From b919e9d9d055b0fda877104ae9a7213c5297c0b3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 10 Jan 2026 23:20:26 +0000 Subject: [PATCH 1/5] Bump pathspec from 1.0.2 to 1.0.3 (#11946) Bumps [pathspec](https://github.com/cpburnz/python-pathspec) from 1.0.2 to 1.0.3.
Release notes

Sourced from pathspec's releases.

v1.0.3

Release v1.0.3. See CHANGES.rst.

Changelog

Sourced from pathspec's changelog.

1.0.3 (2026-01-09)

Bug fixes:

.. _Issue [#101](https://github.com/cpburnz/python-pathspec/issues/101): cpburnz/python-pathspec#101 .. _Issue [#102](https://github.com/cpburnz/python-pathspec/issues/102): cpburnz/python-pathspec#102

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pathspec&package-manager=pip&previous-version=1.0.2&new-version=1.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/test-common.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test.txt | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index a28f82a959e..46a626797ba 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -130,7 +130,7 @@ packaging==25.0 # pytest # sphinx # wheel -pathspec==1.0.2 +pathspec==1.0.3 # via mypy pip-tools==7.5.2 # via -r requirements/dev.in diff --git a/requirements/dev.txt b/requirements/dev.txt index bfebee41c38..1b48b1be4df 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -127,7 +127,7 @@ packaging==25.0 # pytest # sphinx # wheel -pathspec==1.0.2 +pathspec==1.0.3 # via mypy pip-tools==7.5.2 # via -r requirements/dev.in diff --git a/requirements/lint.txt b/requirements/lint.txt index 168b923d67b..3f1c518eb99 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -57,7 +57,7 @@ nodeenv==1.10.0 # via pre-commit packaging==25.0 # via pytest -pathspec==1.0.2 +pathspec==1.0.3 # via mypy platformdirs==4.5.1 # via virtualenv diff --git a/requirements/test-common.txt b/requirements/test-common.txt index ff2632f60f2..bb812c3c718 100644 --- a/requirements/test-common.txt +++ b/requirements/test-common.txt @@ -46,7 +46,7 @@ mypy-extensions==1.1.0 # via mypy packaging==25.0 # via pytest -pathspec==1.0.2 +pathspec==1.0.3 # via mypy pkgconfig==1.5.5 # via -r requirements/test-common.in diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index f31e1a21888..7ec284dc5dc 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -73,7 +73,7 @@ packaging==25.0 # via # gunicorn # pytest -pathspec==1.0.2 +pathspec==1.0.3 # via mypy pkgconfig==1.5.5 # via -r requirements/test-common.in diff --git a/requirements/test.txt b/requirements/test.txt index c41462056bd..72d145f4543 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -73,7 +73,7 @@ packaging==25.0 # via # gunicorn # pytest -pathspec==1.0.2 +pathspec==1.0.3 # via mypy pkgconfig==1.5.5 # via -r requirements/test-common.in From 3d074717b9790a011c8a5a22a8ed0b19177824da Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 10 Jan 2026 23:45:53 +0000 Subject: [PATCH 2/5] Bump aiodns from 3.6.1 to 4.0.0 (#11945) Bumps [aiodns](https://github.com/saghul/aiodns) from 3.6.1 to 4.0.0.
Changelog

Sourced from aiodns's changelog.

4.0.0

  • Breaking change: Requires pycares >= 5.0.0
  • Added new query_dns() method returning native pycares 5.x DNSResult types
  • Deprecated query() method - still works with backward-compatible result types
  • Deprecated gethostbyname() method - use getaddrinfo() instead
  • Added compatibility layer for pycares 4.x result types to ease migration
  • Updated dependencies
    • Bumped pycares from 4.11.0 to 5.0.1 (#220)
    • Bumped pytest from 8.4.2 to 9.0.2 (#224)
    • Bumped pytest-asyncio from 1.2.0 to 1.3.0 (#223)
    • Bumped mypy from 1.19.0 to 1.19.1 (#219)
    • Bumped winloop from 0.3.1 to 0.4.0 (#210)
    • Bumped actions/upload-artifact from 5 to 6 (#222)
    • Bumped actions/download-artifact from 6.0.0 to 7.0.0 (#221)
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiodns&package-manager=pip&previous-version=3.6.1&new-version=4.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
--------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: J. Nick Koston --- aiohttp/resolver.py | 7 +++---- requirements/base-ft.txt | 4 ++-- requirements/base.txt | 4 ++-- requirements/constraints.txt | 4 ++-- requirements/dev.txt | 4 ++-- requirements/lint.txt | 4 ++-- requirements/runtime-deps.txt | 4 ++-- requirements/test-ft.txt | 4 ++-- requirements/test.txt | 4 ++-- 9 files changed, 19 insertions(+), 20 deletions(-) diff --git a/aiohttp/resolver.py b/aiohttp/resolver.py index 8840a1ca3e1..d29ffff1d95 100644 --- a/aiohttp/resolver.py +++ b/aiohttp/resolver.py @@ -118,8 +118,7 @@ async def resolve( hosts: list[ResolveResult] = [] for node in resp.nodes: address: tuple[bytes, int] | tuple[bytes, int, int, int] = node.addr - family = node.family - if family == socket.AF_INET6: + if node.family == socket.AF_INET6: if len(address) > 3 and address[3]: # This is essential for link-local IPv6 addresses. # LL IPv6 is a VERY rare case. Strictly speaking, we should use @@ -133,7 +132,7 @@ async def resolve( resolved_host = address[0].decode("ascii") port = address[1] else: # IPv4 - assert family == socket.AF_INET + assert node.family == socket.AF_INET resolved_host = address[0].decode("ascii") port = address[1] hosts.append( @@ -141,7 +140,7 @@ async def resolve( hostname=host, host=resolved_host, port=port, - family=family, + family=node.family, proto=0, flags=_NUMERIC_SOCKET_FLAGS, ) diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt index a9346182f20..f702a7cf0bd 100644 --- a/requirements/base-ft.txt +++ b/requirements/base-ft.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/base-ft.txt --strip-extras requirements/base-ft.in # -aiodns==3.6.1 +aiodns==4.0.0 # via -r requirements/runtime-deps.in aiohappyeyeballs==2.6.1 # via -r requirements/runtime-deps.in @@ -36,7 +36,7 @@ propcache==0.4.1 # via # -r requirements/runtime-deps.in # yarl -pycares==4.11.0 +pycares==5.0.1 # via aiodns pycparser==2.23 # via cffi diff --git a/requirements/base.txt b/requirements/base.txt index cbf92ac9b66..94528a3f74a 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/base.txt --strip-extras requirements/base.in # -aiodns==3.6.1 +aiodns==4.0.0 # via -r requirements/runtime-deps.in aiohappyeyeballs==2.6.1 # via -r requirements/runtime-deps.in @@ -36,7 +36,7 @@ propcache==0.4.1 # via # -r requirements/runtime-deps.in # yarl -pycares==4.11.0 +pycares==5.0.1 # via aiodns pycparser==2.23 # via cffi diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 46a626797ba..8a7330d8c2f 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/constraints.txt --strip-extras requirements/constraints.in # -aiodns==3.6.1 +aiodns==4.0.0 # via # -r requirements/lint.in # -r requirements/runtime-deps.in @@ -152,7 +152,7 @@ proxy-py==2.4.10 # via # -r requirements/lint.in # -r requirements/test-common.in -pycares==4.11.0 +pycares==5.0.1 # via aiodns pycparser==2.23 # via cffi diff --git a/requirements/dev.txt b/requirements/dev.txt index 1b48b1be4df..4ddefc54719 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/dev.txt --strip-extras requirements/dev.in # -aiodns==3.6.1 +aiodns==4.0.0 # via # -r requirements/lint.in # -r requirements/runtime-deps.in @@ -149,7 +149,7 @@ proxy-py==2.4.10 # via # -r requirements/lint.in # -r requirements/test-common.in -pycares==4.11.0 +pycares==5.0.1 # via aiodns pycparser==2.23 # via cffi diff --git a/requirements/lint.txt b/requirements/lint.txt index 3f1c518eb99..3903809e999 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/lint.txt --strip-extras requirements/lint.in # -aiodns==3.6.1 +aiodns==4.0.0 # via -r requirements/lint.in annotated-types==0.7.0 # via pydantic @@ -67,7 +67,7 @@ pre-commit==4.5.1 # via -r requirements/lint.in proxy-py==2.4.10 # via -r requirements/lint.in -pycares==4.11.0 +pycares==5.0.1 # via aiodns pycparser==2.23 # via cffi diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt index eb0434c07bc..b2a455559ce 100644 --- a/requirements/runtime-deps.txt +++ b/requirements/runtime-deps.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/runtime-deps.txt --strip-extras requirements/runtime-deps.in # -aiodns==3.6.1 +aiodns==4.0.0 # via -r requirements/runtime-deps.in aiohappyeyeballs==2.6.1 # via -r requirements/runtime-deps.in @@ -32,7 +32,7 @@ propcache==0.4.1 # via # -r requirements/runtime-deps.in # yarl -pycares==4.11.0 +pycares==5.0.1 # via aiodns pycparser==2.23 # via cffi diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index 7ec284dc5dc..ebffb307670 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/test-ft.txt --strip-extras requirements/test-ft.in # -aiodns==3.6.1 +aiodns==4.0.0 # via -r requirements/runtime-deps.in aiohappyeyeballs==2.6.1 # via -r requirements/runtime-deps.in @@ -87,7 +87,7 @@ propcache==0.4.1 # yarl proxy-py==2.4.10 # via -r requirements/test-common.in -pycares==4.11.0 +pycares==5.0.1 # via aiodns pycparser==2.23 # via cffi diff --git a/requirements/test.txt b/requirements/test.txt index 72d145f4543..0f18ecb5362 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/test.txt --strip-extras requirements/test.in # -aiodns==3.6.1 +aiodns==4.0.0 # via -r requirements/runtime-deps.in aiohappyeyeballs==2.6.1 # via -r requirements/runtime-deps.in @@ -87,7 +87,7 @@ propcache==0.4.1 # yarl proxy-py==2.4.10 # via -r requirements/test-common.in -pycares==4.11.0 +pycares==5.0.1 # via aiodns pycparser==2.23 # via cffi From e306f5e0ad4bd3702b9241345cebfe85819e63d2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 10 Jan 2026 23:51:15 +0000 Subject: [PATCH 3/5] Bump python-on-whales from 0.79.0 to 0.80.0 (#11948) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [python-on-whales](https://github.com/gabrieldemarmiesse/python-on-whales) from 0.79.0 to 0.80.0.
Release notes

Sourced from python-on-whales's releases.

v0.80.0

What's Changed

New Contributors

Full Changelog: https://github.com/gabrieldemarmiesse/python-on-whales/compare/v0.79.0...v0.80.0

Commits
  • ee87a94 Bump version to 0.80.0
  • 12efa46 Add support for --metadata-file option with buildx bake (#693)
  • 6dfcce4 Add --service-ports flag to compose.run (#701)
  • fde7e12 Use the trusted publisher system of pypi (#702)
  • 511ca73 Add another test for buildx secrets (#651)
  • 5c697f9 fix: missing ipam_config in NetworkInspectResult (#700)
  • 6423af2 Add unconditional debug level logging (#696)
  • 30068c8 Add --with-dependencies to compose build (#694)
  • dd061b3 Add 'pull' argument to compose.create (#691)
  • 1c681d7 feat: add support for buildx create --annotations flag (#690)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python-on-whales&package-manager=pip&previous-version=0.79.0&new-version=0.80.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/test-common.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test.txt | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 8a7330d8c2f..0e7855fe3c9 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -193,7 +193,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-on-whales==0.79.0 +python-on-whales==0.80.0 # via # -r requirements/lint.in # -r requirements/test-common.in diff --git a/requirements/dev.txt b/requirements/dev.txt index 4ddefc54719..0361468c122 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -188,7 +188,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-on-whales==0.79.0 +python-on-whales==0.80.0 # via # -r requirements/lint.in # -r requirements/test-common.in diff --git a/requirements/lint.txt b/requirements/lint.txt index 3903809e999..703a2bb4757 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -90,7 +90,7 @@ pytest-mock==3.15.1 # via -r requirements/lint.in python-dateutil==2.9.0.post0 # via freezegun -python-on-whales==0.79.0 +python-on-whales==0.80.0 # via -r requirements/lint.in pyyaml==6.0.3 # via pre-commit diff --git a/requirements/test-common.txt b/requirements/test-common.txt index bb812c3c718..7ebd1418502 100644 --- a/requirements/test-common.txt +++ b/requirements/test-common.txt @@ -83,7 +83,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-on-whales==0.79.0 +python-on-whales==0.80.0 # via -r requirements/test-common.in rich==14.2.0 # via pytest-codspeed diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index ebffb307670..f8f2bf5db44 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -116,7 +116,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-on-whales==0.79.0 +python-on-whales==0.80.0 # via -r requirements/test-common.in rich==14.2.0 # via pytest-codspeed diff --git a/requirements/test.txt b/requirements/test.txt index 0f18ecb5362..6215d3e8d28 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -116,7 +116,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-on-whales==0.79.0 +python-on-whales==0.80.0 # via -r requirements/test-common.in rich==14.2.0 # via pytest-codspeed From 7a7f7af0ca84c4e89e8c6b2e8286175a50b96d89 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 11 Jan 2026 00:15:40 +0000 Subject: [PATCH 4/5] Bump filelock from 3.20.2 to 3.20.3 (#11954) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.20.2 to 3.20.3.
Release notes

Sourced from filelock's releases.

3.20.3

What's Changed

Full Changelog: https://github.com/tox-dev/filelock/compare/3.20.2...3.20.3

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=pip&previous-version=3.20.2&new-version=3.20.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 0e7855fe3c9..95647942b31 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -69,7 +69,7 @@ exceptiongroup==1.3.1 # via pytest execnet==2.1.2 # via pytest-xdist -filelock==3.20.2 +filelock==3.20.3 # via virtualenv forbiddenfruit==0.1.4 # via blockbuster diff --git a/requirements/dev.txt b/requirements/dev.txt index 0361468c122..6aa1b1697fc 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -67,7 +67,7 @@ exceptiongroup==1.3.1 # via pytest execnet==2.1.2 # via pytest-xdist -filelock==3.20.2 +filelock==3.20.3 # via virtualenv forbiddenfruit==0.1.4 # via blockbuster diff --git a/requirements/lint.txt b/requirements/lint.txt index 703a2bb4757..804fb9072ad 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -29,7 +29,7 @@ distlib==0.4.0 # via virtualenv exceptiongroup==1.3.1 # via pytest -filelock==3.20.2 +filelock==3.20.3 # via virtualenv forbiddenfruit==0.1.4 # via blockbuster From de258a16823377ec9040e8daff06b328254cf71f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 11 Jan 2026 00:35:46 +0000 Subject: [PATCH 5/5] Bump virtualenv from 20.36.0 to 20.36.1 (#11951) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [virtualenv](https://github.com/pypa/virtualenv) from 20.36.0 to 20.36.1.
Release notes

Sourced from virtualenv's releases.

20.36.1

What's Changed

Full Changelog: https://github.com/pypa/virtualenv/compare/20.36.0...20.36.1

Changelog

Sourced from virtualenv's changelog.

v20.36.1 (2026-01-09)

Bugfixes - 20.36.1

- Fix TOCTOU vulnerabilities in app_data and lock directory
creation that could be exploited via symlink attacks - reported by
:user:`tsigouris007`, fixed by :user:`gaborbernat`. (:issue:`3013`)
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=virtualenv&package-manager=pip&previous-version=20.36.0&new-version=20.36.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 95647942b31..37a06e28ec4 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -275,7 +275,7 @@ uvloop==0.21.0 ; platform_system != "Windows" # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==20.36.0 +virtualenv==20.36.1 # via pre-commit wait-for-it==2.3.0 # via -r requirements/test-common.in diff --git a/requirements/dev.txt b/requirements/dev.txt index 6aa1b1697fc..caec288a434 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -265,7 +265,7 @@ uvloop==0.21.0 ; platform_system != "Windows" and implementation_name == "cpytho # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==20.36.0 +virtualenv==20.36.1 # via pre-commit wait-for-it==2.3.0 # via -r requirements/test-common.in diff --git a/requirements/lint.txt b/requirements/lint.txt index 804fb9072ad..3c6a87dc9e4 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -123,7 +123,7 @@ uvloop==0.21.0 ; platform_system != "Windows" # via -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==20.36.0 +virtualenv==20.36.1 # via pre-commit zlib-ng==1.0.0 # via -r requirements/lint.in