build(deps): bump the production-dependencies group across 1 directory with 12 updates

[dependabot]

Bumps the production-dependencies group with 12 updates in the / directory:

Package	From	To
asgiref	3.11.1	3.12.1
cachetools	7.1.3	7.1.6
flask-cors	6.0.2	6.0.5
grpcio	1.80.0	1.83.0
grpcio-testing	1.80.0	1.83.0
grpcio-tools	1.80.0	1.83.0
mysql-connector-python	9.7.0	26.7.0
peewee	4.0.5	4.2.6
phonenumbers	9.0.30	9.0.35
pyjwt	2.12.1	2.13.0
pytest	9.0.3	9.1.1
tqdm	4.67.3	4.70.0

Updates asgiref from 3.11.1 to 3.12.1

Changelog

Sourced from asgiref's changelog.

3.12.1 (2026-07-14)

• Restored the previous SyncToAsync.call internal code shape, which was relied on by some APM services. (#572)

  Note, this change was available whilst maintaining the underlying fix (from #564). It does not constitute an API stability promise. Ideally APMs are not monkey patching internal APIs, and future changes will be made here if needed.

3.12.0 (2026-07-14)

• AsyncToSync no longer captures the running event loop on instantiation. (#562)

  This resolves a series of deadlocks that users experienced after asgiref 3.9.0, particularly with pytest-asyncio. pytest-asyncio stops the event loop between tests, and long-running unawaited futures could find themselves trying to schedule work onto a stopped loop, and so would never complete. Ideally, code should be structured to await long-running futures before returning, but this change should help users experiencing issues here.

  The loop is now resolved when the callable is invoked rather than when it is created. If async_to_sync is called from within sync_to_async, the parent event loop is still used, as before.

  The possibility of deadlock therefore remains in some nested patterns. For example, an async function may call a long-running sync_to_async function that itself uses async_to_sync; if the outer function returns before the sync future completes, the parent event loop may already be stopped, and the nested calls cannot be driven to completion.

  This is not a bug in asgiref — the same patterns deadlock in plain asyncio. As above, restructure your code to await the sync_to_async future before exiting the driving coroutine.

• Fixed an event loop deadlock when exiting ThreadSensitiveContext while its executor thread was still blocked waiting on the event loop. (#535)

• Dropped support for EOL Python 3.9.

• Fixed StatelessServer.run() failing on Python 3.14, where asyncio.get_event_loop() no longer creates an event loop if none exists. It now uses asyncio.run(). (#559)

• Fixed Local leaking data between unrelated sync threads when sys.flags.thread_inherit_context is enabled (Python 3.14+), so a newly

... (truncated)

Commits

• ef9d4b8 Releasing 3.12.1
• 34fba63 Restore previous SyncToAsync.call internal code shape.
• a43900c Separate mypy from tests extra.
• 1b7c338 Releasing 3.12.0
• 157d9d4 Renovate precommit (#552)
• deda0d4 Test free-threading builds and fix Local data leak for thread_inherit_context...
• a54250a Don’t capture the event loop in AsyncToSync.__init__ (#562)
• 836356a Use asyncio.run in StatelessServer.run (#561)
• e04afd5 Dropped support for Python 3.9. (#543)
• 95d2430 Fixed #535: ThreadSensitiveContext.aexit blocking the event loop. (#563)
• Additional commits viewable in compare view

Updates cachetools from 7.1.3 to 7.1.6

Changelog

Sourced from cachetools's changelog.

v7.1.6 (2026-07-24)

• Minor style improvements to keep ruff happy.

v7.1.5 (2026-07-23)

• Fix TLRUCache silently keeping stale values on expired overwrites.

• Reject negative cache item getsizeof values.

• Update build environment.

v7.1.4 (2026-05-22)

• Minor unit test improvements.

• Update build environment.

Commits

• 13bb86a Minor style improvements to keep ruff happy.
• e2250be Fix RTD version handling.
• 0d2a6ea Release v7.1.5.
• d64cf80 Prepare v7.1.5.
• fcbb0de Fix #406: Merge branch 'gaoflow-fix-tlru-overwrite-expired-stale-value' into ...
• c0fdf6a Fix TLRUCache silently keeping stale value on expired overwrite
• 978d34d Bump actions/setup-python from 6.2.0 to 6.3.0
• d5c7eea Reject negative cache item sizes
• 578e976 Update build environment.
• e164b70 Bump codecov/codecov-action from 6.0.0 to 7.0.0
• Additional commits viewable in compare view

Updates flask-cors from 6.0.2 to 6.0.5

Release notes

Sourced from flask-cors's releases.

6.0.5

Supersedes 6.0.4

What's Changed

• Add MyPy Typing and modernize options parsing by @​corydolphin in corydolphin/flask-cors#409 (this broke strict type checking when using Blueprints)
• Restore Blueprint support in CORS type signatures (#410) by @​corydolphin in corydolphin/flask-cors#411

Full Changelog: corydolphin/flask-cors@6.0.3...6.0.5

6.0.4

What's Changed

• Add MyPy Typing by @​corydolphin in corydolphin/flask-cors#409

Full Changelog: corydolphin/flask-cors@6.0.3...6.0.4

6.0.3

What's Changed

• Derive package version from git tag via setuptools-scm by @​corydolphin in corydolphin/flask-cors#405
• Improve CI/CD security with least privilege and build separation by @​corydolphin in corydolphin/flask-cors#406

Full Changelog: corydolphin/flask-cors@6.0.2...6.0.3

6.0.3-pre

What's Changed

• Derive package version from git tag via setuptools-scm by @​corydolphin in corydolphin/flask-cors#405
• Improve CI/CD security with least privilege and build separation by @​corydolphin in corydolphin/flask-cors#406

Full Changelog: corydolphin/flask-cors@6.0.2...6.0.3

Commits

• 91ebc49 Typing Hotfix: support blueprints in the type system
• d601665 Add strict MyPy Typing
• c8e8871 Harden release publishing workflow (#406)
• e1d4034 Derive package version from git tag via setuptools-scm (#405)
• See full diff in compare view

Updates grpcio from 1.80.0 to 1.83.0

Release notes

Sourced from grpcio's releases.

Release v1.83.0

This is release 1.83.0 (garden) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [Security] Default to Post-Quantum Cryptography in TLS key exchange. (#42560)
• [authz] don't pass RBAC policy by value when constructing authorization engine. (#42636)

C#

• Migrate CSharp Grpc.Tools to new DotNet Version. (#42661)
• [C#] Tools - Build: Fix protoc SIGSEGV on ARM64 by aligning max-page-size and migrating to manylinux_2_28. (#42590)

Python

• [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower bound to allow 6.x. (#43001)
• [Python] Add abort_with_status to the aio ServicerContext ABC. (#42733)
• [Python] Update lower bound for protobuf from 6.33.5 to 7.35.1. (#42914)
• [Python] Pyright typeCheckingMode - standard. (#42739)
• [Python] Support Python 3.15 - Upgrade bazel dep rules_python to 2.0.2. (#42637)
• [Python] Hide internal symbols from Python's cygrpc shared object. (#42325)
• [Python] Handle custom Interceptor exceptions in InterceptedCall APIs . (#42593)

Release v1.82.1

This is release gRPC Core 1.82.1 (glacier).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

What's Changed

Python

• [Backport][v1.82.x][Python] Update lower bound for protobuf from 6.33.5 to 7.35.1 by @​asheshvidyut in grpc/grpc#42920

Full Changelog: grpc/grpc@v1.82.0...v1.82.1

Release v1.82.0

This is release gRPC Core 1.82.0 (glacier).

... (truncated)

Commits

• c876f4d [Release] Bump version to 1.83.0 (on v1.83.x branch) (#43036)
• b5c40cd [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower boun...
• 9c223f1 [Release] Bump version to 1.83.0-pre1 (on v1.83.x branch) (#42936)
• b215f80 [Release] Bump core version to 56.0.0 for upcoming release (#42934)
• cf95af0 [Python] Add abort_with_status to the aio ServicerContext ABC (#42733)
• 725c173 Automated rollback of commit 8848182a65239ce4a7a26650c82aee3ec7ed1eee.
• 821431b [PH2] Induced Frames and Reset Frames for PH2
• 6d0b58e disable metadata_publish_to_app_tag experiment
• 41d533a Implement Weighted Random Shuffling and CDS Weight Normalization for pick_fir...
• 8848182 [xDS] split up the grpc_xds_client BUILD target (#42872)
• Additional commits viewable in compare view

Updates grpcio-testing from 1.80.0 to 1.83.0

Updates grpcio-tools from 1.80.0 to 1.83.0

Release notes

Sourced from grpcio-tools's releases.

Release v1.83.0

This is release 1.83.0 (garden) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [Security] Default to Post-Quantum Cryptography in TLS key exchange. (#42560)
• [authz] don't pass RBAC policy by value when constructing authorization engine. (#42636)

C#

• Migrate CSharp Grpc.Tools to new DotNet Version. (#42661)
• [C#] Tools - Build: Fix protoc SIGSEGV on ARM64 by aligning max-page-size and migrating to manylinux_2_28. (#42590)

Python

• [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower bound to allow 6.x. (#43001)
• [Python] Add abort_with_status to the aio ServicerContext ABC. (#42733)
• [Python] Update lower bound for protobuf from 6.33.5 to 7.35.1. (#42914)
• [Python] Pyright typeCheckingMode - standard. (#42739)
• [Python] Support Python 3.15 - Upgrade bazel dep rules_python to 2.0.2. (#42637)
• [Python] Hide internal symbols from Python's cygrpc shared object. (#42325)
• [Python] Handle custom Interceptor exceptions in InterceptedCall APIs . (#42593)

Release v1.82.1

This is release gRPC Core 1.82.1 (glacier).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

What's Changed

Python

• [Backport][v1.82.x][Python] Update lower bound for protobuf from 6.33.5 to 7.35.1 by @​asheshvidyut in grpc/grpc#42920

Full Changelog: grpc/grpc@v1.82.0...v1.82.1

Release v1.82.0

This is release gRPC Core 1.82.0 (glacier).

... (truncated)

Commits

• c876f4d [Release] Bump version to 1.83.0 (on v1.83.x branch) (#43036)
• 9c223f1 [Release] Bump version to 1.83.0-pre1 (on v1.83.x branch) (#42936)
• 1454079 [Python] Update lower bound for protobuf from 6.33.5 to 7.35.1 (#42914)
• 6953d6a [Python] Remove 3.15 until Python 3.15 RC is released. (#42900)
• b025e18 [Python] Support 3.15 (#42388)
• b6a490e [Python][grpcio-tools] Fix build error when CXX contains spaces (#42742)
• 8a56164 [Core] Upgrade to protobuf@35.1 to get upstream MSVC bug fix. (#42773)
• 95f01e5 [Release] Bump version to 1.83.0-dev (on master branch) (#42638)
• f72dd8c [Python] Trim Python2 backward compatibility syntax - remove "future" (#4...
• 3618643 [Core] Upgrade to protobuf 35 (#42512)
• Additional commits viewable in compare view

Updates mysql-connector-python from 9.7.0 to 26.7.0

Changelog

Sourced from mysql-connector-python's changelog.

v26.7.0

This release contains no functional changes.

Commits

• 79f3435 Fix mysqld version parsing for multi-digit components
• 1a242a7 Updated Connector/Python version to v26.7.0
• d5645ae Updated GPL licence book
• c94b53c Updated the CONTRIBUTING and README files
• ecbe56e Updated the CONTRIBUTING and README files
• b0dde65 Updated Connector/Python version to v10.0.0
• See full diff in compare view

Updates peewee from 4.0.5 to 4.2.6

Release notes

Sourced from peewee's releases.

4.2.6

Just tidying up a loose end from the 4.2.4/4.2.5 -- a missed outer join is now cached as an absent relation instead of being written through the foreign-key descriptor. The fk id on the source instance keeps the column's value (previously it was overwritten with None), and accessing the attribute on a non-null fk returns None instead of raising DoesNotExist.

View commits

4.2.5

Fix longstanding bug where anonymous sub-select may keep a stale id()-based hash after clone().

View commits

4.2.4

• Fix derived table joined in an expression subquery losing its FROM alias.
• Fix default Model.select() used as a FROM/JOIN source reduced to its pk.
• Fix compound/subquery SELECT-list column emitting a phantom alias.
• Fix fn.EXISTS(compound) double-parenthesizing.
• Fix x.in_(ValuesList(...)) dropping parens around VALUES.
• Fix two-FK .join(on=...) mis-attaching rows when the fk is on the rhs.
• Fix ON CONFLICT ... DO NOTHING dropping the target/where/constraint.

View commits

4.2.3

Bug hunt wrapped up!

These were all pretty far out there on the edge of edge-cases. Things are looking solid all around.

• Fix a compound select (UNION/INTERSECT/EXCEPT) used as a correlated subquery emitting a phantom alias for the correlated outer table in every branch but the left-most, producing invalid SQL (e.g. no such column: t4.id). The right-hand branch renders in a fresh alias scope that no longer resolved the outer source's existing alias, it now inherits the enclosing scope's aliases while still assigning fresh aliases to its own sources.
• Fix full-text search weights passed as a dict being mis-applied to the wrong columns. For FTS3/4 the implicit docid primary-key was included when building the weight list, shifting every column by one (raising IndexError with the Python ranking UDF, silently mis-scoring with the Cython one), for FTS5, UNINDEXED columns were skipped even though bm25() weights are positional across all columns. The list form of weights was unaffected.
• Fix .cte() clearing the source query's CTE list in place: converting a query that carried a with_cte(...) clause into a CTE stripped the clause from that query, so reusing it afterward referenced an undeclared CTE. The query is now cloned before its CTE list is reset.
• Fix Table.select() with no arguments on a Table declared without columns emitting an empty projection (SELECT FROM ...) instead of SELECT *.
• Fix Table.insert(select_query) with no columns raising TypeError instead of rendering INSERT INTO t SELECT ....
• Fix the MySQL migrator dropping a foreign key's ON DELETE/ON UPDATE action when add_not_null() or rename_column() rebuilds the constraint, silently downgrading e.g. CASCADE to RESTRICT. The actions reported by get_foreign_keys() are now carried through to the rebuilt constraint.
• Fix the legacy postgres_ext JSON contains/contained_by/concat raising AttributeError, and remove() silently rewriting the entire column, when applied to a .path()-chained lookup (e.g. Model.data['a'].path('b')). All four now resolve the root field and full path via _resolve_root(), matching the sibling set/replace/insert/append/update mutators.
• Correct the postgres_ext.JSONField docs: the json-column field does not support the jsonb-based mutation/concatenation builders (they raise ProgrammingError), so the misleading "Postgres casts implicitly" claim was removed and new code is steered to the built-in JSONField.
• Fix the SQLite migrator treating a bare table-level UNIQUE (a, b) constraint as a column when rebuilding a table (add_not_null, drop_column, ...), raising no column named UNIQUE; unique is now recognized as a constraint.
• Fix the SQLite migrator's table rebuild corrupting the CREATE TABLE keywords for a table whose name is a case-insensitive substring of them (e.g. ab, t, tab) -- the table-name substitution is now anchored to the trailing name token.

View commits

4.2.2

• Change Field.__hash__ again... fml. Use (model_cls, field name).

... (truncated)

Changelog

Sourced from peewee's changelog.

4.2.6

• A missed outer join is now cached as an absent relation instead of being written through the foreign-key descriptor. The fk id on the source instance keeps the column's value (previously it was overwritten with None), and accessing the attribute on a non-null fk returns None instead of raising DoesNotExist.

View commits

4.2.5

• Fix anonymous sub-select keeping a stale id()-based hash after clone().

View commits

4.2.4

• Fix derived table joined in an expression subquery losing its FROM alias.
• Fix default Model.select() used as a FROM/JOIN source reduced to its pk.
• Fix compound/subquery SELECT-list column emitting a phantom alias.
• Fix fn.EXISTS(compound) double-parenthesizing.
• Fix x.in_(ValuesList(...)) dropping parens around VALUES.
• Fix two-FK .join(on=...) mis-attaching rows when the fk is on the rhs.
• Fix ON CONFLICT ... DO NOTHING dropping the target/where/constraint.

View commits

4.2.3

• Fix a compound select (UNION/INTERSECT/EXCEPT) used as a correlated subquery emitting a phantom alias for the correlated outer table in every branch but the left-most, producing invalid SQL (e.g. no such column: t4.id). The right-hand branch renders in a fresh alias scope that no longer resolved the outer source's existing alias, it now inherits the enclosing scope's aliases while still assigning fresh aliases to its own sources.
• Fix full-text search weights passed as a dict being mis-applied to the wrong columns. For FTS3/4 the implicit docid primary-key was included when building the weight list, shifting every column by one (raising IndexError with the Python ranking UDF, silently mis-scoring with the Cython one), for FTS5, UNINDEXED columns were skipped even though bm25() weights are positional across all columns. The list form of weights was unaffected.
• Fix .cte() clearing the source query's CTE list in place: converting a query that carried a with_cte(...) clause into a CTE stripped the clause from that query, so reusing it afterward referenced an undeclared CTE. The query is now cloned before its CTE list is reset.
• Fix Table.select() with no arguments on a Table declared without columns emitting an empty projection (SELECT FROM ...) instead of SELECT *.
• Fix Table.insert(select_query) with no columns raising TypeError instead of rendering INSERT INTO t SELECT ....

... (truncated)

Commits

• 65c793b 4.2.6
• 91761fe Avoid stomping fk value when writing None to descriptor
• 02ac7a8 4.2.5
• f850293 Add clone to stub
• 3610121 Add regression test codifying behavior for outer join population
• 0667d1a Ensure we refresh an anonymous subq's hash :|
• 8cee375 4.2.4
• f10df8e Docs cleanup, cont.
• 0f39030 Doc cleanup in sqlite
• fde5817 Fix collation sql w/explicit ASC/DESC
• Additional commits viewable in compare view

Updates phonenumbers from 9.0.30 to 9.0.35

Commits

• 314e40f Prep for 9.0.35 release
• ba1f5b1 Generated files for metadata
• 6245715 Merge metadata changes from upstream 9.0.35
• 671b53f Prep for 9.0.34 release
• b1f3bb2 Generated files for metadata
• 20eecc2 Merge metadata changes from upstream 9.0.34
• fdcad9b README.md: use pyproject-build tool
• 0efec90 Fix lint
• 6400333 Prep for 9.0.33 release
• 4419992 Generated files for metadata
• Additional commits viewable in compare view

Updates pyjwt from 2.12.1 to 2.13.0

Release notes

Sourced from pyjwt's releases.

2.13.0

PyJWT 2.13.0 — Security Release

This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.

Security

• GHSA-xgmm-8j9v-c9wx — JWK JSON accepted as HMAC secret (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by @​aradona91.

• GHSA-jq35-7prp-9v3f — Algorithm allow-list bypass with PyJWK / PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…] allow-list was checked against the token header alg as a string only; actual verification used the algorithm bound to the PyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header alg to match the PyJWK's algorithm before verification. Reported by @​sushi-gif.

• GHSA-w7vc-732c-9m39 — DoS via base64 decode of unused payload segment when b64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied detached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by @​thesmartshadow.

• GHSA-993g-76c3-p5m4 — PyJWKClient accepts non-HTTP(S) URIs. PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which by default also handles file://, ftp://, and data: schemes. An application that fed an attacker-influenced URI into PyJWKClient could be coerced into reading local files or reaching other unintended schemes. PyJWKClient now rejects any URI whose scheme isn't http or https. Reported by @​KEIJOT.

• GHSA-fhv5-28vv-h8m8 — PyJWKClient cache wiped on fetch error. A finally-block put(jwk_set=None) cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by @​eddieran.

Fixed

• Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with InvalidKeyError instead of accepting them with only a warning. Defends against the os.getenv("JWT_SECRET", "") footgun. Thanks to @​SnailSploit and @​spartan8806 for the reports.
• Forward per-call options (including enforce_minimum_key_length) from PyJWT.decode through to PyJWS._verify_signature. The option was previously silently dropped between the two layers, so it only took effect when set on the PyJWT instance. Thanks to @​WLUB for the report.
• RFC 7797 §3 compliance for b64=false: the encoder now auto-adds "b64" to crit, and the decoder rejects tokens that set b64=false without listing it in crit. Thanks to @​MachineLearning-Nerd for the report.

Changed

• Migrate the dev, docs, and tests package extras to dependency groups, by @​kurtmckee in #1152.

Upgrade notes

Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:

• Empty HMAC keys now raise. If your app passed "" or b"" as a secret (often via a missing env var, e.g. os.getenv("JWT_SECRET", "")), encode/decode will now raise InvalidKeyError. This is the intended behavior — fix the configuration.
• PyJWK decoding now requires the token's alg to match the JWK's algorithm. Previously a mismatch was silently honored if the header alg appeared in the allow-list. Tokens that relied on this mismatch will now fail with InvalidAlgorithmError.
• PyJWKClient now rejects non-HTTP(S) URIs at construction time. Tests or dev environments that fetched JWKS from file:// URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct PyJWKSet.from_dict(...) directly).
• b64=false tokens are now strictly RFC 7515 / 7797 compliant. Tokens with a non-empty compact-form payload segment, or that omit "b64" from crit, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.
• enforce_minimum_key_length set per-call now takes effect. Callers who passed options={"enforce_minimum_key_length": True} to jwt.decode() previously got no enforcement; they will now get InvalidKeyError on undersized keys, as documented.

Full changelog: jpadilla/pyjwt@2.12.1...2.13.0

Changelog

Sourced from pyjwt's changelog.

v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>__

Security

- Reject JWK JSON documents passed as raw HMAC secrets in
  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that
  the existing PEM/SSH guard did not cover. Reported by @aradona91 in
  `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__.
- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during
  verification so the caller's ``algorithms=[...]`` allow-list cannot be
  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported
  by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__.
- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-
  influenced URIs cannot read local files or reach unintended schemes via
  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported
  by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__.
- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.
  The previous ``finally``-block ``put(None)`` pattern cleared the cache
  on any transient outage, turning one bad JWKS request into application-
  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__.
- Skip the unconditional base64 decode of the compact-form payload segment
  when ``b64=false`` is set in the protected header, and require that
  segment to be empty (RFC 7515 Appendix F detached form). Closes an
  unauthenticated DoS amplifier. Reported by @thesmartshadow in
  `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__.
Fixed

- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.
Changed



Migrate the dev, docs, and tests package extras to dependency groups by @​kurtmckee in [#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;__

Commits

• 7144e45 Apply ruff format
• d2f4bec Restore cast() calls with cross-version type: ignore for prepare_key
• 22f478c Remove redundant casts in RSAAlgorithm.prepare_key and `ECAlgorithm.prepare...
• 95791b1 Bundle security fixes and hardening into 2.13.0
• dcc27a9 [pre-commit.ci] pre-commit autoupdate (#1155)
• 9d08a9a [pre-commit.ci] pre-commit autoupdate (#1146)
• b87c100 Bump codecov/codecov-action from 5 to 6 (#1154)
• 40e3147 Migrate development extras to dependency groups (#1152)
• See full diff in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates tqdm from 4.67.3 to 4.70.0

Release notes

Sourced from tqdm's releases.

tqdm v4.70.0 stable

• contrib.concurrent: major improvements
  • support process_map(mp_context, max_tasks_per_child), thread_map(thread_name_prefix) (#1265)
  • fix total based on shortest iterable length (#1473)
  • use default max_workers (#1543 <- #1530, #1518)
  • support timeout, buffersize (#1576)
  • improve ETA (#1708 <- #1161)
  • update as_completed (#1709 <- #1565)
  • add tqdm.concurrent.intepreter_map (#1777)
• asyncio: support iterables with only __aiter__ (#1714 <- #1686)
• support reset(float("inf")) (#1783 <- #1781, #651)
• framework: test & reduce wheel size (#1782)

tqdm v4.69.1 stable

• contrib.logging: preserve filters (#1775 <- #1581)
• rich: misc fixes (#1773)
  • support generators (without len) (#1391)
  • fix potential AttributeError on exit (#1674)
• fix total=float('inf') (#1781 <- #651)
• fix potential AttributeError on exit (#1778 <- #1668, #1537, #261)
• fix minor docs typos (#1780, #1746)

tqdm v4.69.0 stable

• add tqdm.asyncio.gather(..., return_exceptions=False) (#1776, #1671 <- #1286)
• misc minor framework updates
  • bump workflow actions & pre-commit hooks

tqdm v4.68.4 stable

• trim to ncols even when '{bar}' not in bar_format (#1717, #1767 <- #1658)
• fix tqdm.write when stdout=None (#1768 <- #1654)

tqdm v4.68.3 stable

• utils: delay os.get_terminal_size (#1763 <- #1760)
• autonotebook: support QtConsole, Spyder, JupyterLite (#1763, #1628, #1559 <- #1283, #1098,