py-soupsieve: updated to 2.9.1
2.9.1
- **FIX**: Correct `[attr^=""]`, `[attr$=""]`, and `[attr*=""]` to match nothing when the value is empty, per CSS
Selectors Level 4 substring matching, which previously matched any element merely having the attribute
(@chuenchen309).
2.9
- **NEW**: Drop Python 3.9 support.
- **NEW**: Lazy compile selector patterns to improve initial import speed.
- **FIX**: Correct `:nth-child`/`:nth-of-type` (and `-last-` variants) for `An+B` values whose sequence steps onto
index 0 or onto the last child (e.g. `:nth-child(2n-2)`, `:nth-child(n-1)`, `:nth-child(n+5)`), which previously
matched the wrong elements or nothing at all (@gaoflow).
- **FIX**: More efficient CSS ID matching (@kaimandalic).
- **FIX**: Fix inefficient trimming of comments and white space (@kaimandalic).
py-geoip2: updated to 5.3.0
5.3.0 (2026-07-16)
* The version is now retrieved from package metadata at runtime using
``importlib.metadata``. This reduces the chance of version inconsistencies
during releases.
* The async client now builds its ``Authorization`` header with
``aiohttp.encode_basic_auth()`` instead of the ``aiohttp.BasicAuth`` /
``auth=`` parameter, which are deprecated as of aiohttp 3.14.0. As a result,
the minimum required ``aiohttp`` version is now 3.14.0.
* A new ``residential`` attribute has been added to
``geoip2.records.Anonymizer``. This is a ``geoip2.records.AnonymizerFeed``
object providing residential proxy data for the network and contains the
following fields: ``confidence``, ``network_last_seen``, and
``provider_name``. This attribute may be populated even when no other
anonymizer attributes are set, so the ``anonymizer`` object may now
contain only this attribute.
py-aiohttp: updated to 3.14.3
3.14.3 (2026-07-22)
Bug fixes
- Fixed the client dropping only the first ``Authorization``, ``Cookie`` and
``Proxy-Authorization`` header when a redirect crossed an origin
- Fixed error message construction in the C HTTP parser
py-wagtailmenus: updated to 4.1
4.1.0
* Added LOCALIZE_MENU_ITEMS setting for i18n locale-aware menus
* Added testing for Wagtail 7.4 (LTS).
* Removed support for Wagtail 6.3 LTS, 7.1 and 7.2 (end of life).
* Removed support for Django 5.1 (end of life).
* Raised minimum Wagtail version to 7.0.
* Removed dead Django <4.1 compatibility shim in `models/menus.py`.
py-wagtail: updated to 7.4.2
7.4.2
CVE-2026-54259: Improper restriction handling on Documents and Images chosen endpoints
CVE-2026-54260: Denial of service via unbounded filter specs in the image preview
CVE-2026-54261: Improper permission handling in image preview
CVE-2026-54262: Pages translations can be created without page permissions when using simple_translation
CVE-2026-54263: Reflected XSS in dynamic image URL generator view
Fix: Prevent spurious migrations when there are missing child blocks in StructBlock.Meta.form_layout (Matthias Brück, Sage Abdullah)
Fix: Prevent error in usage views when using gettext_lazy for a model's verbose_name (James Biggs)
Fix: Prevent development markdown files from being added to virtual environment root upon installation (Dan Braghis)
Fix: Prevent StreamField blocks referenced multiple times from losing their required state after deferred validation (Sage Abdullah)
Docs: Add missing return in example views for template components (Tibor Leupold)
py-django-filter: updated to 26.1
Version 26.1 (2026-07-11)
* Added testing for Django 6.1.
DRF integration will require the upcoming DRF v3.18.
See https://github.com/encode/django-rest-framework/pull/9978
* Added testing against Python 3.14.
opencv: updated to 4.14.0
4.14.0
Core module:
Fixed copyTo on empty fixed-type matrices
Improved precision of RotatedRect::points
Fixed UB in cv::error when breakOnError set to true
Fixed cv::mul overflow for U16 type
Revert "Disable IPP with AVX512 in cv::compare because of performance regression"
Fixed UBSan function pointer type mismatch in countNonZero
Fixed heap-buffer-overflow in YAML parseKey for empty keys
Optimized flip Horizontal
Added AVX VNNI support
Fixed meanStdDev on Windows for ARM
Added NEON implementation for rotate function
Fixed inplace transpose race by enforcing LLSS ordering via local barrier in OpenCL
Fixed incorrect results for in-place flip on strict OpenCL implementations
[32 lines not shown]
rumdl: update to 0.2.40.
0.2.40
Fixed
md003: consume the setext underline when converting a heading to ATX. Converting a setext heading left the underline behind, where a following blank line turned it into a thematic break, so rumdl fmt added a horizontal rule the document never had (7363c34)
md077: stop scoping list items inside blockquotes, which made a lazy continuation line gain indentation on every pass so the formatter never converged (58fb25b)
reflow: keep wiki links, shortcodes and math whole inside a wrapped span (db12c2c)
config: honor the documented MD033 table_allowed alias, which silently dropped the configured value (db2c204)
config: stop reporting MD013's documented semantic-link-understanding alias as an unknown option (1539a64)
parity: make the markdownlint comparison harness actually run (182763c)
Documentation
md013: document that ignore-link-urls affects reporting only. Reflow measures the markdown as written, matching prettier and mdformat (c4f8bad)
0.2.39
[9 lines not shown]
libssh: update to 0.11.5.
Follow upstream version numbering again.
version 0.11.5 (released 2026-07-21)
* Security:
* CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
* CVE-2026-59843: Denial of service via zero advertised channel packet size
* CVE-2026-59844: Denial of service via oversized SFTP read length
* CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
* CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
* CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
* CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
* CVE-2026-59849: Denial of service via automatic certificate authentication loop
* CVE-2026-59850: Use-after-free via data callbacks on closed channels
* Zero-initialize every ssh_string
* Compatibility:
* Fix compatibility with C23 / gcc16
* Bugfixes:
[9 lines not shown]
py-pillow_heif: update to 1.5.0.
## [1.5.0 - 2026-07-22]
### Added
- Grid(tiled) image encoding: `options.GRID_TILE_SIZE` option, `tile_size` parameter for `save` and `grid_tile_size` parameter for `register_*_opener`. #317
- `info["tiling"]` dictionary with the grid info for tiled images. #317
- `PH_LIBHEIF_CMAKE_ARGS` environment variable for `build_libs.py` to pass extra `cmake` arguments to the libheif build.
- Windows ARM64 wheels.
### Changed
- Minimum required `libheif` version is `1.23.1`.
- Releases are now tag-triggered and published to PyPI with attestations via Trusted Publishing. #432
- `libheif` was updated from the `1.23.0` to `1.23.1` version. #445
- `libde265` was updated from the `1.1.0` to `1.1.1` version. #434
### Removed
[3 lines not shown]
py-utils: updated to 4.0.0
Version 4.0 is a modernization release: the public helpers you already rely on
are unchanged, but the package underneath is faster to import, stricter about
types, and built with a modern toolchain.
py-scrapy: updated to 2.17.0
Scrapy 2.17.0 (2026-07-07)
Highlights:
- Security bug fixes
- HTTP/2 and SOCKS proxy support for ``HttpxDownloadHandler``
- Improved settings for changing allowed TLS versions
Security bug fixes
- ``s3://`` requests now use HTTPS by default, instead of plaintext HTTP.
Previously, :class:`~scrapy.core.downloader.handlers.s3.S3DownloadHandler`
sent signed S3 requests over plaintext HTTP unless
``request.meta["is_secure"]`` was set to a true value, exposing the request
path, the AWS ``Authorization`` header, the ``X-Amz-Security-Token`` header
(when using temporary credentials), and the response contents to network
[160 lines not shown]
py-rarfile: updated to 4.4
4.4
Security fixes:
* Skip CRC check for some old subblocks. Previously
`rarfile` tried to calculate header CRC by reading
data payload for those, but that could cause excessive
allocations.
Fixes:
* RAR5: Reattempt passwords after trying wrong password
when header encryption is used.
* Restore fd position in file type detection functions.
