py-django-debug-toolbar: updated to 8.0.0
8.0.0 (2026-09-02)
* Refreshed the toolbar's visual design with self-hosted Alef (panel titles)
and Geist (body text) fonts, an updated color palette, and per-panel
navigation icons.
* Added a new project logo and brand identity, designed by Robin of
`RBNX Studio <https://www.rbnx.studio>`_.
* Added a "Docs" link to the toolbar that opens the documentation.
* Changed the highlight color for the current request and other
"relevant to you" rows from yellow to a green tint, with a left border
accent for legibility in dark mode.
* Added a design guidelines page to the documentation describing the project's
logo, color palette and typography.
* Improved toolbar accessibility: visible keyboard focus, keyboard-operable
scroll regions, reduced-motion support, ``aria-expanded`` on panel toggles,
an ``aria-live`` status for history refreshes, and WCAG 2.1 AA contrast in
both themes.
[12 lines not shown]
py-django-countries: updated to 9.0.0
9.0.0 (10 June 2026)
Features
- Nullable `CountryField` (with `null=True`) now returns `None` instead of `Country(code=None)` when the database value is NULL. This makes the nullability explicit at the field level rather than inside the `Country` object, resulting in cleaner typing where `Country.code` is always a `str` (never `None`).
**Breaking change:** Code that previously checked `obj.country.code is None` should now check `obj.country is None`. The common pattern `if obj.country:` continues to work unchanged.
- Add Django 6.0 and Python 3.14 support. Drop Django 3.2, 5.0, 5.1 and Python 3.8, 3.9. Minimum DRF bumped to 3.14.
- Add an opt-in `Countries.sorted(locale=...)` helper to return country choices sorted by translated display names.
Bugfixes
- Fix multiple type stub issues in `fields.pyi`: correct return types for `Country.name`, `Country.alpha3`, `Country.ioc_code` (now `str` instead of `str | None`), `Country.numeric` (now `int | None` instead of `str | None`), and `MultipleCountriesDescriptor.__iter__` (now `Iterator[Country]` instead of `Any`). Also add missing `blank_label` attribute and accept positional `verbose_name` argument in `CountryField.__init__` overloads.
- Exclude .mypy_cache directory from source distributions (was 73% of the sdist).
Improved Documentation
- Clarify that multiple=True returns a MultipleCountriesDescriptor, not a plain list.
py-django-js-asset: updated to 4.1.0
4.1 (2026-08-28)
- Fixed ``js_asset.Media`` crashing with an ``AttributeError`` when rendering an
asset that only implements Django's plain ``__html__`` contract (neither a
``MediaAsset`` nor one of our ``ImportMap``/``JSON`` types). Such assets now
fall back to ``__html__()`` exactly like ``django.forms.Media`` does; the
nonce cannot be threaded into an opaque ``__html__`` asset, same as with stock
Django.
- Fixed ``js_asset.Media`` treating html-safe strings -- e.g.
``mark_safe('<script defer src="..."></script>')``, a long-documented Django
idiom for embedding a complete asset tag -- as asset paths, so they were run
through ``static()`` and percent-encoded instead of being rendered verbatim.
Anything providing ``__html__()`` now takes the verbatim path, matching
``django.forms.Media``.
- ``js_asset.Media`` additionally renders html-safe strings correctly on Django
6.1, whose own ``forms.Media`` mangles them (fixed in Django for 6.1.1). Only
media built through ``js_asset.Media`` benefits; assets adopted from a plain
[25 lines not shown]
py-django-allauth: updated to 65.19.2
65.19.2 (2026-09-01)
Fixes
- Headless: Posting a well-formed JSON payload that was not an object (e.g. a
list or a string) to the headless endpoints resulted in a server error.
Security notice
- MFA: TOTP enrollment code verification was not rate limited. Impact is
limited, as to exploit this you would need to be already fully authenticated,
pass (rate-limited) reauthentication, and brute force within a 30s TOTP
window.
py-pipx: updated to 1.17.2
1.17.2 - 2026-09-01
Bugfixes
Fix KeyError stderr noise when installing packages in Python3.15.
1.17.1 - 2026-08-30
Bugfixes
pipx environment now reports PIPX_MAX_LOGS, and pipx environment –value PIPX_MAX_LOGS no longer exits with invalid choice.
Miscellaneous internal changes
1.17.0 - 2026-08-29
Features
Add PIPX_COOLDOWN, a default for –cooldown on install, install-all, inject, upgrade, upgrade-all and run, so one release-age policy covers every command. An explicit –cooldown still wins, –cooldown 0 opts a single command out, and a locked install ignores the variable rather than failing.
Bugfixes
Require packaging>=26. Earlier releases serialize a direct reference as name@ url rather than PEP 508’s name @ url, so the specifier pipx recorded in pipx_metadata.json and passed to the backend depended on which packaging happened to be installed.
translate-toolkit: updated to 3.19.19
3.19.19
Changes
Formats and Converters
Apple Stringsdict
Keep direct single-variable format references with their plural
units
Qt QM
Reject malformed messages with invalid lengths
XML-based formats
Honor inherited xml:space attributes to preserve significant
whitespace
Other
[6 lines not shown]
py-test_socket: updated to 0.8.1
0.8.1
Fixes:
Close the socket before raising on a blocked connect, fixing a file
descriptor leak
Make SocketConnectBlockedError pickleable so it survives multiprocessing
test runners such as pytest-xdist and Django's --parallel
Changes:
Added mutation testing via make mutmut
Added CodSpeed performance benchmarks
Dependency, CI, and development updates
py-test-randomly: updated to 5.0.0
5.0.0 (2026-09-01)
Support Python 3.15.
Shuffle tests in a wrapper around the pytest_collection_modifyitems hook, guaranteeing that the shuffle runs before all other plugins’ implementations of the hook.
Previously, pytest-randomly shuffled in a plain tryfirst hook implementation. When another plugin also implemented the hook with tryfirst, as pytest-django does, whichever plugin pytest happened to register later ran first. Registration order comes from package metadata on disk, which can differ between seemingly identical environments — even two containers built from the same Dockerfile, or the same virtual environment after reinstalling a package. As a result, the same seed could yield different test orders in different environments. Worse, in environments where pytest-randomly ended up shuffling last, it silently destroyed the other plugin’s ordering — for pytest-django, the grouping of database tests that mirrors Django’s test runner (non-transactional database tests, then transactional ones, then the rest).
Now the shuffle always runs first, and plugins that group tests with a stable sort apply their grouping on top of the shuffled order, so the final order is reproducible from the seed alone. In environments that previously hit the reversed hook order, upgrading changes the test order for a given seed — restoring both reproducibility and other plugins’ grouping.
Require pytest 8+, the first version to require a version of pluggy that supports hook wrappers, as used by the above fix.
Reset Polyfactory’s default random state at the start of every test, if it is installed.
Switch package build backend from setuptools to uv_build. This makes builds with uv about nine times faster, since uv runs the backend natively, without creating a build environment or spawning a Python process. Additionally, source distributions no longer include test files, which setuptools previously included incompletely, missing the files needed to actually run them.
rocksndiamonds: updated to 4.4.2.4
4.4.2.4
added sound for active conveyor belts
added sound for conveyor belt switches
added sound for switchgate switches
fixed sound of growing amoeba
added key shortcuts for undo/redo game buttons
removed unnecessary historic player move delay for very old levels
fixed “smashed by rock/spring” graphics for non-native EM graphics
fixed push delay for EM engine for non-native EM engine level files
fixed drawing invisible walls with initially activated light switch
fixed graphics for invisible wall explosions
fixed potential crash bugs
py-test-rerunfailures: updated to 16.6
16.6 (2026-08-17)
Features
- Add a repeatable ``--rerun-exclude-path`` option to exclude test files or
directories from reruns.
Bug Fixes
- Fix a regression in version 16.5 which made ``--pdb`` unusable even when no
reruns were configured.
py-scrapy: updated to 2.18.0
Scrapy 2.18.0 (2026-08-20)
Highlights:
- ``HttpxDownloadHandler`` now uses `httpx2 <https://httpx2.pydantic.dev/>`__
- The Twisted-based HTTP/2 download handler is no longer experimental
- ``brotli`` and Zstandard support are now always available, and :ref:`optional
extras <extras>` cover the rest of the optional features
- Late :class:`~scrapy.crawler.Crawler` attributes, such as
:attr:`~scrapy.crawler.Crawler.stats`, now raise :exc:`RuntimeError`
instead of being ``None`` before the crawl starts
- Item exporters now export fields in declaration order
[4 lines not shown]
py-xopen: updated to 2.1.0
v2.1.0 (2026-06-03)
Zstandard is now supported by using compression.zstd, which is part of the Python standard library since Python 3.14. On Python versions before 3.14, backports.zstd is used instead.
Zstandard support is no longer optional. That is, it is no longer necessary to install xopen with the zstd extra. The reason Zstandard was optional was that python-zstandard wheels are quite large, but backports.zstd wheels are much smaller.
Dropped support for Python 3.8 and 3.9
Started supporting Python 3.13 and 3.14 (including free-threaded)
py-fonttools: updated to 4.64.0
4.64.0 (released 2026-08-31)
- [feaLib] Fix name-table parsing for multibyte Mac encodings
- [ttProgram] Also indent TrueType assembly following ``IDEF[ ]``, like function
definitions
- [subset] Keep East Asian spacing ``palt`` by default
- [subset] Bug fix for MATH table in which constructions for glyphs that are only
added during MATH closure were kept
- [ufoLib] Make glyph-to-group construction accessible outside of lookup function
- [glyf] Use reverse glyph map for O(1) ``__setitem__`` membership
- [ttLib] Fix ``fixLookupOverFlows()`` reporting success when it had not promoted
any lookup to Extension, masking unresolvable overflows.
- [ttLib] Add support for TrueType Collection version 2
- [ttLib] Pin a single head.modified timestamp across ``TTCollection.save``
- [ttLib] Give an actionable error when LookupList overflow is unrecoverable
- [ttLib] Add support for the AAT bitmap tables ``bhed``, ``bdat``, ``bloc``,
variants of ``head``, ``EBDT``, ``EBLC`` used in legacy Apple bitmap-only fonts
[57 lines not shown]
py-weasyprint: updated to 69.0
69.0
**This is a security update (CVE-2026-49452).**
We strongly recommend to upgrade WeasyPrint to the latest version if you use the
``--presentational-hints`` option and render untrusted HTML with restricted CSS
properties.
Security:
* Avoid CSS injection with HTML presentational hints.
Command-line API:
* The ``--srgb`` option has been replaced by ``--output-intent=srgb``. Other values are
possible: ``device-cmyk`` for CMYK documents with no ICC profile, or the CSS
identifier of a ``@color-profile`` rule.
[13 lines not shown]
