Deps: Bump the python-packages group with 8 updates

[dependabot]

Bumps the python-packages group with 8 updates:

Package	From	To
django	5.2.16	5.2.17
djangorestframework	3.17.1	3.17.2
pytest-django	4.12.0	4.13.0
cffi	2.1.0	2.1.1
coverage	7.15.2	7.15.4
h2	4.4.0	4.4.1
packaging	26.2	26.3
shtab	1.8.2	1.9.3

Updates django from 5.2.16 to 5.2.17

Commits

• e802ada [5.2.x] Bumped version for 5.2.17 release.
• b9adb81 [5.2.x] Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before...
• ba80833 [5.2.x] Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry c...
• c72a5db [5.2.x] Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language().
• 115ffd0 [5.2.x] Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial l...
• ec5ced4 [5.2.x] Fixed #36770 -- Fixed incomplete mocking in SQLiteInMemoryTestDbs.
• 02369b5 [5.2.x] Allowed the full Python test matrix to run on GitHub Actions.
• 686072f [5.2.x] Added stub release notes and release date for 5.2.17.
• cd5ad8c [5.2.x] Bumped minimum setuptools version to 83.
• 3e389b7 [5.2.x] Closed temporary files in GDALRasterTests.
• Additional commits viewable in compare view

Updates djangorestframework from 3.17.1 to 3.17.2

Release notes

Sourced from djangorestframework's releases.

3.17.2

What's Changed

Bug fixes

• Fix disclosure of GET-protected data in case of validation error with AdminRenderer by @​browniebroke in encode/django-rest-framework#10012. Thanks, @​zainnadeem786 for the report.
• Enforce DATA_UPLOAD_MAX_MEMORY_SIZE for request.data parsing by @​zainnadeem786 in encode/django-rest-framework#10013. Thanks, @​zainnadeem786 for the report.

Full Changelog: encode/django-rest-framework@3.17.1...3.17.2

Commits

• ad309f3 Release 3.17.2 (#10014)
• 2912dc9 Enforce DATA_UPLOAD_MAX_MEMORY_SIZE for request.data parsing (#10013)
• 71f8194 Fix disclosure of GET-protected data in case of validation error with `AdminR...
• See full diff in compare view

Updates pytest-django from 4.12.0 to 4.13.0

Release notes

Sourced from pytest-django's releases.

v4.13.0

https://pytest-django.readthedocs.io/en/latest/changelog.html#v4-13-0-2026-08-06

Changelog

Sourced from pytest-django's changelog.

v4.13.0 (2026-08-06)

Compatibility ^^^^^^^^^^^^^

• Dropped support for Django 4.2 and 5.1.

Improvements ^^^^^^^^^^^^

• Export pytest_django.Settings from the top-level pytest_django module so the :fixture:settings fixture can be type-annotated ([#1257](https://github.com/pytest-dev/pytest-django/issues/1257) <https://github.com/pytest-dev/pytest-django/issues/1257>__).

Bugfixes ^^^^^^^^

• Fixed type hints of assert methods to match actual signature (PR [#1271](https://github.com/pytest-dev/pytest-django/issues/1271) <https://github.com/pytest-dev/pytest-django/pull/1271>__)
• Handled Django 6.2's ImproperlyConfigured (in addition to ImportError) when the configured DJANGO_SETTINGS_MODULE cannot be imported, so pytest-django still shows its guidance message.
• Fixed django_db(transaction=True) tests being set up twice, which repeated the serialized_rollback restore and the fixtures load, and sent setting_changed and post_migrate twice when available_apps is set.
• Fixed --help/--version failing with AppRegistryNotReady (surfaced as a could not load initial conftests warning) when a conftest.py imports Django models at the top level. Django is now set up even when --help/--version are passed, before the initial conftests are loaded for these options ([#1152](https://github.com/pytest-dev/pytest-django/issues/1152) <https://github.com/pytest-dev/pytest-django/issues/1152>__).

Commits

• dc8d17d Release 4.13.0
• 6cfcfbd fixtures: explain a bit more in Settings docstring
• 3478bd7 Minor typing improvements
• faa443b Fix --help/--version when a conftest imports Django models
• fb4417f plugin: add missing type annotation for non_debugging_runtest
• f151858 Remove useless test test_change_settings to simplify (#1302)
• 1a5fdab Removes django-upgrade dependency (#1301)
• 17f1dec asserts: move type annotations to an asserts.pyi stubs file
• 0ca15e7 editorconfig-checker: add .venv to Exclude
• 68334fd Add django-upgrade dependency (#1298)
• Additional commits viewable in compare view

Updates cffi from 2.1.0 to 2.1.1

Release notes

Sourced from cffi's releases.

v2.1.1

What's Changed

• Minimize internal Python API usage for interpreter and thread state sampling where possible. Avoids breaking ABI change in Python >= 3.15.0b4 (python-cffi/cffi#269).

Full Changelog: python-cffi/cffi@v2.1.0...v2.1.1

Commits

• fd33e77 New release 2.1.1
• 56a7876 Use PyGILState_Ensure to avoid accessing CPython internals (#269) (#270)
• See full diff in compare view

Updates coverage from 7.15.2 to 7.15.4

Release notes

Sourced from coverage's releases.

7.15.4

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
• Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.
• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️  PyPI page: coverage 7.15.3. :arrow_right:  To install: python3 -m pip install coverage==7.15.3

Changelog

Sourced from coverage's changelog.

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn't escaped where it's dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare <pull 2227_>_.

• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare <pull 2226_>_.

• Wheels are now provided for Python 3.15.

.. _pull 2226: coveragepy/coveragepy#2226 .. _pull 2227: coveragepy/coveragepy#2227

.. _changes_7-15-3:

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>. Closes issue 2200.

• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios <pull 2239_>_.

• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: coveragepy/coveragepy#2200 .. _pull 2234: coveragepy/coveragepy#2234 .. _pull 2239: coveragepy/coveragepy#2239 .. _pull 2240: coveragepy/coveragepy#2240

.. _changes_7-15-2:

Commits

• 4c0e7ff docs: sample HTML for 7.15.4
• db4cc32 docs: prep for 7.15.4
• c33085c style: start gradual move to ruff 0.16
• 53a0fd5 fix: neutralize control characters in lcov report fields (#2226)
• b64d53d build: make 3.15 wheels
• 53792ab build: show the python version for kits
• f6b03c7 chore: make upgrade_one package=cibuildwheel
• d9b660a chore: make upgrade
• b128a31 docs: oops, move this entry to the correct place
• a7a2c15 fix: escape filename urls in html report href attributes (#2227)
• Additional commits viewable in compare view

Updates h2 from 4.4.0 to 4.4.1

Changelog

Sourced from h2's changelog.

4.4.1 (2026-08-03)

Bugfixes

• Performance improvement: remove consumed frames in-place from data buffer.
• Reject duplicate Host headers in request headers. Thanks to Sunand Mohan for the report.

Commits

• bc239af v4.4.1
• 92b925e add test for duplicate host headers
• 292a408 reject duplicate Host headers in request headers
• 04d3b87 update changelog
• 439b970 prepare for next release cycle
• 9a7ff74 performance: remove consumed frames in place from data buffer (#1321)
• See full diff in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates shtab from 1.8.2 to 1.9.3

Release notes

Sourced from shtab's releases.

shtab v1.9.3 stable

• ⚒️ misc tcsh improvements & fixes (#213)
  • support positional completion under subcommands at any depth
  • guard against out-of-range array indexing
  • handle arguments with a custom .complete in the multi-requirement branch
  • complete --opt=<TAB> for options taking a value (nargs != 0)
  • deduplicate rules
• 🎣 fix fish backend (#232)
  • fix option values breaking subcommands (#228)
  • fix argument values conflicting with command names (#229)
  • handle positional order (#230)
  • fix FILE missing filenames & options unintentionally completing filenames (#227)
• 🐟 fix fish descriptions (#233 <- #231)
  • expand argparse placeholders (e.g. %(prog)s)
  • subcommand help fallback if description missing
• 🛠️ misc refactoring (#238)
  • tests debug output: minor bytes/str fix
  • inline some single-use functions
• 🗜️ tests auto-caplog (#237)
• ± tests diff examples output summary (#234)
• 🌐 update docs FAQs & URLs

shtab v1.9.2 stable

• 🤦 revert to original (shtab<=1.8.1) zsh space/quote handling (#225 <- #224, #196)
• 🔪 fix more zsh edge cases
  • nargs=0 (#221 <- #215)
  • non-sequence choices (#220 <- #214)

shtab v1.9.1 stable

• 🐟 fix fish preamble (#222)
• 👾 fix bash bug (#196)
• 📚 slight docs tidy & refactor
• 🛠️ minor CI framework updates

shtab v1.9.0 stable

• 🐟 support fish shell! (#216 <- #195, #174, #134, #196)
• 🔨 fix shtab --verbose CLI behaviour (#223)
• 📚 docs: git-fame generated contributors list

Commits

• 91e3130 Merge pull request #238 from tqdm/devel
• 33d031e misc tidy
• b0a498b Merge pull request #233 from ThomasWaldmann/fix-fish-descriptions
• 4c664ea misc updates & tidy
• 5cf4ddf fish: expand argparse placeholders, fallback help
• fc7fe03 Merge pull request #237 from tqdm/tests-auto-caplog
• d892b3f tests: auto-caplog
• 79536de Merge pull request #232 from ThomasWaldmann/fix-fish-backend
• d59f615 CI: update fish>=4
• e885d27 fish: drop Choice support, misc tidy
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
django	[>= 3.a, < 4]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.