py-falcon: updated to 4.3.1
4.3.1
This is a :ref:`SemVer <semver>` patch release that makes Falcon's own test
suite compatible with the recently released ``cbor2`` 6.x series.
Documentation and tests aside, this release is functionally identical to
:doc:`Falcon 4.3.0 <4.3.0>`.
py-cairosvg: updated to 2.9.1
2.9.1
WARNING: this is a security update.
Specially crafted SVGs with very long paths could lead to exponential rendering times.
Support path-like objects for the url parameter
Fix support of Windows paths
py-pandas-datareader: updated to 0.11.1
v0.11.0 (June 2026)
Highlights include:
- Restored import and runtime compatibility with pandas 3 by removing the
dependency on pandas internal decorator APIs.
- Vendored ``deprecate_kwarg`` to remove dependency on the private
``pandas.util._decorators`` module.
- Fixed default date sanitization on pandas 3, where ``to_datetime(None)``
now yields ``NaT`` instead of preserving ``None``.
- Added a new high-level ``pandas_datareader.macro`` API providing unified
access to FRED, Eurostat, and OECD macro datasets via ``read_macro``,
``search_macro_datasets``, and ``describe_macro_dataset``.
- Narrowed the default public API surface to focus on macro and widely-used
data sources; securities-related readers that relied on defunct or broken
upstream APIs have been removed.
- Added import smoke coverage and explicit pandas 3 CI lanes.
py-h5py: updated to 3.16.0
What's new in h5py 3.16
New features
* Pre-built packages on PyPI are now built with HDF5 2.0
* h5py now marks itself compatible with free-threading Python.
There are tests for this
bugs. Be cautious about relying on this in critical code.
* Support for storing NumPy complex numbers in HDF5 files using C99 complex
number datatypes
or above, so long as the compiler and the build platform implement the relevant
C99 features.
h5py will still convert NumPy complex numbers into an HDF5 compound datatype
by default, preserving the behaviour from earlier versions. See
:ref:`complex_dtypes` for how to use the new datatypes.
* New attributes :attr:`~.Dataset.filter_ids` and :attr:`~.Dataset.filter_names`
to provide more precise information on the filters set up for a dataset
[37 lines not shown]
py-python-socks: updated to 3.0.0
3.0.0
Breaking Changes
Drop Python 3.8 support: The minimum required Python version is now 3.9+.
Remove Curio support: The curio asynchronous backend has been completely removed.
Change AnyIO Proxy.connect return type: The connect method now returns a native anyio.abc.SocketStream instead of a custom wrapper.
Features
Add proxy chaining support: Introduced an optional forward parameter to the __init__ method of all Proxy classes to enable chaining.
Refactoring & Clean Up
Remove deprecated proxy chains: Deleted the legacy, deprecated implementation of proxy chaining.
Typing & Quality
[2 lines not shown]
py-selenium: updated to 4.48.0
Selenium 4.48.0
* Support CDP versions: v150, v151, v152
* fix W3C capabilities built from a list of options (create_matches)
* generate the internal BiDi protocol layer from the shared binding-neutral schema
* update new BiDi layer generation to conform to latest proposed ADR
Selenium 4.47.0
* Support CDP versions: v149, v150, v151
* Fix default command_executor URL in RemoteWebDriver docstring
* [grid] honor client-advertised se:remoteUrl for reachable BiDi/CDP/VNC URLs
* prevent CDP access with Firefox
* pass --enable-chrome-logs unless CHROME_LOG_FILE is set
* accept By in find_element/find_elements type hints
* fix no_proxy matching so empty entries and substrings do not bypass the proxy
* Ensure driver service subprocess resources are cleaned up
devel/tokei: update to 15.0.0
Added
Added C3 programming language. (#1319)
Other
Add support for Godot TextScene(tscn)
Update strum/strum_macros to 0.28.0
Bump toml from 0.8 to 0.9 (#1346)
Add Laravel Blade language support (#1353)
Add Djot language support in languages.json (#1321)
Update strum/strum_macros to 0.27.2 (#1316)
py-rich-click: updated to 1.9.9
1.9.9
Fixed ctx.forward() not working with commands patched via rich_click.patch()
Added support for Click 8.5 (resolved DeprecationWarnings)
geography/mapserver: Update to 8.6.6
This release contains multiple security fixes, for issues that are
surely not all listed in pkg-vulnerabilities.
Upstream NEWS (misplaced in HISTORY.md), less non-NEWS content:
8.6.6 release (2026-09-06)
--------------------------
8.6.5 release (2026-07-10)
--------------------------
yara: updated to 4.5.8
4.5.8
Document the YR_RE_SCAN_LIMIT regular expression scan limit
BUGFIX: Bound rule table index in OP_PUSH_RULE and OP_INIT_RULE
BUGFIX: Bound tilde stream row-count read in dotnet module
BUGFIX: Bound repeat stack depth in _yr_re_fiber_sync
BUGFIX: Fix memory leak in yr_rules_load_stream (e13acd3).
BUGFIX: Add missing yr_le16toh byte-swapping in pe module (a2ff0db).
BUGFIX: Validate summary counts in yr_rules_from_arena
BUGFIX: Cast e_lfanew to int32_t before sign check in pe_get_header
BUGFIX: Bound export name count against 32-bit overflow in pe_parse_exports
BUGFIX: Null-terminate authenticode digest/thumbprint hex buffers in pe module
BUGFIX: Fix string memory leak in CLI args_free
BUGFIX: Honor -w/--no-warnings for the file-too-large skip message in CLI
BUGFIX: Avoid pointer wrap for large index in str_table_entry
BUGFIX: Bound iterator item count against value stack depth in yr_execute_code
BUGFIX: Byte-swap sh_entry_count in ELF symtab/dynsym link check
[14 lines not shown]
py-ruff: updated to 0.16.6
0.16.6
Preview features
Move pytest-fixture-autouse to the restriction category
[flake8-pytest-style] Add an autofix for PT020
[flake8-tidy-imports] Prevent fix loop between TID254 and TID255
[isort] Exclude pragma comments from line length calculation (I001)
Bug fixes
Validate unary expressions when parsing
[flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514)
[flake8-bugbear] Fix panic on match subjects (B031)
[flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901)
[flake8-pytest-style] Avoid duplicate PT017 diagnostics
[ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102)
[15 lines not shown]
redis: Replace interpreter for scripts/build.sh.
Despite a comment at the top of the script saying it is designed for POSIX
sh, it uses the non-portable 'local' keyword.
