Bump the python-non-major group across 1 directory with 22 updates

[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the python-non-major group with 22 updates in the / directory:

Package	From	To
django-allauth	65.19.0	65.19.4
django-crispy-forms	2.5	2.7
django-environ	0.13.0	0.14.0
django-htmx	1.27.0	1.29.0
django-oauth-toolkit	3.3.0	3.4.1
django-tables2	3.0.0	3.0.1
djangorestframework	3.17.1	3.18.1
drf-spectacular	0.29.0	0.30.0
geopy	2.4.1	2.5.0
gevent	26.5.0	26.9.0
hiredis	3.3.1	3.4.2
pillow	12.2.0	12.3.0
sentry-sdk	2.61.1	2.70.0
twilio	9.10.9	9.11.1
coverage	7.14.1	7.16.1
djlint	1.46.0	1.46.2
prek	0.4.3	0.5.3
psycopg2-binary	2.9.12	2.9.13
pytest	9.0.3	9.1.1
pytest-django	4.12.0	4.14.0
ruff	0.16.6	0.16.9
psycopg2	2.9.12	2.9.13

Updates django-allauth from 65.19.0 to 65.19.4

Commits

• See full diff in compare view

Updates django-crispy-forms from 2.5 to 2.7

Release notes

Sourced from django-crispy-forms's releases.

2.7 (2026-07-29)

• Confirmed support for Django 6.1.

2.6 (2026-03-01)

• Dropped support for Django 4.2, 5.0 and 5.1.

Changelog

Sourced from django-crispy-forms's changelog.

2.7 (2026-07-29)

• Confirmed support for Django 6.1.

2.6 (2026-03-01)

• Dropped support for Django 4.2, 5.0 and 5.1.

Commits

• e7fbb53 Release 2.7. (#1438)
• 9d6b321 Bumped github actions versions.
• 974b5b7 Bumped RTD OS and Python versions.
• 5218268 Confirmed support for Django 6.1. (#1435)
• 847873c docs: replace 'basestring' with 'str' (#1433)
• dc8007e Release 2.6. (#1432)
• 792c671 Updated versions in pyproject.toml. (#1431)
• af31d24 Fix incorrect reverse in crispy tag docs (#1410)
• fb7acdc Don't crash when using the crispy template tag and missing variables (#1418)
• d30a0ab Dropped unsupported Django versions. (#1430)
• Additional commits viewable in compare view

Updates django-environ from 0.13.0 to 0.14.0

Release notes

Sourced from django-environ's releases.

v0.14.0

django-environ 0.14.0 improves type annotations across Env and updates Env.read_env() to support caller-owned file-like objects without closing them.

This is the final django-environ release supporting Python 3.9.

Added

• Type annotations and matching docstring information for Env methods.
• A conditional typing_extensions dependency providing TypeAlias on Python 3.9.

Changed

• Env.read_env() now accepts path-like and file-like objects without closing file-like objects supplied by the caller.

Fixed

• Env.read_env() now raises an explicit error when it cannot determine the caller frame used to resolve the default .env path.

Full changelog: joke2k/django-environ@v0.13.0...v0.14.0

PyPI: https://pypi.org/project/django-environ/0.14.0/

Changelog

Sourced from django-environ's changelog.

v0.14.0_ - 18-June-2026

Added +++++

• Added type annotations and matching docstring information to Env methods [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.
• Added a Python 3.9 compatibility dependency on typing_extensions for TypeAlias [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.

Changed +++++++

• Updated Env.read_env() to accept path-like and file-like objects without closing file-like objects supplied by the caller [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.

Fixed +++++

• Added an explicit error when Env.read_env() cannot determine its caller frame while resolving the default .env path [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.

Commits

• 6e1b461 Merge pull request #635 from joke2k/release/0.14.0
• b65f66e chore(release): prepare 0.14.0
• 39f980a Merge pull request #633 from joke2k/hotfix/0.14-apply-pr-600
• 020825c ci: allow release and hotfix PRs to target main
• 6c1dd5b fix(typing): support TypeAlias on Python 3.9
• c0d7b2b Ensure Env.read_env supports any file-like object
• c41ee54 Guard against an inability to read stack frames
• 64bfe4b Add type information to docstrings
• 791df95 Add type annotations to str and bool parameters of methods in Env
• 4370592 Merge branch 'develop' into main
• See full diff in compare view

Updates django-htmx from 1.27.0 to 1.29.0

Changelog

Sourced from django-htmx's changelog.

1.29.0 (2026-08-06)

• Vendor some stable htmx extensions, named per their htmx 4 versions: htmx-2-compat, hx-browser-indicator, hx-download, hx-head, hx-optimistic, hx-preload, hx-prompt, hx-ptag, hx-sse, hx-targets, hx-upsert, and hx-ws. Render their script tags with the new extensions argument of the htmx_script :doc:template tags \<template_tags>, which selects the extension files matching the htmx version in use:

  .. code-block:: django

  {% htmx_script version=4 extensions="hx-sse,hx-ws" %}
  

  hx-head, hx-preload, hx-sse, and hx-ws are available for both htmx versions 2 and 4; the rest are htmx 4 only.

  The special name htmax renders htmx 4’s htmax bundle of htmx plus its most popular extensions, in place of the plain htmx script:

  .. code-block:: django

  {% htmx_script version=4 extensions="htmax" %}
  

  PR [#614](https://github.com/adamchainz/django-htmx/issues/614) <https://github.com/adamchainz/django-htmx/pull/614>. Thanks to Rex Zhang for initial work in PR [#575](https://github.com/adamchainz/django-htmx/issues/575) <https://github.com/adamchainz/django-htmx/pull/575/commits>.

• Upgrade the vendored htmx 2 to version 2.0.10 <https://github.com/bigskysoftware/htmx/blob/master/CHANGELOG.md#2010---2026-04-21>__.

  PR [#594](https://github.com/adamchainz/django-htmx/issues/594) <https://github.com/adamchainz/django-htmx/pull/594>__.

• Upgrade the vendored htmx 4 to version 4.0.0-beta6 <https://github.com/bigskysoftware/htmx/releases/tag/v4.0.0-beta6>__.

  PR [#610](https://github.com/adamchainz/django-htmx/issues/610) <https://github.com/adamchainz/django-htmx/pull/610>__.

• Add support for the polling tags protocol of the htmx 4 |hx-ptag extension|__:

  • :attr:HtmxDetails.ptag <django_htmx.middleware.HtmxDetails.ptag> reads the HX-PTag request header directly.

  • The :func:django_htmx.http.ptag view decorator implements the protocol, with an API mirroring Django’s |etag decorator|__. It computes the current tag with the given function and, when the HX-PTag request header matches, returns a 304 (Not Modified) response without calling the view, making htmx skip the swap. Otherwise, it calls the view and sets the HX-PTag response header.

  .. |hx-ptag extension| replace:: hx-ptag extension __ https://four.htmx.org/extensions/hx-ptag

  .. |etag decorator| replace:: etag decorator __ https://docs.djangoproject.com/en/stable/topics/conditional-view-processing/

  PR [#613](https://github.com/adamchainz/django-htmx/issues/613) <https://github.com/adamchainz/django-htmx/pull/613>__.

• Switch package build backend from setuptools to uv_build <https://docs.astral.sh/uv/concepts/build-backend/>__. This makes builds with uv about nine times faster, since uv runs the backend natively, without creating a build environment or spawning a Python process. Additionally, source distributions no longer include test files, which setuptools previously included incompletely, missing the files needed to actually run them.

1.28.0 (2026-07-12)

... (truncated)

Commits

• a27556e Version 1.29.0
• f59765a Switch build backend to uv_build (#615)
• e2da8c5 Note :inherited required on htmx 4 in installation docs (#608)
• dcf641f Vendor htmx extensions (#614)
• 007f97c Add htmx 4 polling support (#613)
• f2c3a13 Remove sphinx-build-compatibility (#612)
• 9404744 [pre-commit.ci] pre-commit autoupdate (#611)
• 07171ea Upgrade htmx 4 to 4.0.0-beta6 (#610)
• c1af311 Upgrade htmx to version 2.0.10 (#594)
• 65a895a [pre-commit.ci] pre-commit autoupdate (#605)
• Additional commits viewable in compare view

Updates django-oauth-toolkit from 3.3.0 to 3.4.1

Release notes

Sourced from django-oauth-toolkit's releases.

3.4.1

This release is dominated by security hardening of redirect URI matching, token revocation and refresh token handling. Several entries below change behavior that was previously accepted, and they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the Upgrading guide collects everything you need to act on in one place, so start there. Of particular note: redirect URIs are now matched exactly per RFC 9700 §2.1, so a request may no longer carry query parameters, path parameters, credentials or a fragment that the registered URI does not have; REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token is presented rather than only by the cleartokens sweep; and the built-in templates now link a stylesheet shipped with the package instead of a CDN, so run collectstatic or the pages render unstyled.

Added

• #681 Redirect URI mismatches are now diagnosed on the oauth2_provider logger at DEBUG, reporting the requested URI, every registered candidate it was compared against, and which component of each one differed (scheme, hostname, port, path, query). The same detail is emitted for post_logout_redirect_uri and for the token endpoint's comparison against the URI recorded on the grant. The error response is unchanged: the registered URIs are never disclosed to the requester, only to the server's log. See "Debugging redirect URI mismatches" in the documentation. Note that AbstractApplication.redirect_uri_allowed() and post_logout_redirect_uri_allowed() now call the new check_redirect_to_uri_allowed() (same verdict, plus the mismatch reasons) instead of redirect_to_uri_allowed(), so code that wrapped or patched the latter to influence those methods must target the former.
• #634 A system check (oauth2_provider.W011) that warns when the AccessToken and RefreshToken models are swapped into different apps, and a new "Extending the token models" documentation section explaining how to swap the interrelated token models together.
• #1623 Documentation ("Content Security Policy and the authorization form") on completing the authorization-code flow under a strict form-action Content Security Policy, which Chromium enforces against the post-authorization redirect to the client's redirect_uri.
• #410 Documentation ("Resource scope syntax") clarifying that TokenHasResourceScope checks each required_scopes entry suffixed with the READ_SCOPE/WRITE_SCOPE setting value (defaults read/write, e.g. music:read, music:write), so a bare music scope is rejected; with the default settings-based scopes backend the suffixed scopes must be declared in SCOPES.
• #1157 An "Upgrading" documentation page collecting the breaking changes and upgrade steps for every release that needs them — 2.0, 3.0 and this release — linked from the documentation index, so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has no section there, so a gap between two versions is an answer rather than an omission.
• #452 Documentation ("Custom scopes backend") explaining how to replace the default settings-driven scopes backend via SCOPES_BACKEND_CLASS, including a worked model-based example that stores scopes in the database.
• #1045 Tutorial ("Managing applications and tokens in the Django admin") walking through the admin site for applications and issued tokens, including client-secret hashing, credential masking, and that tokens cannot be created by hand.
• #403 Translatable (gettext_lazy) verbose_name labels on every field of the Application, Grant, AccessToken, RefreshToken, IDToken and DeviceGrant models, so the Django admin and the authorization UI can be localized. Migration

... (truncated)

Changelog

Sourced from django-oauth-toolkit's changelog.

[3.4.1] - 2026-08-21

This release is dominated by security hardening of redirect URI matching, token revocation and refresh token handling. Several entries below change behavior that was previously accepted, and they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the Upgrading guide collects everything you need to act on in one place, so start there. Of particular note: redirect URIs are now matched exactly per RFC 9700 §2.1, so a request may no longer carry query parameters, path parameters, credentials or a fragment that the registered URI does not have; REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token is presented rather than only by the cleartokens sweep; and the built-in templates now link a stylesheet shipped with the package instead of a CDN, so run collectstatic or the pages render unstyled.

Added

• #681 Redirect URI mismatches are now diagnosed on the oauth2_provider logger at DEBUG, reporting the requested URI, every registered candidate it was compared against, and which component of each one differed (scheme, hostname, port, path, query). The same detail is emitted for post_logout_redirect_uri and for the token endpoint's comparison against the URI recorded on the grant. The error response is unchanged: the registered URIs are never disclosed to the requester, only to the server's log. See "Debugging redirect URI mismatches" in the documentation. Note that AbstractApplication.redirect_uri_allowed() and post_logout_redirect_uri_allowed() now call the new check_redirect_to_uri_allowed() (same verdict, plus the mismatch reasons) instead of redirect_to_uri_allowed(), so code that wrapped or patched the latter to influence those methods must target the former.
• #634 A system check (oauth2_provider.W011) that warns when the AccessToken and RefreshToken models are swapped into different apps, and a new "Extending the token models" documentation section explaining how to swap the interrelated token models together.
• #1623 Documentation ("Content Security Policy and the authorization form") on completing the authorization-code flow under a strict form-action Content Security Policy, which Chromium enforces against the post-authorization redirect to the client's redirect_uri.
• #410 Documentation ("Resource scope syntax") clarifying that TokenHasResourceScope checks each required_scopes entry suffixed with the READ_SCOPE/WRITE_SCOPE setting value (defaults read/write, e.g. music:read, music:write), so a bare music scope is rejected; with the default settings-based scopes backend the suffixed scopes must be declared in SCOPES.
• #1157 An "Upgrading" documentation page collecting the breaking changes and upgrade steps for every release that needs them — 2.0, 3.0 and this release — linked from the documentation index, so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has no section there, so a gap between two versions is an answer rather than an omission.
• #452 Documentation ("Custom scopes backend") explaining how to replace the default settings-driven scopes backend via SCOPES_BACKEND_CLASS, including a worked model-based example that stores scopes in the database.
• #1045 Tutorial ("Managing applications and tokens in the Django admin") walking through the admin site for applications and issued tokens, including client-secret hashing, credential masking, and that tokens cannot be created by hand.
• #403 Translatable (gettext_lazy) verbose_name labels on every field of the Application, Grant, AccessToken, RefreshToken, IDToken and DeviceGrant models, so the Django admin and the authorization UI can be localized. Migration

... (truncated)

Commits

• db6c4f5 chore: 3.4.1 release (#1820)
• 9c70975 fix: enforce device grant confirmation ownership (#1819)
• 28bf64c perf: revoke refresh token families as a set on reuse detection (#1810)
• f797b8a fix(validators): stop honoring revoked refresh tokens in the grace window (#1...
• 11024a0 chore(deps): bump cryptography in the uv group across 1 directory (#1807)
• 1e19d4d Log why a redirect URI failed to match (#1814)
• 4f18e0e feat(templates): serve default styles from a bundled stylesheet (#1815)
• ae05be9 feat(models): make model field labels translatable (#1812)
• 2b1a322 fix(models): associate Application validation errors with their fields (#1811)
• 0915396 fix(dcr): honour hashed token storage for registration access tokens (#1799)
• Additional commits viewable in compare view

Updates django-tables2 from 3.0.0 to 3.0.1

Changelog

Sourced from django-tables2's changelog.

3.0.1 (2026-08-29)

• Add support for Django 6.1
• Remove support for Python 3.10

Commits

• 6b830fa Bump version to 3.0.1
• c28fd51 Add support for django 6.1, drop python 3.10 support (#1047)
• 47c5cd2 Bump actions/setup-python from 6 to 7 (#1046)
• 2d53383 Bump actions/cache from 5.0.5 to 6.1.0 (#1042)
• b2dc2cb Bump actions/checkout from 6 to 7 (#1039)
• e52d5bc Bump actions/cache from 5.0.4 to 5.0.5 (#1034)
• See full diff in compare view

Updates djangorestframework from 3.17.1 to 3.18.1

Release notes

Sourced from djangorestframework's releases.

3.18.1

What's Changed

Bug fixes

• Fix duplicate validation errors for GenericIPAddressField with protocol by @​browniebroke in encode/django-rest-framework#10011
• Fix int64 format detection for negative IntegerField minimums in OpenAPI schema definition by @​zainnadeem786 in encode/django-rest-framework#9989
• Fix list serializer on unique constraint validator by @​MehrazRumman in encode/django-rest-framework#10033
• Reject non-finite values (nan, inf) in FloatField by @​winklemad in encode/django-rest-framework#9998

Other changes

• Add a compatibility setting for ListSerializer error formats by @​Kub-AT in encode/django-rest-framework#10027
• Expand deprecation classes and review deprecation policy by @​browniebroke in encode/django-rest-framework#10034

New Contributors

• @​abidaliamanat9 made their first contribution in encode/django-rest-framework#10028
• @​epuronta made their first contribution in encode/django-rest-framework#10030
• @​Kub-AT made their first contribution in encode/django-rest-framework#10027
• @​winklemad made their first contribution in encode/django-rest-framework#9998

Full Changelog: encode/django-rest-framework@3.18.0...3.18.1

3.18.0

What's Changed

Breaking changes

• Drop support for Django 4.2, Django 5.0 and Django 5.1 by @​p-r-a-v-i-n in encode/django-rest-framework#9899
• Change errors for list serializers (many=True) to dict format by @​p-r-a-v-i-n in encode/django-rest-framework#9837

Features

• Add unaccent to SearchFilter by @​mgaligniana in encode/django-rest-framework#9385
• Add support for Django 6.1 by @​browniebroke in encode/django-rest-framework#10003
• Add @throttle_scope function based view decorator by @​d-ryzhykau in encode/django-rest-framework#9963
• Add nulls_distinct support to UniqueTogetherValidator by @​mag123c in encode/django-rest-framework#9866

Bug fixes

• Include choices param for non-editable fields by @​ticosax in encode/django-rest-framework#9929
• Improve cursor pagination template accessibility in browsable API by @​kosbemrunal in encode/django-rest-framework#9905
• Fix partial form data updates involving ListField by @​Natgho in encode/django-rest-framework#9902
• Fix crash due to browsable API extra action permissions by @​dlfoerster in encode/django-rest-framework#9934
• Handle unhashable BooleanField representation value by @​emfpdlzj in encode/django-rest-framework#9973
• Fix OpenAPI schema for zero numeric bounds on ListField children by @​zainnadeem786 in encode/django-rest-framework#9977
• Replace cc_delim_re usage with split_header_value for Django 6.1+ compatibility by @​laymonage in encode/django-rest-framework#9978
• Fix set_rollback to only rollback initialized connections by @​jdetaeye in encode/django-rest-framework#9599
• Fix DictField HTML input returning empty dict for missing fields by @​veeceey in encode/django-rest-framework#9891
• Raise clear error for unsupported unique-together list updates by @​zainnadeem786 in encode/django-rest-framework#9981

Other changes

• Prepare release 3.18.0 by @​github-actions[bot] in encode/django-rest-framework#10015

New Contributors

• @​Im-Bilal made their first contribution in encode/django-rest-framework#9967
• @​dlfoerster made their first contribution in encode/django-rest-framework#9934

... (truncated)

Commits

• dd23495 Prepare release 3.18.1 (#10036)
• cb1fb66 Install gettext in prepare-release
• 858f1fc Reject non-finite values (nan, inf) in FloatField (#9998)
• ea695cd Ensure translations are up to date when preparing release
• 0406c6e Update pygments requirement from >=2.17,<2.21 to ==2.21.* in the optional gro...
• 8c92e89 Expand deprecation classes and review deprecation policy (#10034)
• 3157a6a Update pytest config to native TOML format from v9 (#10035)
• 4f77428 Fixing issue #9484 (#10033)
• f17d70f Fix int64 format detection for negative IntegerField minimums in Open API s...
• 5668281 Add a compatibility setting for ListSerializer error formats (#10027)
• Additional commits viewable in compare view

Updates drf-spectacular from 0.29.0 to 0.30.0

Release notes

Sourced from drf-spectacular's releases.

0.30.0

After working through the backlog for several week, we are finally in a comfortable place again. Thank you to all contributors and users that waited patiently for me the catch up. It does not include all the PRs that were opened, but imho the most critical ones.

This release includes many small improvement, a few bug fixes, updates to the test suite and a renovated test matrix. Some minor schema corrections are to be expected, but nothing drastic. It is mostly fixing small inconsistencies and improving corner cases.

What's Changed

• Fix regression introduced in #1450 by @​hoefling in tfranzel/drf-spectacular#1469
• Fix dependency definition for Django 5.2 by @​ulgens in tfranzel/drf-spectacular#1487
• feat: add support for Django 6.0 and and DRF 3.17 by @​vgrozdanic in tfranzel/drf-spectacular#1496
• Add Support for unsigned integers uint16, uint32 and uint64 by @​ticosax in tfranzel/drf-spectacular#1483
• Implement x-spec-enum-id for type hint Choices. by @​noamkush in tfranzel/drf-spectacular#1486
• Clarifies Docs in Customizations.rst by @​APCBoston in tfranzel/drf-spectacular#1489
• Add setting to disable docstring extraction by @​philipstarkey in tfranzel/drf-spectacular#1491
• feat: add support for polymorphic built-in drf support by @​mastacheata in tfranzel/drf-spectacular#1490
• Document django-rest-knox support by @​johnthagen in tfranzel/drf-spectacular#1503
• add help text to spectacular management command arguments #1175 by @​jbbqqf in tfranzel/drf-spectacular#1502
• change conflicting license field for 3.8 by @​tfranzel in tfranzel/drf-spectacular#1504
• Pr1438 by @​tfranzel in tfranzel/drf-spectacular#1505
• Add blueprint for django-rest-knox by @​johnthagen in tfranzel/drf-spectacular#1506
• Pr1499 by @​tfranzel in tfranzel/drf-spectacular#1511
• Type hint build_bearer_security_scheme_object by @​johnthagen in tfranzel/drf-spectacular#1509
• Housekeeping by @​tfranzel in tfranzel/drf-spectacular#1512
• Pr1501 by @​tfranzel in tfranzel/drf-spectacular#1514
• Fix nullable FileField response schema when blank=True (#1493) by @​mojtabasohrabi in tfranzel/drf-spectacular#1501

New Contributors

• @​ulgens made their first contribution in tfranzel/drf-spectacular#1487
• @​vgrozdanic made their first contribution in tfranzel/drf-spectacular#1496
• @​noamkush made their first contribution in tfranzel/drf-spectacular#1486
• @​APCBoston made their first contribution in tfranzel/drf-spectacular#1489
• @​philipstarkey made their first contribution in tfranzel/drf-spectacular#1491
• @​mastacheata made their first contribution in tfranzel/drf-spectacular#1490
• @​jbbqqf made their first contribution in tfranzel/drf-spectacular#1502
• @​mojtabasohrabi made their first contribution in tfranzel/drf-spectacular#1501

Full Changelog: tfranzel/drf-spectacular@0.29.0...0.30.0

Changelog

Sourced from drf-spectacular's changelog.

0.30.0 (2026-07-06)

• Add OAS 3.2 schema for validation & test
• Type hint build_bearer_security_scheme_object ([#1509](https://github.com/tfranzel/drf-spectacular/issues/1509) <https://github.com/tfranzel/drf-spectacular/issues/1509>_) [johnthagen]
• Fix formatted CharField allow_blank handling ([#1511](https://github.com/tfranzel/drf-spectacular/issues/1511) <https://github.com/tfranzel/drf-spectacular/issues/1511>, ([#1499](https://github.com/tfranzel/drf-spectacular/issues/1499) <https://github.com/tfranzel/drf-spectacular/issues/1499>)) [Luciano de la Iglesia]
• Consider allOf anyOf with nullable on OAS3.1 [#1480](https://github.com/tfranzel/drf-spectacular/issues/1480) <https://github.com/tfranzel/drf-spectacular/issues/1480>_
• Proper handling for OAS 3.2
• fix modification of user-provided schematas [#1500](https://github.com/tfranzel/drf-spectacular/issues/1500) <https://github.com/tfranzel/drf-spectacular/issues/1500>_
• relax contraint on oneOf null case with OAS3.1 [#1480](https://github.com/tfranzel/drf-spectacular/issues/1480) <https://github.com/tfranzel/drf-spectacular/issues/1480>_
• Add blueprint for django-rest-knox ([#1506](https://github.com/tfranzel/drf-spectacular/issues/1506) <https://github.com/tfranzel/drf-spectacular/issues/1506>_) [johnthagen]
• Mitigate GeneratedField lost arguments and special case for DecimalField [#1166](https://github.com/tfranzel/drf-spectacular/issues/1166) <https://github.com/tfranzel/drf-spectacular/issues/1166>_
• Webhook explicit operationId ([#1505](https://github.com/tfranzel/drf-spectacular/issues/1505) <https://github.com/tfranzel/drf-spectacular/issues/1505>_)
• change conflicting license field for 3.8 ([#1504](https://github.com/tfranzel/drf-spectacular/issues/1504) <https://github.com/tfranzel/drf-spectacular/issues/1504>_)
• Document django-rest-knox support [johnthagen]
• add help text to spectacular management command arguments [#1175](https://github.com/tfranzel/drf-spectacular/issues/1175) <https://github.com/tfranzel/drf-spectacular/issues/1175>_ [Jean-Baptiste Braun]
• Mark FileField as nullable in response when not required [#1493](https://github.com/tfranzel/drf-spectacular/issues/1493) <https://github.com/tfranzel/drf-spectacular/issues/1493>_ [mojtaba sohrabi]
• Extend Choices hint fix with generated label description [#1486](https://github.com/tfranzel/drf-spectacular/issues/1486) <https://github.com/tfranzel/drf-spectacular/issues/1486>_
• Suppress py<=3.14 deprecation warning [#1497](https://github.com/tfranzel/drf-spectacular/issues/1497) <https://github.com/tfranzel/drf-spectacular/issues/1497>_
• Remove ancient DRF3.11 and Django2.2 due to contrib packages failing
• feat: add support for django 6.0 and and drf 3.17 [Vjeran Grozdanic]
• Add setting to disable docstring extraction [Phil Starkey]
• feat: add support for polymorphic built-in drf support [Benedikt Bauer]
• Clarifies post-processing hooks [Andy Piltser-Cowan]
• Clarifies customizations step 5 [Andy Piltser-Cowan]
• Fix dependency definition for Django 5.2 [Ülgen Sarıkavak]
• Implement x-spec-enum-id for type hint Choices. [Noam Kushinsky]
• Add Support for unsigned integers uint16, uint32 and uint64 [Nicolas Delaby]
• Fix regression introduced in [#1450](https://github.com/tfranzel/drf-spectacular/issues/1450) <https://github.com/tfranzel/drf-spectacular/issues/1450>_ ([#1469](https://github.com/tfranzel/drf-spectacular/issues/1469) <https://github.com/tfranzel/drf-spectacular/issues/1469>_) [Oleg Höfling]

Breaking changes / important additions:

• Many small improvement, bug fixes, updates to the test suite and renovated test matrix. Some minor schema corrections are to be expected, but nothing drastic.

Commits

• 1a5c44a version bump
• 6ba553f Merge pull request #1514 from tfranzel/pr1501
• d4787a4 Adapt FileField null handling #1501
• d867942 Merge pull request #1512 from tfranzel/housekeeping26
• 5685cf8 Add OAS 3.2 schema for validation & test
• 9fa6f7c minor cleanup
• 69033ea update linting version due to misleading security warnings
• d9e0de6 Type hint build_bearer_security_scheme_object (#1509)
• 9b18b30 Pr1499 (#1511)
• 6e3c72e Consider allOf anyOf with nullable on OAS3.1 #1480
• Additional commits viewable in compare view

Updates geopy from 2.4.1 to 2.5.0

Release notes

Sourced from geopy's releases.

2.5.0

Security Advisory

GitHub Security advisory: GHSA-mhvh-fq92-pfmr.

Regular Expression Denial of Service (ReDoS) in geopy.Point: geopy.Point.from_string may take excessive CPU time when parsing long, malformed coordinate strings due to inefficient regular-expression behavior.

The numeric geopy.Point constructor is not affected.

Geocoders' reverse methods called with string inputs exercise the vulnerable path.

Reported by Younghun Lee in #608, fix contributed by Apoorv Darshan in #610.

The fix rejects any inputs longer than 256 chars unconditionally, which may start falsely rejecting previously valid Point strings with long irrelevant prefixes.

Bugfixes

• .Geocodio: fix GeocoderQueryError being raised for empty results.
• .GoogleV3: fix utcnow deprecation warnings.

Packaging Changes

• Drop support for Python 3.7.
• Add support for Python 3.13, 3.14, and 3.15.
• Migrate build metadata from setup.py to setup.cfg. Remove download_url from the metadata. Contributed by Mike Taves. #535
• Replace distutils with packaging in tests (fixes Python 3.12+).

Code Improvements

• Remove Python 2 relics. Contributed by Miroslav Šedivý. #552

Test Improvements

• Fix applying pytest marks to fixtures (pytest >= 9.1 compatibility). Contributed by Tomáš Hrnčiar. #609
• Fix unclosed event loop warning in tests.
• Fix pytest classmethod warning.
• .Nominatim: fix test_reverse_near_zero which was failing due to locale-specific response formatting. Contributed by Alfredo Tupone. #606

Docs Improvements

... (truncated)

Changelog

Sourced from geopy's changelog.

2.5.0

2026-07-12

Security Advisory

GitHub Security advisory: :ghsa:`mhvh-fq92-pfmr`.
Regular Expression Denial of Service (ReDoS) in :class:.Point:

:meth:.Point.from_string may take excessive CPU time when parsing long,

malformed coordinate strings due to inefficient regular-expression behavior.
The numeric :class:.Point constructor is not affected.
Geocoders' reverse methods called with string inputs exercise the vulnerable path.
Reported by Younghun Lee in :issue:608,

fix contributed by Apoorv Darshan in :issue:610.
The fix rejects any inputs longer than 256 chars unconditionally,

which may start falsely rejecting previously valid Point strings

with long irrelevant prefixes.
Bugfixes

- :class:`.Geocodio`: fix ``GeocoderQueryError`` being raised for empty results.
- :class:`.GoogleV3`: fix ``utcnow`` deprecation warnings.
Packaging Changes

</code></pre>

<ul>

<li>Drop support for Python 3.7.</li>

<li>Add support for Python 3.13, 3.14, and 3.15.</li>

<li>Migrate build metadata from <code>setup.py</code> to <code>setup.cfg</code>.

Remove <code>download_url</code> from the metadata.

Contributed by Mike Taves. (:issue:<code>535</code>)</li>

<li>Replace <code>distutils</code> with <code>packaging</code> in tests (fixes Python 3.12+).</li>

</ul>

<p>Code Improvements</p>

<pre><code>

Remove Python 2 relics.

Contributed by Miroslav Šedivý. (:issue:552)

Test Improvements

</code></pre>

<ul>

<li>Fix applying pytest marks to fixtures (pytest &gt;= 9.1 compatibility).</li>

</ul>

<!-- raw HTML omitted -->

</blockquote>

<p>... (truncated)</p>

</details>

<details>

<summary>Commits</summary>
<ul>

<li><a href="https://github.com/geopy/geopy/commit/402cbba8b093e5e3f89c81b902f576d65608a123&quot;&gt;&lt;code&gt;402cbba&lt;/code&gt;&lt;/a> 2.5.0</li>

<li><a href="https://github.com/geopy/geopy/commit/f8c0dbd0c40db381e3eb906cc3428e04d33b19c4&quot;&gt;&lt;code&gt;f8c0dbd&lt;/code&gt;&lt;/a> Makefile: fix make dist broken after 9af8380</li>

<li><a href="https://github.com/geopy/geopy/commit/46c9eef67abbe10857cfe651b77fc1e33f5637c1&quot;&gt;&lt;code&gt;46c9eef&lt;/code&gt;&lt;/a> Add versionchanged</li>

<li><a href="https://github.com/geopy/geopy/commit/160aec2567168eaec8b78bc6c55125f6cf669246&quot;&gt;&lt;code&gt;160aec2&lt;/code&gt;&lt;/a> Update changelog</li>

<li><a href="https://github.com/geopy/geopy/commit/106ff54eafe7ecc5966938ed07705a883882c475&quot;&gt;&lt;code&gt;106ff54&lt;/code&gt;&lt;/a> AUTHORS: update an email per user's request</li>

<li><a href="https://github.com/geopy/geopy/commit/f35e84ec387671f263099f59a56844c0fe217d51&quot;&gt;&lt;code&gt;f35e84e&lt;/code&gt;&lt;/a> Pull up AUTHORS</li>

<li><a href="https://github.com/geopy/geopy/commit/2c3df74a4af3c4499e0b4b44b45c9c86dd3be8ac&quot;&gt;&lt;code&gt;2c3df74&lt;/code&gt;&lt;/a> Improve English grammar</li>

<li><a href="https://github.com/geopy/geopy/commit/7f176f08cc018a726b795e5ed9f2ab76ab5005a8&quot;&gt;&lt;code&gt;7f176f0&lt;/code&gt;&lt;/a> tests: fix pytest error in 3.13+ caused by ce21fb7</li>

<li><a href="https://github.com/geopy/geopy/commit/547eb9b72fa22a4c8dea09098d2b207bc4e94be9&quot;&g...
Description has been truncated

[calellowitz]

Dependency review: HIGH risk — HOLD

Not because the bumps are wrong — Pillow alone fixes 12 CVEs and django-oauth-toolkit 3.4 closes an unauthenticated open redirect — but because CI is red with a fix that belongs in this PR, plus two audits that can only be run against production data.

Blocking: CI is red and this PR is the cause

176 failed / 1942 passed, while main is green on its last four runs. Single root cause: django-oauth-toolkit 3.4 changed AccessToken.__str__ to return "AccessToken #<pk>" instead of the raw token. Test helpers interpolate the model instance into the auth header, so every request 401s.

Fix is f"Bearer {token}" → f"Bearer {token.token}" at 6 call sites:

• commcare_connect/data_export/tests/test_app_structure_export.py:42
• commcare_connect/data_export/tests/test_user_visit_export.py:20
• commcare_connect/data_export/tests/test_views.py:51
• commcare_connect/data_export/tests/test_views.py:61
• commcare_connect/form_receiver/tests/test_receiver_endpoint.py:62
• commcare_connect/opportunity/tests/test_task_completion.py:28

Production code already uses token.token and is unaffected.

A second failure wave is masked behind those 401s

DRF 3.18 changed many=True error bodies from a list to a dict (LIST_SERIALIZER_ERRORS_AS_DICT now defaults True). These assertions index [0] and will fail once the 401s clear:

• commcare_connect/data_export/tests/test_views.py:649
• commcare_connect/data_export/tests/test_views.py:663

This is also a live API wire-format change, not just a test issue — it affects the bulk work-area PATCH and the automation payment_units endpoints. Worth deciding whether any client depends on the list shape.

Needs checking against production data before merge

Neither can be settled from the code:

1. DOT 3.4.1 enforces exact redirect-URI matching. Query strings must match exactly rather than being a superset; fragments, path params and userinfo are rejected; localhost loses its ephemeral-port exemption. Redirect URIs live only in the DB.
2. HS256 + hash_client_secret=True applications now fail at ID-token signing.

Quiet production risk, not in any changelog

DRF 3.17.2 made Request._parse read self.body for JSONParser, which pulls Django's 2.5 MB DATA_UPLOAD_MAX_MEMORY_SIZE into the path for the first time. form_receiver — the HQ xform ingestion endpoint — sets parser_classes = [parsers.JSONParser] with no limit configured. Large form submissions could start failing.

Also worth knowing

• cffi 1.17.1 → 2.1.1 is a transitive major that the PR body doesn't list.
• 8 new oauth2_provider migrations — needs migrate_multi, not migrate.
• Cleared: pillow/cffi/hiredis have no direct usage; gunicorn runs sync workers so gevent is near-irrelevant; DRF versioning.py and pagination.py are byte-identical across the bump, so V2OnlyVersioning and IdKeysetPagination are safe.
• The pip-audit failure is pre-existing — none of the 13 flagged packages are in this PR, and it is red across the whole Dependabot queue. Worth separate triage.

Recommendation

Push the 6-line Bearer fix to this branch, then re-run CI to expose the DRF serializer failures underneath. Run the two OAuth audits against production config before merging. Test focus: the OAuth flows, the bulk PATCH endpoints, and a large form_receiver submission.

_{Generated review — please sanity-check before acting.}