py-diagnostic: added version 3.0.0
diagnostic makes it easier to build command line tools with great error
reporting.
Features
* Unique codes on every Diagnostic
* Tooling to help ensure all codes in the codebase are documented
* Fancy graphical output, built on top of rich, with graceful fallbacks to
ASCII and plain strings
* Present a causal chain if needed
py-soupsieve: updated to 3.0.4
3.0.4
- **FIX**: Keep own and descendant text separate when combining `:-soup-contains()` and `:-soup-contains-own()`.
- **FIX**: Cache resolved directionality when matching `:dir()` to avoid quadratic time on deeply nested
`dir="auto"` elements.
- **FIX**: Fix `auto` handling in regard to `:dir()` selector. When an element with `dir="auto"` (or a `<bdi>`)
contains no strong direction characters, it should be assumed as left-to-right and not assume the direction of the
parent.
- **FIX**: Match numeric input ranges correctly when values or bounds use scientific notation.
- **FIX**: Fix `:in-range` and `:out-of-range` raising `ValueError` for `week` inputs whose week-year is 10000 or
greater.
- **FIX**: Fix `:nth-last-child(an+b of S)` matching the wrong elements when the first sibling tested does not
match `S`.
- **FIX**: `escape()` now only leaves non-ASCII identifier code points unescaped, as defined by the CSS specification.
All other non-ASCII characters are escaped.
- **FIX**: Allow unescaped U+0080 - U+009F characters in identifiers to match browser behavior.
- **FIX**: Fix `:in-range` and `:out-of-range` treating `time` and `datetime-local` values with seconds as
invalid.
py-parse: updated to 1.22.4
1.22.4
Account for the capture groups %z adds to the generated pattern
Reject out-of-range timezone minutes
Document the extra_types conversion mapping
Fix case-sensitive am/pm and Zulu conversion under case-insensitive matching
Resolve year-less strftime formats against the current year
py-cparser: updated to 3.12
3.12
Emit one type definition for declarators that share it
raise ParseError for _Atomic applied to array or function type
Fix code generation for the _Pragma operator
Parse GNU statement expressions as primary expressions
Fix shared type declarations in switch cases
raise ParseError for typedef in a parameter declaration
Scope for loop init declarations to the loop
py-django-sql-explorer: updated to 5.3.1
5.3.1 (2026-09-24)
Security fix. The AI Assistant endpoints (/assistant/ and /assistant/history/) did not check
permissions, and table names passed to the assistant were not validated before being used to sample rows. The
endpoints now require EXPLORER_PERMISSION_CHANGE, and only tables present in the connection's schema (respecting
EXPLORER_SCHEMA_INCLUDE_TABLE_PREFIXES / EXPLORER_SCHEMA_EXCLUDE_TABLE_PREFIXES) are sampled. All users of
4.1 and later are encouraged to upgrade.
UI improvements:
A download button in the preview pane exports the displayed results as CSV
Fixed the assistant controls floating incorrectly while a response is being generated
Show/Hide Schema is now a single toggle button.
Table descriptions are no longer truncated in the table description list.
The email CSV endpoint no longer requires the X-Requested-With header, and returns a 400 if no email
address is provided.
py-django-mptt: updated to 0.20.0
0.20 (2026-10-20)
DraggableMPTTAdmin now uses Script(src, **attrs) instead of the deprecated JS(src, {...}) form of django-js-asset, and requires django-js-asset>=4.0.
py-django-js-asset: updated to 4.2.0
4.2 (2026-09-24)
- ``ImportMap`` now copies the data it is given, so changing the original dict
no longer changes the import map (and its hash).
- Deprecated ``ImportMap.update()``, import maps will become immutable. Use
``map1 | map2`` or ``map1 |= map2`` instead.
- ``ImportMap.render()`` accepts ``attrs=`` like Django's
``MediaAsset.render()``. Empty import maps are falsy.
- ``JSON.render()`` accepts ``attrs=`` too. It is ignored like ``nonce=``, since
JSON data blocks are not governed by CSP.
py-django-countries: updated to 9.1.0
9.1.0 (11 September 2026)
Features
- Add Django 6.1 support. Django 4.2 remains supported for now, despite reaching
end of life in April 2026; it will be dropped in the next major release.
- Rename Nauru to Naoero, falling back to the old name's translation until
translators catch up.
py-django-treebeard: updated to 7.0.3
Treebeard 7.0.3 is a bugfix release.
Fixed some instances of nodes holding stale data after a move operation.
Fixed admin tree filters not showing all possible filter options.
Made delete() operations for MP_Node and NS_Node atomic to avoid inconsistent state if an exception was raised during deletion.
py-django-import-export: updated to 4.4.3
v4.4.3
* This release patches a denial-of-service vulnerability in :class:`~import_export.widgets.IntegerWidget`.
``IntegerWidget.clean()`` converted imported values using ``int(Decimal(value))`` with no bound on the
value's magnitude. A value written in exponent notation, such as ``1e1000000``, is cheap to parse as a
``Decimal`` but forces Python to expand every digit when converted to ``int``, a cost that grows
superlinearly with the digit count. A single such value could stall the importing process for several
seconds while pinning a CPU core, and a file containing many such rows multiplied the cost.
``IntegerWidget`` is the default widget for all integer model fields, including the ``id`` column used by
every resource that does not override ``import_id_fields``, so almost every import was affected. The stall
occurred during the initial dry run, before the confirmation step. Python's
``sys.set_int_max_str_digits()`` limit did not protect this path, as it only guards conversions between
``int`` and ``str``, not ``Decimal.__int__``.
This was an availability issue only. The resulting integers exceed the range of any standard database
[22 lines not shown]
py-django-bootstrap5: updated to 26.4
26.4 (2026-10-11)
- **Breaking:** Drop support for Python 3.10, end of life since 2026-10-01. The floor is now Python 3.11.
- **Breaking:** Remove `django_bootstrap5.text.text_concat`. It is a general string helper, not a Bootstrap concern, and nothing in the package has ever called it: its one caller joined an icon to a button label and went away when icon support was removed, before this package was forked. It was never documented. If you import it, the replacement is three lines
- Remove `BaseRenderer.get_size_class`, which nothing called. The module-level `get_size_class` in `django_bootstrap5.size` is the one in use, and the method shadowed its name inside the class body.
- Fix a `template_name` set on a `RadioSelect`, `CheckboxSelectMultiple` or `ClearableFileInput` subclass being overwritten by this package's own widget template
- Accept a non-string URL value in `css_url`, `javascript_url` and `theme_url`, so a lazy `static()` value can be used directly instead of only inside the dict form
- Recognize `week`, `search` and `color` input-type widgets as form-control widgets, so `addon_before`/`addon_after` work on them, and warn instead of silently dropping addons on a widget that cannot have them
- Add the documented `inline_field_class` setting to `BOOTSTRAP5_DEFAULTS`, where it was missing. Its effective default is unchanged.
- Store `src/django_bootstrap5/widgets.py` with LF line endings, like every other file and as `.editorconfig` requires. It was the only file in the repository with CRLF.
- Support `addon_before`/`addon_after` on fields with `layout="floating"`
- Add a system check that warns about keys in the `BOOTSTRAP5` setting that the package does not read, such as a setting removed in an earlier release or one carried over from django-bootstrap3 or django-bootstrap4 (`django_bootstrap5.W001`). Silence it with `SILENCED_SYSTEM_CHECKS` if you keep extra keys deliberately.
- Harden the release and Dependabot workflows, and write down the dependency update policy in MAINTAINING.md. The Dependabot auto-merge job gated on `github.actor`, which is spoofable in a `pull_request_target` context, and now gates on the pull request author, with `fetch-metadata` as a second check. The publishing job no longer restores a build cache, so a poisoned entry cannot reach what is uploaded to PyPI. Every job in every workflow now carries `timeout-minutes`, and `ci.yml` declares `permissions: contents: read`.
- Fail `just lint` on invisible and bidirectional control characters, which can make source read differently to a human than to the compiler (Trojan Source, CVE-2021-42574).
- Cover every statement and branch in the test suite, and hold it there with `fail_under = 100`, checked by a `coverage report` step in CI. Until that step existed the floor was set but never run.
- Fail the CI gate when any job fails, not only the test matrix. A failing docs or packaging build could previously be merged.
- Test on Python 3.15 against Django 6.1 and `main`. The job is non-blocking and 3.15 is not advertised as supported, because no Django release claims it yet.
[10 lines not shown]
py-asgiref: updated to 3.13.0
3.13.0 (2026-10-23)
* It is now possible to nest ``ThreadSensitiveContext`` by providing an
explicit ``executor`` for thread-sensitive tasks. This enables moving a block
of such work away from the parent context's shared worker.
The provided executor must run work sequentially and on a single thread, as
per ``ThreadPoolExecutor(max_workers=1)``, and the calling code is
responsible for managing the executor's lifecycle.
See the README for more details.
* ``Local`` attribute access is now 2-3x faster. ``Local(...)`` now uses one
of two internal specialisations, selected by ``thread_critical``, instead of
checking the mode on every access.
As a result ``Local`` is now marked ``@final`` and raises ``TypeError`` if
[9 lines not shown]
py-pyvcd: updated to 0.5.1
pyvcd-0.5.1 (2026-10-19)
* fix: declare the total bit width for aliases of compound vector variables
* fix: write `realtime`, `shortreal`, and `real_parameter` variable values as
real numbers. `realtime` values were previously written in binary, e.g.
``b1`` instead of ``r1``, and fractional values were rejected
* feat: default sizes for `shortreal` (32) and `real_parameter` (64)
variables
py-evalidate: updated to 2.1.6
2.1.5
Few more checks added to EvalModel.security_check(), including .format() and .format_map(), Thanks to Nagizaaz Shaik
.security_check() and .expr() now methods of EvalModel (backward-compatible).
README.md updated
py-websockets: updated to 17.3
17.3
Improvements
Tested compatibility with uvloop in the :mod:`asyncio` implementation.
Used non-blocking reads in the :mod:`threading` implementation. Depending on platforms, this can make connection termination more reliable.
Bug fixes
Fixed a crash when authenticating client connections with HTTP Basic Authentication using non-ASCII credentials.
Fixed a race condition between receiving the next frame of a fragmented message and canceling :meth:`~asyncio.connection.Connection.recv`.
