Skip to content

Bump the all-pip-dependencies group in /infra with 6 updates - #679

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/infra/all-pip-dependencies-1e3e802f2b
Open

Bump the all-pip-dependencies group in /infra with 6 updates#679
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/infra/all-pip-dependencies-1e3e802f2b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-pip-dependencies group in /infra with 6 updates:

Package From To
boto3 1.43.123 1.43.126
django-sortedm2m 4.0.0 4.1.0
django 6.1.2 6.1.3
coverage 7.17.0 7.17.2
markdown 3.11.2 3.11.3
celery 5.6.3 5.7.0

Updates boto3 from 1.43.123 to 1.43.126

Commits
  • ef06721 Merge branch 'release-1.43.126'
  • de8922c Bumping version to 1.43.126
  • 03472f1 Add changelog entries from botocore
  • 0b10f04 Merge branch 'release-1.43.125'
  • 6b6c175 Merge branch 'release-1.43.125' into develop
  • 140a240 Bumping version to 1.43.125
  • e239fae Add changelog entries from botocore
  • fef3ef7 Merge branch 'release-1.43.124'
  • 6b03fe3 Merge branch 'release-1.43.124' into develop
  • edc2ae0 Bumping version to 1.43.124
  • Additional commits viewable in compare view

Updates django-sortedm2m from 4.0.0 to 4.1.0

Release notes

Sourced from django-sortedm2m's releases.

4.1.0

What's Changed

New Contributors

Full Changelog: django-commons/django-sortedm2m@4.0.0...4.1.0

Changelog

Sourced from django-sortedm2m's changelog.

4.1.0

  • Switched to trusted publisher release process with Django Commons
  • Switch from Jazzband org to Django Commons
Commits

Updates django from 6.1.2 to 6.1.3

Commits

Updates coverage from 7.17.0 to 7.17.2

Release notes

Sourced from coverage's releases.

7.17.2

Version 7.17.2 — 2026-11-04

  • Fix: two different scenarios failed with “attempt to write a readonly database”. These were regressions in 7.17.1. They are fixed, closing issue 2356:
    • When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.
    • coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can’t read is now reported like any other unusable data file, and is left in place.

➡️  PyPI page: coverage 7.17.2. :arrow_right:  To install: python3 -m pip install coverage==7.17.2

7.17.1

Version 7.17.1 — 2026-11-03

  • Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167 and issue 2337.
  • Fix: the HTML report only rewrites a file’s page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.
  • Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message “total of 0.4 is less than fail-under=0.5”. Previously, the comparison rounded the total to zero and the message could claim “1 is less than 0”. Closes issue 2295.
  • Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &amp;. Now they are properly escaped only once.
  • Fix: --source=/ measured no files. A file system root can’t be a source directory, so now it is an error. Closes issue 2291.
  • In an abundance of caution, prevent forged SQLite journal files from deleting files they shouldn’t.

➡️  PyPI page: coverage 7.17.1. :arrow_right:  To install: python3 -m pip install coverage==7.17.1

Changelog

Sourced from coverage's changelog.

Version 7.17.2 — 2026-11-04

  • Fix: two different scenarios failed with "attempt to write a readonly database". These were regressions in 7.17.1. They are fixed, closing issue 2356_:

    • When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.

    • coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can't read is now reported like any other unusable data file, and is left in place.

.. _issue 2356: coveragepy/coveragepy#2356

.. _changes_7-17-1:

Version 7.17.1 — 2026-11-03

  • Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167_ and issue 2337_.

  • Fix: the HTML report only rewrites a file's page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.

  • Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message "total of 0.4 is less than fail-under=0.5". Previously, the comparison rounded the total to zero and the message could claim "1 is less than 0". Closes issue 2295_.

  • Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &amp;. Now they are properly escaped only once.

  • Fix: --source=/ measured no files. A file system root can't be a source directory, so now it is an error. Closes issue 2291_.

... (truncated)

Commits
  • d0d3e1d docs: combine the two 'combine' failure descriptions
  • 33cb85f fix: don't initialize a data file we can only read (#2360)
  • 6e71bac docs: prep for 7.17.2
  • 8273f72 test: fix two tests that failed on the Rocky 8 old_sqlite job
  • ce216fd build: a test environment for old version of SQLite
  • 36e4a18 fix: combine failed on SQLite<3.34.0 #2356
  • d80ed19 build: bump version to 7.17.2
  • 1941ee1 docs: prep for 7.17.1
  • 474bba1 chore: make upgrade
  • 1ab58b3 chore: bump the action-dependencies group with 6 updates (#2355)
  • Additional commits viewable in compare view

Updates markdown from 3.11.2 to 3.11.3

Release notes

Sourced from markdown's releases.

Release 3.11.3

Fixed

  • Fix cases in new emphasis handling that did not handle long chains of tokens like they should (#1690).
  • Fix quadratic-time parsing of many consecutive reference definitions, and of many consecutive footnote definitions in the footnotes extension.
  • Support automatic links with URL schemes other than HTTP and FTP, such as <ssh://example.org> (#1244).
  • Fix quadratic-time id generation in the toc extension when many headers share the same text.
  • Ignore glossary abbreviations with empty definitions after inline elements, consistently with abbreviations before inline elements.
  • Strip complete HTML tags with quoted > characters from toc labels and generated heading IDs.
  • Fix quadratic-time regex backtracking in attr_list when a block ends with an unclosed attribute list followed by a long run of spaces, e.g. a line consisting only of { and some text with many trailing spaces (#1656).
  • Fix quadratic-time regex backtracking in hash headers when a long run of # characters is followed by more text on the same line.
  • Fix quadratic time when a document contains many unclosed HTML comments (<!-- with no matching -->).
  • Fix regression in BacktickInlineProcessor where text could be lost when opening and closing backticks did not match (#1668).
  • Escape the language name in the codehilite extension's non-Pygments output to maintain consistency with Pygments output.
  • Preserve attributes without a value in the attr_list extension exactly as provided, rather than rendering them as key="key", so the same source renders consistently under both the html and xhtml output formats (#1501).
Changelog

Sourced from markdown's changelog.

[3.11.3] - 2026-11-05

Fixed

  • Fix cases in new emphasis handling that did not handle long chains of tokens like they should (#1690).
  • Fix quadratic-time parsing of many consecutive reference definitions, and of many consecutive footnote definitions in the footnotes extension.
  • Support automatic links with URL schemes other than HTTP and FTP, such as <ssh://example.org> (#1244).
  • Fix quadratic-time id generation in the toc extension when many headers share the same text.
  • Ignore glossary abbreviations with empty definitions after inline elements, consistently with abbreviations before inline elements.
  • Strip complete HTML tags with quoted > characters from toc labels and generated heading IDs.
  • Fix quadratic-time regex backtracking in attr_list when a block ends with an unclosed attribute list followed by a long run of spaces, e.g. a line consisting only of { and some text with many trailing spaces (#1656).
  • Fix quadratic-time regex backtracking in hash headers when a long run of # characters is followed by more text on the same line.
  • Fix quadratic time when a document contains many unclosed HTML comments (<!-- with no matching -->).
  • Fix regression in BacktickInlineProcessor where text could be lost when opening and closing backticks did not match (#1668).
  • Escape the language name in the codehilite extension's non-Pygments output to maintain consistency with Pygments output.
  • Preserve attributes without a value in the attr_list extension exactly as provided, rather than rendering them as key="key", so the same source renders consistently under both the html and xhtml output formats (#1501).
Commits
  • 40eca04 Bump version to 3.11.3
  • a198bb3 Apply the CommonMark rule of 3 which we missed.
  • 0bfd8c3 Fix quadratic-time parsing of consecutive reference definitions
  • 3f2c551 Avoid rescanning for a comment close after unclosed comments
  • 8bfb9aa Ignore empty abbreviation definitions in element tails
  • 527b81e Recognize additional URL schemes in automatic links
  • b97b56c attr_list: preserve valueless attributes as provided
  • e76f0b7 Fix quadratic-time id generation in toc extension
  • 0f0a860 Fix quadratic-time backtracking in hash header regex
  • 5e335ef Fix TOC labels for quoted HTML angle brackets
  • Additional commits viewable in compare view

Updates celery from 5.6.3 to 5.7.0

Release notes

Sourced from celery's releases.

v5.7.0

Celery 5.7.0

We're pleased to announce Celery 5.7.0, a new stable release of Celery.

This release brings substantial improvements to task workflows, worker reliability, result handling, scheduling, and broker connectivity. It also includes new integrations, improved Python compatibility, performance optimizations, and a large number of bug fixes contributed by the community.

A significant part of this release focuses on making complex Canvas workflows more reliable and efficient, improving worker behavior during broker disconnections and shutdown, and making result-backend state handling more consistent.

Highlights

  • More reliable Canvas workflows: Improved chains, groups, chords, nested workflows, callbacks, errbacks, and failure propagation. Several fixes also reduce unnecessary message growth in complex chains and chords.
  • Improved worker reliability: Better connection recovery, graceful shutdown, prefork process management, autoscaling, and handling of worker-process loss.
  • More predictable task results: Improved result-state consistency, retry handling, ignore_result behavior, and concurrent AsyncResult tracking.
  • Timezone and scheduling improvements: More reliable ETA, countdown, expiration, crontab, solar schedules, and Celery Beat behavior across daylight-saving-time transitions.
  • New Pydantic integration behavior: Tasks configured with pydantic=True can accept Pydantic model instances.
  • New pymemcache result backend support: Adds support for using pymemcache as a result backend.
  • Improved Redis result backend: New expiration settings for chord and failure results, improved Pub/Sub handling, and more reliable chord accounting.
  • Better Python compatibility: Python 3.10 is now the minimum supported version, with compatibility work for newer Python versions, including Python 3.14.
  • Improved worker operations: Cgroup-aware automatic concurrency detection and additional worker-management improvements.

What's New

Canvas, Chains, Groups, and Chords

Celery 5.7 includes extensive improvements to Canvas execution and composition, particularly for nested workflows and complex chains and chords.

  • Fixed failure propagation through chained tasks into chord bodies.
  • Improved chord failure handling when a chord header or a chained chord fails.
  • Fixed chord error handling when the chord body is itself a chain.
  • Improved handling of empty groups and chains, including empty groups inside chains and group headers.
  • Chains are now constructed in a single pass instead of repeatedly folding signatures with the | operator.
  • Reduced unnecessary message growth in chains of chords, chains of groups, implicit chords, and standalone chord bodies.
  • Improved nested group handling and preservation of group IDs.
  • Fixed duplicate nodes in GroupResult.as_tuple() after groups in chains.
  • Improved GroupResult fan-out behavior in chains.
  • Fixed eager execution behavior for chains containing Ignore or Reject.
  • Avoided unnecessary result-backend access when eagerly applying groups inside chains.
  • Improved task replacement with chains containing groups, including cases that previously could hang.
  • Improved callback execution when a task is replaced by a chain, ensuring callbacks are not invoked repeatedly.
  • Fixed eager-chain callback behavior so that chain links are dispatched once at the appropriate point.
  • Improved propagation of task options, ETA, and countdown values to chord headers.
  • Corrected the handling of link and link_error options on chords so they are applied to the chord body.
  • Improved errback argument classification and handling of new-style errback calls.
  • Preserved group errback mutability and improved stamped-header merging and revocation.
  • Improved signature cloning and option isolation, preventing cloned signatures from sharing mutable keyword arguments with their originals.
  • Fixed argument forwarding through nested chains during eager execution.
  • Improved map and starmap option merging.

These changes make complex Canvas compositions more predictable and reduce unnecessary broker traffic and message growth.

... (truncated)

Changelog

Sourced from celery's changelog.

5.7.0

:release-date: 2026-11-05 :release-by: Asif Saif Uddin

Celery v5.7.0 Stable Release is now available for testing and deploy to production. Please help us test this version and report any issues.

What's Changed Since 5.7.0rc1

This section summarizes the changes made since the Celery 5.7.0rc1 pre-release.

Canvas, Chains, Groups, and Chords

  • Run a replaced task's callbacks once when it is replaced with a chain (:ghpull:10927`).
  • Fix chord link and link-error options so they are passed to the body only (:ghpull:10778`).
  • Fix stamped header revocation (:ghpull:10884`).
  • Count each chord header task only once in the Redis backend (:ghpull:10919`).
  • Fix Redis chord claim cleanup ownership (:ghpull:10998`).
  • Fail the chord when chord_unlock retry is refused by the broker (:ghpull:10959`).

Task Execution and Result Handling

  • Fix retry argument conflicts when switching calling conventions (:ghpull:10895`).
  • Pass values to backend hooks by position again (:ghpull:10918`).
  • Don't mark a task REVOKED while another worker is running it (:ghpull:10922`).
  • Keep the first SUCCESS in the database, MongoDB, and Cassandra backends (:ghpull:10920, :ghpull:10944, :ghpull:10945`).
  • Don't record FAILURE when on_success raises after SUCCESS was stored (:ghpull:10759`).
  • Don't fail a task whose SUCCESS was stored before the worker was lost (:ghpull:10752`).
  • Fix a worker hang in WorkerLostError when result_backend_always_retry=True (:ghpull:10960`).
  • Fix send_task() overriding ignore_result defaults (:ghpull:10953`).
  • Preserve ignore_result overrides across task retries (:ghpull:10958`).
  • Make Task.apply() respect the task.ignore_result default (:ghpull:11001`).
  • Don't store RETRY for an ignored result when retrying after a lost worker (:ghpull:11009`).
  • Track every AsyncResult waiting on a task ID (:ghpull:10956`).
  • Allow ResultSet.add() after the set's results are ready (:ghpull:10930`).
  • Use the documented retry defaults in the database backend (:ghpull:10921`).
  • Fix Manager warning output during retries (:ghpull:10948`).
  • Wait between retries when the broker refuses a callback publish (:ghpull:10975`).
  • Merge signature options in map and starmap apply_async() (:ghpull:10787`).
  • Stop gating task publishing signals on cached receiver lists (:ghpull:10791`).

Worker Operations

... (truncated)

Commits
  • 6fcdbf9 Bump version: 5.7.0rc1 → 5.7.0 (#11025)
  • 4a1d6f4 Make beat's pidbox stop test tolerate slow runners (#11024)
  • 6a80d47 Added changelog and new features for celery v5.7.0 stable version (#11016)
  • 6b67b23 Fix dead Akismet and vine zipball links in the docs (#11021)
  • e82fa93 Chore(deps): Bump azure-identity from 1.26.0 to 1.27.0
  • 2fe0ead Chore(deps): Bump google-cloud-storage from 3.15.0 to 3.17.1 (#11013)
  • 89ce900 Fix#10997 - redis chord claim cleanup ownership (#10998)
  • 5d83c46 Don't store RETRY for an ignored result when retrying after a lost worker (#1...
  • 1f435e5 Use Cuba's 2025 fall-back in the midnight DST tests
  • 98b7ba9 Update kombu version to 5.7.0 (#11007)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the all-pip-dependencies group in /infra with 6 updates
531cdde 
Bumps the all-pip-dependencies group in /infra with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.123` | `1.43.126` |
| [django-sortedm2m](https://github.com/django-commons/django-sortedm2m) | `4.0.0` | `4.1.0` |
| [django](https://github.com/django/django) | `6.1.2` | `6.1.3` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.17.0` | `7.17.2` |
| [markdown](https://github.com/Python-Markdown/markdown) | `3.11.2` | `3.11.3` |
| [celery](https://github.com/celery/celery) | `5.6.3` | `5.7.0` |


Updates `boto3` from 1.43.123 to 1.43.126
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.123...1.43.126)

Updates `django-sortedm2m` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/django-commons/django-sortedm2m/releases)
- [Changelog](https://github.com/django-commons/django-sortedm2m/blob/master/CHANGES.rst)
- [Commits](django-commons/django-sortedm2m@4.0.0...4.1.0)

Updates `django` from 6.1.2 to 6.1.3
- [Commits](django/django@6.1.2...6.1.3)

Updates `coverage` from 7.17.0 to 7.17.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.17.0...7.17.2)

Updates `markdown` from 3.11.2 to 3.11.3
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.11.2...3.11.3)

Updates `celery` from 5.6.3 to 5.7.0
- [Release notes](https://github.com/celery/celery/releases)
- [Changelog](https://github.com/celery/celery/blob/main/Changelog.rst)
- [Commits](celery/celery@v5.6.3...v5.7.0)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.126
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-pip-dependencies
- dependency-name: django-sortedm2m
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-pip-dependencies
- dependency-name: django
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-pip-dependencies
- dependency-name: coverage
  dependency-version: 7.17.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-pip-dependencies
- dependency-name: markdown
  dependency-version: 3.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-pip-dependencies
- dependency-name: celery
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-pip-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Nov 11, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants