Bump the pip group across 6 directories with 3 updates by dependabot[bot] · Pull Request #1404 · materialsproject/emmet

dependabot · 2026-03-26T13:15:57Z

Bumps the pip group with 1 update in the /docs directory: tornado.
Bumps the pip group with 3 updates in the /emmet-api/requirements directory: tornado, orjson and requests.
Bumps the pip group with 3 updates in the /emmet-builders-legacy/requirements directory: tornado, orjson and requests.
Bumps the pip group with 3 updates in the /emmet-builders/requirements directory: tornado, orjson and requests.
Bumps the pip group with 3 updates in the /emmet-cli/requirements directory: tornado, orjson and requests.
Bumps the pip group with 2 updates in the /emmet-core/requirements directory: orjson and requests.

Updates tornado from 6.5 to 6.5.5

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1 releases/v3.2.0 releases/v3.1.1

... (truncated)

Commits

7d64650 Merge pull request #3586 from bdarnell/update-cibw
d05d59b build: Bump cibuildwheel to 3.4.0
c2f4673 Merge pull request #3585 from bdarnell/release-655
e5f1aa4 Release notes and version bump for v6.5.5
78a046f httputil: Add CRLF to _FORBIDDEN_HEADER_CHARS_RE
24a2d96 web: Validate characters in all cookie attributes.
119a195 httputil: Add limits on multipart form data parsing
63d4df4 Merge pull request #3564 from bdarnell/release-654
eadbf9a Release notes and version bump for 6.5.4
bbc2b14 Make sure that the in-operator on HTTPHeaders is case insensitive
Additional commits viewable in compare view

Updates tornado from 6.5.4 to 6.5.5

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1 releases/v3.2.0 releases/v3.1.1

... (truncated)

Commits

7d64650 Merge pull request #3586 from bdarnell/update-cibw
d05d59b build: Bump cibuildwheel to 3.4.0
c2f4673 Merge pull request #3585 from bdarnell/release-655
e5f1aa4 Release notes and version bump for v6.5.5
78a046f httputil: Add CRLF to _FORBIDDEN_HEADER_CHARS_RE
24a2d96 web: Validate characters in all cookie attributes.
119a195 httputil: Add limits on multipart form data parsing
63d4df4 Merge pull request #3564 from bdarnell/release-654
eadbf9a Release notes and version bump for 6.5.4
bbc2b14 Make sure that the in-operator on HTTPHeaders is case insensitive
Additional commits viewable in compare view

Updates orjson from 3.11.5 to 3.11.6

Release notes

Sourced from orjson's releases.

3.11.6

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Changelog

Sourced from orjson's changelog.

3.11.6 - 2026-01-29

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Commits

ec02024 3.11.6
d581687 build, clippy misc
4105b29 writer::num
62bb185 Fix sporadic crash on serializing object close
d860078 PyRef idiom refactors
343ae2f Deserializer, Utf8Buffer
7835f58 PyBytesRef and other input refactor
71e0516 PyStrRef
1096df4 MSRV 1.89
b718e75 Drop support for python3.9
Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates tornado from 6.5 to 6.5.5

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1 releases/v3.2.0 releases/v3.1.1

... (truncated)

Commits

7d64650 Merge pull request #3586 from bdarnell/update-cibw
d05d59b build: Bump cibuildwheel to 3.4.0
c2f4673 Merge pull request #3585 from bdarnell/release-655
e5f1aa4 Release notes and version bump for v6.5.5
78a046f httputil: Add CRLF to _FORBIDDEN_HEADER_CHARS_RE
24a2d96 web: Validate characters in all cookie attributes.
119a195 httputil: Add limits on multipart form data parsing
63d4df4 Merge pull request #3564 from bdarnell/release-654
eadbf9a Release notes and version bump for 6.5.4
bbc2b14 Make sure that the in-operator on HTTPHeaders is case insensitive
Additional commits viewable in compare view

Updates orjson from 3.11.5 to 3.11.6

Release notes

Sourced from orjson's releases.

3.11.6

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Changelog

Sourced from orjson's changelog.

3.11.6 - 2026-01-29

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Commits

ec02024 3.11.6
d581687 build, clippy misc
4105b29 writer::num
62bb185 Fix sporadic crash on serializing object close
d860078 PyRef idiom refactors
343ae2f Deserializer, Utf8Buffer
7835f58 PyBytesRef and other input refactor
71e0516 PyStrRef
1096df4 MSRV 1.89
b718e75 Drop support for python3.9
Additional commits viewable in compare view

Updates requests from 2.32.4 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates tornado from 6.5.4 to 6.5.5

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1 releases/v3.2.0 releases/v3.1.1

... (truncated)

Commits

7d64650 Merge pull request #3586 from bdarnell/update-cibw
d05d59b build: Bump cibuildwheel to 3.4.0
c2f4673 Merge pull request #3585 from bdarnell/release-655
e5f1aa4 Release notes and version bump for v6.5.5
78a046f httputil: Add CRLF to _FORBIDDEN_HEADER_CHARS_RE
24a2d96 web: Validate characters in all cookie attributes.
119a195 httputil: Add limits on multipart form data parsing
63d4df4 Merge pull request #3564 from bdarnell/release-654
eadbf9a Release notes and version bump for 6.5.4
bbc2b14 Make sure that the in-operator on HTTPHeaders is case insensitive
Additional commits viewable in compare view

Updates orjson from 3.11.5 to 3.11.6

Release notes

Sourced from orjson's releases.

3.11.6

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Changelog

Sourced from orjson's changelog.

3.11.6 - 2026-01-29

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Commits

ec02024 3.11.6
d581687 build, clippy misc
4105b29 writer::num
62bb185 Fix sporadic crash on serializing object close
d860078 PyRef idiom refactors
343ae2f Deserializer, Utf8Buffer
7835f58 PyBytesRef and other input refactor
71e0516 PyStrRef
1096df4 MSRV 1.89
b718e75 Drop support for python3.9
Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates tornado from 6.5.4 to 6.5.5

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1 releases/v3.2.0 releases/v3.1.1

... (truncated)

Commits

7d64650 Merge pull request #3586 from bdarnell/update-cibw
d05d59b build: Bump cibuildwheel to 3.4.0
c2f4673 Merge pull request #3585 from bdarnell/release-655
e5f1aa4 Release notes and version bump for v6.5.5
78a046f httputil: Add CRLF to _FORBIDDEN_HEADER_CHARS_RE
24a2d96 web: Validate characters in all cookie attributes.
119a195 httputil: Add limits on multipart form data parsing
63d4df4 Merge pull request #3564 from bdarnell/release-654
eadbf9a Release notes and version bump for 6.5.4
bbc2b14 Make sure that the in-operator on HTTPHeaders is case insensitive
Additional commits viewable in compare view

Updates orjson from 3.11.5 to 3.11.6

Release notes

Sourced from orjson's releases.

3.11.6

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Changelog

Sourced from orjson's changelog.

3.11.6 - 2026-01-29

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Commits

ec02024 3.11.6
d581687 build, clippy misc
4105b29 writer::num
62bb185 Fix sporadic crash on serializing object close
d860078 PyRef idiom refactors
343ae2f Deserializer, Utf8Buffer
7835f58 PyBytesRef and other input refactor
71e0516 PyStrRef
1096df4 MSRV 1.89
b718e75 Drop support for python3.9
Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates orjson from 3.11.5 to 3.11.6

Release notes

Sourced from orjson's releases.

3.11.6

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Changelog

Sourced from orjson's changelog.

3.11.6 - 2026-01-29

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Commits

ec02024 3.11.6
d581687 build, clippy misc
4105b29 writer::num
62bb185 Fix sporadic crash on serializing object close
d860078 PyRef idiom refactors
343ae2f Deserializer, Utf8Buffer
7835f58 PyBytesRef and other input refactor
71e0516 PyStrRef
1096df4 MSRV 1.89
b718e75 Drop support for python3.9
Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

//: # (d...

Description has been truncated

Bumps the pip group with 1 update in the /docs directory: [tornado](https://github.com/tornadoweb/tornado). Bumps the pip group with 3 updates in the /emmet-api/requirements directory: [tornado](https://github.com/tornadoweb/tornado), [orjson](https://github.com/ijl/orjson) and [requests](https://github.com/psf/requests). Bumps the pip group with 3 updates in the /emmet-builders-legacy/requirements directory: [tornado](https://github.com/tornadoweb/tornado), [orjson](https://github.com/ijl/orjson) and [requests](https://github.com/psf/requests). Bumps the pip group with 3 updates in the /emmet-builders/requirements directory: [tornado](https://github.com/tornadoweb/tornado), [orjson](https://github.com/ijl/orjson) and [requests](https://github.com/psf/requests). Bumps the pip group with 3 updates in the /emmet-cli/requirements directory: [tornado](https://github.com/tornadoweb/tornado), [orjson](https://github.com/ijl/orjson) and [requests](https://github.com/psf/requests). Bumps the pip group with 2 updates in the /emmet-core/requirements directory: [orjson](https://github.com/ijl/orjson) and [requests](https://github.com/psf/requests). Updates `tornado` from 6.5 to 6.5.5 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.0...v6.5.5) Updates `tornado` from 6.5.4 to 6.5.5 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.0...v6.5.5) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `tornado` from 6.5 to 6.5.5 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.0...v6.5.5) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) Updates `requests` from 2.32.4 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `tornado` from 6.5.4 to 6.5.5 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.0...v6.5.5) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `tornado` from 6.5.4 to 6.5.5 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.0...v6.5.5) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) --- updated-dependencies: - dependency-name: tornado dependency-version: 6.5.5 dependency-type: direct:production dependency-group: pip - dependency-name: tornado dependency-version: 6.5.5 dependency-type: direct:production dependency-group: pip - dependency-name: orjson dependency-version: 3.11.6 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: tornado dependency-version: 6.5.5 dependency-type: direct:production dependency-group: pip - dependency-name: orjson dependency-version: 3.11.6 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: tornado dependency-version: 6.5.5 dependency-type: direct:production dependency-group: pip - dependency-name: orjson dependency-version: 3.11.6 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: tornado dependency-version: 6.5.5 dependency-type: direct:production dependency-group: pip - dependency-name: orjson dependency-version: 3.11.6 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: orjson dependency-version: 3.11.6 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-03-30T16:08:12Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Mar 26, 2026

esoteric-ephemera closed this Mar 30, 2026

dependabot bot deleted the dependabot/pip/docs/pip-af54179633 branch March 30, 2026 16:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the pip group across 6 directories with 3 updates#1404

Bump the pip group across 6 directories with 3 updates#1404
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/docs/pip-af54179633

dependabot bot commented on behalf of github Mar 26, 2026

Uh oh!

dependabot bot commented on behalf of github Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Mar 26, 2026

Release notes

Release notes

3.11.6

Changed

Fixed

3.11.6 - 2026-01-29

Changed

Fixed

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

Release notes

3.11.6

Changed

Fixed

3.11.6 - 2026-01-29

Changed

Fixed

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

Release notes

3.11.6

Changed

Fixed

3.11.6 - 2026-01-29

Changed

Fixed

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

Release notes

3.11.6

Changed

Fixed

3.11.6 - 2026-01-29

Changed

Fixed

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

3.11.6

Changed

Fixed

3.11.6 - 2026-01-29

Changed

Fixed

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

Uh oh!

dependabot bot commented on behalf of github Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant