Skip to content

build(deps): bump the production-dependencies group across 1 directory with 3 updates#49

Open
dependabot[bot] wants to merge 1 commit intostagingfrom
dependabot/pip/staging/production-dependencies-a7f6a02309
Open

build(deps): bump the production-dependencies group across 1 directory with 3 updates#49
dependabot[bot] wants to merge 1 commit intostagingfrom
dependabot/pip/staging/production-dependencies-a7f6a02309

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 30, 2026

Bumps the production-dependencies group with 3 updates in the / directory: gunicorn, requests and twilio.

Updates gunicorn from 25.1.0 to 25.3.0

Release notes

Sourced from gunicorn's releases.

Gunicorn 25.3.0

Bug Fixes

  • HTTP/2 ASGI Body Duplication: Fix request body being received twice in HTTP/2 ASGI requests, causing JSON parsing errors with "Extra data" messages (#3558)

  • ASGI Chunked EOF Handling: Add finish() method to callback parser to handle chunked encoding edge case where connection closes before final CRLF after zero-chunk

  • HTTP/2 Documentation: Fix http_protocols examples to use comma-separated string instead of list syntax (#3561)

  • Chunked Encoding: Reject chunk extensions containing bare CR bytes per RFC 9112 (#3556)

  • Request Line Limit: Fix --limit-request-line 0 to mean unlimited as documented, instead of using default maximum. Works with both Python and fast C parser. (#3563)

Security

  • ASGI Parser Header Validation: Add security checks per RFC 9110/9112:
    • Reject duplicate Content-Length headers
    • Reject requests with both Content-Length and Transfer-Encoding
    • Reject chunked transfer encoding in HTTP/1.0
    • Reject stacked chunked encoding
    • Validate Transfer-Encoding values
    • Strict chunk size validation

Changes

  • Fast HTTP Parser: Update to gunicorn_h1c >= 0.6.3 for asgi_headers property and InvalidChunkExtension validation for bare CR rejection

  • ASGI PROXY Protocol: Add PROXY protocol v1/v2 support to callback parser

  • Docker Images: Update to Python 3.14

Gunicorn 25.2.0

New Features

  • Fast HTTP Parser (gunicorn_h1c 0.4.1): Integrate new exception types and limit parameters from gunicorn_h1c 0.4.1 for both WSGI and ASGI workers
    • Requires gunicorn_h1c >= 0.4.1 for http_parser='fast'
    • Falls back to Python parser in auto mode if version not met
    • Proper HTTP status codes for limit errors (414, 431)

Bug Fixes

  • uWSGI Async Workers: Fix InvalidUWSGIHeader: incomplete header error when using gevent or gthread workers with uwsgi protocol behind nginx. (#3552, [PR #3554](benoitc/gunicorn#3554))

... (truncated)

Commits
  • 9bce72c Update changelog with missing 25.3.0 changes
  • 2a15fdb Fix pylint isinstance-second-argument-not-valid-type warning
  • 8d08aaa Fix --limit-request-line 0 to mean unlimited
  • d40a374 Fix pytest-asyncio configuration and treq_asgi hex escapes
  • da8bd48 Remove unused AsyncRequest class
  • b00f125 Integrate gunicorn_h1c 0.6.3 with InvalidChunkExtension support
  • bdb2ebd Reject chunk extensions with bare CR bytes (RFC 9112)
  • 7057fc9 Fix http_protocols documentation to use string syntax
  • d43acb8 Update to gunicorn_h1c >= 0.6.2 for asgi_headers support
  • cbd27e8 Merge pull request #3559 from benleembruggen/fix/http2-asgi-body-duplication
  • Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.
Commits
  • bc04dfd v2.33.0
  • 66d21cb Merge commit from fork
  • 8b9bc8f Move badges to top of README (#7293)
  • e331a28 Remove unused extraction call (#7292)
  • 753fd08 docs: fix FAQ grammar in httplib2 example
  • 774a0b8 docs(socks): same block as other sections
  • 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
  • ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
  • 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
  • d568f47 docs: clarify Quickstart POST example (#6960)
  • Additional commits viewable in compare view

Updates twilio from 9.10.2 to 9.10.4

Release notes

Sourced from twilio's releases.

9.10.4

Release Notes

Data-ingress

  • API Changes

  • 2026-03-23

  • Added stage-us1 to supportedRealms for all endpoints

  • 2026-03-20

  • Content updates:
  • Removed estimatedCompletionTime from LongRunningOperationResponse
  • Moved operationId from LongRunningOperationResponse to headers

  • 2026-03-18

  • Added 1 new path(s):
  • /v1/ControlPlane/Operations/{OperationId} (GetControlPlaneOperationStatus)

  • 2026-03-11

  • Minor updates (formatting, metadata)

  • 2026-03-11

  • Minor updates (formatting, metadata)

  • 2026-03-11

  • Minor updates (formatting, metadata)

  • 2026-03-11

  • Minor updates (formatting, metadata)

  • 2026-03-11

  • Minor updates (formatting, metadata)

  • 2026-03-05

  • Initial release with 10 paths and 22 operations

Memory

  • 2026-03-19

  • Added 1 new path(s):
  • /v1/ControlPlane/Operations/{operationId} (FetchOperation)

  • 2026-03-11

  • Minor updates (formatting, metadata)

Docs

9.10.3

Release Notes

Twiml

  • Rename recording_configuration to recording_configuration_id attribute in <Conference>, <Dial>, <Record> verbs and <Recording> noun

Ace

  • ACE Signals API Changes

  • 2026-02-18

  • Initial release: POST /signals, GET/POST /signals/{signal_id}/results, GET /health
  • Enables OneAdmin integration for synchronous signal ingestion and policy result polling
  • Supports permission-based authorization for signal operations
  • Health endpoint available for monitoring without authentication

... (truncated)

Changelog

Sourced from twilio's changelog.

[2026-03-24] Version 9.10.4

Data-ingress

  • API Changes

  • 2026-03-23

  • Added stage-us1 to supportedRealms for all endpoints

  • 2026-03-20

  • Content updates:
  • Removed estimatedCompletionTime from LongRunningOperationResponse
  • Moved operationId from LongRunningOperationResponse to headers

  • 2026-03-18

  • Added 1 new path(s):
  • /v1/ControlPlane/Operations/{OperationId} (GetControlPlaneOperationStatus)

  • 2026-03-11

  • Minor updates (formatting, metadata)

  • 2026-03-11

  • Minor updates (formatting, metadata)

  • 2026-03-11

  • Minor updates (formatting, metadata)

  • 2026-03-11

  • Minor updates (formatting, metadata)

  • 2026-03-11

  • Minor updates (formatting, metadata)

  • 2026-03-05

  • Initial release with 10 paths and 22 operations

Memory

  • 2026-03-19

  • Added 1 new path(s):
  • /v1/ControlPlane/Operations/{operationId} (FetchOperation)

  • 2026-03-11

  • Minor updates (formatting, metadata)

[2026-03-10] Version 9.10.3

Twiml

  • Rename recording_configuration to recording_configuration_id attribute in <Conference>, <Dial>, <Record> verbs and <Recording> noun

Ace

  • ACE Signals API Changes

  • 2026-02-18

  • Initial release: POST /signals, GET/POST /signals/{signal_id}/results, GET /health
  • Enables OneAdmin integration for synchronous signal ingestion and policy result polling
  • Supports permission-based authorization for signal operations
  • Health endpoint available for monitoring without authentication

Api

  • Added optional parameter Confirmation to Payments create endpoint to enable payment confirmation prompt before gateway submission
  • Added optional parameter RequireMatchingInputs to Payments create endpoint for input confirmation in agent-assisted payment flows

... (truncated)

Commits
  • a3ea20d Release 9.10.4
  • 09318f2 [Librarian] Regenerated @ 6e3b90a45885c596ade6b11ff7100254b15c9403 c02f66cc96...
  • 2e9d66f Release 9.10.3
  • 7319870 [Librarian] Regenerated @ 6e3b90a45885c596ade6b11ff7100254b15c9403 b84ee26554...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the production-dependencies group across 1 director…
5cca120 
…y with 3 updates

Bumps the production-dependencies group with 3 updates in the / directory: [gunicorn](https://github.com/benoitc/gunicorn), [requests](https://github.com/psf/requests) and [twilio](https://github.com/twilio/twilio-python).


Updates `gunicorn` from 25.1.0 to 25.3.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@25.1.0...25.3.0)

Updates `requests` from 2.32.5 to 2.33.0
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.5...v2.33.0)

Updates `twilio` from 9.10.2 to 9.10.4
- [Release notes](https://github.com/twilio/twilio-python/releases)
- [Changelog](https://github.com/twilio/twilio-python/blob/main/CHANGES.md)
- [Commits](twilio/twilio-python@9.10.2...9.10.4)

---
updated-dependencies:
- dependency-name: gunicorn
  dependency-version: 25.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: twilio
  dependency-version: 9.10.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Mar 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants