[dependabot]

Updates the requirements on django-axes[ipware] to permit the latest version.

Release notes

Sourced from django-axes[ipware]'s releases.

Version 9.0.0

Breaking changes and upgrading

• Require Python 3.11 or newer and Django 5.2 or newer. Python 3.10 and Django 4.2 are no longer supported.
• Run python manage.py migrate after upgrading, even when AXES_USE_ATTEMPT_EXPIRATION is disabled. The axes.0010_accessattemptexpiration migration, introduced in 8.1.0, is required when deleting access attempts. This release adds no new migrations.
• Usernames longer than the Axes username field's maximum length are now truncated consistently before logging and lockout lookups, including values returned by AXES_USERNAME_CALLABLE. Usernames with the same truncated prefix share the same username-based lockout tracking.

Features and fixes

• Truncate usernames to the model field's maximum length before lockout lookups and failed-login logging to avoid database errors for oversized usernames.
• Fall back to the user model's USERNAME_FIELD when AXES_USERNAME_FORM_FIELD is missing from credentials or request data, preserving compatibility with Django's user_login_failed signal.
• Redact passwords and other configured sensitive parameters submitted with a Django form prefix, such as login-password, before storing request data.
• Fix asynchronous middleware lockout responses by passing the original response and credentials in the correct argument order, including to custom lockout callables.
• Handle MultiPartParserError when reading POST data during failed-login logging so malformed multipart requests do not prevent attempts being saved.
• Calculate cooloff thresholds safely when no request is supplied or the request has no axes_attempt_time attribute.
• Add Django 6.1 support.
• Include a PEP 561 py.typed marker so type checkers can use the package's inline annotations.

Project and packaging

• Move project maintenance and repository links from Jazzband to Django Commons.
• Publish releases through PyPI trusted publishing and build distributions using PEP 517.

Full changelog: django-commons/django-axes@8.3.2...9.0.0

Changelog

Sourced from django-axes[ipware]'s changelog.

9.0.0 (2026-10-30)

Breaking changes and upgrading

- Require Python 3.11 or newer and Django 5.2 or newer. Python 3.10 and
  Django 4.2 are no longer supported.
- Run ``python manage.py migrate`` after upgrading, even when
  ``AXES_USE_ATTEMPT_EXPIRATION`` is disabled. The
  ``axes.0010_accessattemptexpiration`` migration, introduced in 8.1.0, is
  required when deleting access attempts. This release adds no new migrations.
- Usernames longer than the Axes username field's maximum length are now
  truncated consistently before logging and lockout lookups, including values
  returned by ``AXES_USERNAME_CALLABLE``. Usernames with the same truncated
  prefix share the same username-based lockout tracking.
Features and fixes

- Truncate usernames to the model field's maximum length before lockout lookups
  and failed-login logging to avoid database errors for oversized usernames.
- Fall back to the user model's ``USERNAME_FIELD`` when
  ``AXES_USERNAME_FORM_FIELD`` is missing from credentials or request data,
  preserving compatibility with Django's ``user_login_failed`` signal.
- Redact passwords and other configured sensitive parameters submitted with a
  Django form prefix, such as ``login-password``, before storing request data.
- Fix asynchronous middleware lockout responses by passing the original
  response and credentials in the correct argument order, including to custom
  lockout callables.
- Handle ``MultiPartParserError`` when reading POST data during failed-login
  logging so malformed multipart requests do not prevent attempts being saved.
- Calculate cooloff thresholds safely when no request is supplied or the
  request has no ``axes_attempt_time`` attribute.
- Add Django 6.1 support.
- Include a PEP 561 ``py.typed`` marker so type checkers can use the package's
  inline annotations.
Project and packaging



Move project maintenance and repository links from Jazzband to Django Commons.
Publish releases through PyPI trusted publishing and build distributions
using PEP 517.

8.3.2 (2026-08-30)

Fix race condition in cache backend.
[aviseth]
</tr></table>

... (truncated)

Commits

• ba99261 Prepare 9.0.0 release
• 6095bd6 Merge pull request #1523 from django-commons/codex/fix-oversized-usernames
• ae7542d Fix oversized usernames using model field max length
• dc3c13e Merge pull request #1500 from django-commons/dependabot/pip/django-ipware-gte...
• b36e19d Merge pull request #1520 from vshalpnjabi/docs-migrate-0010
• d1a605c Merge branch 'master' into dependabot/pip/django-ipware-gte-8.0.0
• 55979bf Merge pull request #1522 from django-commons/codex/remove-unsupported-django-...
• b7d3818 Add Django 6.1 support and modernize date and header APIs
• fb1600b Drop support for Python 3.10 and Django 4.2
• 615d656 Merge pull request #1505 from NorthIsUp/add-py-typed
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)