Bump the python-dependencies group across 1 directory with 60 updates

[dependabot]

Updates the requirements on asgiref, atproto, autobahn, boto3, botocore, cbor2, coverage, daphne, django-allauth, django-anymail, django-stubs-ext, django-stubs, django-unfold, django, djlint, feedparser, gunicorn, langchain-core, langchain-protocol, langgraph-checkpoint, langgraph-sdk, langgraph, langsmith, librt, markdown, mastodon-py, msgpack, opentelemetry-api, opentelemetry-exporter-otlp-proto-http, opentelemetry-instrumentation-django, opentelemetry-sdk, praw, pre-commit, psycopg, pyasn1, pyjwt, pylint-django, pyopenssl, pyright, pytest-django, python-dotenv, qdrant-client, ruff, s3transfer, sentence-transformers, service-identity, standardwebhooks, svix, taskiq, types-deprecated, types-psycopg2, types-python-dateutil, types-pyyaml, types-requests, ujson, uuid-utils, wrapt, xxhash, zope-interface and django-ninja to permit the latest version.
Updates asgiref from 3.11.1 to 3.12.1

Changelog

Sourced from asgiref's changelog.

3.12.1 (2026-07-14)

• Restored the previous SyncToAsync.call internal code shape, which was relied on by some APM services. (#572)

  Note, this change was available whilst maintaining the underlying fix (from #564). It does not constitute an API stability promise. Ideally APMs are not monkey patching internal APIs, and future changes will be made here if needed.

3.12.0 (2026-07-14)

• AsyncToSync no longer captures the running event loop on instantiation. (#562)

  This resolves a series of deadlocks that users experienced after asgiref 3.9.0, particularly with pytest-asyncio. pytest-asyncio stops the event loop between tests, and long-running unawaited futures could find themselves trying to schedule work onto a stopped loop, and so would never complete. Ideally, code should be structured to await long-running futures before returning, but this change should help users experiencing issues here.

  The loop is now resolved when the callable is invoked rather than when it is created. If async_to_sync is called from within sync_to_async, the parent event loop is still used, as before.

  The possibility of deadlock therefore remains in some nested patterns. For example, an async function may call a long-running sync_to_async function that itself uses async_to_sync; if the outer function returns before the sync future completes, the parent event loop may already be stopped, and the nested calls cannot be driven to completion.

  This is not a bug in asgiref — the same patterns deadlock in plain asyncio. As above, restructure your code to await the sync_to_async future before exiting the driving coroutine.

• Fixed an event loop deadlock when exiting ThreadSensitiveContext while its executor thread was still blocked waiting on the event loop. (#535)

• Dropped support for EOL Python 3.9.

• Fixed StatelessServer.run() failing on Python 3.14, where asyncio.get_event_loop() no longer creates an event loop if none exists. It now uses asyncio.run(). (#559)

• Fixed Local leaking data between unrelated sync threads when sys.flags.thread_inherit_context is enabled (Python 3.14+), so a newly

... (truncated)

Commits

• ef9d4b8 Releasing 3.12.1
• 34fba63 Restore previous SyncToAsync.call internal code shape.
• a43900c Separate mypy from tests extra.
• 1b7c338 Releasing 3.12.0
• 157d9d4 Renovate precommit (#552)
• deda0d4 Test free-threading builds and fix Local data leak for thread_inherit_context...
• a54250a Don’t capture the event loop in AsyncToSync.__init__ (#562)
• 836356a Use asyncio.run in StatelessServer.run (#561)
• e04afd5 Dropped support for Python 3.9. (#543)
• 95d2430 Fixed #535: ThreadSensitiveContext.aexit blocking the event loop. (#563)
• Additional commits viewable in compare view

Updates atproto from 0.0.69 to 0.0.72

Release notes

Sourced from atproto's releases.

v0.0.72

What's Changed

🧩 Custom lexicon codegen: atp gen custom turns any lexicon directory into a package of models, namespaces, subscription clients, and a Client subclass that composes with the SDK instead of forking it

📚 Fully reworked docs website: a new theme, the API reference as a nested NSID tree, guides for every workflow with runnable examples, and a much better search

• Add atp gen custom to build a package from any lexicon directory by @​MarshalX in #727
• Make codegen config-driven and fix references into non-emitted lexicons by @​MarshalX in #723
• Resolve model references through the SDK so generated packages can live outside it by @​MarshalX in #724
• Resolve records from generated packages at runtime and autogenerate ClientRaw by @​MarshalX in #725
• Resolve records in unknown fields through the runtime registry by @​MarshalX in #728
• Generate subscription clients and extract the subscription runtime by @​MarshalX in #729
• Format generated code under the generator's own Ruff settings by @​MarshalX in #726
• Add RateLimitExceededError with the limit, remaining, reset_at, and retry_after of the response by @​MarshalX in #738
• Surface the server error message in request exceptions instead of the raw response by @​MarshalX in #722
• Allow running the CLI with python -m atproto_cli by @​MarshalX in #730
• Add guides, inline every example, and document custom lexicon codegen by @​MarshalX in #737
• Restructure the docs into a nested NSID tree on the sphinxawesome theme by @​MarshalX in #735
• Bump the docs stack to Sphinx 9 and pin a patched autodoc-pydantic by @​MarshalX in #734
• Add robots.txt, trim autodoc typehints, and enable more MyST extensions by @​MarshalX in #736
• Raise the DocSearch caps that limited every search to 10 results by @​MarshalX in #744
• Summarize lexicon changes in the update PR title and body by @​MarshalX in #732
• Mock the network suite-wide so no test reaches the real internet by @​MarshalX in #739
• Update lexicons by @​MarshalX in #733, #745 and #747
• Fix clones losing transport config and authentication by @​MarshalX in #738
• Fix clone() breaking Client subclasses and make atp gen refuse to run from missing lexicons or unresolved refs by @​MarshalX in #749
• Fix login() failing on a PDS that does not serve app.bsky by @​MarshalX in #731
• Fix codegen references through the installed SDK and the login, shim, and strict-format regressions by @​MarshalX in #746
• Fix model field types rendering as ForwardRef in the docs by @​MarshalX in #717
• Fix the API reference's dead links, mangled field types, and truncated descriptions by @​MarshalX in #743
• Fix gen_api_docs.py crashing on Python 3.9 by @​MarshalX in #741
• Fix update_lexicons.py breaking on the stale docs pre-clean by @​MarshalX in #740

Full Changelog: MarshalX/atproto@v0.0.71...v0.0.72

v0.0.71

What's Changed

⚡ Jetstream 56k -> 111k events/s, Firehose 22.7k -> 31.1k frames/s. Same bytes in, byte-identical models out (Apple M1)

• Speed up Jetstream 2x and Firehose 1.4x by @​MarshalX in MarshalX/atproto#709
• Speed up the docs build 3.8x and fix the build warnings by @​MarshalX in MarshalX/atproto#715
• Narrow the type of is_record_type with TypeGuard by @​MarshalX in MarshalX/atproto#713
• Deprecate AtUri.http in favor of the correctly named AtUri.href by @​MarshalX in MarshalX/atproto#714
• Fix Firehose frame op by @​MarshalX in MarshalX/atproto#709
• Fix JSON serialization of blobs decoded from DAG-CBOR by @​MarshalX in MarshalX/atproto#708
• Fix ugly changelog on the docs site by @​MarshalX in MarshalX/atproto#710
• Fix ignored constraints of array items in codegen by @​MarshalX in MarshalX/atproto#711
• Fix unions failing the whole response on an unknown $type by @​MarshalX in MarshalX/atproto#712

... (truncated)

Changelog

Sourced from atproto's changelog.

Version 0.0.72

10.09.2026

🧩 Custom lexicon codegen: atp gen custom turns any lexicon directory into a package of models, namespaces, subscription clients, and a Client subclass that composes with the SDK instead of forking it

📚 Fully reworked docs website: a new theme, the API reference as a nested NSID tree, guides for every workflow with runnable examples, and a much better search

• Add atp gen custom to build a package from any lexicon directory by @​MarshalX in #727
• Make codegen config-driven and fix references into non-emitted lexicons by @​MarshalX in #723
• Resolve model references through the SDK so generated packages can live outside it by @​MarshalX in #724
• Resolve records from generated packages at runtime and autogenerate ClientRaw by @​MarshalX in #725
• Resolve records in unknown fields through the runtime registry by @​MarshalX in #728
• Generate subscription clients and extract the subscription runtime by @​MarshalX in #729
• Format generated code under the generator's own Ruff settings by @​MarshalX in #726
• Add RateLimitExceededError with the limit, remaining, reset_at, and retry_after of the response by @​MarshalX in #738
• Surface the server error message in request exceptions instead of the raw response by @​MarshalX in #722
• Allow running the CLI with python -m atproto_cli by @​MarshalX in #730
• Add guides, inline every example, and document custom lexicon codegen by @​MarshalX in #737
• Restructure the docs into a nested NSID tree on the sphinxawesome theme by @​MarshalX in #735
• Bump the docs stack to Sphinx 9 and pin a patched autodoc-pydantic by @​MarshalX in #734
• Add robots.txt, trim autodoc typehints, and enable more MyST extensions by @​MarshalX in #736
• Raise the DocSearch caps that limited every search to 10 results by @​MarshalX in #744
• Summarize lexicon changes in the update PR title and body by @​MarshalX in #732
• Mock the network suite-wide so no test reaches the real internet by @​MarshalX in #739
• Update lexicons by @​MarshalX in #733, #745 and #747
• Fix clones losing transport config and authentication by @​MarshalX in #738
• Fix clone() breaking Client subclasses and make atp gen refuse to run from missing lexicons or unresolved refs by @​MarshalX in #749
• Fix login() failing on a PDS that does not serve app.bsky by @​MarshalX in #731
• Fix codegen references through the installed SDK and the login, shim, and strict-format regressions by @​MarshalX in #746
• Fix model field types rendering as ForwardRef in the docs by @​MarshalX in #717
• Fix the API reference's dead links, mangled field types, and truncated descriptions by @​MarshalX in #743
• Fix gen_api_docs.py crashing on Python 3.9 by @​MarshalX in #741
• Fix update_lexicons.py breaking on the stale docs pre-clean by @​MarshalX in #740

Version 0.0.71

19.08.2026

⚡ Jetstream 56k -> 111k events/s, Firehose 22.7k -> 31.1k frames/s. Same bytes in, byte-identical models out (Apple M1)

• Speed up Jetstream 2x and Firehose 1.4x by @​MarshalX in #709
• Speed up the docs build 3.8x and fix the build warnings by @​MarshalX in #715
• Narrow the type of is_record_type with TypeGuard by @​MarshalX in #713
• Deprecate AtUri.http in favor of the correctly named AtUri.href by @​MarshalX in #714
• Fix Firehose frame op by @​MarshalX in #709
• Fix JSON serialization of blobs decoded from DAG-CBOR by @​MarshalX in #708
• Fix ugly changelog on the docs site by @​MarshalX in #710
• Fix ignored constraints of array items in codegen by @​MarshalX in #711
• Fix unions failing the whole response on an unknown $type by @​MarshalX in #712

... (truncated)

Commits

• 1b29f76 Fix clone() breaking Client subclasses and make atp gen refuse to run f...
• b156da1 Update lexicons: add app.bsky.actor.defs#interestsPref.updatedAt (1 changed) ...
• 1b073d8 Update lexicons: add app.bsky.graph.referencelistoptout (2 changed) (#745)
• 0e28044 Resolve codegen references through the installed SDK and fix login, shim, and...
• 48f6ba9 Raise the DocSearch caps that limited every search to 10 results (#744)
• 66fcfb7 Fix the API reference's dead links, mangled field types, and truncated descri...
• a0ca5dd Fix gen_api_docs.py crashing on Python 3.9 (#741)
• 2c2814d Drop the stale docs pre-clean that broke update_lexicons.py (#740)
• 9c677fa Mock the network suite-wide so no test reaches the real internet (#739)
• 9d50fc4 Fix clones losing transport config and authentication, and add `RateLimitExce...
• Additional commits viewable in compare view

Updates autobahn from 26.6.2 to 26.7.1

Release notes

Sourced from autobahn's releases.

Release v26_7_1

Official release v26_7_1

Included Platforms

• Linux: x86_64, ARM64 (manylinux_2_34 wheels with NVX)
• macOS: Apple Silicon ARM64 (binary wheels with NVX)
• Windows: x86_64 (binary wheels with NVX)

Python Versions

• CPython: 3.11, 3.12, 3.13, 3.14
• PyPy: 3.11

Installation

pip install autobahn[all]==v26_7_1

Or download wheels directly from this release.

Build Information

• Release Date: 2026-07-15 18:49:18 UTC
• Total Wheels: 28
• Source Distributions: 3

Features

Autobahn|Python provides:

• WebSocket client and server implementations (RFC 6455)
• WAMP client library for both Twisted and asyncio
• NVX acceleration for high-performance networking (binary wheels)
• Pure Python fallback wheels for maximum compatibility

Documentation

• Read the Docs
• GitHub Repository
• WAMP Protocol

Development Build fork-ec23ef44-oberstet_autobahn_python-fix_1930-202607151609

Development build from pull request

Build Information

... (truncated)

Changelog

Sourced from autobahn's changelog.

26.7.1

Security

• Fix WebSocket maxMessagePayloadSize being enforced against the compressed on-the-wire frame length instead of the uncompressed reassembled message size when permessage-compress (deflate/bzip2/snappy/brotli) is negotiated. A small compressed frame could inflate far beyond the configured limit and be delivered to the application (a decompression-bomb style denial-of-service; security advisory GHSA-hxp9-w8x3-p566, same class as CVE-2016-10544). The limit is now re-checked at the inflation site against the running uncompressed message size, and the connection is failed with close code 1009 (message too big) before delivery — for both the whole-message and streaming receive APIs and every compression backend. Behaviour change: a compressed message that inflates past maxMessagePayloadSize is now rejected where it previously passed; uncompressed traffic and the per-frame maxFramePayloadSize wire guard are unaffected (#1909)
• Fix the permessage-deflate max_message_size receive cap silently truncating an over-limit message and raising a zlib error instead of cleanly rejecting it: the bounded decompress(…, max_length) left the remaining input in unconsumed_tail undrained, so the message was corrupted rather than reported. Decompression is now bounded cumulatively across frames and raises PayloadExceededError as soon as the uncompressed size would exceed the cap (#1908)
• Make bounded decompression backend-agnostic: decompress_message_data() gains an optional max_output_len argument (documented on the PerMessageCompress base class) and every permessage-compress backend now honours it. deflate and bzip2 stop inflating once the limit is reached (native incremental cap); snappy and brotli, whose libraries expose no output-length argument, inflate the frame (already bounded on the wire by maxFramePayloadSize) and then reject — a weaker but still clean per-frame guarantee. The WebSocket receive path passes the remaining maxMessagePayloadSize budget so a compressed frame no longer expands unbounded into memory before the size check; the previous post-inflation check (#1909) remains as a backstop. Previously only deflate had any decompressed-output cap, so a snappy/bzip2/brotli frame could inflate fully into memory first (#1910)
• Make the asyncio RawSocket receive size limit configurable, at parity with the Twisted backend. The asyncio WampRawSocketFactory now exposes setProtocolOptions(maxMessagePayloadSize=...) / resetProtocolOptions() (bounds [512, 2**24], default 16 MB), and the configured value drives both the advertised handshake length exponent and the enforced receive cap (rounded up to the next power of two), matching the Twisted factory. Previously the asyncio receive limit was hardwired to 16 MB (a dead max_size=None branch), so an asyncio WAMP peer could not tighten its RawSocket receive limit for DoS hardening and Crossbar's RawSocket max_message_size had no effect on the asyncio path (#1911)

FlatBuffers

• Fix check_zlmdb_flatbuffers_version_in_sync() comparing the build-time version() (which is (0, 0, 0, None, None) on installed wheels, where the vendored FlatBuffers __git_version__ is unstamped) — it now compares the reliably-stamped __version__ and returns a version string. Added regression tests (#1891)
• Make autobahn.flatbuffers.version() reliable on installed wheels: when the build-time __git_version__ is a bare commit hash or "unknown" (shallow clone / submodule absent from the sdist), version() now falls back to parsing the static vendored __version__ and returns (major, minor, patch, None, None) instead of (0, 0, 0, None, None); rich git describe detail is still returned on genuine dev/git builds. Also hardened hatch_build.py so it never stamps a non-parseable __git_version__. Return shape is unchanged (5-tuple); no API break (#1891)

Build & CI/CD

• Add CalVer / PEP 440 version-management just recipes (file-version, bump-dev, bump-next, prep-release) mirroring Crossbar.io, and document the versioning policy in CONTRIBUTING.md (#1894)
• Add ruff check --select ANN,UP,TCH (annotation presence, pyupgrade modern syntax, TYPE_CHECKING imports) to the just check-typing recipe so annotation/style regressions are caught in the quality-checks CI job. The existing gaps in src/autobahn/ are ratcheted via an explicit --ignore allowlist to be removed module-by-module (#1839); all other UP/TC rules are enforced immediately, and generated code is excluded. The annotation rules are scoped to this recipe via the command line rather than the global [tool.ruff.lint] select, so the repo-wide check-format gate is unaffected (#1840)
• Fix the aarch64 CPython 3.14 wheel shipping the free-threaded ABI (cp314t) in the GIL cp314 slot (26.6.x). Root cause: manylinux images pre-install both the GIL and free-threaded 3.14 under /opt/python and prepend them to PATH, and uv resolved cpython-3.14 to the free-threaded interpreter (first on PATH). The create recipe now drops free-threaded …t/bin dirs from PATH for GIL envs so uv selects the GIL build. As defence-in-depth, just build also asserts (via _check-venv-abi) that the interpreter's GIL/free-threaded status matches the env and aborts on mismatch, so a wrong-ABI wheel can never be published. A reserved cpy314t env spec (cpython-3.14t) is added for a future free-threaded wheel variant (#1875)
• Bump the .cicd (wamp-cicd) submodule to include exact CPython ABI-tag matching in the shared check-release-fileset release-gate action, so a wrong-ABI wheel (e.g. cp314t in the cp314 slot) is also rejected at release-fileset validation, not only by the build-time guard above (wamp-cicd #11, completes #1875)
• Publish musllinux_1_2 (musl libc / Alpine Linux) binary wheels with NVX acceleration for CPython 3.11–3.14 on both x86_64 and aarch64. Previously pip install autobahn on Alpine fell back to a source build that failed (the clang-built python-build-standalone interpreter's sysconfig carries a --rtlib=compiler-rt flag that Alpine's gcc rejects), so Alpine users could not install autobahn at all; the prebuilt wheels make it "just work". Built inside the official PyPA musllinux_1_2 images (gcc toolchain), tagged automatically by auditwheel, and gated by the check-release-fileset targets. PyPy-on-musl is a tracked follow-up (no official PyPA musllinux PyPy image) (#1877)

Commits

• 22055b5 Fix 1930 (#1931)
• 7d9baba Fix 1911 (#1922)
• 583b534 Fix 1910 (#1921)
• 77d323a Fix 1909 (#1916)
• cd2dffd Fix 1908 (#1912)
• e9eebbe Fix 1877 (#1905)
• c103d73 Fix 1875 (#1902)
• 36aa406 Fix 1840 (#1895)
• 20821ab Fix 1891 (#1894)
• a66e246 Remove duplicate run call for ApplicationRunner (#1887)
• Additional commits viewable in compare view

Updates boto3 from 1.43.40 to 1.43.92

Commits

• 4477cdc Merge branch 'release-1.43.92'
• 5d8a8ab Bumping version to 1.43.92
• 959442c Add changelog entries from botocore
• 5073bde Merge branch 'release-1.43.91'
• 19fa272 Merge branch 'release-1.43.91' into develop
• 036a8a0 Bumping version to 1.43.91
• c01821b Add changelog entries from botocore
• 1833427 Bump https://github.com/astral-sh/ruff-pre-commit (#4840)
• fb57e55 Merge branch 'release-1.43.90'
• c1f45dc Merge branch 'release-1.43.90' into develop
• Additional commits viewable in compare view

Updates botocore from 1.43.40 to 1.43.92

Commits

• dfd7fee Merge branch 'release-1.43.92'
• 0831ac2 Bumping version to 1.43.92
• a91f10f Update endpoints model
• a205ada Update to latest models
• 49ca08d Merge branch 'release-1.43.91'
• 23ca24b Merge branch 'release-1.43.91' into develop
• e312467 Bumping version to 1.43.91
• 2c5b866 Update to latest models
• dc85104 Merge branch 'release-1.43.90'
• 52ed7af Merge branch 'release-1.43.90' into develop
• Additional commits viewable in compare view

Updates cbor2 from 5.9.0 to 6.1.4

Release notes

Sourced from cbor2's releases.

6.1.4

• Fixed frozendict deriving its hash from its keys and its values as two independent sets, so that frozendicts holding the same keys and the same values all collided regardless of how the two were paired; since the decoder builds a frozendict for every map in an immutable position, a payload keyed by such maps decoded in quadratic time (#333; PR by @​sahvx655-wq)
• Fixed the encoder not registering bytearray values in the string reference namespace, unlike bytes and str; since the decoder registers every byte string it reads, a single bytearray desynchronised the namespace and made subsequent string references resolve to the wrong value (#332; PR by @​sahvx655-wq)
• Fixed the decoder silently accepting an indefinite-length map whose break marker arrives after a key with no value, dropping that trailing key and returning a truncated map instead of rejecting the ill-formed input (#331; PR by @​sahvx655-wq)
• Fixed the decoder accepting a non-byte-string payload for a positive or negative bignum (tags 2 and 3). int.from_bytes() also accepts an array (or a map, whose keys it iterates), so a tag wrapping one of those was coerced into an integer instead of being rejected as malformed (#326; PR by @​sahvx655-wq)

6.1.3

• Fixed the decoder registering 6-byte strings in the string reference namespace at indices 65536–4294967295 where the encoder does not, desynchronising the namespace and resolving later string references to the wrong value (#313; PR by @​sahvx655-wq)
• Fixed the IPv4/IPv6 network decoders (tags 52 and 54) silently truncating an address byte string that is longer than the address size instead of rejecting it as malformed (#309; PR by @​sahvx655-wq)
• Fixed quadratic decoding time for indefinite-length and large definite-length byte and text strings, caused by concatenating each chunk onto the accumulated result with + instead of building the result once (#316; PR by @​sahvx655-wq)
• Fixed datetime_as_timestamp encoding whole-second datetimes before 1970 or after 2106 as floats instead of integers, because the timestamp was narrowed through an unsigned 32-bit integer (#317; PR by @​sahvx655-wq)
• Fixed the encoder measuring text strings by code point count instead of UTF-8 byte length when deciding whether to add them to the string reference namespace, desynchronising it from the decoder (which counts bytes) and corrupting later string references for non-ASCII strings (#314; PR by @​sahvx655-wq)
• Fixed the decoder rejecting scoped IPv6 addresses (tag 54) with a CBORDecodeError reading invalid types in input array; the encoder emits them as [address, null, zone id] but the decoder only handled the network and interface array forms, so a scoped ~ipaddress.IPv6Address could not be decoded back (#324; PR by @​sahvx655-wq)

6.1.2

• Fixed incorrect tracking of string references for definite-length text strings of length greater than 65536 (#308; PR by @​sahvx655-wq)
• Fixed cbor2.load() crash caused by incorrect handling of internal read buffer extension during stream deserialization. (#307; PR by @​noderyos)

6.1.1

• Fixed cbor2.load() returning corrupted data for payloads exceeding 4096 bytes (#304)

6.1.0

• Added the allow_duplicate_keys parameter to CBORDecoder, load and loads (default: True). When set to False, a CBORDecodeError is raised upon encountering a duplicate key within the same map. (#283)
• Added support for decoding from any object supporting the buffer API (e.g. memoryview or bytearray) in addition to bytes (#297)
• Fixed compatibility issues with 32-bit systems (#300)

6.0.1

• Fixed an error in the mutability logic during decoding, leading to values being decoded as immutable in unexpected places (#295)

6.0.0

• No changes since v6.0.0rc1

6.0.0rc1

• MAJOR REWRITE: The Python and C implementations of the encoder and decoder were replaced with a single, Rust-based implementation in the interest of maintainability.

  Here are some of the highlights:

  • Improved memory safety (100% safe-mode Rust)
  • Complete elimination of reference leaks
  • Support for free-threading and subinterpreters
  • Substantially improved performance
  • Improved decoder error handling where any non-base exception gets wrapped in a CBORDecodeError
  • Iterative, rather than recursive decoding, meaning the container nesting depth is limited only by the available memory, rather than the C stack size

• BACKWARD INCOMPATIBLE Changed the signature of the tag_hook decoder callables to accept (CBORTag, immutable as arguments instead of CBORDecoder, CBORTag)

• BACKWARD INCOMPATIBLE Changed the signature of the object_hook decoder callables to accept (Mapping[Any, Any], bool) instead of (CBORDecoder, dict[Any, Any])

• BACKWARD INCOMPATIBLE Removed the break_marker singleton as no longer necessary

... (truncated)

Commits

• a780f82 Bumped up the version
• d1f0ca5 Reject non-byte-string payloads in bignum decoders (#326)
• 7a6682b Reject indefinite-length maps missing a value for the last key (#331)
• 693219c Register bytearrays in the string reference namespace (#332)
• 18f9fc7 Hash frozendict by its items instead of keys and values separately (#333)
• 18c6507 [pre-commit.ci] pre-commit autoupdate (#325)
• 5820bd4 Bumped up the version
• 8bb0466 Bump the github-actions group with 2 updates (#323)
• 00e3dea Decode scoped IPv6 addresses instead of rejecting them (#324)
• aeff00b Measure text strings by byte length in maybe_stringref (#314)
• Additional commits viewable in compare view

Updates coverage from 7.15.0 to 7.16.0

Release notes

Sourced from coverage's releases.

7.16.0

Version 7.16.0 — 2026-08-28

• When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
• The Coverage.switch_context() method now returns the previous context.
• Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
• Fixes to validation of options and configuration settings:
  • Negative precision settings now always cause useful error messages (pull 2261).
  • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
  • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
  • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
• Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

7.15.4

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
• Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.
• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️  PyPI page: coverage 7.15.3. :arrow_right:  To install: python3 -m pip install coverage==7.15.3

7.15.2

Version 7.15.2 — 2026-07-15

• Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

7.15.1

Version 7.15.1 — 2026-07-12

• Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare.
• A number of performance improvements thanks to Paul Kehrer, in pull requests 2213, 2214, 2215, 2216, 2218, 2220, and 2221.

... (truncated)

Changelog

Sourced from coverage's changelog.

Version 7.16.0 — 2026-08-28

• When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

• The :meth:.Coverage.switch_context method now returns the previous context.

• Fix: previously, a [paths] pattern would be replaced everywhere in a f...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.