build(deps): bump the python-packages group with 17 updates

[dependabot]

Bumps the python-packages group with 17 updates:

Package	From	To
colored	2.3.0	2.3.2
rdflib	7.1.3	7.6.0
werkzeug	3.1.3	3.1.8
pyjwt	2.10.1	2.13.0
requests	2.32.3	2.34.2
pytz	2025.1	2026.3.post1
confluent-kafka	2.8.0	2.15.0
opentelemetry-api	1.31.1	1.44.0
opentelemetry-sdk	1.31.1	1.44.0
pre-commit	4.2.0	4.6.2
types-pytz	2025.1.0.20250318	2026.3.1.20260727
urllib3	2.3.0	2.7.0
types-requests	2.32.0.20250306	2.33.0.20260712
mypy	1.15.0	2.3.1
cyclonedx-bom	5.3.0	7.3.1
wheel	0.45.1	0.48.0
pip-tools	7.4.1	7.6.1

Updates colored from 2.3.0 to 2.3.2

Changelog

Sourced from colored's changelog.

[2.3.2] - 2026-03-27

Added

• Added tests_pytest/ suite with pytest-based tests for foreground, background, styles, exceptions, hex color matching, and convert functionality.

Fixed

• Fixed mypy type error in hexadecimal.py: changed color parameter type from str | int to str in Hex.find(), as the method requires string input for len() and indexing operations.
• Fixed mypy type errors in attributes.py: added missing return type annotation (-> None) to MetaStyle.__getattr__() and replaced bare dict with dict[str, str] for _STYLES and _COLORS class attributes.
• Fixed ValueError in Colored.enabled() when FORCE_COLOR environment variable contains a non-integer value (e.g. FORCE_COLOR=yes): invalid values are now treated as enabled.
• Fixed Controls.nav() ignoring column=0 due to falsy check: changed if column: to if column is not None: so cursor position at column 0 (start of line) works correctly.
• Fixed ValueError crash in Hex.find() when passing an invalid hex string (e.g. #FF, #AABBCCDD): added format validation that raises InvalidHexColor for strings that are not 4 or 7 characters long starting with #.
• Fixed RGB values out of range in Utilities.is_percentage(): values are now clamped to [0, 255] to always produce valid ANSI escape sequences without breaking existing code.
• Fixed incorrect return type annotation -> None on __getattr__ in MetaStyle, MetaFore, and MetaBack metaclasses: changed to -> NoReturn since these methods always raise an exception and never return.
• Fixed Utilities.set_colorterm() losing the default truecolor value when $COLORTERM is not set in the environment: changed fallback from '' to self.colorterm to preserve the initialized default.
• Renamed misleading Hex.cube() method to Hex.square() to correctly reflect its calculation (x*x), which is the intended least squares fit operation.

[2.3.1] - 2025-07-28

Changed

• Refactor: Optimized Windows Terminal Mode initialization: Moved Colored.enable_windows_terminal_mode() call from Colored.__init__ to module-level execution. This ensures the Windows virtual terminal processing is enabled only once when the colored module is imported, instead of on every Colored object instantiation. This change improves performance by avoiding redundant API calls and checks.
• Refactor: Reduce Colored instance attributes: Removed redundant instance attributes (_ESC, _END, _STYLES, etc.) from the Colored class's __init__ method. These constants are now accessed directly from the Library module, reducing memory footprint per instance and improving adherence to Pylint's R0902 warning.

Fixed

• Resolved static analysis warnings in enable_windows_terminal_mode(): Modified enable_windows_terminal_mode() to ensure consistent return statements and handle all possible execution paths explicitly. This addresses mypy's "Missing return statement" error and pylint's "inconsistent-return-statements" warning by making all return paths explicit and robustly handling potential ctypes related exceptions. The return type hint was also updated to Optional[bool].
• Resolved type hinting and tuple unpacking warnings in Utilities.is_percentage(): Modified the Utilities.is_percentage() method to explicitly return a fixed-length tuple[int, int, int]. This addresses mypy's "Incompatible return value type" error and pylint's "unbalanced-tuple-unpacking" warning by ensuring consistent and statically verifiable return types.
• Refined type validation and error handling in Controls.nav(): Eliminated the redundant _is_str_object static method. Integrated string type validation directly into the nav() method. Replaced AttributeError with TypeError for improved semantic clarity when handling invalid argument types.
• Ensured test_hex_1.py correctly uses nearest ANSI codes for hex color representation, preventing InvalidHexColor exceptions during gradient and random color tests.

Commits

• 18c6356 Improve CHANGES.md entries for all previous versions with detailed descriptions
• d2f347d Fix raise-missing-from warning in Hex.find()
• d04103f Improve test coverage from 75% to 89%
• 30f2fd8 Update Python badge to 3.9+ and fix trailing whitespace in README.md
• 878bb97 Bump version to 2.3.2
• 04ed4b3 Rename Hex.cube() to Hex.square() to reflect actual calculation
• 43a2609 Fix set_colorterm() losing default colorterm when $COLORTERM is unset
• f19f1a5 Fix convert_percentages() docstring to match actual signature and behavior
• 475c55d Fix incorrect type in ansi_to_hex() docstring
• f5eb31f Fix getattr return type annotation to NoReturn in metaclasses
• Additional commits viewable in compare view

Updates rdflib from 7.1.3 to 7.6.0

Release notes

Sourced from rdflib's releases.

2026-02-13 RELEASE 7.6.0

This release introduces a new major feature: GraphDB integration via the Python GraphDB Client. Users can now manage GraphDB instances and perform administrative tasks directly from Python. As GraphDB also supports the RDF4J REST API, users may utilize the recently released RDF4J Client and Store with GraphDB instances. For more details, see the new RDFLib GraphDB documentation under the extras section of the RDFLib documentation.

This release also includes a number of fixes to Graph.cbd() and Turtle-related serializers. Thanks to @​mgberg and @​lisat-dstg, the affected code is now more standards-compliant.

At the request of users, the recently introduced CLI tool sq has been renamed to sparqlquery to avoid conflicts with existing well-known packages.

Other maintenance tasks include updating all CI actions to the latest versions and adding a compatibility layer for pyparsing v3 to remove deprecation warnings.

See the CHANGELOG.md for more details.

2025-11-28 RELEASE 7.5.0

This release introduces a new major feature to RDFLib: RDF4J Store integration and RDF4J Client. Users can use this to connect to RDF4J database servers through RDFLib's Graph and Dataset classes, as well as manage repositories and transactions using the RDF4J Client. A comprehensive user guide for the new RDF4J features is available under the extras section of the RDFLib documentation.

We've also added a new CLI tool, sq (the script is https://github.com/RDFLib/rdflib/blob/HEAD/rdflib/tools/sparqlquery.py), for executing SPARQL queries against local files or remote SPARQL endpoints with custom serialization. This provides a convenient way to query RDF data straight from the command line.

Other enhancements include documentation improvements that fix crosslinking issues between modules, and new documentation content for RDFLib plugins, parsers, and serializers.

For RDFLib developers, this release introduces httpx as an optional dependency to support the new RDF4J functionality. The RDF4J test suite now also uses testcontainers on Linux environments running Python 3.9.2 or later.

See the CHANGELOG.md for more details.

2025-10-30 RELEASE 7.4.0

This release addresses a couple of bugs and improves the testing matrix by adding python 3.12, 3.13 and 3.14 to the test matrix.

This is also the first RDFLib release to use MkDocs for documentation.

See the CHANGELOG.md for more details.

Full Changelog: RDFLib/rdflib@7.3.0...7.4.0

2025-10-24 RELEASE 7.3.0

This release delivers several important fixes and enhancements to RDFLib’s Dataset implementation, resolving long-standing issues and improving consistency across serialization and SPARQL operations. It also introduces new deprecation notices for certain Dataset methods and attributes, which will be removed in the next major release. In addition, this version includes a range of improvements to SPARQL result parsing, typing, and literal handling.

Features

• Added Dataset.__iadd__ support
• Dataset's default serialize format is now trig
• Datasets can now add graphs backed by different stores

Fixes and Improvements

• Fixed an issue where the RecursiveSerializer would output undeclared prefixes for predicates that contained the base as a substring
• Prevented prefix generation for predicates corresponding to the base namespace
• SPARQL Update now correctly inserts into the default graph
• Dataset.parse now returns Self
• N-Quads serialization no longer includes the RDFLib internal default graph identifier
• Static type checkers can now infer the type of Term.__new__
• Removed automatic date conversion for gYear and gYearMonth literals

... (truncated)

Changelog

Sourced from rdflib's changelog.

2026-02-13 RELEASE 7.6.0

This release introduces a new major feature: GraphDB integration via the Python GraphDB Client. Users can now manage GraphDB instances and perform administrative tasks directly from Python. As GraphDB also supports the RDF4J REST API, users may utilize the recently released RDF4J Client and Store with GraphDB instances. For more details, see the new RDFLib GraphDB documentation under the extras section of the RDFLib documentation.

This release also includes a number of fixes to Graph.cbd() and Turtle-related serializers. Thanks to @​mgberg and @​lisat-dstg, the affected code is now more standards-compliant.

At the request of users, the recently introduced CLI tool sq has been renamed to sparqlquery to avoid conflicts with existing well-known packages.

Other maintenance tasks include updating all CI actions to the latest versions and adding a compatibility layer for pyparsing v3 to remove deprecation warnings.

Pull requests merged:

• chore: rename sq to sparqlquery by @​edmondchuc in #3396
• ci: update actions to the latest versions + bump ruff by @​edmondchuc in #3395
• fix: Dataset.add() perf issues by @​edmondchuc in #3394
• docs: improve docs generation for the file in the examples to show … by @​nicholascar in #3393
• docs: GraphDB Client by @​edmondchuc in #3383
• feat: GraphDB Client by @​edmondchuc in #3372
• Improve Graph.cbd by @​mgberg in #3367
• fix serialiser makes invalid turtle curis by @​lisat-dstg in #3364
• Use non-deprecated pyparsing methods by @​rafguns in #3362
• chore: post 7.5.0 tasks by @​edmondchuc in #3336

2025-11-28 RELEASE 7.5.0

This release introduces a new major feature to RDFLib: RDF4J Store integration and RDF4J Client. Users can use this to connect to RDF4J database servers through RDFLib's Graph and Dataset classes, as well as manage repositories and transactions using the RDF4J Client. A comprehensive user guide for the new RDF4J features is available under the extras section of the RDFLib documentation.

We've also added a new CLI tool, sq (the script is rdflib/tools/sparqlquery.py), for executing SPARQL queries against local files or remote SPARQL endpoints with custom serialization. This provides a convenient way to query RDF data straight from the command line.

Other enhancements include documentation improvements that fix crosslinking issues between modules, and new documentation content for RDFLib plugins, parsers, and serializers.

For RDFLib developers, this release introduces httpx as an optional dependency to support the new RDF4J functionality. The RDF4J test suite now also uses testcontainers on Linux environments running Python 3.9.2 or later.

Pull requests merged:

• Documentation rework that plugins usage and modules are crosslinked by @​WhiteGobo in #3320
• formatting: black conforming sparqlquery.py by @​WhiteGobo in #3318
• chore: delete merged_prs.json by @​edmondchuc in #3313
• feat: RDF4J Client by @​edmondchuc in #3306
• test: fix dbpedia webtests by @​edmondchuc in #3304
• Created script sparqlquery. by @​WhiteGobo in #3290

2025-10-30 RELEASE 7.4.0

This release addresses a couple of bugs and improves the testing matrix by adding python 3.12, 3.13 and 3.14 to the test matrix.

This is also the first RDFLib release to use MkDocs for documentation.

Pull requests merged:

... (truncated)

Commits

• 8b32146 chore: 7.6.0 release prep (#3397)
• 5a54903 chore: rename sq script to sparqlquery to resolve https://github.com/RDFLib/r...
• 1a719c1 ci: update actions to the latest versions + bump ruff (#3395)
• 2be67dc Use non-deprecated pyparsing methods (#3362)
• 6539dfe fix serialiser makes invalid turtle curis (#3364)
• b01faee docs: GraphDB Client (#3383)
• 832c064 feat: GraphDB Client (#3372)
• f64ed99 fix: Dataset.add() perf issues (#3394)
• 507a4e1 docs: improve docs generation for the file in the examples to show the top ...
• 43fb1b8 Improve Graph.cbd (#3367)
• Additional commits viewable in compare view

Updates werkzeug from 3.1.3 to 3.1.8

Release notes

Sourced from werkzeug's releases.

3.1.8

This is the Werkzeug 3.1.8 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.8/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-8 Milestone: https://github.com/pallets/werkzeug/milestone/45?closed=1

• Request.host and get_host return the empty string if the header is missing or has invalid characters. #3142

3.1.7

This is the Werkzeug 3.1.7 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.7/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-7 Milestone: https://github.com/pallets/werkzeug/milestone/44?closed=1

• parse_list_header preserves partially quoted items, discards empty items, and returns empty for unclosed quoted values. #3128
• WWWAuthenticate.to_header does not produce a trailing space when there are no parameters. #3127
• Transfer-Encoding is parsed as a set. #3134
• Request.host, get_host, and host_is_trusted validate the characters of the value. An empty value is no longer allowed. A Unix socket server address is ignored. The trusted_list argument to host_is_trusted is optional. #3113
• Fix multipart form parser handling of newline at boundary. #3088
• Response.make_conditional sets the Accept-Ranges header even if it is not a satisfiable range request. #3108
• merge_slashes merges any number of consecutive slashes. #3121

3.1.6

This is the Werkzeug 3.1.6 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.6/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6

• safe_join on Windows does not allow special devices names in multi-segment paths. GHSA-29vq-49wr-vm6x

3.1.5

This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.5/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5 Milestone: https://github.com/pallets/werkzeug/milestone/43?closed=1

• safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. GHSA-87hc-h4r5-73f7
• The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. #3065 #3077
• Fix AttributeError when initializing DebuggedApplication with pin_security=False. #3075

3.1.4

This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.4/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4 Milestone: https://github.com/pallets/werkzeug/milestone/42?closed=1

... (truncated)

Changelog

Sourced from werkzeug's changelog.

Version 3.1.8

Released 2026-04-02

• Request.host and get_host return the empty string if the header is missing or has invalid characters. :issue:3142

Version 3.1.7

Released 2026-03-23

• parse_list_header preserves partially quoted items, discards empty items, and returns empty for unclosed quoted values. :pr:3128
• WWWAuthenticate.to_header does not produce a trailing space when there are no parameters. :issue:3127
• Transfer-Encoding is parsed as a set. :pr:3134
• Request.host, get_host, and host_is_trusted validate the characters of the value. An empty value is no longer allowed. A Unix socket server address is ignored. The trusted_list argument to host_is_trusted is optional. :pr:3113
• Fix multipart form parser handling of newline at boundary. :issue:3088
• Response.make_conditional sets the Accept-Ranges header even if it is not a satisfiable range request. :issue:3108
• merge_slashes merges any number of consecutive slashes. :issue:3121

Version 3.1.6

Released 2026-02-19

• safe_join on Windows does not allow special devices names in multi-segment paths. :ghsa:29vq-49wr-vm6x
• Response.make_conditional sets the Accept-Ranges header even if it is not a satisfiable range request. :issue:3108

Version 3.1.5

Released 2026-01-08

• safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7
• The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:3065 :issue:3077

... (truncated)

Commits

• c1a26b4 release version 3.1.8
• 7926f0b relax get_host strictness (#3148)
• deab88f relax get_host strictness
• 65eb639 start version 3.1.8
• 7720b76 release version 3.1.7 (#3135)
• 005d93b release version 3.1.7
• c328342 merge any number of slashes (#3136)
• 23142a3 merge any number of slashes
• b913d68 always set accept-ranges header
• f282943 Correct 1049dd6b2a363e1ef302b4161c340fb8582f627a
• Additional commits viewable in compare view

Updates pyjwt from 2.10.1 to 2.13.0

Release notes

Sourced from pyjwt's releases.

2.13.0

PyJWT 2.13.0 — Security Release

This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.

Security

• GHSA-xgmm-8j9v-c9wx — JWK JSON accepted as HMAC secret (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by @​aradona91.

• GHSA-jq35-7prp-9v3f — Algorithm allow-list bypass with PyJWK / PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…] allow-list was checked against the token header alg as a string only; actual verification used the algorithm bound to the PyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header alg to match the PyJWK's algorithm before verification. Reported by @​sushi-gif.

• GHSA-w7vc-732c-9m39 — DoS via base64 decode of unused payload segment when b64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied detached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by @​thesmartshadow.

• GHSA-993g-76c3-p5m4 — PyJWKClient accepts non-HTTP(S) URIs. PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which by default also handles file://, ftp://, and data: schemes. An application that fed an attacker-influenced URI into PyJWKClient could be coerced into reading local files or reaching other unintended schemes. PyJWKClient now rejects any URI whose scheme isn't http or https. Reported by @​KEIJOT.

• GHSA-fhv5-28vv-h8m8 — PyJWKClient cache wiped on fetch error. A finally-block put(jwk_set=None) cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by @​eddieran.

Fixed

• Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with InvalidKeyError instead of accepting them with only a warning. Defends against the os.getenv("JWT_SECRET", "") footgun. Thanks to @​SnailSploit and @​spartan8806 for the reports.
• Forward per-call options (including enforce_minimum_key_length) from PyJWT.decode through to PyJWS._verify_signature. The option was previously silently dropped between the two layers, so it only took effect when set on the PyJWT instance. Thanks to @​WLUB for the report.
• RFC 7797 §3 compliance for b64=false: the encoder now auto-adds "b64" to crit, and the decoder rejects tokens that set b64=false without listing it in crit. Thanks to @​MachineLearning-Nerd for the report.

Changed

• Migrate the dev, docs, and tests package extras to dependency groups, by @​kurtmckee in #1152.

Upgrade notes

Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:

• Empty HMAC keys now raise. If your app passed "" or b"" as a secret (often via a missing env var, e.g. os.getenv("JWT_SECRET", "")), encode/decode will now raise InvalidKeyError. This is the intended behavior — fix the configuration.
• PyJWK decoding now requires the token's alg to match the JWK's algorithm. Previously a mismatch was silently honored if the header alg appeared in the allow-list. Tokens that relied on this mismatch will now fail with InvalidAlgorithmError.
• PyJWKClient now rejects non-HTTP(S) URIs at construction time. Tests or dev environments that fetched JWKS from file:// URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct PyJWKSet.from_dict(...) directly).
• b64=false tokens are now strictly RFC 7515 / 7797 compliant. Tokens with a non-empty compact-form payload segment, or that omit "b64" from crit, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.
• enforce_minimum_key_length set per-call now takes effect. Callers who passed options={"enforce_minimum_key_length": True} to jwt.decode() previously got no enforcement; they will now get InvalidKeyError on undersized keys, as documented.

Full changelog: jpadilla/pyjwt@2.12.1...2.13.0

2.12.1

What's Changed

• Add typing_extensions dependency for Python < 3.11 by @​jpadilla in jpadilla/pyjwt#1151

Full Changelog: jpadilla/pyjwt@2.12.0...2.12.1

2.12.0

Security

• Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @​dmbs335 in GHSA-752w-5fwx-jx9f

... (truncated)

Changelog

Sourced from pyjwt's changelog.

v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>__

Security

- Reject JWK JSON documents passed as raw HMAC secrets in
  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that
  the existing PEM/SSH guard did not cover. Reported by @aradona91 in
  `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__.
- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during
  verification so the caller's ``algorithms=[...]`` allow-list cannot be
  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported
  by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__.
- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-
  influenced URIs cannot read local files or reach unintended schemes via
  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported
  by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__.
- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.
  The previous ``finally``-block ``put(None)`` pattern cleared the cache
  on any transient outage, turning one bad JWKS request into application-
  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__.
- Skip the unconditional base64 decode of the compact-form payload segment
  when ``b64=false`` is set in the protected header, and require that
  segment to be empty (RFC 7515 Appendix F detached form). Closes an
  unauthenticated DoS amplifier. Reported by @thesmartshadow in
  `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__.
Fixed

- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.
Changed



Migrate the dev, docs, and tests package extras to dependency groups by @​kurtmckee in [#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;__

v2.12.1 &lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1&gt;__
</tr></table>

... (truncated)

Commits

• 7144e45 Apply ruff format
• d2f4bec Restore cast() calls with cross-version type: ignore for prepare_key
• 22f478c Remove redundant casts in RSAAlgorithm.prepare_key and `ECAlgorithm.prepare...
• 95791b1 Bundle security fixes and hardening into 2.13.0
• dcc27a9 [pre-commit.ci] pre-commit autoupdate (#1155)
• 9d08a9a [pre-commit.ci] pre-commit autoupdate (#1146)
• b87c100 Bump codecov/codecov-action from 5 to 6 (#1154)
• 40e3147 Migrate development extras to dependency groups (#1152)
• a4e1a3d Add typing_extensions dependency for Python < 3.11 (#1151)
• bd9700c Use PyJWK algorithm when encoding without explicit algorithm (#1148)
• Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

• @​k223kim made their first contribution in psf/requests#7433

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
• Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

• 6e83187 v2.34.2
• 84d10f0 Move Request.headers back to Mapping (#7441)
• b7b549b v2.34.1
• e511bc7 Fix mutability issues with headers input types (#7431)
• 5691f59 Update JsonType containers to read-based collections (#7436)
• 2144213 Constrain Response.reason to str (#7437)
• 6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
• 0b401c7 v2.34.0
• 86b378d Align Session.get parameters with requests.get (#7429)
• a4f9a59 Port bpo-39057 to Requests (#7427)
• Additional commits viewable in compare view

Updates pytz from 2025.1 to 2026.3.post1

Commits

• 661bca9 Bump version numbers to 2026.3.post1 for python2 fix
• 1e31a16 Log python version running tests, force python2
• b3ca7c3 Unix line endings
• b55039a Replace non-ASCII character in comment to fix build with Python 2
• 5420ee2 Replace non-ASCII character in comment
• 2c139e8 Merge branch 'fix/localize-overflow-at-datetime-extremes' of https://github.c...
• c843864 Run zdump tests quietly
• 518500c Reduce noise when collecting zdump info dumps
• 081f935 Merge branch 'kytta-fix-dst' into 2026c
• 8c9d69b Merge branch 'master' into 2026c
• Additional commits viewable in compare view

Updates confluent-kafka from 2.8.0 to 2.15.0

Release notes

Sourced from confluent-kafka's releases.

v2.15.0

KIP-932 Queues for Kafka – Now in Preview

confluent-kafka-python 2.15.0 adds a Preview implementation of the KIP-932 share consumer (Queues for Kafka). Members of a share group cooperatively consume from the same partitions with per-record acquire/acknowledge semantics and redelivery, providing queue-like consumption on top of Kafka.

• New ShareConsumer and DeserializingShareConsumer clients: subscribe, batch poll (poll() returns a Messages batch), and close (with context-manager support).
• Implicit (default) and explicit acknowledgement modes (share.acknowledgement.mode), with AcknowledgeType ACCEPT / RELEASE / REJECT and Message.delivery_count().
• Synchronous and asynchronous commit (commit_sync / commit_async) and an acknowledgement-commit callback.
• Runtime SASL credential updates (set_sasl_credentials) and new IllegalStateException / ConcurrentModificationException exceptions.
• (#2217, #2239, #2241, #2252, #2253, #2265, #2273, #2277, #2279)

See the Share Consumer guide and the Share consumers section of librdkafka's INTRODUCTION.md.

Note: The share consumer is currently in Preview and should not be used in production environments. Its public interfaces may change before General Availability, and known limitations apply (see the guide). The share consumer is single-threaded and not thread-safe. It requires a broker with share groups enabled (generally available in Apache Kafka 4.2.0).

Features

• New optional install confluent-kafka[oauthbearer-aws] provides AWS IAM-based OAUTHBEARER authentication via AWS STS GetWebIdentityToken. Activate by setting sasl.oauthbearer.method=oidc, sasl.oauthbearer.metadata.authentication.type=aws_iam, and sasl.oauthbearer.config="region=...,audience=...". See the AWS IAM OAUTHBEARER guide for full configuration, and https://github.com/confluentinc/confluent-kafka-python/blob/HEAD/examples/oauth_oidc_ccloud_aws_iam.py for a worked example.

Enhancements

• Add support for union-of-pools and auto pool mapping for Schema Registry (#2182)

Fixes

• Fix Encryption fails when expanded union types have two references to the same record (@​ChristophMajcenAtXxxlutz, #2262)
• Make orjson optional in JSON serdes with stdlib json fallback (#2281)
• Handle non-http errors during retries (#2292)
• Use TLS certification verification with Hashicorp Vault (#2294)

confluent-kafka-python v2.15.0 is based on librdkafka v2.15.0, see the librdkafka release notes for a complete list of changes, enhancements, fixes and upgrade considerations.

v2.14.2 is a maintenance release with the following fixes and enhancements:

Fixes

• Fix URL joining in Python client (#2228)
• Handle anyOf/allOf in JSON transforms (#2237)
• Fix redefining a named Avro type in a diamond dependency pattern (#2238)
• Fix typing_extensions import errors on Python 3.12 (#2232)
• Fix Encryption fails when referencing self defined types (#2254)

... (truncated)

Changelog

Sourced from confluent-kafka's changelog.

v2.15.0

Description has been truncated

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml