fix: return a parsed PyJWKSet from the JWK Set cache by jpadilla · Pull Request #1208 · jpadilla/pyjwt

jpadilla · 2026-09-13T11:25:08Z

Fixes #914.

JWKSetCache.put() documents PyJWKSet as the cached value, so callers can pre-populate the JWK Set cache (e.g. from an externally stored JWKS) to skip the network round-trip. But get_jwk_set() only accepted a dict back from the cache, so a cache hit holding a PyJWKSet raised:

PyJWKClientError: The JWKS endpoint did not return a JSON object

which is misleading, since no endpoint call is involved.

The existing tests never caught this because fetch_data() puts the raw JSON payload into the cache, making the internal path accidentally self-consistent: the cache held whichever type the caller happened to put in.

The cache holds a parsed key set

Rather than teaching get_jwk_set() to tolerate both types, the cache normalizes on write:

JWKSetCache.put() accepts either a parsed PyJWKSet or the raw JWKS payload and always stores it parsed. Anything else raises PyJWKSetError, so a bad value fails at the point of the mistake instead of on a later read. get() is now genuinely Optional[PyJWKSet], with no union leaking to callers.
PyJWKClient.fetch_data() now validates that the endpoint returned a JSON object before caching. Parsing at write time otherwise hid that case behind a vaguer PyJWKSetError("Invalid JWK Set value"), and the check only ever made sense next to the response it is about. get_jwk_set() keeps its own copy of the check, since fetch_data() is public and may be overridden.
get_jwk_set() caches the key set it returns. A subclass may filter or transform fetch_data()'s result, and that final value has to be what later cache hits serve. On master this happened to work for an override mutating the payload in place, because the cache held a reference to that same dict; an override returning a new dict was already broken, and parsing on write broke the in-place case too. Caching the returned value fixes both.

Two consequences worth calling out:

Cache hits no longer re-parse (and re-load through cryptography) every key. Measured at 6.4µs → 0.2µs for a one-key JWKS, scaling linearly with key count — and it is per token verification, since cache_keys is off by default.
get_jwk_set() now returns the same PyJWKSet instance for as long as it stays cached, where before each call built a fresh one. A caller mutating a returned set would now be mutating the cache. This is noted in the changelog.

A direct fetch_data() call against an endpoint returning a non-object payload now raises instead of returning it; callers reaching the JWKS through get_jwk_set() see the same error as before.

Malformed JWK Set members

PyJWKSet skips keys it cannot use and raises PyJWKSetError when none remain, but two malformed inputs escaped that contract with exceptions that are not PyJWTError, so callers catching PyJWT's own exceptions saw an uncaught crash:

a member that is not a JSON object ({"keys": [null]}) reached PyJWK.__init__ and raised AttributeError
a key whose components have the wrong type ({"kty": "RSA", "n": 1, "e": "AQAB"}) raised TypeError out of Algorithm.from_jwk, whose handler only caught ValueError

Both are reachable from PyJWKClient, whose payload comes straight from a JWKS endpoint. Non-object members are now skipped like any other unusable key, and the from_jwk handler also catches TypeError so a bad component type becomes InvalidKeyError. A single bad entry no longer fails an otherwise usable JWK Set.

Tests

tests/test_jwks_client.py:

test_get_jwk_set_accepts_externally_cached_pyjwkset — the The JWKS endpoint did not return a JSON object when keys are found in the cache #914 regression; fails on master with the exact error from the issue.
test_client_caches_the_parsed_jwk_set and test_get_jwk_set_reuses_the_cached_instance — the cache stores a parsed set and serves that same instance back.
test_fetch_data_override_result_is_cached — a subclass that drops a key keeps it dropped on the cache hit.
test_cache_put_rejects_a_value_that_is_not_a_jwk_set and test_cache_put_none_clears_the_cache — put() rejects junk and clears on None.
test_get_jwk_set_raises_when_endpoint_does_not_return_an_object — covers the endpoint check, which previously had no test of a real non-object response.

tests/test_api_jwk.py: four tests covering non-object members, a set of only non-object members, invalid component types, and PyJWK raising InvalidKeyError for them.

Verification

pytest: 456 passed, 4 skipped (the skips are pre-existing, for optional cryptography algorithms)
tox -e py314-crypto,py314-nocrypto: both OK
ruff check / ruff format --check: clean
mypy jwt/: clean. Full mypy reports 3 pre-existing pytest.raises overload errors in tests/test_api_jws.py and tests/test_api_jwt.py, untouched by this PR
pyupgrade --py39-plus: no changes
Each fix was written test-first and confirmed to fail against the unfixed code with the exact reported error

Note: pre-commit could not run locally — it resolves the pyupgrade hook env to system Python 3.9.6 while pyupgrade requires >=3.10 — so the linters above were run directly.

`JWKSetCache.put()` documents `PyJWKSet` as the cached value, so callers can pre-populate the JWK Set cache (e.g. from an externally stored JWKS) to skip the network round-trip. `get_jwk_set()` only accepted a `dict` from the cache, so a cache hit holding a `PyJWKSet` raised a misleading `PyJWKClientError("The JWKS endpoint did not return a JSON object")`, even though no endpoint call was involved. Return cached `PyJWKSet` values directly, and widen the cache type hints to `PyJWKSet | dict` so they describe what is actually stored - `fetch_data()` caches the raw JSON payload it fetched, while callers populating the cache themselves store a `PyJWKSet`. Other invalid cache values still raise `PyJWKClientError` as before. Fixes #914 Claude-Session: https://claude.ai/code/session_01Vat3P5EcKjHcRUzSCTtyyu

The previous commit made `get_jwk_set()` tolerate either a `PyJWKSet` or a `dict` coming back from the cache, which fixed #914 but left the cache itself holding whichever type the caller happened to put in. Normalize on write instead: `JWKSetCache.put()` accepts a `PyJWKSet` or the raw JWKS payload and always stores it parsed, so `get()` is typed and behaves as `Optional[PyJWKSet]` with no union leaking to callers. Cache hits no longer re-parse (and re-load through `cryptography`) every key, at the cost of returning one shared `PyJWKSet` instance while it stays cached. Parsing the payload on write hid the endpoint-response check behind a vaguer "Invalid JWK Set value", so that check moves into `fetch_data()`, next to the response it is actually about. Callers going through `get_jwk_set()` see the same error as before; a direct `fetch_data()` call now raises instead of returning a non-object payload. Claude-Session: https://claude.ai/code/session_01Vat3P5EcKjHcRUzSCTtyyu

Claude-Session: https://claude.ai/code/session_01Vat3P5EcKjHcRUzSCTtyyu

Restructuring `put()` made codecov count its cache-clearing branch as a changed line, and it had no test. Clearing the cache is part of the public behavior, so cover it rather than exempt it. Claude-Session: https://claude.ai/code/session_01Vat3P5EcKjHcRUzSCTtyyu

`fetch_data()` caches the payload it received from the endpoint, but a subclass may filter or transform that payload before returning it. Since `put()` now parses on write, the cache kept a snapshot taken before the subclass ran, and the next cache hit served the pre-transform key set — a key the subclass had removed came back. On master this happened to work for an override that mutates the dict in place, because the cache held a reference to that same dict; an override returning a new dict was already broken. Cache the value `get_jwk_set()` is about to return instead, which fixes both. Also makes the returned set and the cached set the same object on the fetch path, so repeated calls are identical rather than merely equal. Claude-Session: https://claude.ai/code/session_01Vat3P5EcKjHcRUzSCTtyyu

`PyJWKSet` skips keys it cannot use and raises `PyJWKSetError` when none remain, but two malformed inputs escaped that contract with exceptions that are not `PyJWTError`, so callers catching PyJWT's own exceptions saw an uncaught crash instead: - a member that is not a JSON object (`{"keys": [null]}`) reached `PyJWK.__init__` and raised `AttributeError` - a key whose components have the wrong type (`{"kty": "RSA", "n": 1, "e": "AQAB"}`) raised `TypeError` out of `Algorithm.from_jwk`, which the surrounding handler only caught for `ValueError` Both are reachable from `PyJWKClient`, whose payload comes straight from a JWKS endpoint. Skip non-object members like any other unusable key, and widen the `from_jwk` handler to `TypeError` so a bad component type becomes `InvalidKeyError`. A single bad entry no longer fails an otherwise usable JWK Set, and a set with nothing usable left raises `PyJWKSetError`. Claude-Session: https://claude.ai/code/session_01Vat3P5EcKjHcRUzSCTtyyu

Brings the malformed-member hardening into this PR. CHANGELOG conflict resolved by folding both Fixed sections together and linking #1208 from the merged entry, since it now ships as part of this PR.

@kytta

Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.14.0 to 2.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.15.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst">2.15.0 changelog</a> for complete release details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0></code>__</h2> <p>Security</p> <pre><code> - Wrap recursion errors from deeply nested JWT payloads in ``DecodeError`` instead of exposing a raw ``RecursionError``. <p>Added</p> <pre><code> - Support Python 3.15 by @kytta in `[#1202](jpadilla/pyjwt#1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__ Changed </code></pre> <ul> <li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code> rather than the raw JWKS payload, so a cache hit no longer re-parses every key. <code>JWKSetCache.put()</code> accepts either form and raises <code>PyJWKSetError</code> for anything else. As a result, <code>PyJWKClient.get_jwk_set()</code> returns the same <code>PyJWKSet</code> instance for as long as it stays cached, rather than a freshly built one per call in <code>[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> <li><code>PyJWKClient.fetch_data()</code> now raises <code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)</code> when the endpoint response is not a JSON object, instead of returning it for <code>get_jwk_set()</code> to reject. Callers reaching the JWKS through <code>get_jwk_set()</code> see the same error as before in <code>[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> </ul> <p>Fixed</p> <pre><code> - Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value, so callers pre-populating the cache to avoid a network round-trip could not read it back in `[#914](jpadilla/pyjwt#914) &lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and `[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a ``fetch_data()`` override that filters or transforms the JWKS is no longer undone by the next cache hit in `[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - Raise the documented ``PyJWTError`` subclass instead of leaking a ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a non-numeric, non-string value such as a list, dict, or ``null``. - Reject OKP JWK private keys when their public ``x`` component does not match the private ``d`` component. - Treat malformed JWK Set members as unusable keys rather than letting ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="jpadilla/pyjwt@1d41a6478e1562e68ff667fcd703356acf085f68"><code>1d41a64</code></a> chore: prepare 2.15.0 release</li> <li><a href="jpadilla/pyjwt@9bc06658f875b9b40091539140bbbdc4639161c3"><code>9bc0665</code></a> fix: make recursive payload tests deterministic</li> <li><a href="jpadilla/pyjwt@5fde08a6cf906aa7698de2d6391d88b73006b17b"><code>5fde08a</code></a> fix: normalize recursive JWT payload errors</li> <li><a href="jpadilla/pyjwt@171062d2d734315272a901100aa4b109f2fc3c19"><code>171062d</code></a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173">#1173</a>)</li> <li><a href="jpadilla/pyjwt@c9d4d5375bf464ef363506fed9eb6e7f33217ab6"><code>c9d4d53</code></a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174">#1174</a>)</li> <li><a href="jpadilla/pyjwt@2763752196113e1473b0ed7905aa6034aedfbe53"><code>2763752</code></a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202">#1202</a>)</li> <li><a href="jpadilla/pyjwt@4adcd02722f5011c60079d3978dfc167b9a8eaa5"><code>4adcd02</code></a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201">#1201</a>)</li> <li><a href="jpadilla/pyjwt@9e501d993b4d3e7dba14bdb1722b1d993ac75097"><code>9e501d9</code></a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179">#1179</a>)</li> <li><a href="jpadilla/pyjwt@4047c44d51950ffda15f40054508d3f17c43b1e2"><code>4047c44</code></a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212">#1212</a>)</li> <li><a href="jpadilla/pyjwt@f4e2b59f543cc82d46d9d69922bba59e804216b9"><code>f4e2b59</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210">#1210</a>)</li> <li>Additional commits viewable in <a href="jpadilla/pyjwt@2.14.0...2.15.0">compare view</a></li> </ul> </details> <br /></code></pre> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyjwt&package-manager=pip&previous-version=2.14.0&new-version=2.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

@kytta

Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.14.0 to 2.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.15.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst">2.15.0 changelog</a> for complete release details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0></code>__</h2> <p>Security</p> <pre><code> - Wrap recursion errors from deeply nested JWT payloads in ``DecodeError`` instead of exposing a raw ``RecursionError``. <p>Added</p> <pre><code> - Support Python 3.15 by @kytta in `[#1202](jpadilla/pyjwt#1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__ Changed </code></pre> <ul> <li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code> rather than the raw JWKS payload, so a cache hit no longer re-parses every key. <code>JWKSetCache.put()</code> accepts either form and raises <code>PyJWKSetError</code> for anything else. As a result, <code>PyJWKClient.get_jwk_set()</code> returns the same <code>PyJWKSet</code> instance for as long as it stays cached, rather than a freshly built one per call in <code>[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> <li><code>PyJWKClient.fetch_data()</code> now raises <code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)</code> when the endpoint response is not a JSON object, instead of returning it for <code>get_jwk_set()</code> to reject. Callers reaching the JWKS through <code>get_jwk_set()</code> see the same error as before in <code>[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> </ul> <p>Fixed</p> <pre><code> - Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value, so callers pre-populating the cache to avoid a network round-trip could not read it back in `[#914](jpadilla/pyjwt#914) &lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and `[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a ``fetch_data()`` override that filters or transforms the JWKS is no longer undone by the next cache hit in `[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - Raise the documented ``PyJWTError`` subclass instead of leaking a ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a non-numeric, non-string value such as a list, dict, or ``null``. - Reject OKP JWK private keys when their public ``x`` component does not match the private ``d`` component. - Treat malformed JWK Set members as unusable keys rather than letting ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="jpadilla/pyjwt@1d41a6478e1562e68ff667fcd703356acf085f68"><code>1d41a64</code></a> chore: prepare 2.15.0 release</li> <li><a href="jpadilla/pyjwt@9bc06658f875b9b40091539140bbbdc4639161c3"><code>9bc0665</code></a> fix: make recursive payload tests deterministic</li> <li><a href="jpadilla/pyjwt@5fde08a6cf906aa7698de2d6391d88b73006b17b"><code>5fde08a</code></a> fix: normalize recursive JWT payload errors</li> <li><a href="jpadilla/pyjwt@171062d2d734315272a901100aa4b109f2fc3c19"><code>171062d</code></a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173">#1173</a>)</li> <li><a href="jpadilla/pyjwt@c9d4d5375bf464ef363506fed9eb6e7f33217ab6"><code>c9d4d53</code></a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174">#1174</a>)</li> <li><a href="jpadilla/pyjwt@2763752196113e1473b0ed7905aa6034aedfbe53"><code>2763752</code></a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202">#1202</a>)</li> <li><a href="jpadilla/pyjwt@4adcd02722f5011c60079d3978dfc167b9a8eaa5"><code>4adcd02</code></a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201">#1201</a>)</li> <li><a href="jpadilla/pyjwt@9e501d993b4d3e7dba14bdb1722b1d993ac75097"><code>9e501d9</code></a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179">#1179</a>)</li> <li><a href="jpadilla/pyjwt@4047c44d51950ffda15f40054508d3f17c43b1e2"><code>4047c44</code></a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212">#1212</a>)</li> <li><a href="jpadilla/pyjwt@f4e2b59f543cc82d46d9d69922bba59e804216b9"><code>f4e2b59</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210">#1210</a>)</li> <li>Additional commits viewable in <a href="jpadilla/pyjwt@2.14.0...2.15.0">compare view</a></li> </ul> </details> <br /></code></pre> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyjwt&package-manager=pip&previous-version=2.14.0&new-version=2.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

@kytta

…sessions (#1088) Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.14.0 to 2.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.15.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst">2.15.0 changelog</a> for complete release details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0></code>__</h2> <p>Security</p> <pre><code> - Wrap recursion errors from deeply nested JWT payloads in ``DecodeError`` instead of exposing a raw ``RecursionError``. <p>Added</p> <pre><code> - Support Python 3.15 by @kytta in `[#1202](jpadilla/pyjwt#1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__ Changed </code></pre> <ul> <li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code> rather than the raw JWKS payload, so a cache hit no longer re-parses every key. <code>JWKSetCache.put()</code> accepts either form and raises <code>PyJWKSetError</code> for anything else. As a result, <code>PyJWKClient.get_jwk_set()</code> returns the same <code>PyJWKSet</code> instance for as long as it stays cached, rather than a freshly built one per call in <code>[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> <li><code>PyJWKClient.fetch_data()</code> now raises <code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)</code> when the endpoint response is not a JSON object, instead of returning it for <code>get_jwk_set()</code> to reject. Callers reaching the JWKS through <code>get_jwk_set()</code> see the same error as before in <code>[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> </ul> <p>Fixed</p> <pre><code> - Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value, so callers pre-populating the cache to avoid a network round-trip could not read it back in `[#914](jpadilla/pyjwt#914) &lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and `[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a ``fetch_data()`` override that filters or transforms the JWKS is no longer undone by the next cache hit in `[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - Raise the documented ``PyJWTError`` subclass instead of leaking a ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a non-numeric, non-string value such as a list, dict, or ``null``. - Reject OKP JWK private keys when their public ``x`` component does not match the private ``d`` component. - Treat malformed JWK Set members as unusable keys rather than letting ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="jpadilla/pyjwt@1d41a6478e1562e68ff667fcd703356acf085f68"><code>1d41a64</code></a> chore: prepare 2.15.0 release</li> <li><a href="jpadilla/pyjwt@9bc06658f875b9b40091539140bbbdc4639161c3"><code>9bc0665</code></a> fix: make recursive payload tests deterministic</li> <li><a href="jpadilla/pyjwt@5fde08a6cf906aa7698de2d6391d88b73006b17b"><code>5fde08a</code></a> fix: normalize recursive JWT payload errors</li> <li><a href="jpadilla/pyjwt@171062d2d734315272a901100aa4b109f2fc3c19"><code>171062d</code></a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173">#1173</a>)</li> <li><a href="jpadilla/pyjwt@c9d4d5375bf464ef363506fed9eb6e7f33217ab6"><code>c9d4d53</code></a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174">#1174</a>)</li> <li><a href="jpadilla/pyjwt@2763752196113e1473b0ed7905aa6034aedfbe53"><code>2763752</code></a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202">#1202</a>)</li> <li><a href="jpadilla/pyjwt@4adcd02722f5011c60079d3978dfc167b9a8eaa5"><code>4adcd02</code></a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201">#1201</a>)</li> <li><a href="jpadilla/pyjwt@9e501d993b4d3e7dba14bdb1722b1d993ac75097"><code>9e501d9</code></a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179">#1179</a>)</li> <li><a href="jpadilla/pyjwt@4047c44d51950ffda15f40054508d3f17c43b1e2"><code>4047c44</code></a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212">#1212</a>)</li> <li><a href="jpadilla/pyjwt@f4e2b59f543cc82d46d9d69922bba59e804216b9"><code>f4e2b59</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210">#1210</a>)</li> <li>Additional commits viewable in <a href="jpadilla/pyjwt@2.14.0...2.15.0">compare view</a></li> </ul> </details> <br /></code></pre> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyjwt&package-manager=uv&previous-version=2.14.0&new-version=2.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langchain-azure/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

@kytta

…39272) Bumps the simple group with 8 updates in the /ci/builder directory: | Package | From | To | | --- | --- | --- | | [boto3](https://github.com/boto/boto3) | `1.43.88` | `1.43.102` | | [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.6.3` | `4.6.4` | | [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.1` | `3.11.2` | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.15.0` | | [pymysql](https://github.com/PyMySQL/PyMySQL) | `1.2.0` | `1.2.3` | | [semver](https://github.com/python-semver/python-semver) | `3.0.4` | `3.1.0` | | [build](https://github.com/pypa/build) | `1.6.0` | `1.6.1` | | [hatchling](https://github.com/pypa/hatch) | `1.32.0` | `1.32.4` | Updates `boto3` from 1.43.88 to 1.43.102 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/boto/boto3/commit/da00dd2d4b31a8fa77d8a10aff153f42175404bf"><code>da00dd2</code></a> Merge branch 'release-1.43.102'</li> <li><a href="https://github.com/boto/boto3/commit/551d660d2c3ef8fedeb0eb40973094c995776857"><code>551d660</code></a> Bumping version to 1.43.102</li> <li><a href="https://github.com/boto/boto3/commit/f63e52e1baa89630baac4975fa46057388cab6f0"><code>f63e52e</code></a> Add changelog entries from botocore</li> <li><a href="https://github.com/boto/boto3/commit/a1acf79e6beaf80ae73eff47fbe81b052b9c14f8"><code>a1acf79</code></a> Merge branch 'release-1.43.101'</li> <li><a href="https://github.com/boto/boto3/commit/931d5a2314056f6e3eefbe0d1ce2e3e19ee18c43"><code>931d5a2</code></a> Merge branch 'release-1.43.101' into develop</li> <li><a href="https://github.com/boto/boto3/commit/8c719efadb1fb3bc606ebd849a70610416ad0121"><code>8c719ef</code></a> Bumping version to 1.43.101</li> <li><a href="https://github.com/boto/boto3/commit/7a0087dd65a461194743ccb1c9bfb378e7256042"><code>7a0087d</code></a> Add changelog entries from botocore</li> <li><a href="https://github.com/boto/boto3/commit/50dcfb23f7007694067549bff55036292db1cdc1"><code>50dcfb2</code></a> Bump the github-actions group across 1 directory with 4 updates (<a href="https://redirect.github.com/boto/boto3/issues/4853">#4853</a>)</li> <li><a href="https://github.com/boto/boto3/commit/b9fcb1869fe9907a77aa024dba34019fcd828da4"><code>b9fcb18</code></a> Bump <a href="https://github.com/astral-sh/ruff-pre-commit">https://github.com/astral-sh/ruff-pre-commit</a> (<a href="https://redirect.github.com/boto/boto3/issues/4849">#4849</a>)</li> <li><a href="https://github.com/boto/boto3/commit/2b8c4ed93e6894617dd47fbd6d7957ff75e60403"><code>2b8c4ed</code></a> Merge branch 'release-1.43.100'</li> <li>Additional commits viewable in <a href="https://github.com/boto/boto3/compare/1.43.88...1.43.102">compare view</a></li> </ul> </details> <br /> Updates `jupyterlab` from 4.6.3 to 4.6.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jupyterlab/jupyterlab/releases">jupyterlab's releases</a>.</em></p> <blockquote> <h2>v4.6.4</h2> <h2>4.6.4</h2> <p>(<a href="https://github.com/jupyterlab/jupyterlab/compare/v4.6.3...1f9dbe334e7d21e4855c9a32c7cd642544ac20c4">Full Changelog</a>)</p> <h3>Security fixes</h3> <ul> <li>GHSA-3325-v43h-43rv - moderate</li> <li>GHSA-6966-vjj6-99xv - high</li> <li>GHSA-jwrc-gm9j-263p - moderate</li> <li>GHSA-3jqq-pw4j-pqcj - moderate</li> </ul> <h3>Bugs fixed</h3> <ul> <li>Backport of security patches on 4.6.x branch <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19793">#19793</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>, <a href="https://github.com/MUFFANUJ"><code>@MUFFANUJ</code></a>)</li> <li>Cache and throttle path resolution to avoid requests storm <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19726">#19726</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Fix race when starting the search - keep correct filter <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19765">#19765</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Fix PyPI extension manager <code>package.json</code> inspection for <code>tar.gz</code> archives <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19613">#19613</a> (<a href="https://github.com/MUFFANUJ"><code>@MUFFANUJ</code></a>)</li> <li>Fix resizing optimization for larger notebooks <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19620">#19620</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Preserve kernelspec metadata when spec is unavailable <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19247">#19247</a> (<a href="https://github.com/tomatotomata"><code>@tomatotomata</code></a>)</li> <li>Fix respecting <code>commsOverSubshells</code> option in <code>connectTo()</code> <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19734">#19734</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Show context actions for all images, not only SVGs <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19618">#19618</a> (<a href="https://github.com/fly1d"><code>@fly1d</code></a>)</li> <li>Save sidebar section expansion state from the hidden flag <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19415">#19415</a> (<a href="https://github.com/jtpio"><code>@jtpio</code></a>)</li> <li>Fix memory leak when Property Inspector is open and other issues exposed by new linter rules <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19318">#19318</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> </ul> <h3>Maintenance and upkeep improvements</h3> <ul> <li>Update links to <code>jupyter-ydoc</code> API after docs pages moved <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19790">#19790</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>CI: align Yarn cache configuration <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19737">#19737</a> (<a href="https://github.com/zihjiang"><code>@zihjiang</code></a>)</li> <li>Use Galata filebrowser helpers in tests <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19645">#19645</a> (<a href="https://github.com/Darshan808"><code>@Darshan808</code></a>)</li> <li>Disable subshell usage in comm example <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19725">#19725</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Remove pin to old ipykernel v7 pre-release in UI tests <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19672">#19672</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Update Altair snapshot <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19488">#19488</a> (<a href="https://github.com/jtpio"><code>@jtpio</code></a>)</li> <li>Use <code>ui-test-report-comment</code> action from <code>maintainer-tools</code> <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19290">#19290</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19307">#19307</a>: Update <code>@jupyter/eslint-plugin</code> to v1.1, adopt ne… <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19315">#19315</a> (<a href="https://github.com/krassowski"><code>@krassowski</code></a>)</li> <li>Update the copyright year to 2026 <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19308">#19308</a> (<a href="https://github.com/JussiRoos"><code>@JussiRoos</code></a>)</li> </ul> <h3>Documentation improvements</h3> <ul> <li>Fix the IPython display link in the json-extension README <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19732">#19732</a> (<a href="https://github.com/jtpio"><code>@jtpio</code></a>)</li> <li>Update announcement banner to point to jupyter-wide announcement banner <a href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19189">#19189</a> (<a href="https://github.com/jasongrout"><code>@jasongrout</code></a>)</li> </ul> <h3>Contributors to this release</h3> <p>The following people contributed discussions, new ideas, code and documentation contributions, and review. See <a href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our definition of contributors</a>.</p> <p>(<a href="https://github.com/jupyterlab/jupyterlab/graphs/contributors?from=2026-08-10&to=2026-09-21&type=c">GitHub contributors page for this release</a>)</p> <p><a href="https://github.com/Darshan808"><code>@Darshan808</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3ADarshan808+updated%3A2026-08-10..2026-09-21&type=Issues">activity</a>) | <a href="https://github.com/fly1d"><code>@fly1d</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Afly1d+updated%3A2026-08-10..2026-09-21&type=Issues">activity</a>) | <a href="https://github.com/jasongrout"><code>@jasongrout</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Ajasongrout+updated%3A2026-08-10..2026-09-21&type=Issues">activity</a>) | <a href="https://github.com/jtpio"><code>@jtpio</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Ajtpio+updated%3A2026-08-10..2026-09-21&type=Issues">activity</a>) | <a href="https://github.com/JussiRoos"><code>@JussiRoos</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3AJussiRoos+updated%3A2026-08-10..2026-09-21&type=Issues">activity</a>) | <a href="https://github.com/krassowski"><code>@krassowski</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Akrassowski+updated%3A2026-08-10..2026-09-21&type=Issues">activity</a>) | <a href="https://github.com/MUFFANUJ"><code>@MUFFANUJ</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3AMUFFANUJ+updated%3A2026-08-10..2026-09-21&type=Issues">activity</a>) | <a href="https://github.com/tomatotomata"><code>@tomatotomata</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Atomatotomata+updated%3A2026-08-10..2026-09-21&type=Issues">activity</a>) | <a href="https://github.com/zihjiang"><code>@zihjiang</code></a> (<a href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Azihjiang+updated%3A2026-08-10..2026-09-21&type=Issues">activity</a>)</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/384bff3af6598b3a6348df58fe34450914b49c41"><code>384bff3</code></a> [ci skip] Publish 4.6.4</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/1f9dbe334e7d21e4855c9a32c7cd642544ac20c4"><code>1f9dbe3</code></a> Merge pull request <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19793">#19793</a> from krassowski/security-patches-4.6.x</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/de324ae91346c713c4f5e5485f97b6e914e0f774"><code>de324ae</code></a> Fix for GHSA-3jqq-pw4j-pqcj</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/f7e5f9803fdf2aaaa0e9bfb9cc73386a8cc5f0b2"><code>f7e5f98</code></a> Fix for GHSA-jwrc-gm9j-263p</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/cf6e89a8d315c4134cefa50c220bca296da466a7"><code>cf6e89a</code></a> Fix for GHSA-6966-vjj6-99xv</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/e277bc958e737130ac47b6c5078d08b29298828f"><code>e277bc9</code></a> Fix for GHSA-3325-v43h-43rv</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/cd569945bc976caaf0018365fe1947f4f69db9e2"><code>cd56994</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19790">#19790</a> on branch 4.6.x (Update links to <code>jupyter-ydoc</code> API after ...</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/bbadd0225a351ffcaa01dcbe7a5d9a364d244150"><code>bbadd02</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19726">#19726</a> on branch 4.6.x (Cache and throttle path resolution to avo...</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/4ccae660976c055d4e2a3f44b1c5fa86e6416ac4"><code>4ccae66</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19765">#19765</a> on branch 4.6.x (Fix race when starting the search - keep ...</li> <li><a href="https://github.com/jupyterlab/jupyterlab/commit/6c0f66433831a889e29fa87639315be1f2f57b6d"><code>6c0f664</code></a> Backport PR <a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19737">#19737</a> on branch 4.6.x (CI: align Yarn cache configuration) (<a href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19766">#19766</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/[email protected]...@jupyterlab/[email protected]">compare view</a></li> </ul> </details> <br /> Updates `matplotlib` from 3.11.1 to 3.11.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/matplotlib/matplotlib/releases">matplotlib's releases</a>.</em></p> <blockquote> <h2>REL: v3.11.2</h2> <p>This is the second bugfix release of the 3.11.x series.</p> <p>This release contains several bug-fixes and adjustments:</p> <ul> <li>Speed up RGBA-stage image resampling</li> <li>Fix <code>hexbin</code> clipping in PDF output</li> <li>Fix <code>\text</code> with internal braces</li> <li>Fix some crashes and make some checks more robust to unlikely cases</li> <li>Fix frame skew when saving GIF animations with <code>PillowWriter</code></li> <li>Fix HiDPI handling in Qt toolbar and WebAgg embeddings</li> <li>Fix <code>ResizeEvent</code> handling for <code>TextBox</code></li> <li>Fix bug with PGF hatch linewidth and color</li> <li>Fix a bug with drawing an empty Collection</li> <li>Fix incorrect glyphs in Cairo backends</li> <li>Improve build system to prevent conflicts between wheels and system libraries</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/matplotlib/matplotlib/commit/d3ca9172e392048ec242b90e8423e88d1a3000b2"><code>d3ca917</code></a> REL: v3.11.2</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/b76fea990aa10afdba9225ee0f058d942cfcb770"><code>b76fea9</code></a> DOC: Set current version to 3.11.2</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/39c7f0678af763abe850b41a71cd2724e326157c"><code>39c7f06</code></a> DOC: Prepare GitHub stats for 3.11.2</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/5dd13e39ceadb89af6e17c64cb0c71a2c3ddc94e"><code>5dd13e3</code></a> Merge branch 'v3.11.1-doc' into release-3.11.2</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/aa484be97e65ffa1c7e2770864dc44a219625180"><code>aa484be</code></a> Merge branch 'v3.11.0-doc' into v3.11.1-doc</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/0e10f83000d7993160feb264f84150b5a4cacfff"><code>0e10f83</code></a> Merge pull request <a href="https://redirect.github.com/matplotlib/matplotlib/issues/32330">#32330</a> from meeseeksmachine/auto-backport-of-pr-32324-on-v...</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/ebe947bd694df95e189fb93b63060051a6b55f3d"><code>ebe947b</code></a> Backport PR <a href="https://redirect.github.com/matplotlib/matplotlib/issues/32324">#32324</a>: Don't force any diagnostics to be errors in bundled Harfbuzz</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/8f4b7c53b228dceded120488f569ff936d91844c"><code>8f4b7c5</code></a> Merge pull request <a href="https://redirect.github.com/matplotlib/matplotlib/issues/32322">#32322</a> from meeseeksmachine/auto-backport-of-pr-32321-on-v...</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/93278ade075ca4b6483afac10f9a2d1e775a5f36"><code>93278ad</code></a> Backport PR <a href="https://redirect.github.com/matplotlib/matplotlib/issues/32321">#32321</a>: DOC: correct note about PyOS_InputHook</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/b0aee786396e59de7ea5a1cec646cbc889250b57"><code>b0aee78</code></a> Merge pull request <a href="https://redirect.github.com/matplotlib/matplotlib/issues/32319">#32319</a> from meeseeksmachine/auto-backport-of-pr-32305-on-v...</li> <li>Additional commits viewable in <a href="https://github.com/matplotlib/matplotlib/compare/v3.11.1...v3.11.2">compare view</a></li> </ul> </details> <br /> Updates `pyjwt` from 2.13.0 to 2.15.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.15.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst">2.15.0 changelog</a> for complete release details.</p> <h2>2.14.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst">2.14.0 changelog</a> for the complete release details and related security advisories.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0></code>__</h2> <p>Security</p> <pre><code> - Wrap recursion errors from deeply nested JWT payloads in ``DecodeError`` instead of exposing a raw ``RecursionError``. <p>Added</p> <pre><code> - Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__ Changed </code></pre> <ul> <li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code> rather than the raw JWKS payload, so a cache hit no longer re-parses every key. <code>JWKSetCache.put()</code> accepts either form and raises <code>PyJWKSetError</code> for anything else. As a result, <code>PyJWKClient.get_jwk_set()</code> returns the same <code>PyJWKSet</code> instance for as long as it stays cached, rather than a freshly built one per call in <code>[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> <li><code>PyJWKClient.fetch_data()</code> now raises <code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)</code> when the endpoint response is not a JSON object, instead of returning it for <code>get_jwk_set()</code> to reject. Callers reaching the JWKS through <code>get_jwk_set()</code> see the same error as before in <code>[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> </ul> <p>Fixed</p> <pre><code> - Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value, so callers pre-populating the cache to avoid a network round-trip could not read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) &lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a ``fetch_data()`` override that filters or transforms the JWKS is no longer undone by the next cache hit in `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - Raise the documented ``PyJWTError`` subclass instead of leaking a ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a non-numeric, non-string value such as a list, dict, or ``null``. - Reject OKP JWK private keys when their public ``x`` component does not match the private ``d`` component. - Treat malformed JWK Set members as unusable keys rather than letting ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68"><code>1d41a64</code></a> chore: prepare 2.15.0 release</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3"><code>9bc0665</code></a> fix: make recursive payload tests deterministic</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b"><code>5fde08a</code></a> fix: normalize recursive JWT payload errors</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19"><code>171062d</code></a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173">#1173</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6"><code>c9d4d53</code></a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174">#1174</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53"><code>2763752</code></a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202">#1202</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5"><code>4adcd02</code></a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201">#1201</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097"><code>9e501d9</code></a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179">#1179</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2"><code>4047c44</code></a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212">#1212</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9"><code>f4e2b59</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210">#1210</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.15.0">compare view</a></li> </ul> </details> <br /></code></pre> Updates `pymysql` from 1.2.0 to 1.2.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/PyMySQL/PyMySQL/releases">pymysql's releases</a>.</em></p> <blockquote> <h2>v1.2.3</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/PyMySQL/PyMySQL/compare/v1.2.2...v1.2.3">https://github.com/PyMySQL/PyMySQL/compare/v1.2.2...v1.2.3</a></p> <h2>v1.2.2</h2> <p>Restored the ability to import <code>pymysql.converters.escape_dict</code> for compatibility with aiomysql. This function does not escape dictionaries and is entirely unnecessary. Unless you use aiomysql, there is no need to upgrade from v1.2.1.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/PyMySQL/PyMySQL/compare/v1.2.1...v1.2.2">https://github.com/PyMySQL/PyMySQL/compare/v1.2.1...v1.2.2</a></p> <h2>v1.2.1</h2> <h2>What's Changed</h2> <ul> <li>Bump codecov/codecov-action from 6 to 7 in the all-dependencies group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1250">PyMySQL/PyMySQL#1250</a></li> <li>Bump actions/checkout from 6 to 7 in the all-dependencies group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1253">PyMySQL/PyMySQL#1253</a></li> <li>Bump the all-dependencies group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1254">PyMySQL/PyMySQL#1254</a></li> <li>Bump astral-sh/ruff-action from 4.0.0 to 4.1.0 in the all-dependencies group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1255">PyMySQL/PyMySQL#1255</a></li> <li>Fix typos in comments: charaset -> charset by <a href="https://github.com/maxtaran2010"><code>@maxtaran2010</code></a> in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1256">PyMySQL/PyMySQL#1256</a></li> <li>Bump the all-dependencies group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1258">PyMySQL/PyMySQL#1258</a></li> <li>Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the all-dependencies group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1261">PyMySQL/PyMySQL#1261</a></li> <li>Fix escape_timedelta for negative values by <a href="https://github.com/dngr2"><code>@dngr2</code></a> in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1262">PyMySQL/PyMySQL#1262</a></li> <li>fix ruff errors by <a href="https://github.com/methane"><code>@methane</code></a> in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1263">PyMySQL/PyMySQL#1263</a></li> <li>Refactor LOAD LOCAL INFILE handling by <a href="https://github.com/methane"><code>@methane</code></a> in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1264">PyMySQL/PyMySQL#1264</a></li> <li>perf: optimize packet reading and parsing by <a href="https://github.com/methane"><code>@methane</code></a> in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1268">PyMySQL/PyMySQL#1268</a></li> <li>agent: document local MySQL test setup by <a href="https://github.com/methane"><code>@methane</code></a> in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1270">PyMySQL/PyMySQL#1270</a></li> <li>fix pymysql authentication state machine issue by <a href="https://github.com/methane"><code>@methane</code></a> in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1271">PyMySQL/PyMySQL#1271</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/maxtaran2010"><code>@maxtaran2010</code></a> made their first contribution in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1256">PyMySQL/PyMySQL#1256</a></li> <li><a href="https://github.com/dngr2"><code>@dngr2</code></a> made their first contribution in <a href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1262">PyMySQL/PyMySQL#1262</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/PyMySQL/PyMySQL/compare/v1.2.0...v1.2.1">https://github.com/PyMySQL/PyMySQL/compare/v1.2.0...v1.2.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/PyMySQL/PyMySQL/blob/main/CHANGELOG.md">pymysql's changelog</a>.</em></p> <blockquote> <h2>v1.2.3</h2> <p>Release date: 2026-09-17</p> <p>Restored the ability to import <code>pymysql.converters.escape_bytes_prefixed</code> for compatibility with aiomysql.</p> <p>Use <code>pymysql.converters</code> at your own risk. It's internal functions. No backward compatibility are guaranteed.</p> <h2>v1.2.2</h2> <p>Release date: 2026-09-17</p> <p>Restored the ability to import <code>pymysql.converters.escape_dict</code> for compatibility with aiomysql. This function does not escape dictionaries and is entirely unnecessary. Unless you use aiomysql, there is no need to upgrade from v1.2.1.</p> <h2>v1.2.1 (security fix)</h2> <p>Release date: 2026-09-17</p> <p>Fixed a SQL injection vulnerability caused by incorrect escaping of <code>bytes</code> parameters when using the big5, gbk, sjis, cp932, or gb18030 character sets. This vulnerability also occurs when strings decoded from <code>bytes</code> using <code>surrogateescape</code> are passed as query parameters.</p> <p>See also: <a href="https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9">https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9</a></p> <ul> <li> <p>Queries are now encoded using the <code>strict</code> error handler instead of <code>surrogateescape</code>. Queries that cannot be encoded using the connection encoding can no longer be sent.</p> </li> <li> <p><code>bytes</code> parameters are now always sent as hexadecimal literals, such as <code>X'636174'</code>. Note that this increases the number of bytes sent.</p> </li> <li> <p>The <code>binary_prefix</code> parameter of <code>connect()</code> is deprecated. The <code>_binary</code> prefix is no longer sent.</p> </li> </ul> <p>These changes address the confirmed SQL injection vulnerabilities related to character encoding. However, we strongly recommend using UTF-8 (<code>utf8mb4</code>). Other character sets are not thoroughly tested, and their limited use means that problems may go unreported. In the 2020s, encodings other than UTF-8 should be considered legacy.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/PyMySQL/PyMySQL/commit/c990e86083c26493f3285b1e047902994c4b1811"><code>c990e86</code></a> v1.2.3</li> <li><a href="https://github.com/PyMySQL/PyMySQL/commit/c93fd977ae6ff210a431e89a2e13ab2870b3c9e0"><code>c93fd97</code></a> add escape_bytes_prefixed. do not use it.</li> <li><a href="https://github.com/PyMySQL/PyMySQL/commit/dea8954dd3fe79461e98467be748ac0d024304d5"><code>dea8954</code></a> release v1.2.2</li> <li><a href="https://github.com/PyMySQL/PyMySQL/commit/4f953ba1d30190006361ce549b6e78b8d269ea44"><code>4f953ba</code></a> fix: add escape_dict alias for aiomysql compatibility</li> <li><a href="https://github.com/PyMySQL/PyMySQL/commit/e13a28f0a66db89d191fdd347a602448fc431f97"><code>e13a28f</code></a> ruff format</li> <li><a href="https://github.com/PyMySQL/PyMySQL/commit/26a031dbd56c0e3575bf251ff787b15fd7b1795a"><code>26a031d</code></a> Prepare 1.2.1 security release</li> <li><a href="https://github.com/PyMySQL/PyMySQL/commit/a1547f580c070732386177851beaebb4a3a6ec20"><code>a1547f5</code></a> Merge commit from fork</li> <li><a href="https://github.com/PyMySQL/PyMySQL/commit/10739bc7781fb85bb9df3d21c2465ba9c3988a2c"><code>10739bc</code></a> fix pymysql authentication state machine issue (<a href="https://redirect.github.com/PyMySQL/PyMySQL/issues/1271">#1271</a>)</li> <li><a href="https://github.com/PyMySQL/PyMySQL/commit/0fa39e9865a4f6dbdeef70dc5ee5e051c3053559"><code>0fa39e9</code></a> agent: document local MySQL test setup (<a href="https://redirect.github.com/PyMySQL/PyMySQL/issues/1270">#1270</a>)</li> <li><a href="https://github.com/PyMySQL/PyMySQL/commit/55c604c95b308d8f67ef0def415f44a8d75426f2"><code>55c604c</code></a> perf: optimize packet reading and parsing (<a href="https://redirect.github.com/PyMySQL/PyMySQL/issues/1268">#1268</a>)</li> <li>Additional commits viewable in <a href="https://github.com/PyMySQL/PyMySQL/compare/v1.2.0...v1.2.3">compare view</a></li> </ul> </details> <br /> Updates `semver` from 3.0.4 to 3.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-semver/python-semver/releases">semver's releases</a>.</em></p> <blockquote> <h2>3.1.0</h2> <h2>What's Changed</h2> <ul> <li>Fix <a href="https://redirect.github.com/python-semver/python-semver/issues/463">#463</a>: Remove duplicate code Version.bump_build by <a href="https://github.com/tomschr"><code>@tomschr</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/464">python-semver/python-semver#464</a></li> <li>Fix <a href="https://redirect.github.com/python-semver/python-semver/issues/460">#460</a> Improve bump_prerelease to alway get a newer version by <a href="https://github.com/Learloj"><code>@Learloj</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/462">python-semver/python-semver#462</a></li> <li>441 update pydantic section of docs by <a href="https://github.com/jbkroner"><code>@jbkroner</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/442">python-semver/python-semver#442</a></li> <li>Fix <a href="https://redirect.github.com/python-semver/python-semver/issues/448">#448</a>: Remove Python 3.7-3.9 (EOL) by <a href="https://github.com/tomschr"><code>@tomschr</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/470">python-semver/python-semver#470</a></li> <li>fix: replace semver.parse() with semver.Version.parse() in docstrings by <a href="https://github.com/koteshyelamati"><code>@koteshyelamati</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/471">python-semver/python-semver#471</a></li> <li>fix: next_version should bump version for build-only versions by <a href="https://github.com/binggao1230"><code>@binggao1230</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/469">python-semver/python-semver#469</a></li> <li>fix(next_version): reset prerelease when token changes (<a href="https://redirect.github.com/python-semver/python-semver/issues/339">#339</a>) by <a href="https://github.com/Mukller"><code>@Mukller</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/472">python-semver/python-semver#472</a></li> <li>Bump cryptography from 49.0.0 to 50.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/python-semver/python-semver/pull/473">python-semver/python-semver#473</a></li> <li>Declare support for Python 3.15 by <a href="https://github.com/edgarrmondragon"><code>@edgarrmondragon</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/475">python-semver/python-semver#475</a></li> <li>Add optional native parser backend (minimal adapter) by <a href="https://github.com/lowmiaq-gmail"><code>@lowmiaq-gmail</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/476">python-semver/python-semver#476</a></li> <li>Reject non-ASCII digits and trailing newlines in version parsing by <a href="https://github.com/Str0k"><code>@Str0k</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/478">python-semver/python-semver#478</a></li> <li>Fix bump_build() silently returning an unchanged version for digitless build metadata by <a href="https://github.com/Str0k"><code>@Str0k</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/480">python-semver/python-semver#480</a></li> <li>Handle malformed collection operands in Version comparisons by <a href="https://github.com/Str0k"><code>@Str0k</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/479">python-semver/python-semver#479</a></li> <li>Change version to 3.1.0 by <a href="https://github.com/tomschr"><code>@tomschr</code></a> in <a href="https://redirect.github.com/python-semver/python-semver/pull/481">python-semver/python-semver#481</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Learloj"><code>@Learloj</code></a> made their first contribution in <a href="https://redirect.github.com/python-semver/python-semver/pull/462">python-semver/python-semver#462</a></li> <li><a href="https://github.com/jbkroner"><code>@jbkroner</code></a> made their first contribution in <a href="https://redirect.github.com/python-semver/python-semver/pull/442">python-semver/python-semver#442</a></li> <li><a href="https://github.com/koteshyelamati"><code>@koteshyelamati</code></a> made their first contribution in <a href="https://redirect.github.com/python-semver/python-semver/pull/471">python-semver/python-semver#471</a></li> <li><a href="https://github.com/binggao1230"><code>@binggao1230</code></a> made their first contribution in <a href="https://redirect.github.com/python-semver/python-semver/pull/469">python-semver/python-semver#469</a></li> <li><a href="https://github.com/Mukller"><code>@Mukller</code></a> made their first contribution in <a href="https://redirect.github.com/python-semver/python-semver/pull/472">python-semver/python-semver#472</a></li> <li><a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] made their first contribution in <a href="https://redirect.github.com/python-semver/python-semver/pull/473">python-semver/python-semver#473</a></li> <li><a href="https://github.com/edgarrmondragon"><code>@edgarrmondragon</code></a> made their first contribution in <a href="https://redirect.github.com/python-semver/python-semver/pull/475">python-semver/python-semver#475</a></li> <li><a href="https://github.com/lowmiaq-gmail"><code>@lowmiaq-gmail</code></a> made their first contribution in <a href="https://redirect.github.com/python-semver/python-semver/pull/476">python-semver/python-semver#476</a></li> <li><a href="https://github.com/Str0k"><code>@Str0k</code></a> made their first contribution in <a href="https://redirect.github.com/python-semver/python-semver/pull/478">python-semver/python-semver#478</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/python-semver/python-semver/compare/3.0.4...3.1.0">https://github.com/python-semver/python-semver/compare/3.0.4...3.1.0</a> <strong>Documentation</strong>: <a href="https://python-semver.readthedocs.io/en/latest/">https://python-semver.readthedocs.io/en/latest/</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python-semver/python-semver/blob/master/CHANGELOG.rst">semver's changelog</a>.</em></p> <blockquote> <h1>Version 3.1.0</h1> <p>:Released: 2026-09-12 :Maintainer: Tom Schraitle</p> <h2>Bug Fixes</h2> <ul> <li> <p>:pr:<code>478</code>: <code>Version.parse()</code> and <code>Version.is_valid()</code> now reject non-ASCII digits and trailing newlines, in accordance with the SemVer grammar. Optional minor and patch parsing applies the same character restrictions.</p> </li> <li> <p>:pr:<code>479</code>: Comparing a :class:<code>~semver.Version</code> with a <code>dict</code>, <code>tuple</code>, or <code>list</code> that cannot construct a valid version (for example, an empty collection, wrong number of parts, non-numeric parts, or unknown keys) no longer raises internal errors from <code>Version.__init__</code>. The comparison operators now return :py:const:<code>NotImplemented</code> for such operands, following the general rule for invalid comparison operand types: equality evaluates to <code>False</code> and ordering raises Python's standard :py:exc:<code>TypeError</code> (for example, <code>'>' not supported between instances of 'Version' and 'dict'</code>).</p> </li> <li> <p>:pr:<code>480</code>: (:meth:<code>~semver.version.Version.bump_build</code>) will now add <code>.0</code> to an existing build when the last segment of the current build metadata, split by dots (<code>.</code>), is not numeric. This is to ensure the bumped version contains a raised build instead of silently returning an unchanged version. For example, <code>1.2.3+alpha</code> is bumped to <code>1.2.3+alpha.0</code>. This mirrors the corresponding fix for the prerelease part (:gh:<code>460</code>). Related to :gh:<code>466</code>.</p> </li> <li> <p>:gh:<code>460</code>: :meth:<code>~semver.version.Version.bump_prerelease</code> will now add <code>.0</code> to an existing prerelease when the last segment of the current prerelease, split by dots (<code>.</code>), is not numeric. This is to ensure the new prerelease is considered higher than the previous one.</p> <p>:meth:<code>~semver.version.Version.bump_prerelease</code> now also support an argument <code>bump_when_empty</code> which will bump the patch version if there is no existing prerelease, to ensure the resulting version is considered a higher version than the previous one.</p> </li> </ul> <h2>Features</h2> <ul> <li>:pr:<code>476</code>: Added optional <code>[native]</code> extra to accelerate parsing on CPython via the <code>fast-semver-rs-backend</code> package. The pure-Python parser remains the default; the native backend is opt-in and only available on CPython.</li> </ul> <h2>Internal Changes</h2> <p>: Update GitHub Actions for astral-sh/setup-uv (version 0.10.1), github/codeql-action (version 4)</p> <h2>Trivial Changes</h2> <ul> <li>:gh:<code>463</code>: Remove double code in :meth:<code>Version.bump_build</code></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-semver/python-semver/commit/642d1bc8949d38cca7922df478d0f2c06513f99d"><code>642d1bc</code></a> Change version to 3.1.0 (<a href="https://redirect.github.com/python-semver/python-semver/issues/481">#481</a>)</li> <li><a href="https://github.com/python-semver/python-semver/commit/2a2cf632f9b6c6b5731db85284db129e0d07837d"><code>2a2cf63</code></a> Suppress deprecation warnings in test suite</li> <li><a href="https://github.com/python-semver/python-semver/commit/a62477b6113791ed046e71936754e285892fd1ed"><code>a62477b</code></a> Improve comparisons and fix test coverage.</li> <li><a href="https://github.com/python-semver/python-semver/commit/0aa17a3447958cfe13634b0c3917e7aa4eee3334"><code>0aa17a3</code></a> Handle malformed collection operands in Version comparisons (<a href="https://redirect.github.com/python-semver/python-semver/issues/479">#479</a>)</li> <li><a href="https://github.com/python-semver/python-semver/commit/1b7350c1a7cacea983ab10b345990fee78761d44"><code>1b7350c</code></a> Improve test coverage to 100% (Rust backend)</li> <li><a href="https://github.com/python-semver/python-semver/commit/ea2524a51767cefab58a9b3bb6bcf38e5cdc7d54"><code>ea2524a</code></a> Fix bump_build() silently returning an unchanged version for digitless build ...</li> <li><a href="https://github.com/python-semver/python-semver/commit/1e8757912f633684e1a65d9d7c7e2270c3c79928"><code>1e87579</code></a> Reject non-ASCII digits and trailing newlines in version parsing (<a href="https://redirect.github.com/python-semver/python-semver/issues/478">#478</a>)</li> <li><a href="https://github.com/python-semver/python-semver/commit/0f18aa0b1e0cabba65ee1b506e637faabcdf5d05"><code>0f18aa0</code></a> Add optional native parser backend (minimal adapter) (<a href="https://redirect.github.com/python-semver/python-semver/issues/476">#476</a>)</li> <li><a href="https://github.com/python-semver/python-semver/commit/873a6750f22e82f72fb7c8c4a1ebe958beaa2f1a"><code>873a675</code></a> Declare support for Python 3.15 (<a href="https://redirect.github.com/python-semver/python-semver/issues/475">#475</a>)</li> <li><a href="https://github.com/python-semver/python-semver/commit/99d2032c8f7ef4895df25053ddcdcb85d5460326"><code>99d2032</code></a> Bump cryptography from 49.0.0 to 50.0.0 (<a href="https://redirect.github.com/python-semver/python-semver/issues/473">#473</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python-semver/python-semver/compare/3.0.4...3.1.0">compare view</a></li> </ul> </details> <br /> Updates `build` from 1.6.0 to 1.6.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/build/releases">build's releases</a>.</em></p> <blockquote> <h2>1.6.1</h2>  <h2>What's Changed</h2> <ul> <li>chore[v1]: prepare for v1.6.1 by <a href="https://github.com/henryiii"><code>@henryiii</code></a> in <a href="https://redirect.github.com/pypa/build/pull/1181">pypa/build#1181</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pypa/build/compare/1.6.0...1.6.1">https://github.com/pypa/build/compare/1.6.0...1.6.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/build/blob/main/CHANGELOG.rst">build's changelog</a>.</em></p> <blockquote> <p>#################### 1.6.1 (2026-09-10) ####################</p> <hr /> <p>Bugfixes</p> <hr /> <ul> <li>Avoid trying to detect symlinks on Windows, regression in 1.6.0 - by :user:<code>henryiii</code> (:issue:<code>1175</code>) (:issue:<code>1175</code>)</li> </ul> <hr /> <p>Documentation</p> <hr /> <ul> <li>Fix doubled backslashes in the Windows pip config path (<code>%APPDATA%\pip\pip.ini</code>) in the docs - by :user:<code>aroh3006</code> (:issue:<code>1149</code>)</li> </ul> <hr /> <p>Miscellaneous</p> <hr /> <ul> <li>:issue:<code>1168</code>, :issue:<code>1170</code>, :issue:<code>1178</code></li> </ul> <p>#################### 1.6.0 (2026-08-27) ####################</p> <hr /> <p>Features</p> <hr /> <ul> <li>Add <code>--report=PATH</code> to write a machine-readable JSON report of built artifacts; <code>--metadata</code> now also accepts <code>.whl</code> files - by :user:<code>gaborbernat</code> (:issue:<code>198</code>)</li> <li>The <code>srcdir</code> argument now accepts <code>.tar.gz</code> source distributions, extracting and building from them - by :user:<code>gaborbernat</code> (:issue:<code>311</code>)</li> <li>The "Unmet dependencies" error from <code>--no-isolation</code> builds now shows the wanted version, found version, and interpreter - by :user:<code>gaborbernat</code> (:issue:<code>504</code>)</li> <li>Add <code>--sdist-extract-dir</code> to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:<code>gaborbernat</code> (:issue:<code>614</code>)</li> <li>Add <code>--env-dir</code> to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds <ul> <li>by :user:<code>gaborbernat</code> (:issue:<code>655</code>)</li> </ul> </li> <li>Print a summary of resolved dependency versions (<code>name==version</code>) after installing them in isolated builds - by :user:<code>gaborbernat</code> (:issue:<code>959</code>)</li> <li>On build failure, print a tip pointing to <code>--env-dir</code> and <code>--sdist-extract-dir</code> for debugging and link to the "Debug a failed build" how-to - reported by :user:<code>dimpase</code>, implemented by :user:<code>gaborbernat</code> (:issue:<code>966</code>)</li> </ul> <hr /> <p>Bugfixes</p> <hr />  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/build/commit/89cccef40df9011f03bec18cf52c53d1096ed6ee"><code>89cccef</code></a> chore: prepare for 1.6.1</li> <li><a href="https://github.com/pypa/build/commit/a6f707a75fc8548d7707645e97c7903197387849"><code>a6f707a</code></a> ci: support releases from v* branches (<a href="https://redirect.github.com/pypa/build/issues/1178">#1178</a>)</li> <li><a href="https://github.com/pypa/build/commit/77851610de5d3894fa8a88e06e0232901cf93758"><code>7785161</code></a> docs: fix doubled backslashes in Windows pip config path (<a href="https://redirect.github.com/pypa/build/issues/1149">#1149</a>)</li> <li><a href="https://github.com/pypa/build/commit/244b250c3219070eebb29764f7709262d48afd41"><code>244b250</code></a> fix: always use copies for the isolated venv on Windows (<a href="https://redirect.github.com/pypa/build/issues/1176">#1176</a>)</li> <li><a href="https://github.com/pypa/build/commit/c93ca6f6d252e4d8df7fda4a61f8f9ed8a55a411"><code>c93ca6f</code></a> build(deps): bump re-actors/alls-green from 1.2.2 to 1.3.0 in the github-acti...</li> <li><a href="https://github.com/pypa/build/commit/e02ffd32241aec2e306d90869417c1e900c0adb4"><code>e02ffd3</code></a> pre-commit: bump repositories (<a href="https://redirect.github.com/pypa/build/issues/1173">#1173</a>)</li> <li><a href="https://github.com/pypa/build/commit/aad39a800e3d81bf907018ebe2fab135717da59b"><code>aad39a8</code></a> docs: fix changelog page heading levels and sidebar (<a href="https://redirect.github.com/pypa/build/issues/1171">#1171</a>)</li> <li><a href="https://github.com/pypa/build/commit/5c3fd46b5c38c7caea5dd95ce365971104a734aa"><code>5c3fd46</code></a> docs: use PyPI ref directly (<a href="https://redirect.github.com/pypa/build/issues/1172">#1172</a>)</li> <li><a href="https://github.com/pypa/build/commit/1c5bd6c21cbd33c1816978d45219d48fb4c2b269"><code>1c5bd6c</code></a> 🐛 fix(release): format generated changelog (<a href="https://redirect.github.com/pypa/build/issues/1170">#1170</a>)</li> <li><a href="https://github.com/pypa/build/commit/7f0cc7ed19969558c7daeaa3652ce2ffc81599c1"><code>7f0cc7e</code></a> 🔧 build(type): replace mypy with pyrefly (<a href="https://redirect.github.com/pypa/build/issues/1168">#1168</a>)</li> <li>See full diff in <a href="https://github.com/pypa/build/compare/1.6.0...1.6.1">compare view</a></li> </ul> </details> <br /> Updates `hatchling` from 1.32.0 to 1.32.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/hatch/releases">hatchling's releases</a>.</em></p> <blockquote> <h2>Hatchling v1.32.4</h2> <p><em><strong>Fixed:</strong></em></p> <ul> <li>Revert the extra type parameter added to <code>BuildHookInterface</code> in 1.32.3, which broke plugins that subscripted the interface with a single argument (e.g. <code>BuildHookInterface[MyConfig]</code>) by raising <code>TypeError</code> at import time. <code>BuilderConfig</code> is likewise no longer generic, restoring the pre-1.32.3 plugin interface.</li> <li>Strip spaces around version metadata when using original input for CalVer to keep leading zeroes.</li> </ul> <h2>Hatchling v1.32.3</h2> <p><em><strong>Fixed:</strong></em></p> <ul> <li>Preserve the version string exactly as written in core metadata, so stylized versions such as CalVer <code>2026.08.10</code> are no longer stripped of leading zeros. Distribution file names and <code>.dist-info</code> directories continue to use the PEP 440 normalized form.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/hatch/commit/c4abc454f908bb4fc2a92452a82cb33dac14abf3"><code>c4abc45</code></a> release Hatchling v1.32.4 (<a href="https://redirect.github.com/pypa/hatch/issues/2441">#2441</a>)</li> <li><a href="https://github.com/pypa/hatch/commit/cd57f6890dd0929165ebbcb2effa171a8d9defdd"><code>cd57f68</code></a> Revert type changes for BuildHookInterface (<a href="https://redirect.github.com/pypa/hatch/issues/2440">#2440</a>)</li> <li><a href="https://github.com/pypa/hatch/commit/5c6dc6c67ff91998bedc61b12787c13ac973bca0"><code>5c6dc6c</code></a> Strip surrounding whitespace from version metadata (<a href="https://redirect.github.com/pypa/hatch/issues/2438">#2438</a>)</li> <li><a href="https://github.com/pypa/hatch/commit/0941887cd24b8585c30761d0396d9357e9d9effe"><code>0941887</code></a> release Hatchling v1.32.3 (<a href="https://redirect.github.com/pypa/hatch/issues/2436">#2436</a>)</li> <li><a href="https://github.com/pypa/hatch/commit/6a2b14f466a27e833a2e398eeed7c40867efee6c"><code>6a2b14f</code></a> release Hatchling v1.32.2 (<a href="https://redirect.github.com/pypa/hatch/issues/2434">#2434</a>)</li> <li><a href="https://github.com/pypa/hatch/commit/081013fad3dcf306cff3f42edd7ab1912ea8b687"><code>081013f</code></a> Hatchling 1.32.2 release (<a href="https://redirect.github.com/pypa/hatch/issues/2433">#2433</a>)</li> <li><a href="https://github.com/pypa/hatch/commit/248141c335525f4a2ca36bbd396d6fc5a5627c80"><code>248141c</code></a> Use hatchling plugin manager (<a href="https://redirect.github.com/pypa/hatch/issues/2432">#2432</a>)</li> <li><a href="https://github.com/pypa/hatch/commit/4b17561f822b1b416403a61855374892ecbe11de"><code>4b17561</code></a> release Hatch v1.18.1 (<a href="https://redirect.github.com/pypa/hatch/issues/2426">#2426</a>)</li> <li><a href="https://github.com/pypa/hatch/commit/b6aaa1a3cac6be652ac90c8c79612bddcca733ea"><code>b6aaa1a</code></a> release Hatchling v1.32.1 (<a href="https://redirect.github.com/pypa/hatch/issues/2425">#2425</a>)</li> <li><a href="https://github.com/pypa/hatch/commit/47f333a98228c326786d3919f346bd7b74d9cf8f"><code>47f333a</code></a> Prepare for hatch and hatchling releases (<a href="https://redirect.github.com/pypa/hatch/issues/2424">#2424</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pypa/hatch/compare/hatchling-v1.32.0...hatchling-v1.32.4">compare view</a></li> </ul> </details> <br /> <details> <summary>Most Recent Ignore Conditions Applied to This Pull Request</summary> | Dependency Name | Ignore Conditions | | --- | --- | | boto3 | [>= 1.42.dev0, < 1.43] | </details> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

@kytta

Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.14.0 to 2.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.15.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst">2.15.0 changelog</a> for complete release details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0></code>__</h2> <p>Security</p> <pre><code> - Wrap recursion errors from deeply nested JWT payloads in ``DecodeError`` instead of exposing a raw ``RecursionError``. <p>Added</p> <pre><code> - Support Python 3.15 by @kytta in `[#1202](jpadilla/pyjwt#1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__ Changed </code></pre> <ul> <li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code> rather than the raw JWKS payload, so a cache hit no longer re-parses every key. <code>JWKSetCache.put()</code> accepts either form and raises <code>PyJWKSetError</code> for anything else. As a result, <code>PyJWKClient.get_jwk_set()</code> returns the same <code>PyJWKSet</code> instance for as long as it stays cached, rather than a freshly built one per call in <code>[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> <li><code>PyJWKClient.fetch_data()</code> now raises <code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)</code> when the endpoint response is not a JSON object, instead of returning it for <code>get_jwk_set()</code> to reject. Callers reaching the JWKS through <code>get_jwk_set()</code> see the same error as before in <code>[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> </ul> <p>Fixed</p> <pre><code> - Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value, so callers pre-populating the cache to avoid a network round-trip could not read it back in `[#914](jpadilla/pyjwt#914) &lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and `[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a ``fetch_data()`` override that filters or transforms the JWKS is no longer undone by the next cache hit in `[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - Raise the documented ``PyJWTError`` subclass instead of leaking a ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a non-numeric, non-string value such as a list, dict, or ``null``. - Reject OKP JWK private keys when their public ``x`` component does not match the private ``d`` component. - Treat malformed JWK Set members as unusable keys rather than letting ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="jpadilla/pyjwt@1d41a6478e1562e68ff667fcd703356acf085f68"><code>1d41a64</code></a> chore: prepare 2.15.0 release</li> <li><a href="jpadilla/pyjwt@9bc06658f875b9b40091539140bbbdc4639161c3"><code>9bc0665</code></a> fix: make recursive payload tests deterministic</li> <li><a href="jpadilla/pyjwt@5fde08a6cf906aa7698de2d6391d88b73006b17b"><code>5fde08a</code></a> fix: normalize recursive JWT payload errors</li> <li><a href="jpadilla/pyjwt@171062d2d734315272a901100aa4b109f2fc3c19"><code>171062d</code></a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173">#1173</a>)</li> <li><a href="jpadilla/pyjwt@c9d4d5375bf464ef363506fed9eb6e7f33217ab6"><code>c9d4d53</code></a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174">#1174</a>)</li> <li><a href="jpadilla/pyjwt@2763752196113e1473b0ed7905aa6034aedfbe53"><code>2763752</code></a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202">#1202</a>)</li> <li><a href="jpadilla/pyjwt@4adcd02722f5011c60079d3978dfc167b9a8eaa5"><code>4adcd02</code></a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201">#1201</a>)</li> <li><a href="jpadilla/pyjwt@9e501d993b4d3e7dba14bdb1722b1d993ac75097"><code>9e501d9</code></a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179">#1179</a>)</li> <li><a href="jpadilla/pyjwt@4047c44d51950ffda15f40054508d3f17c43b1e2"><code>4047c44</code></a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212">#1212</a>)</li> <li><a href="jpadilla/pyjwt@f4e2b59f543cc82d46d9d69922bba59e804216b9"><code>f4e2b59</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210">#1210</a>)</li> <li>Additional commits viewable in <a href="jpadilla/pyjwt@2.14.0...2.15.0">compare view</a></li> </ul> </details> <br /></code></pre> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyjwt&package-manager=pip&previous-version=2.14.0&new-version=2.15.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the pip group with 11 updates: | Package | From | To | | --- | --- | --- | | [alembic](https://github.com/sqlalchemy/alembic) | `1.19.1` | `1.20.0` | | [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.44.0` | `1.45.0` | | [opentelemetry-instrumentation-fastapi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.65b0` | `0.66b0` | | [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) | `1.44.0` | `1.45.0` | | [psycopg](https://github.com/psycopg/psycopg) | `3.3.2` | `3.3.6` | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.15.0` | | [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.52` | `2.1.0` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.4` | `0.54.0` | | [pytest-cov](https://github.com/pytest-dev/pytest-cov) | `7.0.0` | `7.1.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.13.2` | `0.16.9` | | [hatchling](https://github.com/pypa/hatch) | `1.28.0` | `1.32.4` | Updates `alembic` from 1.19.1 to 1.20.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sqlalchemy/alembic/releases">alembic's releases</a>.</em></p> <blockquote> <h1>1.20.0</h1> <p>Released: September 11, 2026</p> <h2>usecase</h2> <ul> <li> <p><strong>[usecase] [batch]</strong> Added a warning for the case where an unnamed CHECK constraint on a reflected table is omitted from a batch "recreate" operation. An unnamed CHECK constraint can't be reliably carried over in a batch recreate as it may refer to columns that are being dropped or changed. This omission was previously a silent operation. The presence of any <code>~sqlalchemy.schema.CheckConstraint</code> in <code>Operations.batch_alter_table.table_args</code> is taken to indicate that the case has been accommodated, and no warning is emitted.</p> <p>References: <a href="https://redirect.github.com/sqlalchemy/alembic/issues/1846">#1846</a></p> </li> <li> <p><strong>[usecase] [autogenerate]</strong> Autogenerate now renders a warning comment above any rendered <code>Operations.drop_constraint()</code> directive for which the constraint name is <code>None</code>, as is the case when a constraint that has no name in the model is dropped, most typically within the <code>downgrade()</code> function of a migration that adds an unnamed constraint. A warning is also emitted on the console when the migration script is generated. The directive requires a non-None name in order to be able to emit a "DROP CONSTRAINT" command.</p> <p>References: <a href="https://redirect.github.com/sqlalchemy/alembic/issues/916">#916</a></p> </li> </ul> <h2>bug</h2> <ul> <li> <p><strong>[bug] [batch]</strong> Fixed bug in batch mode where adding a column with a type that generates its own CHECK constraint, such as <code>~sqlalchemy.types.Boolean</code> or <code>~sqlalchemy.types.Enum</code> with <code>~sqlalchemy.types.Boolean.create_constraint</code> set to <code>True</code>, would emit the constraint twice when the table was recreated, once under the name generated by the naming convention in use and once under the name given to the type. The constraint is now emitted once, using the same name that would be used outside of batch mode.</p> <p>References: <a href="https://redirect.github.com/sqlalchemy/alembic/issues/1768">#1768</a></p> </li> <li> <p><strong>[bug] [batch]</strong> Fixed bug in batch mode where a CHECK constraint generated by a type such as <code>~sqlalchemy.types.Boolean</code> or <code>~sqlalchemy.types.Enum</code> would lose the name established for it by the naming convention in use when the table was recreated, as the constraint was regenerated against the temporary table used for the recreate operation. The naming convention is now resolved against the name of the table being replaced.</p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sqlalchemy/alembic/commits">compare view</a></li> </ul> </details> <br /> Updates `opentelemetry-api` from 1.44.0 to 1.45.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-python/releases">opentelemetry-api's releases</a>.</em></p> <blockquote> <h2>Version 1.45.0/0.66b0</h2> <h3>Added</h3> <ul> <li><code>opentelemetry-exporter-prometheus</code>: add support to configure Resource attributes as metric labels (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122">#5122</a>)</li> <li>infra: add renovate (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202">#5202</a>)</li> <li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add support for extended attribute values everywhere. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266">#5266</a>)</li> <li><code>opentelemetry-sdk</code>: wire the top-level <code>log_level</code> field in declarative configuration — when set, maps the OTel <code>SeverityNumber</code> value to a Python logging level and applies it to the <code>opentelemetry</code> logger so SDK internal diagnostics respect the configured severity. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351">#5351</a>)</li> <li><code>opentelemetry-sdk</code>: add the new stable <code>AlwaysRecordSampler</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354">#5354</a>)</li> <li><code>opentelemetry-configuration</code>, <code>opentelemetry-sdk</code>: wire top-level <code>attribute_limits</code> into per-signal providers via declarative config; add <code>log_record_limits</code> support to <code>LoggerProvider</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365">#5365</a>)</li> <li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON HTTP exporter package (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374">#5374</a>)</li> <li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add <code>enabled()</code> support to the Logger API, SDK, and <code>LogRecordProcessor</code> to let instrumentation skip expensive work when logging is disabled (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380">#5380</a>)</li> <li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON file Docker tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412">#5412</a>)</li> <li><code>opentelemetry-configuration</code>: wire the experimental <code>tracer_configurator/development</code>, <code>meter_configurator/development</code> and <code>logger_configurator/development</code> fields into <code>create_tracer_provider</code>, <code>create_meter_provider</code> and <code>create_logger_provider</code>, so per-instrumentation-scope <code>enabled</code> overrides declared in the config file are applied to the provider (previously these fields were parsed but silently discarded). The logger <code>minimum_severity</code>/<code>trace_based</code> fields are not supported by the Python SDK and are ignored with a warning. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5418">#5418</a>)</li> <li><code>docs/examples</code>: add example on how to manually setup the SDK to get SDK metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5449">#5449</a>)</li> <li><code>opentelemetry-docker-tests</code>: add Prometheus exporter docker tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5457">#5457</a>)</li> <li><code>opentelemetry-sdk</code>: count records dropped after shutdown on <code>otel.sdk.processor.{span,log}.processed</code> with <code>error.type=already_shutdown</code> (batch span/log and simple log processors), which the semantic conventions define as a valid value for this metric. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5509">#5509</a>)</li> <li><code>opentelemetry-semantic-conventions</code>: update semantic conventions to v1.44.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5511">#5511</a>)</li> <li><code>opentelemetry-sdk</code>: add <code>host.id</code> to the host resource detector (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5653">#5653</a>)</li> <li><code>opentelemetry-test-utils</code>: add <code>CapturingSampler</code> to record what samplers receive in instrumentation tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5681">#5681</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Enable <code>PIE</code> (flake8-pie) ruff rule and fix all violations (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5150">#5150</a>)</li> <li>The public <code>opentelemetry.util.types.AttributeValue</code> type in package <code>opentelemetry-api</code> is being expanded to include <code>None</code>, heterogeneous sequences of primitive types (and nested sequences) as opposed to only homogeneous primitive sequences, and Mappings of strings to any primitive types or sequences/mappings (which themselves must only contain primitive types or sequences/mappings validated the same way). If a <code>bytes</code> type is set as an attribute value in the SDK, it will no longer be utf-8 decoded to a string, instead it will be passed along as is in accordance with the OTEL spec, since <code>bytes</code> is a valid type in the OTLP proto. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266">#5266</a>)</li> <li><code>opentelemetry-exporter-otlp-proto-http</code>: add a <code>max_request_size</code> argument to the OTLP HTTP exporters (traces, logs, metrics); serialized requests larger than the limit are dropped before sending, measured before compression. Defaults to 64 MiB (enabled); set to 0 to disable. Mirrors opentelemetry-go#8157. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5369">#5369</a>)</li> <li>[BREAKING] <code>opentelemetry-api</code>: subclasses of <code>Logger</code> need to implement the <code>enabled</code> method (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380">#5380</a>)</li> <li><code>opentelemetry-exporter-otlp-proto-http</code>: refactor to use shared opentelemetry-exporter-otlp-common and opentelemetry-exporter-http-transport packages and switch default HTTP backend to urllib3 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5389">#5389</a>)</li> <li><code>opentelemetry-sdk</code>: unify logging force_flush timeout defaults to 30000ms (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5438">#5438</a>)</li> <li><code>opentelemetry-python</code>: enable Ruff default ruleset and fix auto-fixable lint issues (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5491">#5491</a>)</li> <li><code>opentelemetry-sdk</code>: <code>SimpleSpanProcessor</code> now drops spans ended after <code>shutdown()</code> instead of passing them to the exporter, and counts them on <code>otel.sdk.processor.span.processed</code> with <code>error.type=already_shutdown</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5512">#5512</a>)</li> <li>Bump pytest to 9.0.3 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5518">#5518</a>)</li> <li><code>opentelemetry-exporter-otlp-proto-http</code>: clarify that the <code>endpoint=</code> kwarg requires the full signal path (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5633">#5633</a>)</li> <li><code>opentelemetry-sdk</code>: fix typos in SpanLimits docstring (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5658">#5658</a>)</li> </ul> <h3>Fixed</h3> <ul> <li><code>opentelemetry-configuration</code>: perform environment variable substitution on scalar values after parsing the configuration file, so <code>${VAR}</code> references inside comments and mapping keys are no longer substituted and undefined references in comments no longer abort loading (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5407">#5407</a>)</li> <li><code>opentelemetry-configuration</code>: declarative config environment variable substitution now replaces an unset variable that has no default with an empty value instead of raising an error, per the configuration spec. Resource attributes whose value resolves to null (an unset <code>${VAR}</code> with no default) are skipped with a warning instead of being inserted as a null value. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5408">#5408</a>)</li> <li>'scripts/build.sh<code>: add </code>opentelemetry-configuration<code>and</code>opentelemetry-proto-json` to the package to release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5425">#5425</a>)</li> <li><code>opentelemetry-sdk</code>: fix <code>View</code> instrument-name matching so a view configured with an instrument's real (mixed-case) name is applied; matching is now case-insensitive and platform-independent instead of relying on <code>fnmatch</code>'s OS-dependent case handling (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5430">#5430</a>)</li> <li><code>opentelemetry-sdk</code>: fix missing f-prefix in exponential histogram error messages (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5434">#5434</a>)</li> <li><code>opentelemetry-configuration</code>: resolve false-positive warning logs for newer schema minor version (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5436">#5436</a>)</li> <li><code>opentelemetry-sdk</code>: make methods on <code>FixedSizeExemplarReservoirABC</code> thread safe (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5437">#5437</a>)</li> <li><code>opentelemetry-propagator-jaeger</code>: fix typing issues and enable pyright typechecking for the package <code>opentelemetry-propagator-jaeger</code>: skip <code>uberctx-</code> baggage headers with an empty value on extraction instead of raising <code>TypeError</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5440">#5440</a>)</li> <li><code>opentelemetry-sdk</code>: fix <code>TypeError</code> when instantiating a <code>_BaseConfigurator</code> subclass whose <code>__init__</code> takes arguments (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5441">#5441</a>)</li> <li><code>opentelemetry-sdk</code>: fix <code>TypeError</code> in <code>os.fork()</code> when a <code>BatchProcessor</code> or <code>PeriodicExportingMetricReader</code> is garbage collected (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5453">#5453</a>)</li> <li><code>opentelemetry-configuration</code>: a declarative config key present with an empty (null) value on an object-typed node (e.g. <code>always_on:</code>, a <code>- service:</code> detector, or a metric <code>console:</code> exporter) is now treated the same as an explicit empty config (<code>always_on: {}</code>) instead of failing type dispatch or silently skipping the node. Both <code>dict</code>-typed nodes and dataclasses constructible with no arguments are covered. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5454">#5454</a>)</li> <li><code>opentelemetry-api</code>: fix copy-pasted log message in <code>SpanContext.__delattr__</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5455">#5455</a>)</li> <li><code>opentelemetry-sdk</code>: reject views with <code>ExponentialBucketHistogramAggregation</code> for asynchronous instruments instead of silently producing no data (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5461">#5461</a>)</li> <li><code>opentelemetry-sdk</code>: fill every bucket of <code>SimpleFixedSizeExemplarReservoir</code> before random sampling (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5462">#5462</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md">opentelemetry-api's changelog</a>.</em></p> <blockquote> <h2>Version 1.45.0/0.66b0 (2026-09-25)</h2> <h3>Added</h3> <ul> <li><code>opentelemetry-exporter-prometheus</code>: add support to configure Resource attributes as metric labels (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122">#5122</a>)</li> <li>infra: add renovate (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202">#5202</a>)</li> <li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add support for extended attribute values everywhere. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266">#5266</a>)</li> <li><code>opentelemetry-sdk</code>: wire the top-level <code>log_level</code> field in declarative configuration — when set, maps the OTel <code>SeverityNumber</code> value to a Python logging level and applies it to the <code>opentelemetry</code> logger so SDK internal diagnostics respect the configured severity. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351">#5351</a>)</li> <li><code>opentelemetry-sdk</code>: add the new stable <code>AlwaysRecordSampler</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354">#5354</a>)</li> <li><code>opentelemetry-configuration</code>, <code>opentelemetry-sdk</code>: wire top-level <code>attribute_limits</code> into per-signal providers via declarative config; add <code>log_record_limits</code> support to <code>LoggerProvider</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365">#5365</a>)</li> <li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON HTTP exporter package (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374">#5374</a>)</li> <li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add <code>enabled()</code> support to the Logger API, SDK, and <code>LogRecordProcessor</code> to let instrumentation skip expensive work when logging is disabled (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380">#5380</a>)</li> <li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON file Docker tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412">#5412</a>)</li> <li><code>opentelemetry-configuration</code>: wire the experimental <code>tracer_configurator/development</code>, <code>meter_configurator/development</code> and <code>logger_configurator/development</code> fields into <code>create_tracer_provider</code>, <code>create_meter_provider</code> and <code>create_logger_provider</code>, so per-instrumentation-scope <code>enabled</code> overrides declared in the config file are applied to the provider (previously these fields were parsed but silently discarded). The logger <code>minimum_severity</code>/<code>trace_based</code> fields are not supported by the Python SDK and are ignored with a warning. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5418">#5418</a>)</li> <li><code>docs/examples</code>: add example on how to manually setup the SDK to get SDK metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5449">#5449</a>)</li> <li><code>opentelemetry-docker-tests</code>: add Prometheus exporter docker tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5457">#5457</a>)</li> <li><code>opentelemetry-sdk</code>: count records dropped after shutdown on <code>otel.sdk.processor.{span,log}.processed</code> with <code>error.type=already_shutdown</code> (batch span/log and simple log processors), which the semantic conventions</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/4f0fcfa53e53a8c654a34df0d0a1fd74483ebca2"><code>4f0fcfa</code></a> Prepare release 1.45.0/0.66b0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5690">#5690</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/9406f34ca29d78ad760658ccb9f37b7b6c8e58e9"><code>9406f34</code></a> opentelemetry-test-utils: add CapturingSampler for instrumentation tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5681">#5681</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/1fe31a9bd00c88c824060506aed49b0611fe6e9c"><code>1fe31a9</code></a> fix: update W3CBaggagePropagator to properly handle whitespace (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5680">#5680</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/008b5b0a06c521203b43842c2604acfce9a2b534"><code>008b5b0</code></a> feat(config): wire top-level attribute_limits into per-signal providers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5365">#5365</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/edfad0cafec718ff0f635232390e7f37e2460ab1"><code>edfad0c</code></a> [opentelemetry-sdk] Fix overwriting of the service.instance.id which has been...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/f5e0f622e0ff4653bc61045400c3d1d4335f0ea0"><code>f5e0f62</code></a> opentelemetry-sdk: unify logging force_flush timeout defaults to 30000ms (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5438">#5438</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/e4021aa3c5696dd58827352d1faa958fed92d93f"><code>e4021aa</code></a> chore(ci): update ci (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5677">#5677</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/0c6508c3bbcb785dbcb2e2c37bb86fbb5bd5a55e"><code>0c6508c</code></a> ci: restrict checkout credential persistence (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5589">#5589</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/2e88971399233addaab674c43920ca5945263f4b"><code>2e88971</code></a> Add host.id to host resource attributes (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5653">#5653</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/5f851d2aefc88085df4c9c1a100787a544e18f82"><code>5f851d2</code></a> opentelemetry-exporter-otlp-proto-grpc: fix incorrect default port for gRPC i...</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-python/compare/v1.44.0...v1.45.0">compare view</a></li> </ul> </details> <br /> Updates `opentelemetry-instrumentation-fastapi` from 0.65b0 to 0.66b0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-python-contrib/releases">opentelemetry-instrumentation-fastapi's releases</a>.</em></p> <blockquote> <h2>Version 1.45.0/0.66b0</h2> <h3>Added</h3> <ul> <li><code>opentelemetry-instrumentation-psycopg2</code>, <code>opentelemetry-instrumentation-psycopg</code>: Add sqlcommenter support for <code>instrument_connection</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4267">#4267</a>)</li> <li><code>opentelemetry-instrumentation-fastapi</code>: Document auto-instrumentation setup and HTTP/WebSocket trace propagation <code>opentelemetry-instrumentation</code>: Include the instrumentation README in API docs (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4555">#4555</a>)</li> <li><code>opentelemetry-instrumentation-botocore</code>: capture Bedrock prompt cache token usage for <code>converse</code> and <code>converse_stream</code> API (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4615">#4615</a>)</li> <li><code>opentelemetry-instrumentation-fastapi</code>: advertise inline type annotations (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4685">#4685</a>)</li> <li><code>opentelemetry-instrumentation-kafka-python</code>: Update kafka python instrumentation to support kafka-python>=3 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4786">#4786</a>)</li> <li><code>opentelemetry-instrumentation-mysql</code>: add semantic convention stability opt-in mode tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4810">#4810</a>)</li> <li><code>opentelemetry-instrumentation-aiopg</code>: Add DB client operation duration and returned rows metrics. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4826">#4826</a>)</li> <li><code>opentelemetry-instrumentation-httpx</code>: support strict typing (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4833">#4833</a>)</li> <li><code>opentelemetry-instrumentation-mysqlclient</code>: add semantic convention stability opt-in mode tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4834">#4834</a>)</li> <li><code>opentelemetry-instrumentation-pymysql</code>: add semantic convention stability opt-in mode tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4835">#4835</a>)</li> <li><code>opentelemetry-instrumentation-sqlite3</code>: add semantic convention stability opt-in mode tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4836">#4836</a>)</li> <li><code>opentelemetry-instrumentation-psycopg</code>: add semantic convention stability opt-in mode tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4838">#4838</a>)</li> <li>infra: add validation for changelog file format (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4856">#4856</a>)</li> <li><code>opentelemetry-instrumentation-aio-pika</code>: bump maximum admissible aio-pika version to 11.0.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4998">#4998</a>)</li> </ul> <h3>Changed</h3> <ul> <li><code>opentelemetry-instrumentation</code>: clarify dependency conflict messages, in logs and in <code>DependencyConflictError</code>, and promote auto-instrumentation version conflict logs to error level (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/5025">#5025</a>)</li> </ul> <h3>Removed</h3> <ul> <li><code>opentelemetry-instrumentation-kafka-python</code>: drop support for the deprecated <code>kafka-python-ng</code> fork now that <code>kafka-python</code> is actively maintained again (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4839">#4839</a>)</li> <li><code>opentelemetry-instrumentation-kafka-python</code>: remove unused <code>KafkaPropertiesExtractor.extract_send_key</code> and <code>KafkaPropertiesExtractor.extract_send_value</code> helpers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4858">#4858</a>)</li> <li><code>opentelemetry-instrumentation-anthropic</code>, <code>opentelemetry-instrumentation-claude-agent-sdk</code>, <code>opentelemetry-instrumentation-langchain</code>, <code>opentelemetry-instrumentation-weaviate</code>: removed from this repository; these instrumentations now live in and are maintained from the <a href="https://github.com/open-telemetry/opentelemetry-python-genai">opentelemetry-python-genai</a> repository (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4903">#4903</a>)</li> </ul> <h3>Fixed</h3> <ul> <li><code>opentelemetry-instrumentation-aws-lambda</code>: support ALB multiValueHeaders (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4605">#4605</a>)</li> <li><code>opentelemetry-instrumentation-redis</code>: extract <code>ClusterPipeline</code> commands from <code>_execution_strategy</code> in redis-py 6+ so pipeline span attributes include the queued commands instead of being empty (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4728">#4728</a>)</li> <li><code>opentelemetry-instrumentation-aiopg</code>: fix connection metadata for manual instrumentation (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4821">#4821</a>)</li> <li><code>opentelemetry-instrumentation-redis</code>: treat explicit <code>db=None</code> as database index 0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4828">#4828</a>)</li> <li><code>opentelemetry-instrumentation-aws-lambda</code>: use the correct camel case when accessing the SQS message attributes (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4831">#4831</a>)</li> <li><code>opentelemetry-instrumentation-botocore</code>: Restore PyPy test coverage. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4841">#4841</a>)</li> <li><code>opentelemetry-instrumentation-botocore</code>: don't emit error status on 3xx ClientError responses (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4851">#4851</a>)</li> <li><code>opentelemetry-instrumentation-kafka-python</code>: record the actual <code>messaging.kafka.partition</code> read back from the producer <code>send()</code> future, instead of a pre-computed estimate that did not match the delivered partition for randomly-partitioned messages (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4858">#4858</a>)</li> <li><code>opentelemetry-instrumentation-logging</code>: Promote otel.event.name to LogRecord.event_name in _translate (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4864">#4864</a>)</li> <li><code>opentelemetry-instrumentation-grpc</code>: respect suppressed instrumentation in server interceptors (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4870">#4870</a>)</li> <li><code>opentelemetry-instrumentation-logging</code>: Import code_attributes from stable semconv package (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4873">#4873</a>)</li> <li><code>opentelemetry-instrumentation-asyncio</code>: fix <code>to_thread</code> instrumentation so spans and duration metrics measure the actual function execution instead of ending immediately, repeated calls of the same function are all recorded instead of only the first one, and failures are recorded with the same <code>state</code> values (<code>exception</code>, <code>timeout</code>, <code>cancelled</code>) as the coroutine and future paths; the <code>AsyncioInstrumentor.trace_to_thread</code> method is renamed to <code>AsyncioInstrumentor.wrap_to_thread_func</code> to reflect that it now returns a wrapper (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4901">#4901</a>)</li> <li><code>opentelemetry-instrumentation-logging</code>: fix documented name of the code attributes env var to <code>OTEL_PYTHON_LOG_CODE_ATTRIBUTES</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4912">#4912</a>)</li> <li><code>opentelemetry-instrumentation-psycopg</code>: avoid <code>IndexError</code> in <code>get_operation_name</code> for comment-only or whitespace-only Composed statements (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4936">#4936</a>)</li> <li><code>opentelemetry-instrumentation-psycopg2</code>: avoid <code>IndexError</code> in <code>get_operation_name</code> for comment-only or whitespace-only statements (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4942">#4942</a>)</li> <li><code>opentelemetry-instrumentation-sqlalchemy</code>: avoid <code>IndexError</code> in <code>_operation_name</code> for comment-only or whitespace-only statements (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4943">#4943</a>)</li> <li><code>opentelemetry-instrumentation-mysql</code>: support mysql-connector-python 26.7.0 and later (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4951">#4951</a>)</li> <li><code>opentelemetry-util-http</code>: stop <code>_parse_url_query</code> raising on unparsable urls (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4965">#4965</a>)</li> <li><code>opentelemetry-instrumentation-asyncio</code>: fix metric name and future example in module docs (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/5083">#5083</a>)</li> <li><code>opentelemetry-instrumentation-pymemcache</code>: honor instrumentation suppression (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/5086">#5086</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md">opentelemetry-instrumentation-fastapi's changelog</a>.</em></p> <blockquote> <h2>Version 1.45.0/0.66b0 (2026-09-25)</h2> <h3>Added</h3> <ul> <li><code>opentelemetry-instrumentation-psycopg2</code>, <code>opentelemetry-instrumentation-psycopg</code>: Add sqlcommenter support for <code>instrument_connection</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4267">#4267</a>)</li> <li><code>opentelemetry-instrumentation-fastapi</code>: Document auto-instrumentation setup and HTTP/WebSocket trace propagation <code>opentelemetry-instrumentation</code>: Include the instrumentation README in API docs (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4555">#4555</a>)</li> <li><code>opentelemetry-instrumentation-botocore</code>: capture Bedrock prompt cache token usage for <code>converse</code> and <code>converse_stream</code> API (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4615">#4615</a>)</li> <li><code>opentelemetry-instrumentation-fastapi</code>: advertise inline type annotations (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4685">#4685</a>)</li> <li><code>opentelemetry-instrumentation-kafka-python</code>: Update kafka python instrumentation to support kafka-python>=3 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4786">#4786</a>)</li> <li><code>opentelemetry-instrumentation-mysql</code>: add semantic convention stability opt-in mode tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4810">#4810</a>)</li> <li><code>opentelemetry-instrumentation-aiopg</code>: Add DB client operation duration and returned rows metrics. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4826">#4826</a>)</li> <li><code>opentelemetry-instrumentation-httpx</code>: support strict typing (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4833">#4833</a>)</li> <li><code>opentelemetry-instrumentation-mysqlclient</code>: add semantic convention stability opt-in mode tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4834">#4834</a>)</li> <li><code>opentelemetry-instrumentation-pymysql</code>: add semantic convention stability opt-in mode tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4835">#4835</a>)</li> <li><code>opentelemetry-instrumentation-sqlite3</code>: add semantic convention stability opt-in mode tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4836">#4836</a>)</li> <li><code>opentelemetry-instrumentation-psycopg</code>: add semantic convention stability opt-in mode tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4838">#4838</a>)</li> <li>infra: add validation for changelog file format (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4856">#4856</a>)</li> <li><code>opentelemetry-instrumentation-aio-pika</code>: bump maximum admissible aio-pika version to 11.0.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python-contrib/pull/4998">#4998</a>)</li> </ul> <h3>Changed</h3> <ul> <li><code>opentelemetry-instrumentation</code>: clarify dependency conflict messages, in</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/open-telemetry/opentelemetry-python-contrib/commits">compare view</a></li> </ul> </details> <br /> Updates `opentelemetry-sdk` from 1.44.0 to 1.45.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-python/releases">opentelemetry-sdk's releases</a>.</em></p> <blockquote> <h2>Version 1.45.0/0.66b0</h2> <h3>Added</h3> <ul> <li><code>opentelemetry-exporter-prometheus</code>: add support to configure Resource attributes as metric labels (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122">#5122</a>)</li> <li>infra: add renovate (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202">#5202</a>)</li> <li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add support for extended attribute values everywhere. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266">#5266</a>)</li> <li><code>opentelemetry-sdk</code>: wire the top-level <code>log_level</code> field in declarative configuration — when set, maps the OTel <code>SeverityNumber</code> value to a Python logging level and applies it to the <code>opentelemetry</code> logger so SDK internal diagnostics respect the configured severity. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351">#5351</a>)</li> <li><code>opentelemetry-sdk</code>: add the new stable <code>AlwaysRecordSampler</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354">#5354</a>)</li> <li><code>opentelemetry-configuration</code>, <code>opentelemetry-sdk</code>: wire top-level <code>attribute_limits</code> into per-signal providers via declarative config; add <code>log_record_limits</code> support to <code>LoggerProvider</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365">#5365</a>)</li> <li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON HTTP exporter package (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374">#5374</a>)</li> <li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add <code>enabled()</code> support to the Logger API, SDK, and <code>LogRecordProcessor</code> to let instrumentation skip expensive work when logging is disabled (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380">#5380</a>)</li> <li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON file Docker tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412">#5412</a>)</li> <li><code>opentelemetry-configuration</code>: wire the experimental <code>tracer_configurator/development</code>, <code>meter_configurator/development</code> and <code>logger_configurator/development</code> fields into <code>create_tracer_provider</code>, <code>create_meter_provider</code> and <code>create_logger_provider</code>, so per-instrumentation-scope <code>enabled</code> overrides declared in the config file are applied to the provider (previously these fields were parsed but silently discarded). The logger <code>minimum_severity</code>/<code>trace_based</code> fields are not supported by the Python SDK and are ignored with a warning. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5418">#5418</a>)</li> <li><code>docs/examples</code>: add example on how to manually setup the SDK to get SDK metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5449">#5449</a>)</li> <li><code>opentelemetry-docker-tests</code>: add Prometheus exporter docker tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5457">#5457</a>)</li> <li><code>opentelemetry-sdk</code>: count records dropped after shutdown on <code>otel.sdk.processor.{span,log}.processed</code> with <code>error.type=already_shutdown</code> (batch span/log and simple log processors), which the semantic conventions define as a valid value for this metric. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5509">#5509</a>)</li> <li><code>opentelemetry-semantic-conventions</code>: update semantic conventions to v1.44.0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5511">#5511</a>)</li> <li><code>opentelemetry-sdk</code>: add <code>host.id</code> to the host resource detector (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5653">#5653</a>)</li> <li><code>opentelemetry-test-utils</code>: add <code>CapturingSampler</code> to record what samplers receive in instrumentation tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5681">#5681</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Enable <code>PIE</code> (flake8-pie) ruff rule and fix all violations (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5150">#5150</a>)</li> <li>The public <code>opentelemetry.util.types.AttributeValue</code> type in package <code>opentelemetry-api</code> is being expanded to include <code>None</code>, heterogeneous sequences of primitive types (and nested sequences) as opposed to only homogeneous primitive sequences, and Mappings of strings to any primitive types or sequences/mappings (which themselves must only contain primitive types or sequences/mappings validated the same way). If a <code>bytes</code> type is set as an attribute value in the SDK, it will no longer be utf-8 decoded to a string, instead it will be passed along as is in accordance with the OTEL spec, since <code>bytes</code> is a valid type in the OTLP proto. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266">#5266</a>)</li> <li><code>opentelemetry-exporter-otlp-proto-http</code>: add a <code>max_request_size</code> argument to the OTLP HTTP exporters (traces, logs, metrics); serialized requests larger than the limit are dropped before sending, measured before compression. Defaults to 64 MiB (enabled); set to 0 to disable. Mirrors opentelemetry-go#8157. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5369">#5369</a>)</li> <li>[BREAKING] <code>opentelemetry-api</code>: subclasses of <code>Logger</code> need to implement the <code>enabled</code> method (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380">#5380</a>)</li> <li><code>opentelemetry-exporter-otlp-proto-http</code>: refactor to use shared opentelemetry-exporter-otlp-common and opentelemetry-exporter-http-transport packages and switch default HTTP backend to urllib3 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5389">#5389</a>)</li> <li><code>opentelemetry-sdk</code>: unify logging force_flush timeout defaults to 30000ms (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5438">#5438</a>)</li> <li><code>opentelemetry-python</code>: enable Ruff default ruleset and fix auto-fixable lint issues (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5491">#5491</a>)</li> <li><code>opentelemetry-sdk</code>: <code>SimpleSpanProcessor</code> now drops spans ended after <code>shutdown()</code> instead of passing them to the exporter, and counts them on <code>otel.sdk.processor.span.processed</code> with <code>error.type=already_shutdown</code>. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5512">#5512</a>)</li> <li>Bump pytest to 9.0.3 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5518">#5518</a>)</li> <li><code>opentelemetry-exporter-otlp-proto-http</code>: clarify that the <code>endpoint=</code> kwarg requires the full signal path (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5633">#5633</a>)</li> <li><code>opentelemetry-sdk</code>: fix typos in SpanLimits docstring (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5658">#5658</a>)</li> </ul> <h3>Fixed</h3> <ul> <li><code>opentelemetry-configuration</code>: perform environment variable substitution on scalar values after parsing the configuration file, so <code>${VAR}</code> references inside comments and mapping keys are no longer substituted and undefined references in comments no longer abort loading (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5407">#5407</a>)</li> <li><code>opentelemetry-configuration</code>: declarative config environment variable substitution now replaces an unset variable that has no default with an empty value instead of raising an error, per the configuration spec. Resource attributes whose value resolves to null (an unset <code>${VAR}</code> with no default) are skipped with a warning instead of being inserted as a null value. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5408">#5408</a>)</li> <li>'scripts/build.sh<code>: add </code>opentelemetry-configuration<code>and</code>opentelemetry-proto-json` to the package to release (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5425">#5425</a>)</li> <li><code>opentelemetry-sdk</code>: fix <code>View</code> instrument-name matching so a view configured with an instrument's real (mixed-case) name is applied; matching is now case-insensitive and platform-independent instead of relying on <code>fnmatch</code>'s OS-dependent case handling (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5430">#5430</a>)</li> <li><code>opentelemetry-sdk</code>: fix missing f-prefix in exponential histogram error messages (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5434">#5434</a>)</li> <li><code>opentelemetry-configuration</code>: resolve false-positive warning logs for newer schema minor version (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5436">#5436</a>)</li> <li><code>opentelemetry-sdk</code>: make methods on <code>FixedSizeExemplarReservoirABC</code> thread safe (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5437">#5437</a>)</li> <li><code>opentelemetry-propagator-jaeger</code>: fix typing issues and enable pyright typechecking for the package <code>opentelemetry-propagator-jaeger</code>: skip <code>uberctx-</code> baggage headers with an empty value on extraction instead of raising <code>TypeError</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5440">#5440</a>)</li> <li><code>opentelemetry-sdk</code>: fix <code>TypeError</code> when instantiating a <code>_BaseConfigurator</code> subclass whose <code>__init__</code> takes arguments (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5441">#5441</a>)</li> <li><code>opentelemetry-sdk</code>: fix <code>TypeError</code> in <code>os.fork()</code> when a <code>BatchProcessor</code> or <code>PeriodicExportingMetricReader</code> is garbage collected (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5453">#5453</a>)</li> <li><code>opentelemetry-configuration</code>: a declarative config key present with an empty (null) value on an object-typed node (e.g. <code>always_on:</code>, a <code>- service:</code> detector, or a metric <code>console:</code> exporter) is now treated the same as an explicit empty config (<code>always_on: {}</code>) instead of failing type dispatch or silently skipping the node. Both <code>dict</code>-typed nodes and dataclasses constructible with no arguments are covered. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5454">#5454</a>)</li> <li><code>opentelemetry-api</code>: fix copy-pasted log message in <code>SpanContext.__delattr__</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5455">#5455</a>)</li> <li><code>opentelemetry-sdk</code>: reject views with <code>ExponentialBucketHistogramAggregation</code> for asynchronous instruments instead of silently producing no data (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5461">#5461</a>)</li> <li><code>opentelemetry-sdk</code>: fill every bucket of <code>SimpleFixedSizeExemplarReservoir</code> before random sampling (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5462">#5462</a>)</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md">opentelemetry-sdk's changelog</a>.</em></p> <blockquote> <h2>Version 1.45.0/0.66b0 (2026-09-25)</h2> <h3>Added</h3> <ul> <li><code>opentelemetry-exporter-prometheus</code>: add support to configure Resource attributes as metric labels (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5122">#5122</a>)</li> <li>infra: add renovate (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5202">#5202</a>)</li> <li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add support for extended attribute values everywhere. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5266">#5266</a>)</li> <li><code>opentelemetry-sdk</code>: wire the top-level <code>log_level</code> field in declarative configuration — when set, maps the OTel <code>SeverityNumber</code> value to a Python logging level and applies it to the <code>opentelemetry</code> logger so SDK internal diagnostics respect the configured severity. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5351">#5351</a>)</li> <li><code>opentelemetry-sdk</code>: add the new stable <code>AlwaysRecordSampler</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5354">#5354</a>)</li> <li><code>opentelemetry-configuration</code>, <code>opentelemetry-sdk</code>: wire top-level <code>attribute_limits</code> into per-signal providers via declarative config; add <code>log_record_limits</code> support to <code>LoggerProvider</code> (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5365">#5365</a>)</li> <li><code>opentelemetry-exporter-otlp-json-http</code>: add OTLP JSON HTTP exporter package (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5374">#5374</a>)</li> <li><code>opentelemetry-api</code>, <code>opentelemetry-sdk</code>: add <code>enabled()</code> support to the Logger API, SDK, and <code>LogRecordProcessor</code> to let instrumentation skip expensive work when logging is disabled (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5380">#5380</a>)</li> <li><code>opentelemetry-exporter-otlp-json-file</code>: add OTLP JSON file Docker tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5412">#5412</a>)</li> <li><code>opentelemetry-configuration</code>: wire the experimental <code>tracer_configurator/development</code>, <code>meter_configurator/development</code> and <code>logger_configurator/development</code> fields into <code>create_tracer_provider</code>, <code>create_meter_provider</code> and <code>create_logger_provider</code>, so per-instrumentation-scope <code>enabled</code> overrides declared in the config file are applied to the provider (previously these fields were parsed but silently discarded). The logger <code>minimum_severity</code>/<code>trace_based</code> fields are not supported by the Python SDK and are ignored with a warning. (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5418">#5418</a>)</li> <li><code>docs/examples</code>: add example on how to manually setup the SDK to get SDK metrics (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5449">#5449</a>)</li> <li><code>opentelemetry-docker-tests</code>: add Prometheus exporter docker tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/pull/5457">#5457</a>)</li> <li><code>opentelemetry-sdk</code>: count records dropped after shutdown on <code>otel.sdk.processor.{span,log}.processed</code> with <code>error.type=already_shutdown</code> (batch span/log and simple log processors), which the semantic conventions</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/4f0fcfa53e53a8c654a34df0d0a1fd74483ebca2"><code>4f0fcfa</code></a> Prepare release 1.45.0/0.66b0 (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5690">#5690</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/9406f34ca29d78ad760658ccb9f37b7b6c8e58e9"><code>9406f34</code></a> opentelemetry-test-utils: add CapturingSampler for instrumentation tests (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5681">#5681</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/1fe31a9bd00c88c824060506aed49b0611fe6e9c"><code>1fe31a9</code></a> fix: update W3CBaggagePropagator to properly handle whitespace (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5680">#5680</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/008b5b0a06c521203b43842c2604acfce9a2b534"><code>008b5b0</code></a> feat(config): wire top-level attribute_limits into per-signal providers (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5365">#5365</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/edfad0cafec718ff0f635232390e7f37e2460ab1"><code>edfad0c</code></a> [opentelemetry-sdk] Fix overwriting of the service.instance.id which has been...</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/f5e0f622e0ff4653bc61045400c3d1d4335f0ea0"><code>f5e0f62</code></a> opentelemetry-sdk: unify logging force_flush timeout defaults to 30000ms (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5438">#5438</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/e4021aa3c5696dd58827352d1faa958fed92d93f"><code>e4021aa</code></a> chore(ci): update ci (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5677">#5677</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/0c6508c3bbcb785dbcb2e2c37bb86fbb5bd5a55e"><code>0c6508c</code></a> ci: restrict checkout credential persistence (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5589">#5589</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/2e88971399233addaab674c43920ca5945263f4b"><code>2e88971</code></a> Add host.id to host resource attributes (<a href="https://redirect.github.com/open-telemetry/opentelemetry-python/issues/5653">#5653</a>)</li> <li><a href="https://github.com/open-telemetry/opentelemetry-python/commit/5f851d2aefc88085df4c9c1a100787a544e18f82"><code>5f851d2</code></a> opentelemetry-exporter-otlp-proto-grpc: fix incorrect default port for gRPC i...</li> <li>Additional commits viewable in <a href="https://github.com/open-telemetry/opentelemetry-python/compare/v1.44.0...v1.45.0">compare view</a></li> </ul> </details> <br /> Updates `psycopg` from 3.3.2 to 3.3.6 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/psycopg/psycopg/blob/master/docs/news.rst">psycopg's changelog</a>.</em></p> <blockquote> <p>.. currentmodule:: psycopg</p> <p>.. index:: single: Release notes single: News</p> <h1><code>psycopg</code> release notes</h1> <h2>Current release</h2> <p>Psycopg 3.3.6 ^^^^^^^^^^^^^</p> <ul> <li>Add support for Python 3.15 (:ticket:<code>[#1245](https://github.com/psycopg/psycopg/issues/1245)</code>).</li> <li>Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:<code>[#1371](https://github.com/psycopg/psycopg/issues/1371)</code>).</li> <li>Cancel a running query upon receiving <code>!SystemExit</code> (:ticket:<code>[#1384](https://github.com/psycopg/psycopg/issues/1384)</code>).</li> <li>Report <code>!None</code> instead of <code>65535</code> as the <code>Column.precision</code> of an :sql:<code>interval</code> column declared with a fields restriction and no explicit precision, such as e.g. :sql:<code>interval day to second</code> (:ticket:<code>[#1397](https://github.com/psycopg/psycopg/issues/1397)</code>).</li> <li>Fix dumping of nested subclasses of lists as arrays (:ticket:<code>[#1398](https://github.com/psycopg/psycopg/issues/1398)</code>).</li> <li>Discard prepared statements upon :sql:<code>DEALLOCATE ALL</code> (:ticket:<code>[#1408](https://github.com/psycopg/psycopg/issues/1408)</code>).</li> <li>Better guards dumping large Python <code>!int</code> to binary numeric (:ticket:<code>[#1414](https://github.com/psycopg/psycopg/issues/1414)</code>).</li> <li>Improve performance of async queries by reducing the overhead of the <code>!wait_async()</code> function (:ticket:<code>[#1331](https://github.com/psycopg/psycopg/issues/1331)</code>).</li> </ul> <p>Psycopg 3.3.5 ^^^^^^^^^^^^^</p> <ul> <li>Discard prepared statements upon :sql:<code>ALTER *</code> or <code>DISCARD *</code> (:ticket:<code>[#1307](https://github.com/psycopg/psycopg/issues/1307)</code>).</li> <li>Fix <code>!ProgrammingError</code> when dumping non-<code>!None</code> values with no <code>!NoneType</code> dumper registered in python implementation (:ticket:<code>[#1325](https://github.com/psycopg/psycopg/issues/1325)</code>).</li> <li>Fix <code>!wait_selector</code> wait function to not raise <code>!KeyError</code> (:ticket:<code>[#1327](https://github.com/psycopg/psycopg/issues/1327)</code>).</li> <li>Fix <code>!DataError</code> messages leaking the literal <code>{...}</code> placeholder instead of the offending value when loading a pre-year-1 :sql:<code>timestamp</code> or a malformed binary :sql:<code>jsonb</code> value (:ticket:<code>[#1372](https://github.com/psycopg/psycopg/issues/1372)</code>).</li> <li>Raise <code>!DataError</code> instead of <code>!ValueError</code> when <code>~psycopg.rows.namedtuple_row</code> receives duplicate column names (:ticket:<code>[#1348](https://github.com/psycopg/psycopg/issues/1348)</code>).</li> <li>Raise <code>!DataError</code> on inconsistent copy data (:tickets:<code>[#1359](https://github.com/psycopg/psycopg/issues/1359), [#1360](https://github.com/psycopg/psycopg/issues/1360)</code>).</li> <li>Handle client encodings aliases (:ticket:<code>[#1363](https://github.com/psycopg/psycopg/issues/1363)</code>).</li> <li>Fix building C extension with Cython 3.3.</li> </ul> <p>Psycopg 3.3.4</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psycopg/psycopg/commit/a67654d1e7afbf9b3a619557838f62de1c790e7c"><code>a67654d</code></a> chore: bump psycopg package version to 3.3.6</li> <li><a href="https://github.com/psycopg/psycopg/commit/443814b3b111ac678a39fd523c1a826266fb69b5"><code>443814b</code></a> Merge pull request <a href="https://redirect.github.com/psycopg/psycopg/issues/1416">#1416</a> from dvarrazzo/wait-async-perf</li> <li><a href="https://github.com/psycopg/psycopg/commit/42966e9ebbda3b9c69b15c5588543c15f2aae5dd"><code>42966e9</code></a> test: add helpful comments to some tests</li> <li><a href="https://github.com/psycopg/psycopg/commit/5e8797f0c8003d8cd12a1e5c13f05fbb94c1c1d2"><code>5e8797f</code></a> test: add reasonable connect_timeout to most tests</li> <li><a href="https://github.com/psycopg/psycopg/commit/c81ba62442dfbd69e207d6914e6ae2aa27e56886"><code>c81ba62</code></a> perf: reduce the overhead of wait_async()</li> <li><a href="https://github.com/psycopg/psycopg/commit/d2bbfe4e2b1e36a20e72a18097f35a3db27296e3"><code>d2bbfe4</code></a> refactor: use get_running_loop() in the async wait functions</li> <li><a href="https://github.com/psycopg/psycopg/commit/2b1484a550e01c88fda077099678f0abb9217ecb"><code>2b1484a</code></a> test: add a script to measure the async wait functions</li> <li><a href="https://github.com/psycopg/psycopg/commit/573cf4aa70d8fdefc9d5f3eb69d5419cd6d3cd51"><code>573cf4a</code></a> test: fix incorrect wait timing test</li> <li><a href="https://github.com/psycopg/psycopg/commit/2b68990874175b8d97269218d4963b2d5c8656f3"><code>2b68990</code></a> refactor: drop leftovers of waiting with inf interval in wait_conn_async</li> <li><a href="https://github.com/psycopg/psycopg/commit/60765dd8fc7d8df03cd75efcff485bfb3c83a0ed"><code>60765dd</code></a> Merge pull request <a href="https://redirect.github.com/psycopg/psycopg/issues/1414">#1414</a> from dvarrazzo/fix-decimal-overflow</li> <li>Additional commits viewable in <a href="https://github.com/psycopg/psycopg/compare/3.3.2...3.3.6">compare view</a></li> </ul> </details> <br /> Updates `pyjwt` from 2.13.0 to 2.15.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.15.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst">2.15.0 changelog</a> for complete release details.</p> <h2>2.14.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst">2.14.0 changelog</a> for the complete release details and related security advisories.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0></code>__</h2> <p>Security</p> <pre><code> - Wrap recursion errors from deeply nested JWT payloads in ``DecodeError`` instead of exposing a raw ``RecursionError``. <p>Added</p> <pre><code> - Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__ Changed </code></pre> <ul> <li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code> rather than the raw JWKS payload, so a cache hit no longer re-parses every key. <code>JWKSetCache.put()</code> accepts either form and raises <code>PyJWKSetError</code> for anything else. As a result, <code>PyJWKClient.get_jwk_set()</code> returns the same <code>PyJWKSet</code> instance for as long as it stays cached, rather than a freshly built one per call in <code>[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> <li><code>PyJWKClient.fetch_data()</code> now raises <code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)</code> when the endpoint response is not a JSON object, instead of returning it for <code>get_jwk_set()</code> to reject. Callers reaching the JWKS through <code>get_jwk_set()</code> see the same error as before in <code>[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> </ul> <p>Fixed</p> <pre><code> - Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead of raising ``PyJWKClientError(&q…

@kytta

mgazda-splunk · 2026-10-14T13:51:38Z

Thanks for this PR. One case it aims to fix still fails on 2.15.x: a
fetch_data() override that converts a non-standard response into a JWKS.

# The endpoint returns {"data": [<jwk>, ...]} instead of {"keys": [...]}
class WrappedJWKClient(PyJWKClient):
    def fetch_data(self):
        data = super().fetch_data()
        return {"keys": data["data"]}

WrappedJWKClient(uri).get_signing_key_from_jwt(token)
# 2.14.0: OK
# 2.15.1: PyJWKSetError: The JWK Set did not contain any keys

super().fetch_data() writes the raw response to the cache, and
JWKSetCache.put() now parses it, so it raises before the override can convert
it. With cache_jwk_set=False it works.

Possible fix: make get_jwk_set() the only place that writes to the cache (it
already caches the override's return value), or skip the write in
fetch_data() when the raw response isn't a valid JWKS.

Happy to open a PR or issue with that, WDYT @jpadilla ?

jpadilla added 6 commits September 13, 2026 07:06

docs: link PR #1208 from the changelog entries

47deeb2

Claude-Session: https://claude.ai/code/session_01Vat3P5EcKjHcRUzSCTtyyu

auvipy approved these changes Sep 13, 2026

View reviewed changes

merge: treat malformed JWK Set members as unusable keys

334cf26

Brings the malformed-member hardening into this PR. CHANGELOG conflict resolved by folding both Fixed sections together and linking #1208 from the merged entry, since it now ships as part of this PR.

jpadilla merged commit 384c945 into master Sep 14, 2026
35 checks passed

jpadilla deleted the worktree-fix-issue-914-jwks-cache branch September 14, 2026 17:28

This was referenced Sep 14, 2026

fix: PyJWKClient fetches new JWKS when kid is not found in cache #1207

Closed

Fix get_jwk_set for PyJWKSet values in the JWK Set cache #1204

Closed

FanWu-ai mentioned this pull request Oct 19, 2026

Reject non-object JSON in JWK deserialization #1237

Open

rennerdo30 mentioned this pull request Oct 21, 2026

［Historical PR］ deps（pip）: bump the pip-minor-patch group across 1 directory with 4 updates rennerdo30/watch-together#84

Closed

Navigation Menu

Repository navigation

fix: return a parsed PyJWKSet from the JWK Set cache - #1208

fix: return a parsed PyJWKSet from the JWK Set cache#1208
jpadilla merged 7 commits into
masterfrom
worktree-fix-issue-914-jwks-cache

jpadilla commented Sep 13, 2026 •

edited

Loading

Uh oh!

Uh oh!

mgazda-splunk commented Oct 14, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

jpadilla commented Sep 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The cache holds a parsed key set

Malformed JWK Set members

Tests

Verification

Uh oh!

Uh oh!

mgazda-splunk commented Oct 14, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jpadilla commented Sep 13, 2026 •

edited

Loading