Skip to content

build(deps): bump the uv group across 3 directories with 3 updates - #1475

Merged
benoit-cty merged 1 commit into
masterfrom
dependabot/uv/uv-ae789d73bc
Nov 1, 2026
Merged

build(deps): bump the uv group across 3 directories with 3 updates#1475
benoit-cty merged 1 commit into
masterfrom
dependabot/uv/uv-ae789d73bc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 2 updates in the / directory: authlib and joserfc.
Bumps the uv group with 3 updates in the /carbonserver directory: authlib, joserfc and dnspython.
Bumps the uv group with 3 updates in the /requirements directory: authlib, joserfc and dnspython.

Updates authlib from 1.7.2 to 1.9.1

Release notes

Sourced from authlib's releases.

v1.9.1

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

Full Changelog: authlib/authlib@v1.9.0...v1.9.1

v1.9.0

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.8.0...v1.9.0

v1.8.0

What's Changed

... (truncated)

Commits
  • 46b9487 chore: release 1.9.1
  • abb3f49 docs: use the issuer identifier as ID-JAG audience and fix broken links
  • 1bd2a31 Merge commit from fork
  • 311da11 docs: more detailed PKCE instructions
  • 873f72c docs: rpinitiated instructions
  • 4ff30db Merge commit from fork
  • 9a86ff3 docs: rpinitiated sequence chart
  • 1c35757 docs: RFC 9101 sequence chart
  • a755e28 docs: add a sequence diagram to the token introspection page
  • 1996c56 docs: PKCE flow chart illustration
  • Additional commits viewable in compare view

Updates joserfc from 1.7.0 to 1.7.6

Release notes

Sourced from joserfc's releases.

1.7.6

   🐞 Bug Fixes

    View changes on GitHub

1.7.5

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

1.7.4

   🐞 Bug Fixes

    View changes on GitHub

1.7.3

   🐞 Bug Fixes

    View changes on GitHub

1.7.2

   🐞 Bug Fixes

    View changes on GitHub

1.7.1

   🐞 Bug Fixes

... (truncated)

Changelog

Sourced from joserfc's changelog.

1.7.6

Released on October 19, 2026

  • JWE: Limit base64url-encoded additional authenticated data to 65,536 bytes before copying or decoding it in JSON serialization. Configure the limit with JWERegistry(max_aad_length=...).
  • JWT: Reject non-string jti claims, including arrays containing an expected token ID, even when no claim options are configured.
  • JWT: Report the correct claim name for invalid iss values.
  • JWS & JWE: Validate compact token size before splitting it into segments.
  • JWK: Handle key set equality comparisons with unrelated types.

1.7.5

Released on August 29, 2026

  • JWK: Ignore keys with unknown kty values when importing a key set.
  • JWE: Add max_recipients to JWERegistry.

1.7.4

Released on July 13, 2026

  • Reject JWS general JSON serialization when signatures is empty.
  • Raises DecodeError when encrypted_key is None in JWE.

1.7.3

Released on July 8, 2026

  • Add default claims validation for iss, sub and aud.
  • Add size validation even for self-provided payload.

1.7.2

Released on June 29, 2026

  • Avoid trailing padding for JWTs.

1.7.1

Released on June 8, 2026

... (truncated)

Commits
  • c54d9cc chore: release 1.7.6
  • d060c2e fix(ci): restrict default workflow token permissions
  • e93fd2b fix(jwt): require string values for jti claims
  • 25e9526 fix(jwe): limit additional authenticated data size
  • 27d7c8a fix(jwk): handle KeySet equality with unrelated types (#106)
  • 397e04f fix: validate compact value size before split
  • 8074dc7 Merge pull request #105 from janmrow/fix/jwt-iss-claim-name
  • eec6d5e fix(jwt): report correct claim name for invalid iss
  • 357c319 chore: release 1.7.5
  • d6dc8df feat: add max_recipients on JWERegistry
  • Additional commits viewable in compare view

Updates authlib from 1.7.2 to 1.9.1

Release notes

Sourced from authlib's releases.

v1.9.1

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

Full Changelog: authlib/authlib@v1.9.0...v1.9.1

v1.9.0

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.8.0...v1.9.0

v1.8.0

What's Changed

... (truncated)

Commits
  • 46b9487 chore: release 1.9.1
  • abb3f49 docs: use the issuer identifier as ID-JAG audience and fix broken links
  • 1bd2a31 Merge commit from fork
  • 311da11 docs: more detailed PKCE instructions
  • 873f72c docs: rpinitiated instructions
  • 4ff30db Merge commit from fork
  • 9a86ff3 docs: rpinitiated sequence chart
  • 1c35757 docs: RFC 9101 sequence chart
  • a755e28 docs: add a sequence diagram to the token introspection page
  • 1996c56 docs: PKCE flow chart illustration
  • Additional commits viewable in compare view

Updates joserfc from 1.7.0 to 1.7.6

Release notes

Sourced from joserfc's releases.

1.7.6

   🐞 Bug Fixes

    View changes on GitHub

1.7.5

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

1.7.4

   🐞 Bug Fixes

    View changes on GitHub

1.7.3

   🐞 Bug Fixes

    View changes on GitHub

1.7.2

   🐞 Bug Fixes

    View changes on GitHub

1.7.1

   🐞 Bug Fixes

... (truncated)

Changelog

Sourced from joserfc's changelog.

1.7.6

Released on October 19, 2026

  • JWE: Limit base64url-encoded additional authenticated data to 65,536 bytes before copying or decoding it in JSON serialization. Configure the limit with JWERegistry(max_aad_length=...).
  • JWT: Reject non-string jti claims, including arrays containing an expected token ID, even when no claim options are configured.
  • JWT: Report the correct claim name for invalid iss values.
  • JWS & JWE: Validate compact token size before splitting it into segments.
  • JWK: Handle key set equality comparisons with unrelated types.

1.7.5

Released on August 29, 2026

  • JWK: Ignore keys with unknown kty values when importing a key set.
  • JWE: Add max_recipients to JWERegistry.

1.7.4

Released on July 13, 2026

  • Reject JWS general JSON serialization when signatures is empty.
  • Raises DecodeError when encrypted_key is None in JWE.

1.7.3

Released on July 8, 2026

  • Add default claims validation for iss, sub and aud.
  • Add size validation even for self-provided payload.

1.7.2

Released on June 29, 2026

  • Avoid trailing padding for JWTs.

1.7.1

Released on June 8, 2026

... (truncated)

Commits
  • c54d9cc chore: release 1.7.6
  • d060c2e fix(ci): restrict default workflow token permissions
  • e93fd2b fix(jwt): require string values for jti claims
  • 25e9526 fix(jwe): limit additional authenticated data size
  • 27d7c8a fix(jwk): handle KeySet equality with unrelated types (#106)
  • 397e04f fix: validate compact value size before split
  • 8074dc7 Merge pull request #105 from janmrow/fix/jwt-iss-claim-name
  • eec6d5e fix(jwt): report correct claim name for invalid iss
  • 357c319 chore: release 1.7.5
  • d6dc8df feat: add max_recipients on JWERegistry
  • Additional commits viewable in compare view

Updates dnspython from 2.8.0 to 2.9.0

Release notes

Sourced from dnspython's releases.

dnspython 2.9.0

This release fixes a potential excessive CPU consumption issue. Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue.

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

Changelog

Sourced from dnspython's changelog.

2.9.0

  • Decompression chain length is limited to 16. Prior to this change, a maliciously crafted DNS message could cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications which processed untrusted DNS wire form messages with dnspython could be degraded or DoS'd by the extra CPU use required.

    Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos for finding and reporting this issue.

    See GHSA-45c3-73f7-pv4m

  • Httpx2 has replaced httpx for HTTPS TCP connections.

  • The minimum supported Python version is now 3.11.

  • DNSSEC now supports ML-DSA-44, a post-quantum signature algorithm.

  • The NSEC3 Next Hashed Owner Name in presentation format is now decoded as base32hex (RFC 5155 Section 1.3, RFC 4648 Extended Hex Alphabet). The letters W, X, Y, and Z are not in that alphabet; they used to be accepted and silently decoded to a different owner name, so to_text of the result did not match the input. They are now rejected.

  • The NID and L64 node/locator ids in presentation format are now rejected when a group contains anything other than hex digits. A sign or underscore, which int() silently accepts, produced a record whose text form did not parse back the same way (RFC 6742).

  • Rdata of a known type in the generic \# syntax, such as an NS record in a zone file, no longer fails to parse when it contains a name under the origin. Its names are relativized as in the type's own text form.

  • The SVCB and HTTPS ech parameter value must now be an ECHConfigList with a correct length prefix and at least 4 octets of content (RFC 9848, RFC 9849). The individual ECHConfig structures are not checked.

  • SVCB and HTTPS SvcParamKeys in presentation format, including those listed in mandatory, must now be spelled as RFC 9460 requires: 1-63 lowercase letters, digits, or hyphens. Uppercase keys such as ALPN and keys with underscores such as no_default_alpn are rejected.

  • SVCB and HTTPS presentation format parsing now follows the escaping rules of RFC 9460. SvcParamKeys may not contain escapes (e.g. \097lpn=h2), and in comma-separated values (alpn, docpath) only \, and \\ are valid escapes after character-string decoding (e.g. alpn="h2\\x" is rejected).

... (truncated)

Commits

Updates authlib from 1.7.2 to 1.9.1

Release notes

Sourced from authlib's releases.

v1.9.1

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

Full Changelog: authlib/authlib@v1.9.0...v1.9.1

v1.9.0

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.8.0...v1.9.0

v1.8.0

What's Changed

... (truncated)

Commits
  • 46b9487 chore: release 1.9.1
  • abb3f49 docs: use the issuer identifier as ID-JAG audience and fix broken links
  • 1bd2a31 Merge commit from fork
  • 311da11 docs: more detailed PKCE instructions
  • 873f72c docs: rpinitiated instructions
  • 4ff30db Merge commit from fork
  • 9a86ff3 docs: rpinitiated sequence chart
  • 1c35757 docs: RFC 9101 sequence chart
  • a755e28 docs: add a sequence diagram to the token introspection page
  • 1996c56 docs: PKCE flow chart illustration
  • Additional commits viewable in compare view

Updates joserfc from 1.7.0 to 1.7.6

Release notes

Sourced from joserfc's releases.

1.7.6

   🐞 Bug Fixes

    View changes on GitHub

1.7.5

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

1.7.4

   🐞 Bug Fixes

    View changes on GitHub

1.7.3

   🐞 Bug Fixes

    View changes on GitHub

1.7.2

   🐞 Bug Fixes

    View changes on GitHub

1.7.1

   🐞 Bug Fixes

... (truncated)

Changelog

Sourced from joserfc's changelog.

1.7.6

Released on October 19, 2026

  • JWE: Limit base64url-encoded additional authenticated data to 65,536 bytes before copying or decoding it in JSON serialization. Configure the limit with JWERegistry(max_aad_length=...).
  • JWT: Reject non-string jti claims, including arrays containing an expected token ID, even when no claim options are configured.
  • JWT: Report the correct claim name for invalid iss values.
  • JWS & JWE: Validate compact token size before splitting it into segments.
  • JWK: Handle key set equality comparisons with unrelated types.

1.7.5

Released on August 29, 2026

  • JWK: Ignore keys with unknown kty values when importing a key set.
  • JWE: Add max_recipients to JWERegistry.

1.7.4

Released on July 13, 2026

  • Reject JWS general JSON serialization when signatures is empty.
  • Raises DecodeError when encrypted_key is None in JWE.

1.7.3

Released on July 8, 2026

  • Add default claims validation for iss, sub and aud.
  • Add size validation even for self-provided payload.

1.7.2

Released on June 29, 2026

  • Avoid trailing padding for JWTs.

1.7.1

Released on June 8, 2026

... (truncated)

Commits
  • c54d9cc chore: release 1.7.6
  • d060c2e fix(ci): restrict default workflow token permissions
  • e93fd2b fix(jwt): require string values for jti claims
  • 25e9526 fix(jwe): limit additional authenticated data size
  • 27d7c8a fix(jwk): handle KeySet equality with unrelated types (#106)
  • 397e04f fix: validate compact value size before split
  • 8074dc7 Merge pull request #105 from janmrow/fix/jwt-iss-claim-name
  • eec6d5e fix(jwt): report correct claim name for invalid iss
  • 357c319 chore: release 1.7.5
  • d6dc8df feat: add max_recipients on JWERegistry
  • Additional commits viewable in compare view

Updates dnspython from 2.8.0 to 2.9.0

Release notes

Sourced from dnspython's releases.

dnspython 2.9.0

This release fixes a potential excessive CPU consumption issue. Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue.

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

Changelog

Sourced from dnspython's changelog.

2.9.0

  • Decompression chain length is limited to 16. Prior to this change, a maliciously crafted DNS message could cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications which processed untrusted DNS wire form messages with dnspython could be degraded or DoS'd by the extra CPU use required.

    Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos for finding and reporting this issue.

    See GHSA-45c3-73f7-pv4m

  • Httpx2 has replaced httpx for HTTPS TCP connections.

  • The minimum supported Python version is now 3.11.

  • DNSSEC now supports ML-DSA-44, a post-quantum signature algorithm.

  • The NSEC3 Next Hashed Owner Name in presentation format is now decoded as base32hex (RFC 5155 Section 1.3, RFC 4648 Extended Hex Alphabet). The letters W, X, Y, and Z are not in that alphabet; they used to be accepted and silently decoded to a different owner name, so to_text of the result did not match the input. They are now rejected.

  • The NID and L64 node/locator ids in presentation format are now rejected when a group contai...

    Description has been truncated

@dependabot
dependabot Bot requested a review from a team as a code owner November 1, 2026 13:07
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 1, 2026
@github-actions github-actions Bot added the size/L label Nov 1, 2026
@dependabot @benoit-cty
build(deps): bump the uv group across 3 directories with 3 updates
69c2ee2 
Bumps the uv group with 2 updates in the / directory: [authlib](https://github.com/authlib/authlib) and [joserfc](https://github.com/authlib/joserfc).
Bumps the uv group with 3 updates in the /carbonserver directory: [authlib](https://github.com/authlib/authlib), [joserfc](https://github.com/authlib/joserfc) and [dnspython](https://github.com/rthalley/dnspython).
Bumps the uv group with 3 updates in the /requirements directory: [authlib](https://github.com/authlib/authlib), [joserfc](https://github.com/authlib/joserfc) and [dnspython](https://github.com/rthalley/dnspython).


Updates `authlib` from 1.7.2 to 1.9.1
- [Release notes](https://github.com/authlib/authlib/releases)
- [Commits](authlib/authlib@v1.7.2...v1.9.1)

Updates `joserfc` from 1.7.0 to 1.7.6
- [Release notes](https://github.com/authlib/joserfc/releases)
- [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst)
- [Commits](authlib/joserfc@1.7.0...1.7.6)

Updates `authlib` from 1.7.2 to 1.9.1
- [Release notes](https://github.com/authlib/authlib/releases)
- [Commits](authlib/authlib@v1.7.2...v1.9.1)

Updates `joserfc` from 1.7.0 to 1.7.6
- [Release notes](https://github.com/authlib/joserfc/releases)
- [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst)
- [Commits](authlib/joserfc@1.7.0...1.7.6)

Updates `dnspython` from 2.8.0 to 2.9.0
- [Release notes](https://github.com/rthalley/dnspython/releases)
- [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst)
- [Commits](rthalley/dnspython@v2.8.0...v2.9.0)

Updates `authlib` from 1.7.2 to 1.9.1
- [Release notes](https://github.com/authlib/authlib/releases)
- [Commits](authlib/authlib@v1.7.2...v1.9.1)

Updates `joserfc` from 1.7.0 to 1.7.6
- [Release notes](https://github.com/authlib/joserfc/releases)
- [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst)
- [Commits](authlib/joserfc@1.7.0...1.7.6)

Updates `dnspython` from 2.8.0 to 2.9.0
- [Release notes](https://github.com/rthalley/dnspython/releases)
- [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst)
- [Commits](rthalley/dnspython@v2.8.0...v2.9.0)

---
updated-dependencies:
- dependency-name: authlib
  dependency-version: 1.9.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: joserfc
  dependency-version: 1.7.6
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: authlib
  dependency-version: 1.9.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: joserfc
  dependency-version: 1.7.6
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: dnspython
  dependency-version: 2.9.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: authlib
  dependency-version: 1.9.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: joserfc
  dependency-version: 1.7.6
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: dnspython
  dependency-version: 2.9.0
  dependency-type: direct:production
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@benoit-cty
benoit-cty force-pushed the dependabot/uv/uv-ae789d73bc branch from dbb5d0f to 69c2ee2 Compare November 1, 2026 13:48
@benoit-cty
benoit-cty merged commit d6baa36 into master Nov 1, 2026
14 checks passed
@benoit-cty
benoit-cty deleted the dependabot/uv/uv-ae789d73bc branch November 1, 2026 13:51
@codecov

codecov Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.67%. Comparing base (7ef62bf) to head (69c2ee2).
⚠️ Report is 9 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master    #1475   +/-   ##
=======================================
  Coverage   93.67%   93.67%           
=======================================
  Files          50       50           
  Lines        5593     5593           
=======================================
  Hits         5239     5239           
  Misses        354      354

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@benoit-cty benoit-cty benoit-cty approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code size/L

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@benoit-cty