Skip to content

Bump the python-dependencies group across 1 directory with 6 updates - #381

Merged
ramereth merged 1 commit into
masterfrom
dependabot/pip/python-dependencies-a4b5d3f1b4
Sep 3, 2026
Merged

Bump the python-dependencies group across 1 directory with 6 updates#381
ramereth merged 1 commit into
masterfrom
dependabot/pip/python-dependencies-a4b5d3f1b4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 6 updates in the / directory:

Package From To
gunicorn 26.0.0 26.2.0
idna 3.18 3.19
sentry-sdk 2.68.0 2.68.1
coverage 7.15.4 7.16.0
imagesize 2.0.0 2.0.1
pygments 2.20.0 2.21.0

Updates gunicorn from 26.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

  • Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits
  • 36f2a3c gunicorn 26.2.0
  • cbba350 test: cover the h2c edge paths that had none
  • 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
  • 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
  • 5853551 Merge pull request #3712 from Rotzbua/patch-1
  • 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
  • 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
  • 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
  • 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
  • 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
  • Additional commits viewable in compare view

Updates idna from 3.18 to 3.19

Release notes

Sourced from idna's releases.

v3.19

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.19 (2026-08-18)

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits
  • 03a9a11 Release 3.19
  • 2d2a7ef Pre-release 3.19rc0
  • 5cce130 Merge pull request #268 from kjd/fix-std3-regex-alert
  • 3914b75 Split the STD3 disallowed-character range so uppercase is explicit
  • ce9fd98 Merge pull request #267 from kjd/housekeeping
  • 809240c Fail CI when the license copyright year is behind the current year
  • d9e16c5 Consolidate test fixtures, prune stale gitignore entries, and fix doc typos
  • ef30fee Remove dead code and pare back superfluous comments
  • b907913 Tighten the version support and Unicode notes in the README
  • 6204cbe Ignore local build artifacts and stop packaging stray tooling config
  • Additional commits viewable in compare view

Updates sentry-sdk from 2.68.0 to 2.68.1

Release notes

Sourced from sentry-sdk's releases.

2.68.1

enable_logs

  • (logs) Don't stop sending auto-collected logs when enable_logs=True by @​sentrivana in #7237

    If you have enable_logs set to True, our logging integrations for the standard library logging module as well as Loguru will auto-collect logs and send them to Sentry as Sentry logs by default, preserving old behavior. Turning automatic collection off for a specific integration can still be achieved using the capture_sentry_logs integration option.

    import sentry_sdk
from sentry_sdk.integrations.logging import LoggingIntegration
from sentry_sdk.integrations.loguru import LoguruIntegration
sentry_sdk.init(
enable_logs=True,
integrations=[
LoggingIntegration(capture_sentry_logs=True),
LoguruIntegration(capture_sentry_logs=False),
],
)

    Please note that the enable_logs option is deprecated and will be removed in the next major release. The sentry_sdk.logger.X API now works regardless of it, and auto-collection can be opted into via the capture_sentry_logs integration-level options, which are False by default, unless you have enable_logs=True. We've added this compatibility layer to make the transition to a enable_logs-free world easier.

Bug Fixes 🐛

Changelog

Sourced from sentry-sdk's changelog.

2.68.1

enable_logs

  • (logs) Don't stop sending auto-collected logs when enable_logs=True by @​sentrivana in #7237

    If you have enable_logs set to True, our logging integrations for the standard library logging module as well as Loguru will auto-collect logs and send them to Sentry as Sentry logs by default, preserving old behavior. Turning automatic collection off for a specific integration can still be achieved using the capture_sentry_logs integration option.

    import sentry_sdk
from sentry_sdk.integrations.logging import LoggingIntegration
from sentry_sdk.integrations.loguru import LoguruIntegration
sentry_sdk.init(
enable_logs=True,
integrations=[
LoggingIntegration(capture_sentry_logs=True),
LoguruIntegration(capture_sentry_logs=False),
],
)

    Please note that the enable_logs option is deprecated and will be removed in the next major release. The sentry_sdk.logger.X API now works regardless of it, and auto-collection can be opted into via the capture_sentry_logs integration-level options, which are False by default, unless you have enable_logs=True. We've added this compatibility layer to make the transition to a enable_logs-free world easier.

Bug Fixes 🐛

Commits
  • 98f7d91 Update changelog
  • 8f886ff release: 2.68.1
  • df4ec02 fix(logs): Don't stop sending auto-collected logs when enable_logs=True (#7...
  • e320318 test(pyramid): Add tests for data_collection gating of request body (#7218)
  • 7b8a385 test(bottle): Add tests for data_collection gating of request body (#7217)
  • cbcadc9 test(sanic): Add tests for data_collection gating of request body (#7216)
  • e42c798 feat(tornado): Gate request body collection on data_collection option (#7215)
  • d05bb60 test(django): Add tests for data_collection gating of request body (#7213)
  • bcce67b feat(wsgi): Gate request body collection on data_collection option (#7212)
  • 41220c4 fix(google_genai): Gate streaming gen_ai.response.tool_calls on outputs, no...
  • Additional commits viewable in compare view

Updates coverage from 7.15.4 to 7.16.0

Release notes

Sourced from coverage's releases.

7.16.0

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
  • The Coverage.switch_context() method now returns the previous context.
  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
  • Fixes to validation of options and configuration settings:
    • Negative precision settings now always cause useful error messages (pull 2261).
    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

Changelog

Sourced from coverage's changelog.

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

  • The :meth:.Coverage.switch_context method now returns the previous context.

  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

  • Fixes to validation of options and configuration settings:

    • Negative precision settings now always cause useful error messages (pull 2261_).

    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with "Can't combine statement coverage data with branch data". Each named concurrency library is now properly considered (pull 2270_).

  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265_).

.. _pull 2261: coveragepy/coveragepy#2261 .. _pull 2262: coveragepy/coveragepy#2262 .. _pull 2263: coveragepy/coveragepy#2263 .. _pull 2265: coveragepy/coveragepy#2265 .. _issue 2266: coveragepy/coveragepy#2266 .. _pull 2268: coveragepy/coveragepy#2268

... (truncated)

Commits
  • 3e9fc16 docs: prep for 7.16.0
  • 38be8d1 build: control check-manifest explicitly
  • 8eb1266 docs(build): no longer commit sample_html
  • 1a8b3fa docs: remove sample_html
  • aeaa79b docs: linklint is now sphinx-linklint
  • d5eaf3f test: a branchless way to re-add extensions
  • 57e52fd docs: adjust CHANGES for #2270
  • b9d304d fix: check for multiprocessing in a --concurrency list (#2270)
  • a6ef928 chore: make upgrade
  • 070461f chore: bump the action-dependencies group with 4 updates (#2271)
  • Additional commits viewable in compare view

Updates imagesize from 2.0.0 to 2.0.1

Release notes

Sourced from imagesize's releases.

Bug fix

  • Optimize metadata parsing and HTTP range reads.
  • Fix JPEG2000 box parsing.
  • Accept single-quoted SVG dimensions.
  • Return positive heights for top-down BMP images.
  • Remove the upper Python version cap, migrate packaging to pyproject.toml, and add Python 3.15 CI coverage.
  • Bump the package version to 2.0.1 and add recent feedback contributors to the README.

Related issues: shibukawa/imagesize_py#64 shibukawa/imagesize_py#83 shibukawa/imagesize_py#84

Related pull requests: shibukawa/imagesize_py#86 shibukawa/imagesize_py#87 shibukawa/imagesize_py#88 shibukawa/imagesize_py#89 shibukawa/imagesize_py#90 shibukawa/imagesize_py#91 shibukawa/imagesize_py#92

Commits
  • cf87fc0 Prepare release 2.0.1
  • 24992f6 Merge pull request #92 from shibukawa/feature/add-test-python315
  • cda8b07 Add Python 3.15 test coverage
  • a42d408 Merge pull request #91 from shibukawa/feature/fix-issue83
  • a83b14f Merge remote-tracking branch 'origin/master' into feature/fix-issue84
  • a1374b1 Optimize metadata parsing and HTTP range reads
  • d088634 Merge pull request #90 from shibukawa/feature/fix-issue84
  • fde3b5e Fix JPEG2000 box parsing for issue 84
  • 7d5c748 Merge pull request #87 from stephenfin/pyproject
  • efe3db1 Merge pull request #89 from jdillard/fix-64-svg-single-quotes
  • Additional commits viewable in compare view

Updates pygments from 2.20.0 to 2.21.0

Release notes

Sourced from pygments's releases.

2.21.0

  • New lexers:

  • Updated lexers:

    • Bash: Fix coloured keyword at the beginning of a name (#2926)
    • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
    • C#:
      • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
      • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
      • Recognize union (#3182)
    • C/C++:
      • Add C23/C++26 attributes (#3084)
      • Add more C2Y keywords (#3092)
      • Highlight a function following a namespace body (#2928)
      • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
      • Add .ipp as a file extension (#3141, #1008)
    • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
    • Csound: Add missing opcode parameter type letter (#3161)
    • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
    • D: Allow non-ASCII (Unicode) identifiers (#1088)
    • Fish: Fix single quote backslash escape (#3138, #2821)
    • Go: Various lexer improvements (#3199)
    • GoogleSQL: Require a word break after SET (#3167)
    • Hexdump: Only match valid digits (#3200, #2847)
    • JavaScript: Highlight the arguments object (#3146)
    • Jsonnet: Recognize colons in array slice expressions (#2828)
    • JSX: Allow apostrophes in element text (#2816)
    • Julia: Fix rstrings backslash (#3140, #2537)
    • Kotlin: Support companion objects without an explicit name (#2525)
    • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
    • Kusto: Recognize member-access dots in dynamic objects (#2779)
    • Lua: Various improvements (#3143)
    • Macaulay2: Update symbols to 1.26.05 (#3120)
    • Markdown:
      • Highlight bold-italics (***...*** and ___...___) (#3067)
      • Fix mention regex to support hyphens in usernames (#3139, #3135)
    • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)
    • Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

  • New lexers:

  • Updated lexers:

    • Bash: Fix coloured keyword at the beginning of a name (#2926)
    • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
    • C#:
      • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
      • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
      • Recognize union (#3182)
    • C/C++:
      • Add C23/C++26 attributes (#3084)
      • Add more C2Y keywords (#3092)
      • Highlight a function following a namespace body (#2928)
      • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
      • Add .ipp as a file extension (#3141, #1008)
    • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
    • Csound: Add missing opcode parameter type letter (#3161)
    • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
    • D: Allow non-ASCII (Unicode) identifiers (#1088)
    • Fish: Fix single quote backslash escape (#3138, #2821)
    • Go: Various lexer improvements (#3199)
    • GoogleSQL: Require a word break after SET (#3167)
    • Hexdump: Only match valid digits (#3200, #2847)
    • JavaScript: Highlight the arguments object (#3146)
    • Jsonnet: Recognize colons in array slice expressions (#2828)
    • JSX: Allow apostrophes in element text (#2816)
    • Julia: Fix rstrings backslash (#3140, #2537)
    • Kotlin: Support companion objects without an explicit name (#2525)
    • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
    • Kusto: Recognize member-access dots in dynamic objects (#2779)
    • Lua: Various improvements (#3143)
    • Macaulay2: Update symbols to 1.26.05 (#3120)
    • Markdown:
      • Highlight bold-italics (***...*** and ___...___) (#3067)
      • Fix mention regex to support hyphens in usernames (#3139, #3135)
    • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for

... (truncated)

Commits
  • a43b45d Get ready for the 2.21.0 release.
  • d8f14cb Fix version_added for Purescript.
  • 19c5817 Remove superfluous parentheses from PostgresExplainLexer (#3232)
  • 9992e09 Merge pull request #3191 from jvoisin/dupes
  • bd22577 Fix regexlint warnings after latest update.
  • 6a62df1 Release preparation: Update the changelog.
  • aabba32 Merge pull request #3221 from jvoisin/alter
  • d3441d0 Merge pull request #3225 from jvoisin/caddy
  • c593f3f Add a lexer for Caddy
  • 0644b53 Simplify single-character regex alternations to character classes
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python-dependencies group across 1 directory with 6 updates
b60e4e0 
Bumps the python-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [gunicorn](https://github.com/benoitc/gunicorn) | `26.0.0` | `26.2.0` |
| [idna](https://github.com/kjd/idna) | `3.18` | `3.19` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.68.0` | `2.68.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.4` | `7.16.0` |
| [imagesize](https://github.com/shibukawa/imagesize_py) | `2.0.0` | `2.0.1` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |



Updates `gunicorn` from 26.0.0 to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@26.0.0...26.2.0)

Updates `idna` from 3.18 to 3.19
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.19)

Updates `sentry-sdk` from 2.68.0 to 2.68.1
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.68.0...2.68.1)

Updates `coverage` from 7.15.4 to 7.16.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.4...7.16.0)

Updates `imagesize` from 2.0.0 to 2.0.1
- [Release notes](https://github.com/shibukawa/imagesize_py/releases)
- [Commits](shibukawa/imagesize_py@2.0.0...2.0.1)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

---
updated-dependencies:
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: idna
  dependency-version: '3.19'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: sentry-sdk
  dependency-version: 2.68.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: coverage
  dependency-version: 7.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: imagesize
  dependency-version: 2.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 1, 2026
@ramereth
ramereth merged commit 8cccff6 into master Sep 3, 2026
7 checks passed
@ramereth
ramereth deleted the dependabot/pip/python-dependencies-a4b5d3f1b4 branch September 3, 2026 21:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ramereth