release notes](https://github.com/carltongibson/django-filter/releases)
- [Changelog](https://github.com/carltongibson/django-filter/blob/main/CHANGES.rst)
- [Commits](carltongibson/django-filter@26.1...26.2)

Updates `djangorestframework` from 3.18.1 to 3.18.3
- [Release notes](https://github.com/encode/django-rest-framework/releases)
- [Commits](encode/django-rest-framework@3.18.1...3.18.3)

Updates `drf-spectacular-sidecar` from 2026.9.1 to 2026.10.1
- [Commits](tfranzel/drf-spectacular-sidecar@2026.9.1...2026.10.1)

Updates `iniconfig` from 2.3.0 to 2.3.1
- [Release notes](https://github.com/pytest-dev/iniconfig/releases)
- [Changelog](https://github.com/pytest-dev/iniconfig/blob/main/CHANGELOG)
- [Commits](pytest-dev/iniconfig@v2.3.0...v2.3.1)

Updates `pluggy` from 1.6.0 to 1.7.0
- [Changelog](https://github.com/pytest-dev/pluggy/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pluggy@1.6.0...1.7.0)

Updates `psycopg` from 3.3.6 to 3.3.8
- [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst)
- [Commits](psycopg/psycopg@3.3.6...3.3.8)

Updates `psycopg-binary` from 3.3.6 to 3.3.8
- [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst)
- [Commits](psycopg/psycopg@3.3.6...3.3.8)

Updates `pyjwt` from 2.14.0 to 2.15.1
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.14.0...2.15.1)

Updates `pytest` from 9.1.1 to 9.2.0
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.1.1...9.2.0)

Updates `rpds-py` from 2026.6.3 to 2026.9.1
- [Release notes](https://github.com/crate-py/rpds/releases)
- [Changelog](https://github.com/crate-py/rpds/blob/main/release.toml)
- [Commits](crate-py/rpds@v2026.6.3...v2026.9.1)

Updates `sqlparse` from 0.6.0 to 0.6.1
- [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG)
- [Commits](andialbrecht/sqlparse@0.6.0...0.6.1)

Updates `tzdata` from 2026.4 to 2026.6
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.4...2026.6)

---
updated-dependencies:
- dependency-name: asgiref
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: django
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: django-filter
  dependency-version: '26.2'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: djangorestframework
  dependency-version: 3.18.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: drf-spectacular-sidecar
  dependency-version: 2026.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: iniconfig
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: pluggy
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: psycopg
  dependency-version: 3.3.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: psycopg-binary
  dependency-version: 3.3.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: pyjwt
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: rpds-py
  dependency-version: 2026.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
- dependency-name: sqlparse
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend
- dependency-name: tzdata
  dependency-version: '2026.6'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 7, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants