Bump the python-dependencies group across 1 directory with 32 updates

[dependabot]

Updates the requirements on crawl4ai, google-genai, litellm, openai, pinecone, playwright, pypdf, redis, psycopg2-binary, requests, faker, fastapi, uvicorn, pymupdf, pymupdf4llm, prometheus-client, python-multipart, sqlalchemy, httpx-oauth, arq, greenlet, aiosqlite, pytest, pytest-asyncio, opentelemetry-api, opentelemetry-sdk, opentelemetry-exporter-otlp-proto-http, opentelemetry-instrumentation-fastapi, opentelemetry-instrumentation-redis, opentelemetry-instrumentation-sqlalchemy, opentelemetry-instrumentation-httpx and pgvector to permit the latest version.
Updates crawl4ai to 0.8.6

Changelog

Sourced from crawl4ai's changelog.

Changelog

All notable changes to Crawl4AI will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.8.0] - 2026-01-12

Security

• 🔒 CRITICAL: Remote Code Execution Fix: Removed __import__ from hook allowed builtins
  • Prevents arbitrary module imports in user-provided hook code
  • Hooks now disabled by default via CRAWL4AI_HOOKS_ENABLED environment variable
  • Credit: Neo by ProjectDiscovery
• 🔒 HIGH: Local File Inclusion Fix: Added URL scheme validation to Docker API endpoints
  • Blocks file://, javascript:, data: URLs on /execute_js, /screenshot, /pdf, /html
  • Only allows http://, https://, and raw: URLs
  • Credit: Neo by ProjectDiscovery

Breaking Changes

• Docker API: Hooks disabled by default: Set CRAWL4AI_HOOKS_ENABLED=true to enable
• Docker API: file:// URLs blocked: Use Python library directly for local file processing

Added

• 🚀 init_scripts for BrowserConfig: Pre-page-load JavaScript injection for stealth evasions
• 🔄 CDP Connection Improvements: WebSocket URL support, proper cleanup, browser reuse
• 💾 Crash Recovery for Deep Crawl: resume_state and on_state_change for BFS/DFS/Best-First strategies
• 📄 PDF/MHTML for raw:/file:// URLs: Generate PDFs and MHTML from cached HTML content
• 📸 Screenshots for raw:/file:// URLs: Render cached HTML and capture screenshots
• 🔗 base_url Parameter: Proper URL resolution for raw: HTML processing
• ⚡ Prefetch Mode: Two-phase deep crawling with fast link extraction
• 🔀 Enhanced Proxy Support: Improved proxy rotation and sticky sessions
• 🌐 HTTP Strategy Proxy Support: Non-browser crawler now supports proxies
• 🖥️ Browser Pipeline for raw:/file://: New process_in_browser parameter
• 📋 Smart TTL Cache for Sitemap Seeder: cache_ttl_hours and validate_sitemap_lastmod parameters
• 📚 Security Documentation: Added SECURITY.md with vulnerability reporting guidelines

Fixed

• raw: URL Parsing: Fixed truncation at # character (CSS color codes like #eee)
• Caching System: Various improvements to cache validation and persistence

Documentation

• Multi-sample schema generation section
• URL seeder smart TTL cache parameters
• v0.8.0 migration guide
• Security policy and disclosure process

[Unreleased]

Added

... (truncated)

Commits

• 4e4a996 fix: replace litellm with unclecode-litellm due to PyPI supply chain compromise
• f4bda05 release: bump version to 0.8.6
• 01c685c fix: pin litellm to safe fork (v1.81.13) due to PyPI supply chain compromise
• 1a40ccf Merge pull request #1844 from hafezparast/fix/maysam-browser-none-guard-1842
• 6eb2530 Merge pull request #1849 from hafezparast/fix/maysam-serialize-skip-non-confi...
• fb24ee5 Merge pull request #1851 from hafezparast/fix/maysam-mcp-sse-asgi-1850
• 3846b73 Merge branch 'develop' of https://github.com/unclecode/crawl4ai into main
• 1a597cb Merge pull request #1836 from unclecode/release/v0.8.5
• 219416e fix: MCP SSE endpoint crash on Starlette >=0.50 (#1850)
• e603e4a fix: skip non-allowlisted types in serialization/deserialization (#1848)
• Additional commits viewable in compare view

Updates google-genai to 2.6.0

Release notes

Sourced from google-genai's releases.

v2.6.0

2.6.0 (2026-05-21)

Features

• Add enable_prompt_injection_detection for Computer Use feature for the Gemini API. (b1f632d)
• Add budget_exceeded status (15443c0)
• Add gemini-3.5-flash (15443c0)
• Add new fields (2910346)

Documentation

• Replace vertexai with enterprise in Client instantiation (c1c6df7)

Changelog

Sourced from google-genai's changelog.

2.6.0 (2026-05-21)

Features

• Add enable_prompt_injection_detection for Computer Use feature for the Gemini API. (b1f632d)
• Add budget_exceeded status (15443c0)
• Add gemini-3.5-flash (15443c0)
• Add new fields (2910346)

Documentation

• Replace vertexai with enterprise in Client instantiation (c1c6df7)

2.5.0 (2026-05-20)

Features

• Add Gemini 3.5 Flash model to options (706fd02)

2.4.0 (2026-05-17)

Features

• Support Agent and Environment APIs. (ef20d6b)

Bug Fixes

• Output_text for turns that don't end with text. (2afdeff)
• Pass max_line_length to readline() to prevent LineTooLong on large SSE lines with MTLS. (0e8f7bb)

2.3.0 (2026-05-15)

Features

• Add content union to UserInputStep (a5059a8)
• Interaction.{output_text,output_image,output_audio,output_video} (975d16a)
• Migrate Agent Engines, Evaluation, Prompt Management, and Skill features to agentplatform (abb1099)

Documentation

• Refresh generated docs for 2.2 (2ce0298)

2.2.0 (2026-05-12)

... (truncated)

Commits

• a682e6a chore(main): release 2.6.0 (#2485)
• b1f632d feat: add enable_prompt_injection_detection for Computer Use feature for th...
• 2910346 feat: add new fields
• 15443c0 feat: Add budget_exceeded status
• c1c6df7 docs: replace vertexai with enterprise in Client instantiation
• 161f8e4 chore(main): release 2.5.0 (#2473)
• 06216a4 chore: update comment in BatchJobOutputInfo to unblock javadoc generation
• 706fd02 feat: Add Gemini 3.5 Flash model to options
• e12c163 chore: Cleanup
• 610059b chore(main): release 2.4.0 (#2446)
• Additional commits viewable in compare view

Updates litellm from 1.83.1 to 1.85.1

Release notes

Sourced from litellm's releases.

v1.85.1

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.85.1

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.85.1/cosign.pub \
  ghcr.io/berriai/litellm:v1.85.1

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

Full Changelog: BerriAI/litellm@v1.85.0...v1.85.1

v1.84.1

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.84.1

... (truncated)

Commits

• See full diff in compare view

Updates openai to 2.38.0

Release notes

Sourced from openai's releases.

v2.38.0

2.38.0 (2026-05-21)

Full Changelog: v2.37.0...v2.38.0

Features

• api: api update (33d1d01)
• api: manual updates (a21700a)
• api: update OpenAPI spec or Stainless config (00265c5)

Chores

• api: docs updates (ee10152)
• check release PR custom code sync (2638779)
• remove release automation trigger (bd6eea5)
• trigger release automation (f62d082)

Changelog

Sourced from openai's changelog.

2.38.0 (2026-05-21)

Full Changelog: v2.37.0...v2.38.0

Features

• api: api update (33d1d01)
• api: manual updates (a21700a)
• api: update OpenAPI spec or Stainless config (00265c5)

Chores

• api: docs updates (ee10152)
• check release PR custom code sync (2638779)
• remove release automation trigger (bd6eea5)
• trigger release automation (f62d082)

2.37.0 (2026-05-13)

Full Changelog: v2.36.0...v2.37.0

Features

• api: add service_tier parameter to responses compact method (625827c)
• internal/types: support eagerly validating pydantic iterators (7e527bc)
• Remove unnecessary client_id when using workload identity provider for auth (c39ea8d)

Bug Fixes

• client: add missing f-string prefix in file type error message (c85ebd9)

2.36.0 (2026-05-07)

Full Changelog: v2.35.1...v2.36.0

Features

• api: manual updates (13c639c)
• api: realtime 2 (8fe0ab8)

2.35.1 (2026-05-06)

Full Changelog: v2.35.0...v2.35.1

Bug Fixes

• api: fix imagegen size enum regression (4484653)

... (truncated)

Commits

• e757667 release: 2.38.0
• b85b647 feat(api): api update
• d881c67 Revert "chore: check release PR custom code sync"
• d4a3228 chore: check release PR custom code sync
• 4888838 chore: remove release automation trigger
• 74978f0 chore: trigger release automation
• bab18af chore(api): docs updates
• a6f899a feat(api): manual updates
• 2897485 feat(api): update OpenAPI spec or Stainless config
• a2f1d6c codegen metadata
• Additional commits viewable in compare view

Updates pinecone to 9.0.1

Release notes

Sourced from pinecone's releases.

Release v9.0.1

v9.0.1 is a polish release. It rolls up two weeks of fixes against backend response shapes, new client-side validation, completes the gRPC namespace API, widens public input types for ergonomic flexibility, and lands a deep pass on docstrings and migration guidance.

---

Highlights

• Several methods, parameters, and fields omitted from v9.0.0 are restored. Highlights include the gRPC namespace operations (create_namespace, describe_namespace, delete_namespace, list_namespaces, list_namespaces_paginated), sparse/hybrid vector queries on Index.search / AsyncIndex.search, pc.preview.indexes.describe_backup, pc.indexes.configure(serverless_read_capacity=...), pc.assistants.create(..., environment=...), and several response fields the backend was returning but the SDK was dropping. See Filling v9.0.0 gaps.
• Schema and read_capacity are correctly forwarded everywhere. Several v9.0.0 paths (BYOC, IntegratedSpec, ServerlessSpec, async creation, the create_index shim, configure) silently dropped these fields; all are now end-to-end correct.
• Input types are uniformly wider. Public methods that previously required list[T] now accept any Sequence[T]; dict[str, str] and dict[str, Any] parameters now accept Mapping. Existing call sites are unaffected, but tuple, generator-backed sequences, and Mapping subclasses now type-check and work without conversion.
• Better IDE support for Jedi-based editors. A new pinecone/__init__.pyi stub fixes type resolution in Spyder, Eric, Cython, and other editors that don't follow from … import * re-exports. mypy and Pyright/Pylance users are unaffected.
• Docstrings, examples, and the v9 migration guide got a thorough cleanup. 50+ fixes to incorrect cross-references, outdated import paths, false claims about defaults, and broken example code.

---

Filling v9.0.0 gaps

A handful of methods and fields that should have shipped in v9.0.0 were inadvertently left out. They are restored in v9.0.1.

gRPC namespace operations

These methods exist on the REST Index but were missing from GrpcIndex in v9.0.0:

grpc_index = pc.index("my-index", grpc=True)
grpc_index.create_namespace("orders")
ns = grpc_index.describe_namespace("orders")
for ns in grpc_index.list_namespaces():   # auto-paginating generator
print(ns.name)
page = grpc_index.list_namespaces_paginated(limit=50)
grpc_index.delete_namespace("orders")

Index.search / AsyncIndex.search: sparse and hybrid queries

The REST search surface accepts sparse and hybrid vector queries, but v9.0.0 only plumbed dense list[float] through Index.search / AsyncIndex.search. Sparse and hybrid inputs are now accepted as a dict alongside dense lists:

index.search(
    namespace="docs",
    query={"vector": {"values": [0.1, 0.2, ...], "indices": [3, 17, 42, ...]}},
    top_k=10,
)

Keys are validated and normalized client-side; invalid combinations (e.g. values without indices on sparse) raise ValidationError before the HTTP call.

Preview: describe_backup

... (truncated)

Commits

• 523f5a8 release: 9.0.1
• a38baf2 ci(typecheck): add init.pyi drift check to typecheck job
• dc6b283 docs: fix misleading Returns in normalize_rerank_documents
• 8f08fd6 docs(inference): fix unstable internal import in reranking how-to
• 4ccead0 Merge commit '2bc6e720'
• 2bc6e72 feat(dx): add pinecone/init.pyi stub for Jedi-based IDE type resolution
• 77dfb21 docs(admin_adapter): add Args, Returns, and Raises to AdminAdapter methods
• 00f38ef docs(adapters): add Args and Returns sections to decode_response docstring
• d8c6017 docs(indexes): fix missing required field_map arg in EmbedConfig example
• a1c0b14 docs(migration): fix v9 migration table to show canonical pc.index() instead ...
• Additional commits viewable in compare view

Updates playwright to 1.60.0

Release notes

Sourced from playwright's releases.

v1.60.0

🐍 Python improvements

• New FormData class for building multipart/form-data request bodies — pass to api_request_context.post(form=…) etc.
• expect.soft(...) soft assertions collect multiple failures in a test instead of stopping at the first one. Requires up-to-date pytest integration to work.
• All timeout parameters now accept datetime.timedelta — applies wherever a timeout is taken, e.g. page.goto(), locator.click(), expect(...).to_be_visible().
• Async context manager support across more APIs — async with now works for objects returned from screencast.show_actions(), screencast.show_overlays(), etc.
• page.expect_request(...) and page.expect_response(...) now accept async predicates.
• Typed overloads for expect_event / wait_for_event so the event payload type is inferred per event name.

🌐 HAR recording on Tracing

tracing.start_har() / tracing.stop_har() expose HAR recording as a first-class tracing API, with the same content, mode and url_filter options as record_har:

context.tracing.start_har("trace.har")
page = context.new_page()
page.goto("https://playwright.dev")
context.tracing.stop_har()

🪝 Drop API

New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic DataTransfer in the page context — works cross-browser and is great for testing upload zones:

page.locator("#dropzone").drop(
    files={"name": "note.txt", "mime_type": "text/plain", "buffer": b"hello"},
)
page.locator("#dropzone").drop(
data={
"text/plain": "hello world",
"text/uri-list": "https://example.com",
},
)

🎯 Aria snapshots

• expect(page).to_match_aria_snapshot() now works on a Page, in addition to a Locator — equivalent to asserting against page.locator("body").
• New boxes option on locator.aria_snapshot() / page.aria_snapshot() appends each element's bounding box as [box=x,y,width,height], useful for AI consumption.

New APIs

Browser, Context and Page

• Event browser.on("context") — fired when a new context is created on the browser.
• BrowserContext now mirrors lifecycle events from its pages: browser_context.on("download"), browser_context.on("frameattached"), browser_context.on("framedetached"), browser_context.on("framenavigated"), browser_context.on("pageclose"), browser_context.on("pageload").

Locators and Assertions

... (truncated)

Commits

• 93f3201 chore: roll driver to 1.60.0 (#3079)
• 0ebdf2d feat(assertions): add expect.soft() for collecting multiple failures (#3065)
• 18810d8 feat: add FormData class for form and multipart requests (#3060)
• b846cee chore: roll to 1.60.0-beta-1778142790000 (#3069)
• 873c5c7 fix(setup): update auditwheel to 6.4.0 for InWheel tempdir fix (#3063)
• 9df9fac feat: accept datetime.timedelta for timeout parameters (#3059)
• 856ae37 devops: Update EsrpRelease (#3064)
• 161bd3d build(deps): bump flake8 from 7.2.0 to 7.3.0 (#2896)
• ac9bf29 build(deps): bump types-requests from 2.32.4.20250809 to 2.32.4.20260107 (#2975)
• deb2df8 build(deps): bump pytest-cov from 6.3.0 to 7.1.0 (#2976)
• Additional commits viewable in compare view

Updates pypdf to 6.12.1

Release notes

Sourced from pypdf's releases.

Version 6.12.1, 2026-05-22

What's new

Security (SEC)

• Limit input size and element count for XMP metadata (#3796) by @​stefan6419846

Robustness (ROB)

• Prevent cyclic parent hierarchies for inherited dictionaries (#3795) by @​stefan6419846
• Deal with invalid first code in LZW decoder (#3794) by @​stefan6419846

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.12.1, 2026-05-22

Security (SEC)

• Limit input size and element count for XMP metadata (#3796)

Robustness (ROB)

• Prevent cyclic parent hierarchies for inherited dictionaries (#3795)
• Deal with invalid first code in LZW decoder (#3794)

Full Changelog

Version 6.12.0, 2026-05-21

Security (SEC)

• Disallow cross-reference streams with zero-only width values (#3791)
• Avoid excessive whitespace in layout mode text extraction (#3790)

New Features (ENH)

• Implement SASLprep (RFC 4013) for AES-256 password normalization (#3780)
• CID font resource from font file to encode more characters (#3652)

Performance Improvements (PI)

• Optimize retrieval of named destinatinos in reader (#3442)

Bug Fixes (BUG)

• Fix TreeObject.insert_child KeyError on fresh children (#3786)

Robustness (ROB)

• AppearanceStream: Also honor user-set font name when not flattening annotations (#3781)

Documentation (DOC)

• Block encrypting writer in incremental mode (#3789)

Full Changelog

Version 6.11.0, 2026-05-09

New Features (ENH)

• Initialise a Font from an embedded font file (#3704)

Robustness (ROB)

• Allow to fix AES padding length in non-strict mode (#3742)

Developer Experience (DEV)

• Enable PyPy testing again (#3752)
• Align mypy Makefile target with strict mode (#3690)

Full Changelog

Version 6.10.2, 2026-04-15

... (truncated)

Commits

• 228780a REL: 6.12.1
• 62191d5 SEC: Limit input size and element count for XMP metadata (#3796)
• e852631 ROB: Prevent cyclic parent hierarchies for inherited dictionaries (#3795)
• 6b4bbcc ROB: Deal with invalid first code in LZW decoder (#3794)
• 20c16d3 TST: Update tests for Python 3.15 support (#3793)
• 08eb143 REL: 6.12.0
• 507d7c9 SEC: Disallow cross-reference streams with zero-only width values (#3791)
• 9d27470 SEC: Avoid excessive whitespace in layout mode text extraction (#3790)
• 0a8e699 DOC: Block encrypting writer in incremental mode (#3789)
• 541ebd4 DEV: Update idna from version 3.10 to 3.15
• Additional commits viewable in compare view

Updates redis to 7.4.0

Release notes

Sourced from redis's releases.

7.4.0

Changes

🐛 Bug Fixes

• Fix AttributeError in cluster metrics recording when connection is None or ClusterNode object instance is used to extract the connection info (#3999)
• Fixing security concern in repr methods for ConnectionPools - passwords might leak in plain text logs (#3998)
• Refactored connection count and SCH metric collection (#4001)

🧪 Experimental Features

-Refactored health check logic for MultiDBClient (#3994)

🧰 Maintenance

• Expose basic Otel classes and functions to be importable through redis.observability to match the examples in the readthedocs (#3996)

We'd like to thank all the contributors who worked on this release! @​vladvildanov @​petyaslavova

Commits

• b72f24a Updating lib version to 7.4.0
• 0a4e0af Refactored health check logic for MultiDBClient (#3994)
• 15492c9 Refactored connection count and SCH metric collection (#4001)
• cd964ac Expose basic Otel classes and funtions to be importable through redis.observa...
• 46ab74d Fixing security concern in repr methods for ConnectionPools - passwords m...
• 26482db Fix AttributeError in cluster metrics recording when connection is None or Cl...
• See full diff in compare view

Updates psycopg2-binary to 2.9.12

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.14.
• Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
• Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
• Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.13.
• Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
• Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Wheel package bundled with PostgreSQL 16 libpq in order to add support for recent features, such as sslcertmode.

What's new in psycopg 2.9.7 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix propagation of exceptions raised during module initialization (:ticket:[#1598](https://github.com/psycopg/psycopg2/issues/1598)).

... (truncated)

Commits

• 3a6d9d6 ci: include almalinux in whieel building
• ebca6bf chore: bump to version 3.9.12
• 0196f02 build(deps): bump pypa/cibuildwheel from 3.3.1 to 3.4.0
• d157bdc build(deps): bump docker/setup-qemu-action from 3 to 4
• 7fccc0f build(deps): bump actions/upload-artifact from 6 to 7
• d52a61e chore: bump dependency libraries
• b231d72 chore: fix building binary images
• 6d76e84 Merge pull request #1836 from psycopg/fix-1835
• f7e314c fix: overflow in malformed interval
• eb905c1 docs: replace bare except clause with except Exception
• Additional commits viewable in compare view

Updates requests to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
• Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

• 6e83187 v2.34.2
• 84d10f0 Move Request.headers back to Mapping (#7441)
• b7b549b v2.34.1
• e511bc7 Fix mutability issues with headers input types (#7431)
• 5691f59 Update JsonType containers to read-based collections (#7436)
• 2144213 Constrain Response.reason to str (#7437)
• 6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
• 0b401c7 v2.34.0
• 86b378d Align Session.get parameters with requests.get (#7429)
• a4f9a59 Port bpo-39057 to Requests (#7427)
• Additional commits viewable in compare view

Updates faker to 40.18.0

Release notes

Sourced from faker's releases.

Release v40.18.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.18.0 - 2026-05-14

• Add automotive providers for ar_DZ and fr_DZ locales. Thanks @​othmane099.
• Add phone_number provider for ar_DZ and fr_DZ locales. Thanks @​othmane099.

v40.17.0 - 2026-05-14

• Add am_ET phone_number provider for Ethiopia. Thanks @​jasur-py.

v40.16.0 - 2026-05-14

• Fix duplicate phone number prefix 145 in zh_CN locale. Thanks @​r266-tec.

v40.15.0 - 2026-04-17

• Add job providers for ar_DZ and fr_DZ locales (#2352). Thanks @​othmane099.
• Add company providers for ar_DZ and fr_DZ locales (#2351). Thanks @​othmane099.
• Add geo providers for ar_DZ and fr_DZ locales (#2350). Thanks @​othmane099.
• Add currency providers for ar_DZ and fr_DZ locales (#2349). Thanks @​othmane099.
• Add date_time provider for ar_DZ locale (#2348). Thanks @​othmane099.
• Add ssn providers for ar_DZ and fr_DZ locales (#2347). Thanks @​othmane099.

v40.14.1 - 2026-04-17

• Fix UnicodeEncodeError in CLI docs on non-UTF consoles (#2362). Thanks @​RedZapdos123.

v40.14.0 - 2026-04-17

• Fix: update placekitten URL to placekittens (#2364). Thanks @​reory.

v40.13.0 - 2026-04-06

• Fix: Ensure deterministic locale selection in multi-locale mode. Thanks @​just6660 and @​patakk.

v40.12.0 - 2026-03-30

• Add address providers for ar_DZ and fr_DZ locales (#2341). Thanks @​othmane099.

v40.11.1 - 2026-03-23

• Fix: rebind deepcopy proxies to copied Faker instances. Thanks @​SunS1eep1ng.

v40.11.0 - 2026-03-13

• Add major Swiss banks to de_CH bank provider. Thanks @​raphael-s.

v40.10.0 - 2026-03-13

• Fix: mixed-gender names in es_MX locale. Thanks @​rodrigobnogueira...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.