[dependabot]

Bumps the production-dependencies group with 13 updates in the / directory:

Package	From	To
asgiref	3.11.1	3.12.1
cachetools	7.1.3	7.1.7
flask-cors	6.0.2	6.0.5
grpcio	1.80.0	1.83.0
grpcio-testing	1.80.0	1.83.0
grpcio-tools	1.80.0	1.83.0
mysql-connector-python	9.7.0	26.7.0
peewee	4.0.5	4.3.0
phonenumbers	9.0.30	9.0.37
pyjwt	2.12.1	2.13.0
pytest	9.0.3	9.1.1
tqdm	4.67.3	4.70.0
twilio	9.10.9	9.11.0

Updates asgiref from 3.11.1 to 3.12.1
Updates cachetools from 7.1.3 to 7.1.7
Updates flask-cors from 6.0.2 to 6.0.5
Updates grpcio from 1.80.0 to 1.83.0

Commits

• c876f4d [Release] Bump version to 1.83.0 (on v1.83.x branch) (#43036)
• b5c40cd [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower boun...
• 9c223f1 [Release] Bump version to 1.83.0-pre1 (on v1.83.x branch) (#42936)
• b215f80 [Release] Bump core version to 56.0.0 for upcoming release (#42934)
• cf95af0 [Python] Add abort_with_status to the aio ServicerContext ABC (#42733)
• 725c173 Automated rollback of commit 8848182a65239ce4a7a26650c82aee3ec7ed1eee.
• 821431b [PH2] Induced Frames and Reset Frames for PH2
• 6d0b58e disable metadata_publish_to_app_tag experiment
• 41d533a Implement Weighted Random Shuffling and CDS Weight Normalization for pick_fir...
• 8848182 [xDS] split up the grpc_xds_client BUILD target (#42872)
• Additional commits viewable in compare view

Updates grpcio-testing from 1.80.0 to 1.83.0

Updates grpcio-tools from 1.80.0 to 1.83.0

Commits

• c876f4d [Release] Bump version to 1.83.0 (on v1.83.x branch) (#43036)
• 9c223f1 [Release] Bump version to 1.83.0-pre1 (on v1.83.x branch) (#42936)
• 1454079 [Python] Update lower bound for protobuf from 6.33.5 to 7.35.1 (#42914)
• 6953d6a [Python] Remove 3.15 until Python 3.15 RC is released. (#42900)
• b025e18 [Python] Support 3.15 (#42388)
• b6a490e [Python][grpcio-tools] Fix build error when CXX contains spaces (#42742)
• 8a56164 [Core] Upgrade to protobuf@35.1 to get upstream MSVC bug fix. (#42773)
• 95f01e5 [Release] Bump version to 1.83.0-dev (on master branch) (#42638)
• f72dd8c [Python] Trim Python2 backward compatibility syntax - remove "future" (#4...
• 3618643 [Core] Upgrade to protobuf 35 (#42512)
• Additional commits viewable in compare view

Updates mysql-connector-python from 9.7.0 to 26.7.0

Changelog

Sourced from mysql-connector-python's changelog.

v26.7.0

This release contains no functional changes.

Commits

• 79f3435 Fix mysqld version parsing for multi-digit components
• 1a242a7 Updated Connector/Python version to v26.7.0
• d5645ae Updated GPL licence book
• c94b53c Updated the CONTRIBUTING and README files
• ecbe56e Updated the CONTRIBUTING and README files
• b0dde65 Updated Connector/Python version to v10.0.0
• See full diff in compare view

Updates peewee from 4.0.5 to 4.3.0

Changelog

Sourced from peewee's changelog.

4.3.0

Backwards-incompatible:

• Specify requires-python >= 3.8. I've been putting off committing to anything like this, since technically we still work on 3.7, but 3.8 is the minimum we run on CI so it felt correct.
• Replace docid implicit primary key on legacy FTSModel (FTS4) with rowid, which is equivalent. Using docid presents no benefit and switching to rowid makes operations more consistent. Users have a couple options when updating:
  • Explicitly add docid = DocIDField() to your FTSModel classes.
  • Update your code, replacing docid with rowid. The underlying data does not require a migration, as docid was just an alias for rowid.
• When a RETURNING-clause insert of a single row inserts nothing, e.g. a conflict was ignored, execute() returns None on every backend.

Improvements:

• Connection pools roll back transactions left open on check-in.
• Pooled Postgres probes idle connections with SELECT 1 and discards dead ones, matching the MySQL pool's ping. Previously a connection terminated server-side while parked in the pool was handed out and failed on first use.
• close_pool() in pwasyncio no longer spins the event loop on Python 3.13+ attempting to reclaim connections in use, and pool creation is now bounded by acquire_timeout. Connections terminated during shutdown are detected as stale and discarded at the next checkout.
• JSONField negative path indexes render as $[last] / $[last-n] on MySQL/MariaDB. Previously the sqlite-only $[#-n] form was emitted, which MariaDB evaluates to NULL (overwriting the column when used with set()) and MySQL rejects as an invalid path.
• JSONField mutators (set(), insert(), etc) store Python booleans as json true/false instead of the driver's 0/1, so values written by create() and by mutators compare consistently. Floats on MySQL/MariaDB likewise take their json text form, as MariaDB reformats driver floats in a way that breaks equality against the stored document.
• Reflection/pwiz map MySQL JSON columns to the core JSONField instead of emitting from playhouse.mysql_ext import * for a re-exported field.
• playhouse.pwasyncio logs to the peewee.pwasyncio logger rather than playhouse.pwasyncio.
• Fix dataset freeze/thaw of NULL blob and datetime values. Empty CSV cells now import as NULL for non-text fields.
• Lateral joins honor a user-supplied on= predicate instead of silently replacing it with true, and default to ON true when on= is omitted.
• The SQLite FTS content option must be a Model or table-name string. Passing a Field now raises ImproperlyConfigured: it generated DDL that fts5 rejects outright and that fts4 silently truncated to the table name.
• Fix FTS5Model.VocabModel(): term/col/offset were declared as virtual fields and omitted from default SELECTs, the instance-type model had the wrong column set, all three table-types shared one default table name, and

... (truncated)

Commits

• d8d6f31 4.3.0
• aa7fdd7 Update CL
• 163aaff Merge pull request #3064 from TheLastCicada/fix/bare-fields-type-params
• 395c156 Do not apply type parameters to bare fields
• 4001705 Fixup self-ref detection + run mypy on stub itself.
• f68e857 Fix for self-referential FK's in stub
• 63da6ec Require >= 3.8 explicitly going forwards.
• 8538afd Refactor last insert ID, simplify.
• 273cf0c Clean up a bit in tests
• 5767f91 Fix shadowed test.
• Additional commits viewable in compare view

Updates phonenumbers from 9.0.30 to 9.0.37

Commits

• e605afe Prep for 9.0.37 release
• 9bf1822 Generated files for metadata
• f3e59e7 Merge metadata changes from upstream 9.0.37
• 5fc9318 Prep for 9.0.36 release
• eefd53f Generated files for metadata
• 064dc99 Merge metadata changes from upstream 9.0.36
• bf0c2ed Fix geocoder returning empty when longer prefix lacks requested language (#323)
• 314e40f Prep for 9.0.35 release
• ba1f5b1 Generated files for metadata
• 6245715 Merge metadata changes from upstream 9.0.35
• Additional commits viewable in compare view

Updates pyjwt from 2.12.1 to 2.13.0

Changelog

Sourced from pyjwt's changelog.

v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>__

Security

- Reject JWK JSON documents passed as raw HMAC secrets in
  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that
  the existing PEM/SSH guard did not cover. Reported by @aradona91 in
  `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__.
- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during
  verification so the caller's ``algorithms=[...]`` allow-list cannot be
  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported
  by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__.
- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-
  influenced URIs cannot read local files or reach unintended schemes via
  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported
  by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__.
- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.
  The previous ``finally``-block ``put(None)`` pattern cleared the cache
  on any transient outage, turning one bad JWKS request into application-
  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__.
- Skip the unconditional base64 decode of the compact-form payload segment
  when ``b64=false`` is set in the protected header, and require that
  segment to be empty (RFC 7515 Appendix F detached form). Closes an
  unauthenticated DoS amplifier. Reported by @thesmartshadow in
  `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__.
Fixed

- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.
Changed



Migrate the dev, docs, and tests package extras to dependency groups by @​kurtmckee in [#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;__

Commits

• 7144e45 Apply ruff format
• d2f4bec Restore cast() calls with cross-version type: ignore for prepare_key
• 22f478c Remove redundant casts in RSAAlgorithm.prepare_key and `ECAlgorithm.prepare...
• 95791b1 Bundle security fixes and hardening into 2.13.0
• dcc27a9 [pre-commit.ci] pre-commit autoupdate (#1155)
• 9d08a9a [pre-commit.ci] pre-commit autoupdate (#1146)
• b87c100 Bump codecov/codecov-action from 5 to 6 (#1154)
• 40e3147 Migrate development extras to dependency groups (#1152)
• See full diff in compare view

Updates pytest from 9.0.3 to 9.1.1

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates tqdm from 4.67.3 to 4.70.0

Release notes

Sourced from tqdm's releases.

tqdm v4.70.0 stable

• contrib.concurrent: major improvements
  • support process_map(mp_context, max_tasks_per_child), thread_map(thread_name_prefix) (#1265)
  • fix total based on shortest iterable length (#1473)
  • use default max_workers (#1543 <- #1530, #1518)
  • support timeout, buffersize (#1576)
  • improve ETA (#1708 <- #1161)
  • update as_completed (#1709 <- #1565)
  • add tqdm.concurrent.intepreter_map (#1777)
• asyncio: support iterables with only __aiter__ (#1714 <- #1686)
• support reset(float("inf")) (#1783 <- #1781, #651)
• framework: test & reduce wheel size (#1782)

tqdm v4.69.1 stable

• contrib.logging: preserve filters (#1775 <- #1581)
• rich: misc fixes (#1773)
  • support generators (without len) (#1391)
  • fix potential AttributeError on exit (#1674)
• fix total=float('inf') (#1781 <- #651)
• fix potential AttributeError on exit (#1778 <- #1668, #1537, #261)
• fix minor docs typos (#1780, #1746)

tqdm v4.69.0 stable

• add tqdm.asyncio.gather(..., return_exceptions=False) (#1776, #1671 <- #1286)
• misc minor framework updates
  • bump workflow actions & pre-commit hooks

tqdm v4.68.4 stable

• trim to ncols even when '{bar}' not in bar_format (#1717, #1767 <- #1658)
• fix tqdm.write when stdout=None (#1768 <- #1654)

tqdm v4.68.3 stable

• utils: delay os.get_terminal_size (#1763 <- #1760)
• autonotebook: support QtConsole, Spyder, JupyterLite (#1763, #1628, #1559 <- #1283, #1098, #512)
• minor docs updates
  • fix typo (#1762)
  • use git-fame
• misc minor framework updates
  • fix & update CI build
  • pre-commit: add docs & metadata generation
  • move tox.ini -> pyproject.toml, move tox-gh-actions -> tox-gh
  • add Python 3.14, drop 3.7 support

tqdm v4.68.2 stable

• revert accidental change to ascii default (fixes #1760)
  • UnicodeEncodeError: 'charmap' codec can't encode characters in position 6-7: character maps to <undefined> can be fixed by installing tqdm!=4.68.0,!=4.68.1
• misc docs updates
  • fix links
  • replace stray rst -> md syntax
  • consistent "progress bar" terminology (#1737)

... (truncated)

Commits

• 96f2e60 Merge pull request #1777 from shermansiu/feat/interpreter-pool
• c27393e misc tidy
• 061c623 Disable tqdm.monitor_interval for subinterpreters because they do not have ...
• 9fc160b Update how we check for interpreter_map support in the tests
• b42463a Ensure that subinterpreters can import tqdm while unpickling the initializer
• 16d5486 Add support for nested progress bars
• 9f5890f Add initial implementation for interpreter_map
• 321f920 Merge pull request #1783 from LuShadowX/reset-inf-total
• 4664b57 minor tidy
• 426a098 Treat inf total as unknown in reset() too
• Additional commits viewable in compare view

Updates twilio from 9.10.9 to 9.11.0

Changelog

Sourced from twilio's changelog.

[2026-08-11] Version 9.11.0

Library - Fix

• [PR #929](twilio/twilio-python#929): mock HTTP session in TestUserAgentClients to avoid live network calls. Thanks to @​shrutiburman!

Twiml

• Remove <Assistant> noun from <Connect> verb as part of the AI Assistants deprecation (breaking change)
• Add passports attribute to <Dial> verb for SHAKEN/STIR passport passthrough

Accounts

• Add SuppressEmailNotification parameter to the Secondary Auth Token and Auth Token promotion endpoints. Set it to true to suppress the email notification sent to account owners and administrators. Defaults to false, preserving existing behavior.
• Add SMS Pumping Protection GET and POST API

Ai

• Removing ai workbench apis

Api

• Add missing uri property to the twiml_session resource

Data-ingress

• 2026-08-07

• Removed 1 API path:
• /v1/DataQuery (Realtime DataQuery)

• 2026-07-07

• Added 1 new API path (data plane):
• /v1/DataQuery (Realtime DataQuery)

• 2026-06-17

• Content updates:
• Added properties to OAuthJWTBearerCredentials: privateKey, privateKeyPassphrase

• 2026-06-12

• Added 16 new path(s):
• /v1/DataSyncs/{syncId} (FetchDataSync)
• /v1/CloudAppSources/{sourceId}/Objects (ListCloudAppObjects)
• /v1/WarehouseSources/{sourceId}/Preview (CreateWarehousePreview)
• /v1/WarehouseSources/{sourceId}/Preview/{operationId} (FetchWarehousePreview)
• /v1/DataSample/{operationId} (FetchDataSample)
• /v1/ControlPlane/CloudAppSources/{sourceId} (FetchCloudAppSource, PatchCloudAppSource, DeleteCloudAppSource)
• /v1/ControlPlane/CloudAppSources/{sourceId}/Datasets (ListCloudAppDatasets, CreateCloudAppDataset)
• /v1/ControlPlane/CloudAppSources/{sourceId}/Datasets/{datasetId} (FetchCloudAppDataset, PatchCloudAppDataset, DeleteCloudAppDataset)
• /v1/ControlPlane/WarehouseSources/{sourceId} (FetchWarehouseSource, PatchWarehouseSource, DeleteWarehouseSource)
• /v1/ControlPlane/WarehouseSources/{sourceId}/Datasets (ListWarehouseDatasets, CreateWarehouseDataset)
• ...and 6 more paths
• Removed 16 path(s):
• /v1/DataSyncs/{SyncId} (FetchDataSync)
• /v1/CloudAppSources/{SourceId}/Objects (ListCloudAppObjects)
• /v1/WarehouseSources/{SourceId}/Preview (CreateWarehousePreview)
• /v1/WarehouseSources/{SourceId}/Preview/{OperationId} (FetchWarehousePreview)
• /v1/DataSample/{OperationId} (FetchDataSample)
• /v1/ControlPlane/CloudAppSources/{SourceId} (FetchCloudAppSource, PatchCloudAppSource, DeleteCloudAppSource)
• /v1/ControlPlane/CloudAppSources/{SourceId}/Datasets (ListCloudAppDatasets, CreateCloudAppDataset)

... (truncated)

Commits

• 306691e Fix tag validation regex in deploy.yml (#954)
• a7c1450 Update Python version matrix in deploy.yml (#953)
• eba3466 [Librarian] Regenerated @ f443c9dfa233e41d0e61c9ed6ca2b162467a08b5 89762bc866...
• fbdfe4e Update deployment trigger to all tags (#950)
• 3a5e24d Comment out docs generation verification step (#952)
• 89689b2 handle-blank-response-202 (#949)
• 3b82ae1 Remove assistant apis cluster test (#948)
• 184b583 fix: updates to release process (#941)
• becbfc5 removed oauth beta maturity from readme (#943)
• ecf51ac Add test and release gate workflow (#940)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions