py-tox: updated to 4.61.2
Bug fixes - 4.61.2
tox now expands a generative digit range only where a factor starts, so an environment such as py313-django4-2 keeps its name rather than becoming py313-django4, 3 and 2
Improved documentation - 4.61.2
Document how factors work in one place, covering what a factor is, the characters tox accepts in one, the platform and architecture factors that apply to conditions without appearing in a name, and how selecting by factor differs from selecting by name
Give a reference entry to the configuration keys that had none. interrupt_post_commands runs commands_post after an interrupt, and config_file_path, host_python, home and tox_root_name are constants a configuration can substitute
py-virtualenv: updated to 21.7.8
Bugfixes - 21.7.8
A missing source needed by both install modes now disables the builtin creator
through meta.error. The check compared RefWhen values against RefMust members,
so creation went on to fail with a FileNotFoundError or a dangling symlink
py-requests-futures: updated to 1.1.0
1.1.0
Minor:
Cancel queued requests on close
Patch:
Remove the unused build attribute and the Python 2.7 NullHandler fallback
Close owned sessions after their background requests finish, including when using a supplied executor, and reject requests after close
Pickle check covers request arguments, not just the callable
background_callback now emits a DeprecationWarning instead of a log line
Fix pool sizing for supplied sessions
Preserve falsy callback results
openimageio: updated to 3.1.17.0
3.1.17.0
raw: Add raw:thumbnail_index and raw:thumbnail_sort hints to select a specific embedded thumbnail, plus assorted thumbnail fixes and unit tests.
raw: Allow vector types in multi-value hints (white balance as a float4, cropbox/greybox as int2 boxes).
raw: Fix undebayered flip mapping, buffer bounds, and overflow issues.
exr: Convert mixed-native-integer-depth channels through proper rescaling instead of reinterpreting bytes when writing OpenEXR (also fixes copy_image and iconvert native fast paths).
oiiotool: More robust handling of failed reads: preserve the reader's specific error message instead of a generic "file not found", don't dereference specs of a failed read, and safer error message marshalling.
IBA: Detect iterator read errors in orientation functions (flip, flop, rotate90/180/270, transpose).
writers: Don't write thumbnail_* metadata to formats that can't hold a thumbnail.
readers: Use check_open() and check_compression_ratio() in all readers that lacked them, guarding against decompression bombs and implausible header dimensions.
bmp: Decompression-bomb guard, UB-safe height negation, and scanline bounds checks.
exif: Harden the shared Exif decoder against malformed input (affects all formats that embed Exif).
ffmpeg: Fix heap bounds, bad packet handling, add checks at open, and other fixes.
fits: Validate the NAXIS count against the permitted 0-999 range.
gif: Reject a short graphics-control extension block.
icc: Fix out-of-bounds pointer formation, use alignment-safe reads, and 64-bit tag bounds in the shared ICC profile decoder (jpeg, png, tiff, webp, jpeg2000, psd).
jpeg: More detection of corrupt files.
[23 lines not shown]
libnice: updated to 0.1.24
libnice 0.1.24 (2026-09-01)
API: nice_agent_attach_recv_ex() to retrieve extra message data in recv callback
API: nice_message_extra_data_get_tos() to enable access to IP_TOS/IPV6_TCLASS
IP header field of incoming packets; requires GLib 2.88
API: stun_usage_bind_run_compat() to allow specifying compatibility mode when
sending a binding request
Nicesrc: Attach GstNetControlMessageMeta containing the TOS header field to buffers
Ensure NICE_CANDIDATE_MAX_TURN_SERVERS is obeyed
Ensure nice_agent_get_local_credentials() returns FALSE on error
Fix random crashes
Fix potential heap buffer overflow in UDP-TURN over TCP
Fix compilation on FreeBSD
py-vcs-versioning: updated to 2.3.2
2.3.2 (2026-09-01)
Fixed
- Register the `pkginfo` workdir discovery factory in vcs-versioning itself. `PKG-INFO` is standard sdist metadata, not a setuptools artifact, but its factory was only registered by setuptools-scm -- so a standalone vcs-versioning install could not infer a version from an sdist. This broke sdist builds for non-setuptools backends, e.g. meson-python calling `python -m vcs_versioning` from `project()`.
Fallback workdir candidates are now ordered by how much metadata they carry (egg-info, then archival, then `PKG-INFO`) instead of by entry point iteration order, so a setuptools built sdist keeps using its `scm_version.json` now that the two factories ship from different distributions.
Miscellaneous
- Stop shipping a per-package `uv.lock` in the sdist. It could not be generated correctly whenever `setuptools-scm` required an unreleased `vcs-versioning`, which broke the release proposal workflow.
py-patsy: updated to 1.0.3
v1.0.3
* Added official support for Python 3.14.
* Fixed constraint tokenizer compatibility with Python 3.15 pre-releases.
* Updates to CI tooling and doc building.
py-platformdirs: updated to 4.11.7
4.11.7 (2026-09-01)
4.11.6 (2026-09-01)
Give :func:`~platformdirs.user_bin_dir` and :func:`~platformdirs.user_bin_path` the use_site_for_root argument. They took none, so neither could reach the Unix redirect of root to :func:`~platformdirs.site_bin_dir`. :pr:`537`
py-tibs: updated to 2.0.1
2.0.1
Lots of new features added. A few caused some small backwardly incompatible changes, so as the user base is still small I just accepted the better API and upped the major version number.
py-readme_renderer: updated to 46.0
46.0 (2026-08-28)
* Render Markdown GFM alerts as semantic HTML admonitions
* Support GitHub emoji shortcodes in Markdown
* Don't drop reStructuredText's top-level heading, and render headings at
their literal levels starting at ``<h1>``, consistent with Markdown
* Require ``comrak`` 0.0.13 and higher for the ``md`` extra
* Handle expected warnings in the test suite
* Fix the 45.0 changelog date
* Update workflows
py-acme py-certbot*: updated to 5.8.0
5.8.0
Changed
certbot and its acme library now require cryptography>=47.0.0.
Fixed
Fixed removed domains being omitted from the certificate update confirmation prompt.
py-awscli: updated to 1.46.1
1.46.1
* enhancement:CodeArtifact: Updated npm login to write configuration directly to .npmrc, consistent with how other package manager integrations handle their config files.
* enhancement:SSM SessionManager: Add warning message for outdated SessionManagerPlugin version
1.46.0
* feature:dependencies: Vendor botocore and s3transfer
py-boto3: updated to 1.43.86
1.43.86
* api-change:``bedrock-agentcore-control``: [``botocore``] Online evaluation configurations now support up to 25 evaluators. CloudWatch Logs data sources for online evaluation now support up to 10 log groups.
* api-change:``guardduty``: [``botocore``] Amazon GuardDuty now supports custom detection rules, including APIs to manage rule associations and organization-level configurations.
* api-change:``iotsitewise``: [``botocore``] AWS IoT SiteWise Scenario Discovery now supports mounting Amazon S3 data directly into pipeline task containers via S3 Access Points, and configuring additional ephemeral storage per task. Mount configurations can be overridden at execution time. See the API guide for details.
* api-change:``kinesis``: [``botocore``] Amazon Kinesis Data Streams now supports a dry run feature for data-plane APIs to validate the permissions and request parameters. If all checks complete successfully, the API returns a 'DryRunOperationException', confirming the request would have succeeded without the 'DryRun' parameter.
* api-change:``lambda``: [``botocore``] AWS Lambda now provides configurable control over S3 direct access, allowing you to explicitly enable or disable how functions stream file reads directly from S3 buckets. This gives you flexibility to tune data access behavior based on your workload requirements, independent of memory size.
* api-change:``lightsail``: [``botocore``] This release adds support for the Amazon Lightsail GetProfile API, which returns the profile for the specified account.
* api-change:``marketplace-agreement``: [``botocore``] This release adds renewal support for AWS Marketplace private offers. Agreements report whether they renew and, if not, why. Renewal terms add price increases, renewal limits, renewal decision deadlines, and payment schedule templates. SearchAgreements adds filters.
* api-change:``marketplace-discovery``: [``botocore``] GetOfferTerms now returns renewalTerm for offers with pre-authorized renewals, exposing maxRenewals, lockoutPeriod, adjustmentDeadline, priceIncrease (fixed percentage or percentage range), and termTemplates (renewal payment schedules). Enables buyers to view renewal pricing and terms.
* api-change:``mediaconvert``: [``botocore``] Adds support for AAC passthrough. Adds ManifestCues option to support HLS manifest Cue marker passthrough. Adds playback device compatibility mode for DASH H.265 outputs. Adds TTML caption styling options. Adds interlace mode support for XAVC HD Intra CBG profile.
* api-change:``sesv2``: [``botocore``] Added support for managing SMIME signing certificates for email identities, including associating, listing, and disassociating certificates. Added the UpdateConfigurationSet operation to configure message security options such as signing scheme.
* api-change:``taxsettings``: [``botocore``] France and Monaco Additional Info changes
1.43.85
[63 lines not shown]
py-s3transfer: updated to 0.19.2
0.19.2
bugfix:TLS: Return a configuration error when the CA bundle value (ca_bundle, AWS_CA_BUNDLE, REQUESTS_CA_BUNDLE, or verify) resolves to an empty or whitespace-only string.
py-botocore: updated to 1.43.86
1.43.86
* api-change:``bedrock-agentcore-control``: Online evaluation configurations now support up to 25 evaluators. CloudWatch Logs data sources for online evaluation now support up to 10 log groups.
* api-change:``guardduty``: Amazon GuardDuty now supports custom detection rules, including APIs to manage rule associations and organization-level configurations.
* api-change:``iotsitewise``: AWS IoT SiteWise Scenario Discovery now supports mounting Amazon S3 data directly into pipeline task containers via S3 Access Points, and configuring additional ephemeral storage per task. Mount configurations can be overridden at execution time. See the API guide for details.
* api-change:``kinesis``: Amazon Kinesis Data Streams now supports a dry run feature for data-plane APIs to validate the permissions and request parameters. If all checks complete successfully, the API returns a 'DryRunOperationException', confirming the request would have succeeded without the 'DryRun' parameter.
* api-change:``lambda``: AWS Lambda now provides configurable control over S3 direct access, allowing you to explicitly enable or disable how functions stream file reads directly from S3 buckets. This gives you flexibility to tune data access behavior based on your workload requirements, independent of memory size.
* api-change:``lightsail``: This release adds support for the Amazon Lightsail GetProfile API, which returns the profile for the specified account.
* api-change:``marketplace-agreement``: This release adds renewal support for AWS Marketplace private offers. Agreements report whether they renew and, if not, why. Renewal terms add price increases, renewal limits, renewal decision deadlines, and payment schedule templates. SearchAgreements adds filters.
* api-change:``marketplace-discovery``: GetOfferTerms now returns renewalTerm for offers with pre-authorized renewals, exposing maxRenewals, lockoutPeriod, adjustmentDeadline, priceIncrease (fixed percentage or percentage range), and termTemplates (renewal payment schedules). Enables buyers to view renewal pricing and terms.
* api-change:``mediaconvert``: Adds support for AAC passthrough. Adds ManifestCues option to support HLS manifest Cue marker passthrough. Adds playback device compatibility mode for DASH H.265 outputs. Adds TTML caption styling options. Adds interlace mode support for XAVC HD Intra CBG profile.
* api-change:``sesv2``: Added support for managing SMIME signing certificates for email identities, including associating, listing, and disassociating certificates. Added the UpdateConfigurationSet operation to configure message security options such as signing scheme.
* api-change:``taxsettings``: France and Monaco Additional Info changes
1.43.85
[63 lines not shown]
py-google-auth-oauthlib: updated to 1.4.1
1.4.1
Bug Fixes
google-auth-oauthlib: prevent port re-use on windows
Documentation
handwritten: centralize CONTRIBUTING.rst pointers
py-websocket-client: updated to 1.9.2
1.9.2
- Fix race in `WebSocketApp.close()` when `run_forever()` thread clears the socket during the close handshake
1.9.1
- Add Python 3.14 support to setup config and CI (f2bc97a)
- Fix `close()` dropping close frame when reason is str (2f22e2e)
- Fix `close()` type annotation and docstring for timeout and reason (d69f730)
- Make `abort()` robust for sockets that cannot shutdown, same logic as `shutdown()` (1904e3d)
- Raise `WebSocketException` for redirects missing a `Location` header (97e34db)
- Raise when WebSocket connect redirect limit is exhausted (be0d38d)
- Raise `WebSocketException` for redirects to invalid targets (62ef6af)
- Fix unformatted ABNF validation error messages (0145b7b)
- Fix `validate_utf8()` crash on str input (4a8e6ed)
- Store `status_message` on `WebSocketBadStatusException` (368aeda)
- Raise `WebSocketException` for `check_hostname` with `CERT_NONE` (0232aca)
- Fix `handleDisconnect` type annotation: None default requires Optional (20f3712)
- Remove unreachable `not frame` check in `recv_data_frame()` (b684242)
[9 lines not shown]
py-coverage: updated to 7.16.0
7.16.0 — 2026-08-28
- When combining files, now path separator slashes will automatically be
converted to the local file system style. This makes it less necessary to
define ``[paths]`` configuration to combine data across operating systems.
Fixes `issue 2266`_.
- The :meth:`.Coverage.switch_context` method now returns the previous context.
- Fix: previously, a ``[paths]`` pattern would be replaced everywhere in a file
path when it was only meant to be replaced once, in the leading portion of
the path. This is now fixed, in `pull 2268`_.
- Fixes to validation of options and configuration settings:
- Negative precision settings now always cause useful error messages (`pull
2261`_).
[25 lines not shown]
