Chore(deps): Bump the python-dependencies group across 1 directory with 101 updates

[dependabot]

Bumps the python-dependencies group with 101 updates in the / directory:

Package	From	To
alembic	1.18.4	1.18.5
altair	6.0.0	6.2.2
anyio	4.12.1	4.14.1
asttokens	3.0.1	3.0.2
async-lru	2.1.0	2.3.0
attrs	25.4.0	26.1.0
beautifulsoup4	4.14.3	4.15.0
bleach	6.3.0	6.4.0
cachetools	6.2.6	7.1.4
certifi	2026.1.4	2026.6.17
cffi	2.0.0	2.1.0
charset-normalizer	3.4.4	3.4.9
click	8.3.1	8.4.2
cryptography	46.0.7	49.0.0
debugpy	1.8.20	1.8.21
decorator	5.2.1	5.3.1
distlib	0.4.0	0.4.3
filelock	3.28.0	3.29.7
fonttools	4.61.1	4.63.0
gitpython	3.1.46	3.1.50
groq	0.37.1	1.5.0
idna	3.11	3.18
imbalanced-learn	0.14.1	0.14.2
ipykernel	7.2.0	7.3.0
ipython	9.10.0	9.15.0
jedi	0.19.2	0.20.0
json5	0.13.0	0.15.0
jsonpointer	3.0.0	3.1.1
jupyter-events	0.12.0	0.12.1
jupyter-lsp	2.3.0	2.3.1
jupyter-client	8.8.0	8.9.1
jupyter-server	2.17.0	2.20.0
jupyterlab	4.5.4	4.6.1
kiwisolver	1.4.9	1.5.0
langchain	1.2.15	1.3.13
langchain-core	1.3.0	1.4.9
langchain-groq	1.1.2	1.1.3
langgraph	1.1.8	1.2.9
langgraph-checkpoint	4.0.2	4.1.1
langgraph-prebuilt	1.0.10	1.1.0
langgraph-sdk	0.3.13	0.4.2
langsmith	0.7.32	0.10.2
llvmlite	0.46.0b1	0.48.0
mako	1.3.10	1.3.12
markupsafe	2.1.5	3.0.3
matplotlib	3.10.8	3.11.0
matplotlib-inline	0.2.1	0.2.2
mistune	3.2.0	3.3.3
narwhals	2.16.0	2.23.0
nbclient	0.10.4	0.11.0
nbconvert	7.17.0	7.17.1
notebook	7.5.3	7.6.0
numba	0.63.0b1	0.66.0
numpy	2.4.2	2.5.1
optuna	4.7.0	4.9.0
orjson	3.11.8	3.11.9
packaging	26.0	26.2
pandas	2.3.3	3.0.3
parso	0.8.6	0.8.7
pdfminer-six	20251230	20260107
pdfplumber	0.11.9	0.11.10
pillow	12.1.1	12.3.0
platformdirs	4.5.1	4.10.0
plotly	5.18.0	6.9.0
pre-commit	4.5.1	4.6.0
prometheus-client	0.24.1	0.25.0
protobuf	6.33.5	7.35.1
pyarrow	23.0.0	25.0.0
pydantic	2.13.2	2.13.4
pydantic-core	2.46.2	2.47.0
pydeck	0.9.1	0.9.3
pygments	2.19.2	2.20.0
pypdfium2	5.7.0	5.11.0
pytest	9.0.3	9.1.1
python-discovery	1.2.2	1.4.4
python-json-logger	4.0.0	4.1.0
pytz	2025.2	2026.2
requests	2.32.5	2.34.2
rpds-py	0.30.0	2026.6.3
ruff	0.15.11	0.15.21
scikit-learn	1.8.0	1.9.0
scipy	1.17.0	1.18.0
setuptools	82.0.0	83.0.0
shap	0.50.0	0.52.0
sklearn-compat	0.1.5	0.1.6
smmap	5.0.2	5.0.3
soupsieve	2.8.3	2.8.4
sqlalchemy	2.0.47	2.0.51
streamlit	1.54.0	1.59.1
tinycss2	1.4.0	1.5.1
tornado	6.5.4	6.5.7
tqdm	4.67.3	4.68.4
traitlets	5.14	5.15.1
typing-extensions	4.15.0	4.16.0
tzdata	2025.3	2026.3
urllib3	2.6.3	2.7.0
uuid-utils	0.14.1	0.17.0
virtualenv	21.2.4	21.6.1
wcwidth	0.6.0	0.8.2
xgboost	2.1.4	3.3.0
xxhash	3.6.0	3.8.1

Updates alembic from 1.18.4 to 1.18.5

Release notes

Sourced from alembic's releases.

1.18.5

Released: June 25, 2026

usecase

• [usecase] [commands] Added --splice support to the merge() command. Previously, the merge command would suggest using --splice when attempting to merge non-head revisions, but the flag was not actually accepted by the command. The splice parameter is now available in both the command-line interface and the command.merge() function, matching the existing support in command.revision(). Pull request courtesy Kadir Can Ozden.

  References: #1712

• [usecase] [environment] Added ScriptDirectory.get_heads.consider_depends_on parameter to ScriptDirectory.get_heads(). When set to True, head revisions that are also a dependency of another revision via depends_on are excluded from the result, matching the effective heads that would be present in the alembic_version table after running all upgrades.

  References: #1806

bug

• [bug] [autogenerate] Fixed rendering of dialect keyword arguments containing ~sqlalchemy.schema.Column objects within sequences, such as postgresql_include. These were previously rendered using repr(), producing invalid Python in the generated migration scripts. Column objects within list or tuple values are now correctly rendered as their string column names. Pull request courtesy Ajay Singh.

  References: #1258

• [bug] [mysql] Implemented type comparison for ENUM datatypes on MySQL, which checks that the individual enum values are equivalent. If additional entries are on either side, this generates a diff. Changes of order do not generate a diff. Pull request courtesy Furkan Köykıran.

  References: #1745, #779

• [bug] [operations] Fixed bug where the inline_references parameter of Operations.add_column() did not include foreign key referential actions such as ON DELETE, ON UPDATE, DEFERRABLE, INITIALLY, and MATCH when rendering the inline REFERENCES clause.

... (truncated)

Commits

• See full diff in compare view

Updates altair from 6.0.0 to 6.2.2

Release notes

Sourced from altair's releases.

Version 6.2.2

What's Changed

Bug Fixes

• fix: Avoid layered concat view name collisions by @​joelostblom in vega/altair#4066
• fix: Include layered concat views in selection params by @​joelostblom in vega/altair#4069

Documentation

• docs: Add an Andrews curves example to the gallery by @​kyo5uke in vega/altair#4049
• docs: Add an interactive bin-size example to the gallery by @​kyo5uke in vega/altair#4050
• docs: Validate docs publish clone by @​joelostblom in vega/altair#4064
• docs: Fix broken example and sync with VL by @​joelostblom in vega/altair#4010

Maintenance

• ci: Make warning for doc preview page more prominent by @​joelostblom in vega/altair#4048
• ci: Check uv lockfile by @​joelostblom in vega/altair#4052
• ci: Run docs build only for docs-related changes and don't duplicate builds on PRs by @​joelostblom in vega/altair#4053
• build: Update dependencies from dependabot alerts by @​joelostblom in vega/altair#4055
• ci: Upload docs build artifact for PR preview by @​joelostblom in vega/altair#4056
• build: Reduce dependabot PRs by @​joelostblom in vega/altair#4028
• ci: Correctly resolve docbuild worflow number from PR number by @​joelostblom in vega/altair#4060
• ci: Group major GitHub Actions updates by @​joelostblom in vega/altair#4061
• ci: Rename docbuild job from 'build' to 'docbuild' by @​joelostblom in vega/altair#4062
• ci: Schedule release drafts twice monthly by @​joelostblom in vega/altair#4057
• ci: Publish official docs after release is published by @​joelostblom in vega/altair#4054
• ci: Document how local versioning works and add base tag by @​joelostblom in vega/altair#4051
• ci: Disambiguate workflow naming by @​joelostblom in vega/altair#4063
• ci: enable partial Python 3.14t coverage by @​axelray-dev in vega/altair#4038

New Contributors

• @​kyo5uke made their first contribution in vega/altair#4049

Full Changelog: vega/altair@v6.2.1...v6.2.2

Version 6.2.1

What's Changed

Bug Fixes

• fix: Write dataset cache files atomically by @​joelostblom in vega/altair#4034

Maintenance

• ci: Prevent uv from dirtying worktree during publish by @​joelostblom in vega/altair#4045
• ci: Clarify release review instructions by @​joelostblom in vega/altair#4046

Full Changelog: vega/altair@v6.2.0...v6.2.1

Version 6.2.0

This is the first release in an effort to have smaller, more frequent releases going forward. By making the release process more convenient, we aim to more quickly push out fixes and features that already landed on the main branch to a released version of Altair.

... (truncated)

Commits

• a976571 fix: Include layered concat views in selection params (#4069)
• 432157b fix: Avoid layered concat view name collisions (#4066)
• b875b95 docs: Fix a broken example and sync another one with VL (#4010)
• 7b289f9 ci: Enable partial Python 3.14t coverage (#4038)
• 105ff2b docs: Validate docs publish clone (#4064)
• c82dd2e ci: Disambiguate workflow naming (#4063)
• 624bee9 docs: Add an interactive bin-size example to the gallery (#4050)
• 3b1acf6 docs: Add an Andrews curves example to the gallery (#4049)
• edea5f6 ci: Document how local versioning works and add base tag (#4051)
• f8b4337 ci: Publish official docs after release is published (#4054)
• Additional commits viewable in compare view

Updates anyio from 4.12.1 to 4.14.1

Release notes

Sourced from anyio's releases.

4.14.1

• Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
• Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)

4.14.0

• Added support for Python 3.15

• Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)

• Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)

• Added support for custom capacity limiters in async path and file I/O functions and classes

• Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)

• Changed TaskGroup.start_soon() to return a TaskHandle

• Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)

• Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope

• Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)

• Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)

• Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)

• Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:

  • TaskGroup.start_soon()
  • TaskGroup.start()
  • anyio.from_thread.run()

  This reverts an earlier change from v3.7.0 which was made in error. (#1153)

• Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)

• Changed several classes (and their subclasses) to have __slots__ (with __weakref__):

  • anyio.CancelScope
  • anyio.CapacityLimiter
  • anyio.Condition
  • anyio.Event
  • anyio.Lock
  • anyio.ResourceGuard
  • anyio.Semaphore

• Fixed cancellation exception escaping a cancel scope when triggered via check_cancelled() in a worker thread (#1113)

• Fixed TaskGroup raising AttributeError instead of a clear error when entered more than once (#1109; PR by @​bahtya)

... (truncated)

Commits

• 149b9e9 Bumped up the version
• 377518c Bump actions/checkout from 6 to 7 in the github-actions group (#1186)
• b42a2f5 [pre-commit.ci] pre-commit autoupdate (#1185)
• 3ceb6ff Allow 0 tokens in a CapacityLimiter instantiated outside an event loop (#1183)
• e10d1db Add missing await to open_file() in file I/O concurrency example (#1182)
• 1dbc3b6 OutcomeException should not discard test runner_task (#1180)
• ffe9133 Bumped up the version
• f8b9f01 Fixed asyncio lock waiter deadlocks after cancellation (#1145)
• d517ee1 [pre-commit.ci] pre-commit autoupdate (#1176)
• 550b68e Make anyio.run support Awaitable at runtime on all backends (#1171)
• Additional commits viewable in compare view

Updates asttokens from 3.0.1 to 3.0.2

Release notes

Sourced from asttokens's releases.

v3.0.2

What's Changed

• Modernize type annotations by @​AlexWaygood in gristlabs/asttokens#172
• Fix pypy CI by skipping redundant mypy runs on it by @​dsagal in gristlabs/asttokens#173
• Fix IndexError on source mixing lone CR with LF line endings (#105) by @​apoorvdarshan in gristlabs/asttokens#174
• Release modernization, and publish to PyPI from CI via trusted publishing by @​dsagal in gristlabs/asttokens#175

New Contributors

• @​AlexWaygood made their first contribution in gristlabs/asttokens#172
• @​apoorvdarshan made their first contribution in gristlabs/asttokens#174

Full Changelog: gristlabs/asttokens@v3.0.1...v3.0.2

Commits

• f97a6e1 Release modernization, and publish to PyPI from CI via trusted publishing (#175)
• bb3c487 Fix IndexError on source mixing lone CR with LF line endings (#105) (#174)
• d1eed10 Fix pypy CI by skipping redundant mypy runs on it (#173)
• b8834d3 Modernize type annotations (#172)
• See full diff in compare view

Updates async-lru from 2.1.0 to 2.3.0

Release notes

Sourced from async-lru's releases.

2.3.0

• Added cache_contains() for read-only key lookup.
• Changed cross-loop cache access to auto-reset and rebind to the current event loop.
• Added AlruCacheLoopResetWarning when an auto-reset happens due to event loop change.
• Forwarded cache_close(wait=...) for bound methods.

2.2.0

• Added a jitter parameter to randomise TTL.
• Raise RuntimeError when cache is used by different loop.

Changelog

Sourced from async-lru's changelog.

2.3.0 (2026-03-18)

• Added cache_contains() for read-only key lookup.
• Changed cross-loop cache access to auto-reset and rebind to the current event loop.
• Added AlruCacheLoopResetWarning when an auto-reset happens due to event loop change.
• Forwarded cache_close(wait=...) for bound methods.

2.2.0 (2026-02-20)

• Added a jitter parameter to randomise TTL.
• Raise RuntimeError when cache is used by different loop.

Commits

• cb9e034 Release v2.3.0 (#748)
• a2aa7b0 build(deps): bump coverage from 7.13.4 to 7.13.5 (#747)
• 63760a4 feat: add cache_contains() for read-only key lookup (#746)
• e2ddf7a Forward cache_close(wait=...) for bound methods (#745)
• 33e1a7c Emit AlruCacheLoopResetWarning on event loop auto-reset (#744)
• fff4d49 feat: Allow alru_cache to automatically clear and rebind to the current eve...
• 7ef00b7 Release v2.2.0 (#741)
• 01db639 fix: avoid binding loop for invalid cache keys (#740)
• c6acbe8 build(deps): bump pytest-codspeed from 4.2.0 to 4.3.0 (#738)
• 8783cf7 build(deps): bump coverage from 7.13.3 to 7.13.4 (#737)
• Additional commits viewable in compare view

Updates attrs from 25.4.0 to 26.1.0

Release notes

Sourced from attrs's releases.

26.1.0

Highlights

The main outward change here only affects people using field transformers, but it should be a nice quality of life improvement!

Full changelog below!

Special Thanks

This release would not be possible without my generous sponsors! Thank you to all of you making sustainable maintenance possible! If you would like to join them, go to https://github.com/sponsors/hynek and check out the sweet perks!

Above and Beyond

Variomedia AG (@variomedia), Tidelift (@tidelift), Kraken Tech (@kraken-tech), Privacy Solutions GmbH (@privacy-solutions), FilePreviews (@filepreviews), Ecosystems (@ecosyste-ms), TestMu AI Open Source Office (Formerly LambdaTest) (@LambdaTest-Inc), Doist (@Doist), Daniel Fortunov (@asqui), and Kevin P. Fleming (@kpfleming).

Maintenance Sustainers

Buttondown (@buttondown), Christopher Dignam (@chdsbd), Magnus Watn (@magnuswatn), David Cramer (@dcramer), Rivo Laks (@rivol), Polar (@polarsource), Mike Fiedler (@miketheman), Duncan Hill (@cricalix), Colin Marquardt (@cmarqu), Pieter Swinkels (@swinkels), Nick Libertini (@libertininick), Brian M. Dennis (@crossjam), Celebrity News AG (@celebritynewsag), The Westervelt Company (@westerveltco), Sławomir Ehlert (@slafs), Mostafa Khalil (@khadrawy), Filip Mularczyk (@mukiblejlok), Thomas Klinger (@thmsklngr), Andreas Poehlmann (@ap--), August Trapper Bigelow (@atbigelow), Carlton Gibson (@carltongibson), and Roboflow (@roboflow).

Full Changelog

Backwards-incompatible Changes

• Field aliases are now resolved before calling field_transformer, so transformers receive fully populated Attribute objects with usable alias values instead of None. The new Attribute.alias_is_default flag indicates whether the alias was auto-generated (True) or explicitly set by the user (False). #1509

Changes

• Fix type annotations for attrs.validators.optional(), so it no longer rejects tuples with more than one validator. #1496
• The attrs.validators.disabled() contextmanager can now be nested. #1513
• Frozen classes can set on_setattr=attrs.setters.NO_OP in addition to None. #1515
• It's now possible to pass attrs instances in addition to attrs classes to attrs.fields(). #1529

---

This release contains contributions from @​bysiber, @​DavidCEllis, @​finite-state-machine, @​hynek, @​veeceey, and @​vstinner.

Artifact Attestations

You can verify this release's artifact attestions using GitHub's CLI tool by downloading the sdist and wheel from PyPI and running:

$ gh attestation verify --owner python-attrs attrs-26.1.0.tar.gz

... (truncated)

Changelog

Sourced from attrs's changelog.

26.1.0 - 2026-03-19

Backwards-incompatible Changes

• Field aliases are now resolved before calling field_transformer, so transformers receive fully populated Attribute objects with usable alias values instead of None. The new Attribute.alias_is_default flag indicates whether the alias was auto-generated (True) or explicitly set by the user (False). #1509

Changes

• Fix type annotations for attrs.validators.optional(), so it no longer rejects tuples with more than one validator. #1496
• The attrs.validators.disabled() contextmanager can now be nested. #1513
• Frozen classes can set on_setattr=attrs.setters.NO_OP in addition to None. #1515
• It's now possible to pass attrs instances in addition to attrs classes to attrs.fields(). #1529

Commits

• 7bfc49e Prepare 26.1.0
• 31e0286 Update test_validators.py for Python 3.15a7 (#1530)
• 48b8611 Add instance support to attrs.fields() (#1529)
• 3a68d49 dev: document missing git tags failure mode
• a572c3a Allow field(on_setattr=NO_OP) on frozen classes
• af9c510 Fix validators.disabled() to save/restore state on nesting (#1513)
• ab7f8b2 update dev
• ce89f5d Fix message passing in frozen errors
• eccd966 Fix optional validator to accept tuples of len > 1 (#1496)
• e92fe52 policies: tighten screws (#1528)
• Additional commits viewable in compare view

Updates beautifulsoup4 from 4.14.3 to 4.15.0

Updates bleach from 6.3.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

• Dropped support for pypy 3.10. (#764)

Security fixes

• Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

  Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

  For example::

  import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

  outputs::

  'Click'

  See the advisory for details.

• Fix GHSA-gj48-438w-jh9v.

  Fix issue where URI sanitization wasn't happening in formaction attributes.

  See the advisory for details.

Bug fixes

• Add support for pypy 3.11. (#764)

• Drop version max in tinycss2 pin. (#772)

  This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Commits

• f0355a7 fix: fix last release date in CHANGES
• ae4e8a2 chore: bleach 6.4.0 and final release
• 970df58 fix: uri-sanitization in formaction attributes
• 7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
• 913ab75 fix: reduce redundancy in workflow jobs
• 218c15a fix: rework pip caching
• 4f0b097 fix: fix tox platform restrictions
• e95a79d chore: update pytest
• 91539d4 Bump actions/cache from 5.0.3 to 5.0.4
• cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
• Additional commits viewable in compare view

Updates cachetools from 6.2.6 to 7.1.4

Changelog

Sourced from cachetools's changelog.

v7.1.4 (2026-05-22)

• Minor unit test improvements.

• Update build environment.

v7.1.3 (2026-05-18)

• Minor type stub improvements.

• Update build environment.

v7.1.2 (2026-05-16)

• Minor type stub improvements.

• Minor documentation improvements.

• Modernize build environment.

v7.1.1 (2026-05-03)

• Various type stub improvements.

v7.1.0 (2026-05-01)

• Add type stubs based on the work of the good people at typeshed <https://github.com/python/typeshed/tree/main/stubs/cachetools/>__.

• Update unit tests.

v7.0.6 (2026-04-20)

• Minor code improvements.

• Update project URLs.

• Update CI environment.

... (truncated)

Commits

• 48284d7 Release v7.1.4.
• 55ea96b Update build environment.
• c5439fe Add threading tests for lock-only decorators.
• 91828fc Run threading tests unconditionally with timeout.
• 16952ed Release v7.1.3.
• 92dd756 Prepare v7.1.3.
• ced08f5 Improve cachetools.func type stubs.
• d809d7b Update build environment.
• c84b5e5 Release v7.1.2.
• 39ad61c Prepare v7.1.2.
• Additional commits viewable in compare view

Updates certifi from 2026.1.4 to 2026.6.17

Commits

• d0ac52f 2026.06.17 (#418)
• d46de62 Bump actions/checkout from 6.0.2 to 6.0.3 (#417)
• 6c183ec fix: update Requests docs link to canonical URL (#415)
• 36e3568 Bump dessant/lock-threads from 6.0.0 to 6.0.2
• d7ea151 2026.05.20 (#413)
• 5dddfb0 2026.04.22 (#410)
• f99eccd Bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (#404)
• 918bed0 Bump actions/upload-artifact from 7.0.0 to 7.0.1 (#405)
• 0a49067 Bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 (#403)
• acf6ce8 Bump actions/download-artifact from 8.0.0 to 8.0.1 (#398)
• Additional commits viewable in compare view

Updates cffi from 2.0.0 to 2.1.0

Release notes

Sourced from cffi's releases.

v2.1.0

• Added support for Python 3.15 and support for C extensions generated by CFFI to target the new abi3t free-threaded ABI.
• Dropped support for Python 3.9.
• Added cffi-gen-src CLI to generate CFFI C extension source for alternate build backend support.
• Fixed crashes inside __delitem__.
• Fixed "string too big" error under MSVC.
• Fixed mingw builds.
• Added support for arm64 iOS wheels.

Commits

• d9f6f70 New release 2.1.0
• 02a7b0e Misc pre-2.1 release/packaging cleanup (#253)
• 1362e5d Move cffi-gen-src release note to 2.1.0 notes
• a797055 Make error message when embedding version test fails more friendly
• f1f40a8 Update changelog
• dc62c93 Delete missed cp39 Windows builds
• a341180 Update version numbers to prepare for v2.1 release
• 9f04d85 Mark test using inet_ntoa as thread-unsafe
• 5f12702 Fix flaky pytest-run-parallel CI crash
• 26b3d3a Merge branch 'main' into integrate-buildtool
• Additional commits viewable in compare view

Updates charset-normalizer from 3.4.4 to 3.4.9

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

• Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

Version 3.4.8

3.4.8 (2026-07-06)

Fixed

• Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
• Unnecessary json import at runtime (#753)
• Inverse capitalization not seen by noise detector (#731)

Changed

• No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.
• Micro-optimizations in our noise / coherence measurements.
• No longer using regex search by default for our preemptive charset mark algorithm.
• Raised upperbound of setuptools to v83.
• Raised upperbound of mypy(c) to v2.1.

Removed

• Redundant UTF7 BOM marker (#730)

Version 3.4.7

3.4.7 (2026-04-02)

Changed

• Pre-built optimized version using mypy[c] v1.20.
• Relax setuptools constraint to setuptools>=68,<82.1.

Fixed

• Correctly remove SIG remnant in utf-7 decoded string. (#718) (#716)

Version 3.4.6

3.4.6 (2026-03-15)

Changed

• Flattened the logic in charset_normalizer.md for higher performance. Removed eligible(..) and feed(...) in favor of feed_info(...).
• Raised upper bound for mypy[c] to 1.20, for our optimized version.
• Updated UNICODE_RANGES_COMBINED using Unicode blocks v17.

Fixed

• Edge case where noise difference between two candidates can be almost insignificant. (#672)
• CLI --normalize writing to wrong path when passing multiple files in. (#702)

Misc

• Freethreaded pre-built wheels now shipped in PyPI starting with 3.14t. (#616)

... (truncated)

Changelog

Sourced from charset-normalizer's changelog.

3.4.9 (2026-07-07)

Fixed

• Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

3.4.8 (2026-07-06)

Fixed

• Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
• Unnecessary json import at runtime (#753)
• Inverse capitalization not seen by noise detector (#731)

Changed

• No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.
• Micro-optimizations in our noise / coherence measurements.
• No longer using regex search by default for our preemptive charset mark algorithm.
• Raised upperbound of setuptools to v83.
• Raised upperbound of mypy(c) to v2.1.

Removed

• Redundant UTF7 BOM marker (#730)

3.4.7 (2026-04-02)

Changed

• Pre-built optimized version using mypy[c] v1.20.
• Relax setuptools constraint to setuptools>=68,<82.1.

Fixed

• Correctly remove SIG remnant in utf-7 decoded string. (#718) (#716)

3.4.6 (2026-03-15)

Changed

• Flattened the logic in charset_normalizer.md for higher performance. Removed eligible(..) and feed(...) in favor of feed_info(...).
• Raised upper bound for mypy[c] to 1.20, for our optimized version.
• Updated UNICODE_RANGES_COMBINED using Unicode blocks v17.

Fixed

• Edge case where noise difference between two candidates can be almost insignificant. (#672)
• CLI --normalize writing to wrong path when passing multiple files in. (#702)

Misc

• Freethreaded pre-built wheels now shipped in PyPI starting with 3.14t. (#616)

3.4.5 (2026-03-06)

Changed

... (truncated)

Commits

• cc68407 Merge pull request #772 from jawah/fix-regression-fallback-path
• 152b923 chore: release 3.4.9
• 2bc2607 fix: unicodedecodeerror in fallbac...

  Description has been truncated