py-nbconvert: updated to 7.17.2
7.17.2
Maintenance and upkeep improvements
- Fix CI: fetch the classic CSS from PyPI, update dead links
Other merged PRs
- Use org-level security policy (jupyter/.github/SECURITY.md)
py-paramiko: updated to 5.1.0
5.1.0 2026-10-17
[Feature]: Added support for the mlkem768x25519-sha256 post-quantum hybrid key exchange method described in draft-ietf-sshm-mlkem-hybrid-kex. It pairs ML-KEM-768 (FIPS 203) with X25519 and is interoperable with OpenSSH 10.0+. The new method is enabled automatically when the installed cryptography library exposes ML-KEM (which requires OpenSSL 3.5+, AWS-LC, or BoringSSL); it is preferred over the existing classical methods when available. See paramiko.kex_mlkem.KexMLKEM768X25519.
py-photutils: updated to 3.1.1
3.1.1 (2026-10-16)
General
- Importing the top-level ``photutils`` package and subpackages is now
faster.
Bug Fixes
- ``photutils.aperture``
- Fixed the ``to_pixel`` methods of ``SkyEllipticalAperture``,
``SkyEllipticalAnnulus``, ``SkyRectangularAperture``, and
``SkyRectangularAnnulus`` for an aperture whose position frame
differs from the WCS celestial frame (e.g., ICRS positions with a
Galactic WCS). The rotation angle ``theta`` is again measured in
the frame of the aperture position.
[19 lines not shown]
py-astropy: updated to 8.0.2
8.0.2 (2026-10-15)
API Changes
astropy.wcs
- Integer indices beyond the size of an axis are now rejected when slicing a
``SlicedLowLevelWCS`` with a known shape, as for Numpy arrays. In addition,
``simplify_basic_index`` now accepts `None` entries in ``shape`` for dimensions
whose size is not known, in which case the index for that dimension is
returned unchanged, except that a negative integer or slice start raises a
``ValueError``.
Bug Fixes
astropy.coordinates
[195 lines not shown]
py-narwhals: updated to 2.27.1
2.27.1
fix: return a numeric dtype from str.len_chars on all-null object columns
fix: count characters, not bytes, in str.zfill on Polars < 2.0
py-sphinx: updated to 9.1.1
9.1.1 (released Oct 19, 2026)
Bugs fixed
* LaTeX: PDF build crash since LaTeX June 2026 release if tables are
styled with ``'colorrows'`` (which is the default).
Patch by Jean-François B.
* Fix JavaScript search for languages whose stemmer class name
does not match the language name, such as Chinese (which reuses the
English stemmer) and Dutch (which uses the Dutch Porter stemmer).
Patch by Hugo van Kemenade
* Fixed support for Python 3.16 alpha 0 (changes in the ``enum`` module).
Patch by Adam Turner
py-uv py-uv-build: updated to 0.13.3
0.13.3
Performance
Avoid severe uv export slowdowns in dependency graphs with extras
0.13.2
Enhancements
Report all installed packages in uv workspace metadata, including packages outside the selected resolution
Include supported environment restrictions when exporting pylock.toml
Retry dropped GET and HEAD requests when fetching package and index data
Preserve encoding declarations in wheel data scripts that require shell launchers
Show causes and hints when uv python find --script cannot discover an interpreter, including with -q
Print valid ksh activation instructions and support non-relocatable environments under OpenBSD-derived ksh
Allow PEP 508 direct URLs, including Mercurial and extensionless archive URLs, in uv-build's [build-system].requires validation
[45 lines not shown]
py-python-discovery: updated to 1.6.4
v1.6.4 (2026-10-19)
Improved documentation - 1.6.4
- Clarify the executable paths accepted by ``try_first_with`` in the standalone usage example. (:issue:`150`)
v1.6.3 (2026-10-16)
Bug fixes - 1.6.3
- Treat specs with dot-only version components, such as ``python.``, as literal executable paths instead of raising
``IndexError``
- Pass PEP 514 ``ExecutableArguments`` to registered Windows interpreters when querying them, so a registration that
points at a launcher such as ``py.exe -3.11`` reports the interpreter it selects
(:issue:`148`)
v1.6.2 (2026-10-10)
Bug fixes - 1.6.2
[4 lines not shown]
py-line_profiler: updated to 5.1.0
5.1.0
* FIX: Text output now replaces characters the output stream cannot
encode with escape sequences instead of dropping the source line
* FIX: Make sure that the profiled code is run in the
``sys.modules['__main__']`` namespace to avoid issues w/e.g. pickling
* CHANGE: Drop support for Python 3.8 and Python 3.9
* FIX: ``ScopingPolicy`` members now type-check properly as instances
thereof -- at least on Python versions (3.11+) where ``enum.StrEnum``
is available
* FIX: Bytecodes of profiled functions now always labeled to prevent
confusion with non-profiled "twins"
* FIX: Stop reverting ``sys.modules`` after calling ``kernprof.main()``
to avoid edge-case issues with e.g. pickling
* FIX: Fixed bugs where ``kernprof -l`` (1) misses ``--prof-mod``
targets if multiple thereof are imported in the same (from-)import
statement, and (2) crashes when profiling modules containing
``from ... import *`` statements
[5 lines not shown]
py-protego: updated to 0.7.0
0.7.0 (2026-09-21)
- **Backward-incompatible:** ``Protego.parse()`` now raises a more suitable
``TypeError`` instead of a ``ValueError`` when ``content`` is not a string.
- Added official support for Python 3.15.
- ``can_fetch()`` now allows ``/robots.txt`` whatever the rules say, as
required by RFC 9309.
- A group now applies to a user agent only if its product token appears in
that user agent at a token boundary, so that ``User-agent: bot`` no longer
applies to ``mybot``. A product token within a whole ``User-Agent`` header
value, e.g. ``Mozilla/5.0 (compatible; mybot/1.0)``, still matches.
- Percent-encoding is now normalized in the query string and the parameters
of a URL, and not only in its path, so that a rule matches whichever
[34 lines not shown]
py-pytimeparse: updated to 1.1.10
1.1.10
Handle multiline input during sign parsing
Sum fractional units exactly so whole-second results are not truncated
add type hints to make "mypy" happy about "import pytimeparse"
Useless shebangs
py-authlib: updated to 1.9.1
1.9.1
Use scriv to handle the changelog
1.9.0
eat: add Identity Assertion JWT Authorization Grant (ID-JAG)
Fix empty signatures validation in JWS JSON deserialization
fix(jose): reject boolean values for NumericDate claims
fix(client): avoid duplicated OAuth 1.0 parameters in signed requests
OAuth2 token fetch crashes with JSONDecodeError instead of a catchable error on rate-limit responses
docs: add i18n wrappers in conf.py and templates
fix(oauth): enforce JOSE key, scope, and audience validation
AsyncOpenIDMixin.parse_id_token: return None when id_token is absent, matching the sync client
fix(oauth): enforce nonce and JAR request validation
fix(oauth): require client authentication for ID-JAG grants
haproxy: updated to 3.4.7
3.4.7
- MEDIUM: jwt: Reject "none" alg in jwt_verify by default
- MINOR: quic: implement the AEAD integrity limit
- BUG/MEDIUM: flt-http-comp: Block HTX_FL_EOM flag till the end of compression
- BUG/MINOR: flt-http-comp: Rely on htx_set_eom() to restore EOM flag
- MINOR: stconn: prefer to replace endpoints rather than detaching them
- BUILD: haring: fix compile issue due to nop warning.
- MINOR: stick-table: provide a function to estimate on-wire data size
- MINOR: stick-table: calculate the on-wire size of each key
- BUG/MEDIUM: stick-table: restrict key sizes to what fits in a buffer
- BUG/MEDIUM: pattern: don't dereference static_pattern's data when not filling it
- BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5
- BUG/MINOR: jwe: Avoid buffer overflow in fake cek (RSA1.5)
- BUG/MINOR: http: do not consume the delimiter of a truncated q-factor
- BUG/MINOR: sample: apply the ms_/us_ time offsets in the input unit
- BUG/MINOR: sample: zero-pad the fractional part emitted by http_date()
- BUG/MINOR: sample: make quic_enabled() always succeed
[55 lines not shown]
py-pkginfo: updated to 1.13.3
1.13.3 (2026-10-16)
- Remove dead branch in 'wheel.Wheel._extract_purelib'.
1.13.2 (2026-10-16)
- Add ``Wheel`` support for exposing the PEP 427 tags encoded in the wheel
filename (``python_tag``, ``abi_tag``, ``platform_tag``, ``build_tag``),
along with the ``Root-Is-Purelib`` setting read from the archive's
``WHEEL`` file (``purelib``): the closest available signal for whether
a wheel contains native code.
- Anchor candidate matching for installed distribution metadata at the
``<name>-<version>`` boundary, such that a package whose name is a
strict prefix of another installed package's name no longer has its
metadata masked by that other package (e.g. 'pyramid' vs.
'pyramid_chameleon').
[4 lines not shown]
py-pykka: updated to 4.5.0
4.5.0
Breaking changes
Drop support for Python 3.10, which has reached end-of-life.
Changes
Add support for Python 3.15.
Migrate docs from Mkdocs to Zensical.
Types are now checked with ty, in addition to mypy and basedpyright, which has replaced pyright.
py-ijson: updated to 3.6.0
3.6.0
* Removed support for Python < 3.10
* Fixed treatment of null characters on strings (map keys and string values) on `cffi` backend
py-tldextract: updated to 5.4.0
5.4.0 (2026-10-03)
* Features
* Add `TLDEXTRACT_PUBLIC_SUFFIX_LIST_URLS` environment variable to set the default suffix list URLs
* Add the clearer `TLDEXTRACT_DEFAULT_FETCH_TIMEOUT` environment variable, while retaining support for `TLDEXTRACT_CACHE_TIMEOUT`
* Bugfixes
* Fix hostname extraction from already-parsed URLs with credentials, ports, or IPv6 addresses
* Preserve private suffix metadata when a longer wildcard suffix does not match
* Docs
* Document added and deprecated names
* Misc.
* Require CI gate before merging
py-lazy-object-proxy: updated to 1.13.0
1.13.0 (2026-10-17)
* Document explicit proxy evaluation and identity checks with ``None``.
* Fixed some broken tests on Python 3.15.
* Added configuration for Windows ARM64 wheels.
* Added Python 3.15 wheels.
* Dropped support for EOL Python 3.10 and 3.9.
* Dropped wheel building for Python 3.13 free-threading (experimental and unsupported by cibuildwheel anymore;
`details <https://github.com/pypa/cibuildwheel/issues/2683>`_).
* Fixed typo in ``__annotations__`` (basically it was broken).
py-httpx2: updated to 2.15.1
2.15.1 (October 19th, 2026)
Fixed
* Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client.
2.15.0 (October 19th, 2026)
Removed
* Drop support for Python 3.10
py-httpcore2: updated to 2.15.1
2.15.1 (October 19th, 2026)
Fixed
* Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client.
2.15.0 (October 19th, 2026)
Removed
* Drop support for Python 3.10.
