Skip to content

Bump the production-dependencies group across 1 directory with 7 updates#27

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/production-dependencies-3db825a5ac
Open

Bump the production-dependencies group across 1 directory with 7 updates#27
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/production-dependencies-3db825a5ac

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 1, 2026

Bumps the production-dependencies group with 7 updates in the / directory:

Package From To
babel 2.17.0 2.18.0
flask 3.1.2 3.1.3
gunicorn 23.0.0 25.1.0
packaging 25.0 26.0
setuptools 80.9.0 82.0.0
sqlalchemy 2.0.44 2.0.47
werkzeug 3.1.4 3.1.6

Updates babel from 2.17.0 to 2.18.0

Release notes

Sourced from babel's releases.

v2.18.0

Happy 2026! Like last year's release (ahem...), this one too is being made from FOSDEM 2026, in Brussels, Belgium. 🇧🇪 We'll aspire for a less glacial release cycle for 2.19. 😁

Please see CHANGELOG.rst for the detailed change log.

Full Changelog: python-babel/babel@v2.17.0...v2.18.0

Changelog

Sourced from babel's changelog.

Version 2.18.0

Happy 2026! This release is, coincidentally, also being made from FOSDEM.

We will aspire for a slightly less glacial release cadence in this year; there are interesting features in the pipeline.

Features


* Core: Add `babel.core.get_cldr_version()` by @akx in :gh:`1242`
* Core: Use CLDR 47 by @tomasr8 in :gh:`1210`
* Core: Use canonical IANA zone names in zone_territories by @akx in :gh:`1220`
* Messages: Improve extract performance via ignoring directories early during os.walk by @akx in :gh:`968`
* Messages: Merge in per-format keywords and auto_comments by @akx in :gh:`1243`
* Messages: Update keywords for extraction of dpgettext and dnpgettext by @mardiros in :gh:`1235`
* Messages: Validate all plurals in Python format checker by @tomasr8 in :gh:`1188`
* Time: Use standard library `timezone` instead of `FixedOffsetTimezone` by @akx in :gh:`1203`

Bugfixes

  • Core: Fix formatting for "Empty locale identifier" exception added in #1164 by @​akx in :gh:1184
  • Core: Improve handling of no-inheritance-marker in timezone data by @​akx in :gh:1194
  • Core: Make the number pattern regular expression more efficient by @​akx in :gh:1213
  • Messages: Keep translator comments next to the translation function call by @​akx in :gh:1196
  • Numbers: Fix KeyError that occurred when formatting compact currencies of exactly one thousand in several locales by @​bartbroere in :gh:1246

Other improvements


* Core: Avoid unnecessary uses of `map()` by @akx in :gh:`1180`
* Messages: Have init-catalog create directories too by @akx in :gh:`1244`
* Messages: Optimizations for read_po by @akx in :gh:`1200`
* Messages: Use pathlib.Path() in catalog frontend; improve test coverage by @akx in :gh:`1204`

Infrastructure and documentation

  • CI: Renovate CI & lint tools by @​akx in :gh:1228
  • CI: Tighten up CI with Zizmor by @​akx in :gh:1230
  • CI: make job permissions explicit by @​akx in :gh:1227
  • Docs: Add SECURITY.md by @​akx in :gh:1229
  • Docs: Remove u string prefix from docs by @​verhovsky in :gh:1174
  • Docs: Update dates.rst with current unicode.org tr35 link by @​clach04 in :gh:1189
  • General: Add some PyPI classifiers by @​tomasr8 in :gh:1186
  • General: Apply reformatting by hand and with Ruff by @​akx in :gh:1202
  • General: Test on and declare support for Python 3.14 by @​akx in :gh:1233

... (truncated)

Commits
  • 56c63ca Prepare for 2.18.0 (#1248)
  • 73015a1 Add user-agent to CLDR downloader (#1247)
  • 29bd362 Fix formatting compact currencies of exactly one thousand in several locales ...
  • 851db43 Reuse InitCatalog's guts in UpdateCatalog (#1244)
  • fd00e60 Extract: Merge in per-format keywords and auto_comments (#1243)
  • 12a14b6 Add dpgettext and dnpgettext support (#1235)
  • 7110e62 Use canonical IANA zone names in zone_territories (#1220)
  • e91c346 Improve extract performance via ignoring directories early during os.walk (#968)
  • 0c4f378 Convert Unittest testcases with setup/teardown to fixtures (#1240)
  • 218c96e Add babel.core.get_cldr_version() (#1242)
  • Additional commits viewable in compare view

Updates flask from 3.1.2 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates gunicorn from 23.0.0 to 25.1.0

Release notes

Sourced from gunicorn's releases.

Gunicorn 25.1.0

New Features

  • Control Interface (gunicornc): Add interactive control interface for managing running Gunicorn instances, similar to birdc for BIRD routing daemon ([PR #3505](benoitc/gunicorn#3505))

    • Unix socket-based communication with JSON protocol
    • Interactive mode with readline support and command history
    • Commands: show all/workers/dirty/config/stats/listeners
    • Worker management: worker add/remove/kill, dirty add/remove
    • Server control: reload, reopen, shutdown
    • New settings: --control-socket, --control-socket-mode, --no-control-socket
    • New CLI tool: gunicornc for connecting to control socket
    • See Control Interface Guide for details

  • Dirty Stash: Add global shared state between workers via dirty.stash ([PR #3503](benoitc/gunicorn#3503))

    • In-memory key-value store accessible by all workers
    • Supports get, set, delete, clear, keys, and has operations
    • Useful for sharing state like feature flags, rate limits, or cached data

  • Dirty Binary Protocol: Implement efficient binary protocol for dirty arbiter IPC using TLV (Type-Length-Value) encoding ([PR #3500](benoitc/gunicorn#3500))

    • More efficient than JSON for binary data
    • Supports all Python types: str, bytes, int, float, bool, None, list, dict
    • Better performance for large payloads

  • Dirty TTIN/TTOU Signals: Add dynamic worker scaling for dirty arbiters ([PR #3504](benoitc/gunicorn#3504))

    • Send SIGTTIN to increase dirty workers
    • Send SIGTTOU to decrease dirty workers
    • Respects minimum worker constraints from app configurations

Changes

  • ASGI Worker: Promoted from beta to stable
  • Dirty Arbiters: Now marked as beta feature

Documentation

  • Fix Markdown formatting in /configure documentation

25.0.3

What's Changed

Bug Fixes

  • Fix RuntimeError when StopIteration raised in ASGI coroutine (#3484)
  • Fix passing maxsplit in re.split() as positional argument (deprecated in Python 3.13)

... (truncated)

Commits
  • 2d43101 docs: merge gunicornc into 25.1.0 release
  • bf4ad8d docs: update 25.1.0 release date to 2026-02-13
  • 730350e Merge pull request #3505 from benoitc/feature/gunicornc-control-interface
  • 63df19b fix(tests): use process groups for reliable signal handling in PyPy
  • cd77bcc fix(tests): increase wait time for all server tests
  • 02ea985 fix(tests): improve server test reliability on FreeBSD
  • 6d81c9e fix: resolve pylint warnings
  • 7486baa fix: remove unused imports
  • 3e60d29 docs: add gunicornc control interface guide
  • e05e40d feat(ctl): add message-based dirty worker management
  • Additional commits viewable in compare view

Updates packaging from 25.0 to 26.0

Release notes

Sourced from packaging's releases.

26.0

Read about the performance improvements here: https://iscinumpy.dev/post/packaging-faster.

What's Changed

Features:

Behavior adaptations:

Fixes:

Performance:

... (truncated)

Changelog

Sourced from packaging's changelog.

26.0 - 2026-01-20


Features:

    

  • PEP 751: support pylock (:pull:900)
    • 

  • PEP 794: import name metadata (:pull:948)
    • 

  • Support for writing metadata to a file (:pull:846)
    • 

  • Support __replace__ on Version (:pull:1003)
    • 

  • Support positional pattern matching for Version and SpecifierSet (:pull:1004)
    • 



Behavior adaptations:


    

  • PEP 440 handling of prereleases for Specifier.contains, SpecifierSet.contains, and SpecifierSet.filter (:pull:897)
    • 

  • Handle PEP 440 edge case in SpecifierSet.filter (:pull:942)
    • 

  • Adjust arbitrary equality intersection preservation in SpecifierSet (:pull:951)
    • 

  • Return False instead of raising for .contains with invalid version (:pull:932)
    • 

  • Support arbitrary equality on arbitrary strings for Specifier and SpecifierSet's filter and contains method. (:pull:954)
    • 

  • Only try to parse as Version on certain marker keys, return False on unequal ordered comparisons (:pull:939)
    • 



Fixes:


    

  • Update _hash when unpickling Tag() (:pull:860)
    • 

  • Correct comment and simplify implicit prerelease handling in Specifier.prereleases (:pull:896)
    • 

  • Use explicit _GLibCVersion NamedTuple in _manylinux (:pull:868)
    • 

  • Detect invalid license expressions containing () (:pull:879)
    • 

  • Correct regex for metadata 'name' format (:pull:925)
    • 

  • Improve the message around expecting a semicolon (:pull:833)
    • 

  • Support nested parens in license expressions (:pull:931)
    • 

  • Add space before at symbol in Requirements string (:pull:953)
    • 

  • A root logger use found, use a packaging logger instead (:pull:965)
    • 

  • Better support for subclassing Marker and Requirement (:pull:1022)
    • 

  • Normalize all extras, not just if it comes first (:pull:1024)
    • 

  • Don't produce a broken repr if Marker fails to construct (:pull:1033)
    • 



Performance:


    

  • Avoid recompiling regexes in the tokenizer for a 3x speedup (:pull:1019)
    • 

  • Improve performance in _manylinux.py (:pull:869)
    • 

  • Minor cleanups to Version (:pull:913)
    • 

  • Skip redundant creation of Version's in specifier comparison (:pull:986)
    • 

  • Cache the Specifier's Version (:pull:985)
    • 

  • Make Version a little faster (:pull:987)
    • 

  • Minor Version regex cleanup (:pull:990)
    • 

  • Faster regex on Python 3.11.5+ for Version (:pull:988, :pull:1055)
    • 

  • Lazily calculate _key in Version (:pull:989, :pull:1048)
    • 

  • Faster canonicalize_version (:pull:993)
    • 

  • Use re.fullmatch in a couple more places (:pull:992, :pull:1029)
    • 

  • Use map instead of generator (:pull:996)
    • 

  • Deprecate ._version (_Version, a NamedTuple) (:pull:995, :pull:1062)
    
</tr></table>

... (truncated)

Commits

Updates setuptools from 80.9.0 to 82.0.0

Changelog

Sourced from setuptools's changelog.

v82.0.0

Deprecations and Removals

  • pkg_resources has been removed from Setuptools. Most common uses of pkg_resources have been superseded by the importlib.resources <https://docs.python.org/3/library/importlib.resources.html>_ and importlib.metadata <https://docs.python.org/3/library/importlib.metadata.html>_ projects. Projects and environments relying on pkg_resources for namespace packages or other behavior should depend on older versions of setuptools. (#3085)

v81.0.0

Deprecations and Removals

  • Removed support for the --dry-run parameter to setup.py. This one feature by its nature threads through lots of core and ancillary functionality, adding complexity and friction. Removal of this parameter will help decouple the compiler functionality from distutils and thus the eventual full integration of distutils. These changes do affect some class and function signatures, so any derivative functionality may require some compatibility shims to support their expected interface. Please report any issues to the Setuptools project for investigation. (#4872)

v80.10.2

Bugfixes

  • Update vendored dependencies. (#5159)

Misc

v80.10.1

Misc

v80.10.0

Features

  • Remove post-release tags on setuptools' own build. (#4530)
  • Refreshed vendored dependencies. (#5139)

... (truncated)

Commits
  • 03f3615 Bump version: 81.0.0 → 82.0.0
  • 530d114 Merge pull request #5007 from pypa/feature/remove-more-pkg_resources
  • 11efe9f Merge branch 'maint/75.3'
  • 118f129 Bump version: 75.3.3 → 75.3.4
  • 90561ff Merge pull request #5150 from UladzimirTrehubenka/backport_cve_47273
  • 4595034 Add news fragment.
  • fc00800 Merge pull request #5171 from cclauss/ruff-v0.15.0
  • 127e561 Remove tests reliant on pkg_resources, rather than xfailing them.
  • 64bc21e Reference the superseding libraries.
  • cf1ff45 Merge branch 'main' into debt/pbr-without-pkg_resources
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.44 to 2.0.47

Release notes

Sourced from sqlalchemy's releases.

2.0.47

Released: February 24, 2026

orm

  • [orm] [bug] Fixed issue when using ORM mappings with Python 3.14's PEP 649 feature that no longer requires "future annotations", where the ORM's introspection of the __init__ method of mapped classes would fail if non-present identifiers in annotations were present. The vendored getfullargspec() method has been amended to use Format.FORWARDREF under Python 3.14 to prevent resolution of names that aren't present.

    References: #13104

engine

  • [engine] [usecase] The connection object returned by _engine.Engine.raw_connection() now supports the context manager protocol, automatically returning the connection to the pool when exiting the context.

    References: #13116

postgresql

  • [postgresql] [bug] Fixed an issue in the PostgreSQL dialect where foreign key constraint reflection would incorrectly swap or fail to capture onupdate and ondelete values when these clauses appeared in a different order than expected in the constraint definition. This issue primarily affected PostgreSQL-compatible databases such as CockroachDB, which may return ON DELETE before ON UPDATE in the constraint definition string. The reflection logic now correctly parses both clauses regardless of their ordering.

    References: #13105

  • [postgresql] [bug] Fixed issue in the engine_insertmanyvalues feature where using PostgreSQL's ON CONFLICT clause with _dml.Insert.returning.sort_by_parameter_order enabled would generate invalid SQL when the insert used an implicit sentinel (server-side autoincrement primary key). The generated SQL would incorrectly declare a sentinel counter column in the imp_sen table alias without providing corresponding values in the VALUES clause, leading to a ProgrammingError indicating column count mismatch. The fix allows batch execution mode when embed_values_counter is active, as the embedded counter provides the ordering capability needed even with upsert behaviors, rather than unnecessarily downgrading to row-at-a-time execution.

... (truncated)

Commits

Updates werkzeug from 3.1.4 to 3.1.6

Release notes

Sourced from werkzeug's releases.

3.1.6

This is the Werkzeug 3.1.6 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.6/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6

  • safe_join on Windows does not allow special devices names in multi-segment paths. GHSA-29vq-49wr-vm6x

3.1.5

This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.5/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5 Milestone: https://github.com/pallets/werkzeug/milestone/43?closed=1

  • safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. GHSA-87hc-h4r5-73f7
  • The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. #3065 #3077
  • Fix AttributeError when initializing DebuggedApplication with pin_security=False. #3075
Changelog

Sourced from werkzeug's changelog.

Version 3.1.6

Released 2026-02-19

  • safe_join on Windows does not allow special devices names in multi-segment paths. :ghsa:29vq-49wr-vm6x

Version 3.1.5

Released 2026-01-08

  • safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7
  • The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:3065 :issue:3077
  • Fix AttributeError when initializing DebuggedApplication with pin_security=False. :issue:3075
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the production-dependencies group across 1 directory with 7 updates
b2542d2 
Bumps the production-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [babel](https://github.com/python-babel/babel) | `2.17.0` | `2.18.0` |
| [flask](https://github.com/pallets/flask) | `3.1.2` | `3.1.3` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `23.0.0` | `25.1.0` |
| [packaging](https://github.com/pypa/packaging) | `25.0` | `26.0` |
| [setuptools](https://github.com/pypa/setuptools) | `80.9.0` | `82.0.0` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.44` | `2.0.47` |
| [werkzeug](https://github.com/pallets/werkzeug) | `3.1.4` | `3.1.6` |



Updates `babel` from 2.17.0 to 2.18.0
- [Release notes](https://github.com/python-babel/babel/releases)
- [Changelog](https://github.com/python-babel/babel/blob/master/CHANGES.rst)
- [Commits](python-babel/babel@v2.17.0...v2.18.0)

Updates `flask` from 3.1.2 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.2...3.1.3)

Updates `gunicorn` from 23.0.0 to 25.1.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@23.0.0...25.1.0)

Updates `packaging` from 25.0 to 26.0
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@25.0...26.0)

Updates `setuptools` from 80.9.0 to 82.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v80.9.0...v82.0.0)

Updates `sqlalchemy` from 2.0.44 to 2.0.47
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `werkzeug` from 3.1.4 to 3.1.6
- [Release notes](https://github.com/pallets/werkzeug/releases)
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)
- [Commits](pallets/werkzeug@3.1.4...3.1.6)

---
updated-dependencies:
- dependency-name: babel
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: gunicorn
  dependency-version: 25.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: packaging
  dependency-version: '26.0'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: setuptools
  dependency-version: 82.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: sqlalchemy
  dependency-version: 2.0.47
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: werkzeug
  dependency-version: 3.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Mar 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants