Update all non-major dependencies - #527
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Deploying bats-ai with
|
| Latest commit: |
6a25854
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://7d0a025a.bats-ai.pages.dev |
| Branch Preview URL: | https://renovate-all-minor-patch.bats-ai.pages.dev |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
August 7, 2026 17:56
f206a39 to
ec884c8
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
11 times, most recently
from
August 15, 2026 05:03
2d8a506 to
5cc482d
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
August 21, 2026 06:10
844d33c to
29b37cf
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 24, 2026 05:07
29b37cf to
6a25854
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
10.68.0→10.70.01.18.1→1.19.0==65.18.0→==65.19.1==1.6.2→==1.6.3==3.4.0→==3.4.1==9.15.0→==9.16.13.3.0→3.4.0==2.5.1→==2.5.2==4.13.0.92→==4.14.0.94==2.66.1→==2.68.0==4.69.1→==4.70.03.5.40→3.5.413.12.11→3.13.2Release Notes
getsentry/sentry-javascript (@sentry/vue)
v10.70.0Compare Source
@sentry/node-cpu-profilerto 2.4.3 (#22992)@solidjs/routerv1 (#23163)onRequestpath (#22985)beforeSendwhile preserving session updates (#22819)meriyahissue forstandalonebuild (#23055)sourcemaps.disablewhenunstable_sentryVitePluginOptionsis set (#22966)<Routes>unmount (#22948)metricsfrom worker entry point (#23027)Internal Changes
@sentry/coredep to nextjs-16-userfeedback (#23009)sveltekit-3test (#23016)Work in this release was contributed by @davidmurdoch, @Jxxunnn, and @kamilogorek. Thank you for your contributions!
Bundle size 📦
v10.69.0Compare Source
Important Changes
instrumentAgentWithSentryfor Cloudflare Agents (#22786)The Cloudflare SDK adds a new
instrumentAgentWithSentryAPI for Cloudflare Agents. It works likeinstrumentDurableObjectWithSentryforAgentclasses from theagentsSDK and additionally creates spans for@callableRPC methods and automatically sets theconversationIdbased on the agent's name. When building with the Sentry Vite plugin, Agents are instrumented automatically (#22788).Other Changes
CREATE INDEXspans oncf_-prefixed tables (#22767)cf_spans stay filtered (#22766)sentry.originon logs fromSentryEffectLogger(#22806)@apm-js-collab/code-transformer-bundler-plugins(#22678)Internal Changes
Bundle size 📦
axios/axios (axios)
v1.19.0Compare Source
This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.
allauth/django-allauth (django-allauth)
v65.19.1Compare Source
v65.19.0Compare Source
vitalik/django-ninja (django-ninja)
v1.6.3: 1.6.3Compare Source
What's Changed
Hotfix release cut from v1.6.2 — contains only the changes above, none of the other work currently on master.
Full Changelog: vitalik/django-ninja@v1.6.2...v1.6.3
django-oauth/django-oauth-toolkit (django-oauth-toolkit)
v3.4.1Compare Source
This release is dominated by security hardening of redirect URI matching, token revocation and
refresh token handling. Several entries below change behavior that was previously accepted, and
they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the
Upgrading guide collects everything you need to act on in one place, so start there. Of particular
note: redirect URIs are now matched exactly per
RFC 9700 §2.1, so a request may no
longer carry query parameters, path parameters, credentials or a fragment that the registered URI
does not have;
REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token ispresented rather than only by the
cleartokenssweep; and the built-in templates now link astylesheet shipped with the package instead of a CDN, so run
collectstaticor the pages renderunstyled.
Added
oauth2_providerlogger atDEBUG,reporting the requested URI, every registered candidate it was compared against, and which
component of each one differed (scheme, hostname, port, path, query). The same detail is
emitted for
post_logout_redirect_uriand for the token endpoint's comparison against theURI recorded on the grant. The error response is unchanged: the registered URIs are never
disclosed to the requester, only to the server's log. See "Debugging redirect URI
mismatches" in the documentation. Note that
AbstractApplication.redirect_uri_allowed()and
post_logout_redirect_uri_allowed()now call the newcheck_redirect_to_uri_allowed()(same verdict, plus the mismatch reasons) instead of
redirect_to_uri_allowed(), so codethat wrapped or patched the latter to influence those methods must target the former.
oauth2_provider.W011) that warns when theAccessTokenandRefreshTokenmodels are swapped into different apps, and a new"Extending the token models" documentation section explaining how to swap the
interrelated token models together.
the authorization-code flow under a strict
form-actionContent Security Policy, whichChromium enforces against the post-authorization redirect to the client's
redirect_uri.TokenHasResourceScopechecks each
required_scopesentry suffixed with theREAD_SCOPE/WRITE_SCOPEsettingvalue (defaults
read/write, e.g.music:read,music:write), so a baremusicscopeis rejected; with the default settings-based scopes backend the suffixed scopes must be
declared in
SCOPES.every release that needs them — 2.0, 3.0 and this release — linked from the documentation index,
so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has
no section there, so a gap between two versions is an answer rather than an omission.
settings-driven scopes backend via
SCOPES_BACKEND_CLASS, including a worked model-basedexample that stores scopes in the database.
admin site for applications and issued tokens, including client-secret hashing, credential
masking, and that tokens cannot be created by hand.
gettext_lazy)verbose_namelabels on every field of theApplication,Grant,AccessToken,RefreshToken,IDTokenandDeviceGrantmodels, sothe Django admin and the authorization UI can be localized. Migration
oauth2_provider.0021_translatable_field_labelsrecords the label changes; it makes nodatabase schema changes.
Deprecated
JSONOAuthLibCore(OAUTH2_PROVIDER["OAUTH2_BACKEND_CLASS"]set tooauth2_provider.oauth2_backends.JSONOAuthLibCore) is deprecated and now emits aDeprecationWarning. It makes the OAuth token, introspection, andrevocation endpoints read
application/jsonbodies, but those endpoints are defined touse
application/x-www-form-urlencoded(RFC 6749, RFC 7662, RFC 7009); the JSON mode isnon-standard and breaks interoperability with spec-compliant clients. It is scheduled for
removal in 4.0.
Changed
Application.clean()now reports its validation errors per field instead of asnon-field errors, and reports all of them at once instead of stopping at the first
problem. The application forms (the built-in registration/edit views and the Django
admin) render each message next to the offending input — a rejected redirect URI on
redirect_uris, a non-https CORS origin onallowed_origins, an unusable algorithm onalgorithm, and the HS256 client-secret conflicts onclient_secret/hash_client_secret.ValidationError.message_dictis keyed by those field names, socallers of
Application.full_clean()(including dynamic client registration and CIMD)now surface the field name alongside the message. A custom
ModelFormthat omits one ofthose fields still gets the message as a non-field error, provided it subclasses
oauth2_provider.forms.ApplicationForm.third-party CDN.
oauth2_provider/base.htmlnow links a small stylesheet distributedwith the package (
static/oauth2_provider/css/oauth2_provider.css), which also absorbsthe inline
<style>block that template carried. The built-in pages therefore render inair-gapped installs and under a strict Content Security Policy such as
default-src 'self', which blocks a foreign style host and an inline style block alike,and the authorization page no longer makes an unpinned (no Subresource Integrity)
third-party request while the user is making a consent decision. The stylesheet is served
through
staticfiles, so runcollectstaticfor the pages to be styled. The Bootstrap 2class names used by the templates are unchanged, and the
cssblock ofbase.htmlisstill the supported way to substitute your own styles.
AccessTokenandRefreshTokenadmins now invalidate tokens through a "Revoke selected"action instead of raw delete (delete is disabled on those two admins). A raw delete of an access
token left its bound refresh token behind (
RefreshToken.access_tokenisSET_NULL) — an orphanthat could still mint new access tokens — and a raw delete of a refresh token discarded the
revoked tombstone that
REFRESH_TOKEN_REUSE_PROTECTIONrelies on. The revoke action invalidatesthe whole token family consistently; expired rows are still pruned by
cleartokens.GrantandIDTokenadmins keep the default delete. The access-token revoke logic is now a single sharedoauth2_provider.models.revoke_access_token()helper used by the admin action, the/revoke/endpoint, and
AuthorizedTokenDeleteView.cleartokensmanagement command now prints a warning to stderr whenREFRESH_TOKEN_EXPIRE_SECONDSis unset (or0), explaining that only revoked andorphaned refresh tokens are removed and that expired access/ID tokens still bound to a
refresh token are retained until that refresh token is gone. The management-command docs
were clarified to match.
/revoke/endpoint) now also revokesthe refresh token bound to it, matching the admin "delete access token" view and
RFC 7009 §2.1. Previously the refresh token survived and could immediately mint a new
access token, defeating the revocation and leaving the refresh token an active "orphan"
(its
access_tokenforeign key isSET_NULL). Whether a refresh token may surviveaccess-token revocation will become a configurable policy in 4.0.
REFRESH_TOKEN_EXPIRE_SECONDSas defense-in-depth (rotation remains the primarymitigation), and document why
OIDC_RP_INITIATED_LOGOUT_ACCEPT_EXPIRED_TOKENSdefaultsto
True(theid_token_hintis a previously issued token per OIDC RP-Initiated Logout)and how to harden it.
Fixed
AccessToken,IDToken, andRefreshTokenmodels arerouted to a single database is now registered under the
modelstag instead ofdatabase.Django 6.1 stopped running
database-tagged checks unless a database alias is passedexplicitly (
manage.py check --database default), because such checks may do more thanstatic analysis; this one only asks the configured routers where the token models would be
written and never opens a connection, so under the old tag a plain
manage.py checkwouldhave silently stopped reporting a cross-database token configuration on Django 6.1.
REFRESH_TOKEN_REUSE_PROTECTIONnow revokes a compromised token family as a setinstead of one row at a time. A rotating client keeps every refresh token it has ever been
issued in the same family, so the old per-row loop cost one
SELECT ... FOR UPDATEroundtrip per token in the family, paid again on every replay of the stale token: a client stuck
on a retry timer could hold a worker and a database connection for tens of seconds per
request. The sweep now runs in a fixed number of queries whatever the size of the family,
through the new
AbstractRefreshToken.revoke_family(), andtoken_familyis indexed(migration
0022_refreshtoken_token_family_index) so it no longer scans the whole refreshtoken table. What gets revoked is unchanged: every live member of the family, and the
family's access tokens. If you swap in your own refresh token model, run
makemigrationstopick up the index, and if you override
revoke()overriderevoke_family()to match.Where a family holds two live tokens sharing a checksum -- which
RefreshToken's(token_checksum, revoked)uniqueness permits but the bulk write cannot express (#1816) --the sweep falls back to revoking row by row, so reuse detection still returns
invalid_grantrather than raising.Such a scheme has no naming authority, so only a single slash follows it
(
com.example.app:/oauth2redirect), butApplication.clean()reassembled every URI with://before validating and rejected the result with "Enter a valid URL." — leaving nativeapps no way to register the form the RFC prescribes and their clients actually send. The
double-slash variant was not a workaround: the two spellings parse to different hostnames
and produce
redirect_uri_mismatchagainst each other. Schemes that require an authority(
http,https,ws,wss,ftp) must still include a host, and the redundantcom.example.app:///oauth2redirectand rootlesscom.example.app:oauth2redirectspellingsare rejected so that each callback has one canonical registration (RFC 9700 §2.1).
Upgrade note: the rootless spelling was previously accepted, but the same reassembly
rewrote it to
com.example.app://oauth2redirect— registeringoauth2redirectas ahostname, which no client matches. It is now rejected at registration instead of being
silently reinterpreted; re-register any such URI in the single-slash form.
redirect_to_uri_allowed()no longer raisesAttributeErrorwhenALLOW_URI_WILDCARDSis enabled and a redirect URI has no hostname, as is the case forprivate-use URI scheme redirects.
REFRESH_TOKEN_EXPIRE_SECONDSis now enforced when a refresh token is presented,not only by the
cleartokens(clear_expired) cleanup job. Previously a refresh tokenpast its configured lifetime kept working until a cleanup sweep happened to remove it —
or forever, if
cleartokenswas never scheduled. Expiry is idle-based: a refresh tokenis rejected
REFRESH_TOKEN_EXPIRE_SECONDSafter its access token expires (the deadlineslides forward on every refresh), so actively-used tokens are unaffected. The default
(
REFRESH_TOKEN_EXPIRE_SECONDS = None) still never expires refresh tokens. Upgradenote: deployments that set
REFRESH_TOKEN_EXPIRE_SECONDSmay see idle refresh tokensthat are already past their lifetime rejected on upgrade, forcing those clients to
re-authenticate.
clear_expired()now reclaims "orphaned" refresh tokens — non-revoked refreshtokens whose access token was deleted out of band, leaving
access_tokenNULL. Theprevious
access_token__expires__ltjoin could never match aNULLaccess token, sosuch rows could remain in the database indefinitely.
REFRESH_TOKEN_GRACE_PERIOD_SECONDSno longerraises
AttributeError: 'NoneType' object has no attribute 'token'(HTTP 500) when theaccess token previously minted from that refresh token still exists but its own refresh
token has since been removed — e.g. by
clear_expiredor a concurrent rotation._save_bearer_tokennow re-issues a refresh token bound to the surviving access tokeninstead of dereferencing the missing one (creating a fresh access token there would
violate the one-to-one
AccessToken.source_refresh_tokenrelation).AssertionError(HTTP 500) when an application without any registered
redirect_uris(e.g. aclient_credentialsapplication) is driven through a flow that needs a defaultredirect URI.
Application.default_redirect_urinow raisesoauthlib'sMissingRedirectURIError, consistent with the multiple-URI case.OAuth2Validator.validate_bearer_tokennow rejects a token whoseapplication is not usable (
Application.is_usable()returnsFalse) with aninvalid_tokenerror, mirroring the check the issuance path already performsin
_load_application. The defaultis_usable()returnsTrue, so this onlyaffects swapped Application models that override it.
TokenHasScopeandTokenMatchesOASRequirementspermissions nowdeny (return
False) and log a warning, instead of raising anAssertionError(HTTP 500), when
request.authis not an OAuth2 access token. This lets them becomposed with other permission classes (e.g. OR-ed) without a non-OAuth2 token
turning into a server error.
Security
#1819 The device authorization flow's confirmation and status views now act only on a device
grant that belongs to the signed-in user.
DeviceUserCodeViewclaims a pending grant for theuser who enters the
user_code, butDeviceConfirmViewandDeviceGrantStatusViewlooked thegrant up by
client_idanduser_codealone. Any other authenticated user who learned thatshort, human-readable code — it is displayed on the device's screen for a person to read and
type — could therefore approve the pending authorization, handing the device tokens bound to
the account of the user who entered it, or deny it, or read its status page. RFC 8628 §3.3 has
the user who is being asked to authorize the device grant that authorization. Both views now
filter on
user=request.userand return404to anyone else; a grant that has not yet beenclaimed through the user-code step likewise can no longer be confirmed by navigating straight
to the confirmation URL.
#1816 A refresh token that was deliberately revoked is no longer honored inside
REFRESH_TOKEN_GRACE_PERIOD_SECONDS. The grace window exists to shield the token aclient retries when it did not receive the rotated response, but
revokedrecords boththat supersession and a deliberate revocation (the RFC 7009
/revoke/endpoint,AuthorizedTokenDeleteView, the admin, RP-initiated logout, revoking the bound accesstoken), and validation could not tell them apart. A revoked token was therefore usable
for the length of the window, contrary to
RFC 7009 §2.1 ("the
invalidation takes place immediately, and the token cannot be used again after the
revocation"). With
ROTATE_REFRESH_TOKEN = Falseit was additionally re-issued as a newlive row carrying the same token value, bringing the repudiated credential back to life
in the database. The two are now distinguished by whether the token was ever consumed to
mint a successor access token. A genuine rotation retry inside the window is unaffected,
and deployments on the default
REFRESH_TOKEN_GRACE_PERIOD_SECONDS = 0were neverexposed.
This generalizes a test that previously applied only when
REFRESH_TOKEN_REUSE_PROTECTIONwas enabled, so it is also a behavior change with reuseprotection off: a superseded token whose successor access token has since been deleted is
now rejected inside the window rather than accepted.
Redirect URIs are now matched exactly, as
RFC 9700 §2.1 requires
("authorization servers MUST utilize exact string matching except for port numbers in
localhost redirection URIs of native apps") and OpenID Connect Core §3.1.2.1 restates
via RFC 3986 §6.2.1 Simple String Comparison. Four deviations are closed, each of which
let a request differ from the registered URI while still matching it:
tested that the registered query was a subset of the requested one. An attacker
could append parameters to an otherwise-legitimate
redirect_uriand have theauthorization server reflect them into the client's callback alongside the
authorization code, the redirect-URI manipulation class described in
RFC 9700 §4.1.
https://example.com/cb;evil=1).urlparse()peels
;paramsoff the last path segment into a separate attribute, and only.pathwas compared, so these smuggled data to the callback the same way extra query
parameters did. Matching now uses
urlsplit(), which leaves them in the path.https://evil@example.com/cb). Only.hostnamewas compared, so userinfo rode along unnoticed. Credentials are not part of a
registered callback and are now rejected on either side.
urlparse()split off before comparison,so
https://example.com/cb#xmatched a registeredhttps://example.com/cb.RFC 6749 §3.1.2 states
the endpoint URI MUST NOT include a fragment component. A bare trailing
#is anempty fragment component and is rejected too; a percent-encoded
%23is not afragment delimiter and is unaffected.
Registration is tightened to match:
AllowedURIValidatortested the parsed fragment,which is empty both for a URI with no fragment and for one ending in a bare
#, sohttps://example.com/cb#was accepted at save time. With matching now denying any#,such a registration would be stored and then never authorize anything; it is rejected
up front instead. Registering a URI ending in
#now raises aValidationErrorwhereit previously succeeded.
Case-insensitive scheme/host comparison (RFC 3986 §6.2.2.1 normalization) and the
RFC 8252 §7.3 loopback any-port exemption are unchanged;
ALLOW_URI_WILDCARDSstillopts out of exact host matching and remains flagged by
oauth2_provider.W009/E004.Upgrade note: clients that pass per-request data through the
redirect_uriquerystring will now be rejected — every query parameter must be registered, and in the same
order. Register the full URI including its query, or move per-request data into the
stateparameter, which is what it is for. Applications whose registeredredirect_urisalready carry no query component are unaffected.#1510 Revoking an access token from the authorized-tokens page
(
AuthorizedTokenDeleteView) now also revokes the refresh token issuedalongside it. Previously only the access token was deleted, leaving the
refresh token usable to mint a fresh access token and defeating the
revocation (a regression from 2.3.0). Per
RFC 7009 §2.1 an
access token revocation may also revoke the respective refresh token; for a
user-initiated revocation that is now the behavior.
#1617 With
REFRESH_TOKEN_REUSE_PROTECTIONenabled,REFRESH_TOKEN_GRACE_PERIOD_SECONDSno longer extends the validity of a refresh token that is several generations old in
the rotation chain. The grace period now only shields the immediately preceding
refresh token (the token a client retries when it did not receive the rotated
response); replaying an older, already-rotated-past token within the grace window is
rejected and revokes the whole token family, instead of being honored (and, without a
requested scope, minting a fresh token pair).
#727 The token revocation endpoint (
/o/revoke_token/) now only revokes tokens thatwere issued to the authenticated client. Previously it revoked any token matching the
submitted value regardless of which application issued it, so a client could revoke
another client's tokens. Per
RFC 7009 §2.1 the server
verifies the token was issued to the client making the request; a token belonging to a
different client is now left untouched and the endpoint still returns
200(RFC 7009§2.2) without disclosing whether the token exists.
#1799 RFC 7592 registration access tokens now honour
COMPLIANT_BCP_RFC9700_TOKEN_STORAGE. Thedynamic client registration views assigned the token straight onto the model instead of routing it
through the storage path that honours the setting, so a deployment that had opted into hashed-at-rest
storage still had this one token persisted in cleartext. The registration response and the management
endpoint continue to return the token to its owner; only what is written to the database changes.
ipython/ipython (ipython)
v9.16.1Compare Source
v9.16.0Compare Source
kitware-resonant/terraform-heroku-resonant (kitware-resonant/resonant/heroku)
v3.4.0Compare Source
smtpsubmodule now supports an optionaldmarc_ruavariable, to add a DMARCruarecord for aggregate reportsnumpy/numpy (numpy)
v2.5.2Compare Source
getsentry/sentry-python (sentry-sdk)
v2.68.0Compare Source
Important
We're making
enable_logsandenable_metricsno-op with this release (#7177), and they'll be dropped in the next major.Previously,
enable_logsalso controlled automatic logs collection from the logging and Loguru integrations. These integrations now get an integration-levelcapture_sentry_logsboolean option to allow for more control over the auto-collection. These options areFalseby default, i.e., nothing is auto-collected without your explicit opt-in.Action Needed
If you had
enable_logsset toTrue:sentry_sdk.logger.XAPI, no action necessary, the API will just work.LoggingIntegrationorLoguruIntegration, the auto-collection will be turned off in this release. You can switch auto-collection on explicitly with:If you had
enable_logsset toFalse:sentry_sdk.logger.XAPI, you'll need to remove the calls entirely or define abefore_send_logcallback to filter out unwanted logs.If you has
enable_metricsset toFalse:before_send_metricor remove the calls to the API.Why We're Doing This
We recognize this is a disruptive change for some folks and want to make it clear this is a one-off. We're removing the options because they were an unnecessary hurdle that one had to jump through to be able to use logs and metrics, and it was confusing why the logging API would not just work on its own. On the other hand, we wanted to give you more fine-grained control over automatic collection.
New Features ✨
Other
NoOpStreamedSpanby @alexander-alderman-webb in [#7163](https://redirect.gConfiguration
📅 Schedule: (UTC)
* 0-3 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.