chore(deps): bump the dependencies group across 1 directory with 36 updates

[dependabot]

Bumps the dependencies group with 36 updates in the /src/backend directory:

Package	From	To
boto3	1.43.97	1.43.107
botocore	1.43.97	1.43.107
charset-normalizer	3.5.1	3.5.2
cryptography	50.0.1	50.0.2
django	5.2.17	6.1.1
django-allauth	65.19.6	65.19.7
django-ipware	7.0.1	8.0.0
django-js-asset	4.1.0	4.2.0
django-otp	1.3.0	1.7.3
fonttools	4.65.0	4.66.1
googleapis-common-protos	1.75.3	1.75.5
markdown	3.10.3	3.11
opentelemetry-exporter-otlp-proto-common	1.44.0	1.45.0
opentelemetry-exporter-otlp-proto-grpc	1.44.0	1.45.0
opentelemetry-exporter-otlp-proto-http	1.44.0	1.45.0
opentelemetry-instrumentation	0.65b0	0.66b0
opentelemetry-instrumentation-dbapi	0.65b0	0.66b0
opentelemetry-proto	1.44.0	1.45.0
opentelemetry-semantic-conventions	0.65b0	0.66b0
opentelemetry-util-http	0.65b0	0.66b0
platformdirs	4.11.10	4.12.2
pydantic-core	2.46.5	2.49.0
pyjwt	2.15.0	2.15.1
python-dotenv	1.2.3	1.2.4
python-ipware	3.0.0	4.1.1
scim2-models	0.6.12	0.10.2
sentry-sdk	2.69.2	2.71.0
wcwidth	0.8.4	0.9.1
wrapt	2.4.1	2.5.0
coverage	7.16.1	7.16.2
django-test-migrations	1.6.0	1.7.0
isort	9.0.1	9.0.2
prek	0.5.3	0.5.4
scim2-client	0.7.5	0.11.1
scim2-tester	0.2.8	0.5.0
ty	0.0.76	0.0.84

Updates boto3 from 1.43.97 to 1.43.107

Commits

• 402e09c Merge branch 'release-1.43.107'
• 4d32164 Bumping version to 1.43.107
• e6738b9 Add changelog entries from botocore
• c2a321b Bump https://github.com/astral-sh/ruff-pre-commit (#4855)
• 88630f8 Merge branch 'release-1.43.106'
• fac0859 Merge branch 'release-1.43.106' into develop
• eefb3fc Bumping version to 1.43.106
• 8878189 Add changelog entries from botocore
• 29c0d66 Merge branch 'release-1.43.105'
• 82c6dbe Merge branch 'release-1.43.105' into develop
• Additional commits viewable in compare view

Updates botocore from 1.43.97 to 1.43.107

Commits

• 646bd4e Merge branch 'release-1.43.107'
• ed29178 Bumping version to 1.43.107
• 6672725 Update endpoints model
• f19f55e Update to latest models
• ca596c7 Merge branch 'release-1.43.106'
• 96abf2d Merge branch 'release-1.43.106' into develop
• 1808528 Bumping version to 1.43.106
• 3d316f0 Update endpoints model
• 053554b Update to latest models
• e9bb16c Merge branch 'release-1.43.105'
• Additional commits viewable in compare view

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.
.. _v50-0-1:

Commits

• 4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
• 70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
• a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
• See full diff in compare view

Updates django from 5.2.17 to 6.1.1

Commits

• 249b13d [6.1.x] Bumped version for 6.1.1 release.
• 5f26fa8 [6.1.x] Added release date for 6.1.1.
• fdcf78a [6.1.x] Added remaining community package mentions to the documentation.
• 7241568 [6.1.x] Fixed #37222 -- Fixed QuerySet.distinct() crash on duplicated selecti...
• ef3fc80 [6.1.x] Fixed #37312, Refs #36605 -- Fixed annotation preservation and key se...
• b09cb6b [6.1.x] Clarified scope of object-level admin view permissions.
• a6d3aa2 [6.1.x] Corrected heading hierarchy in the admin actions documentation.
• 9031d41 [6.1.x] Clarified object-level permission checks in admin actions.
• fc805c6 [6.1.x] Fixed #37311 -- Prevented consumption of rhs iterators in annotation ...
• 4b0185a [6.1.x] Fixed #37300 -- Preserved parent instance hints on custom Prefetch qu...
• Additional commits viewable in compare view

Updates django-allauth from 65.19.6 to 65.19.7

Commits

• See full diff in compare view

Updates django-ipware from 7.0.1 to 8.0.0

Release notes

Sourced from django-ipware's releases.

django-ipware 8.0.0

django-ipware is now a thin Django wrapper over python-ipware 4.1, and uses its modern engine by default. from ipware import get_client_ip and get_client_ip(request) work unchanged.

Upgrade in one minute

• Python 3.10+ and Django 5.2+ are required. On older versions, pin django-ipware<8.
• Need exactly the 7.x results? Set IPWARE_ALGORITHM = "legacy" in settings.py, or pass algorithm="legacy". The legacy algorithm is frozen.
• Arguments now beat settings. In 7.x, IPWARE_META_PRECEDENCE_ORDER and IPWARE_STRICT silently overrode the matching arguments. If you relied on that, remove the argument or the setting.
• IPWARE_META_PROXY_COUNT works again. If it is in your settings, it is now enforced.
• Trusted proxies are stricter. A complete IP in proxy_trusted_ips matches exactly; it no longer also matches longer addresses such as 1.2.3.45 for "1.2.3.4". Use a CIDR or a prefix if you relied on that.
• Misconfiguration raises ValueError, e.g. an unknown proxy_order, a bare string for proxy_trusted_ips, or an empty entry.

What's better

• A better client IP: public > private > link-local > loopback, the first public hop of a chain, and multicast / 0.0.0.0 / reserved addresses are never returned.
• RFC 7239 Forwarded, NAT64 and IPv4-mapped addresses understood; malformed values rejected.
• is_routable follows python-ipware's ranking.
• New: strict=False / IPWARE_STRICT (#122), py.typed shipped (#124), correct Optional[str] return type (#126).

Quality

The original 7.x tests pass on both algorithms. Option-matrix tests check the modern path against python-ipware's modern engine and the legacy path against its v3 engine, with 100% line and branch coverage. CI covers Python 3.10–3.14 with Django 5.2, 6.0 and 6.1.

Thanks

@​hirotasoshu (#121, #122), @​streadway (#124), @​philipstarkey (#125), @​btruhand (#126), @​sujh (#127).

Full details: CHANGELOG.md.

Changelog

Sourced from django-ipware's changelog.

8.0.0

Built on python-ipware 4.1. The default algorithm is now python-ipware's modern engine; the 7.x behavior stays available, frozen, via algorithm="legacy" or IPWARE_ALGORITHM = "legacy".

Community (thank you!):

• Non-strict mode: get_client_ip(request, strict=False) or IPWARE_STRICT = False. By @​hirotasoshu (#122, closes #121).
• py.typed is shipped in the package, so type checkers see the annotations. By @​streadway (#124).
• CI tests currently supported Python and Django versions. By @​philipstarkey (#125).
• Return type is Tuple[Optional[str], bool]. Reported by @​btruhand (#126).
• IPWARE_META_PROXY_COUNT works again. Reported by @​sujh (#127).

Enhance:

• New algorithm argument and IPWARE_ALGORITHM setting: "modern" (default) or "legacy". Upgrade and pass nothing to get modern; set IPWARE_ALGORITHM = "legacy" to keep the exact 7.x results.
• Modern picks a better client IP, see python-ipware 4.1: public > private > link-local > loopback, the first public hop of a chain, never multicast / 0.0.0.0 / reserved, RFC 7239 Forwarded, NAT64 unwrapping, and malformed values rejected instead of truncated.
• is_routable is True only for globally routable addresses as ranked by python-ipware (deprecated site-local fec0::/10 is no longer reported as routable).
• Trusted proxies: a complete IP matches exactly (7.x prefix-matched, so "1.2.3.4" also trusted 1.2.3.45); prefixes match on whole octets; CIDR networks are supported.

Fix:

• An explicit argument now always wins over its Django setting. In 7.x, IPWARE_META_PRECEDENCE_ORDER and IPWARE_STRICT silently overrode the request_header_order and strict arguments.
• IPWARE_META_PROXY_COUNT is read again (documented but ignored in 7.x). It applies only when set.
• proxy_order must be "left-most" or "right-most"; anything else raises ValueError (7.x silently used right-most).
• Misconfiguration raises ValueError, e.g. proxy_trusted_ips passed as a bare string, an empty or non-IP entry, or a negative proxy_count.
• One-shot iterables (generators) work for proxy_trusted_ips and request_header_order.

Modernize:

• Requires Python 3.10+ and Django 5.2+ (tested on Python 3.10–3.14, Django 5.2, 6.0, 6.1). Django 4.2 and Python 3.9 are end of life; use django-ipware<8 for them.
• Depends on python-ipware>=4.1.0,<5 and declares Django>=5.2.
• Packaging moved to PEP 621 pyproject.toml with the Hatchling backend; setup.py removed.
• CI runs only on pull requests into master: tests on every Python / Django combination, then build.
• Removed the obsolete default_app_config.
• Tests: the original 7.x suite runs against both algorithms; option-matrix tests check modern against python-ipware's modern engine and legacy against its v3 engine; 100% line and branch coverage.

Commits

• d3ca311 Algorithm: modern by default, legacy as the only opt-out (drop "auto") (#130)
• 7be3686 Docs: rich README in the python-ipware style, add SECURITY.md (#129)
• 31d991c 8.0.0: thin wrapper over python-ipware 4.1, modern default, frozen legacy (#128)
• f8f2c46 Merge pull request #125 from philipstarkey/ci-updates
• e60b124 Feat: allow non-strict mode (#122)
• 0aa9579 Include py.typed in package (#124)
• 3899959 Test against currently supported Python and Django versions
• See full diff in compare view

Updates django-js-asset from 4.1.0 to 4.2.0

Changelog

Sourced from django-js-asset's changelog.

.. _changelog:

Change log

Next version

5.0a1 (2026-09-28)

This release is motivated by the Django enhancement proposal <https://github.com/django/deps/pull/101>__ and new feature request <https://github.com/django/new-features/issues/214>__ I have been working on at Django on the Med 2026 <https://djangomed.eu/>__. django-js-asset is a proving ground for the ideas of DEP022 and makes them available now. It keeps its own compatibility guarantees, so it doesn't follow the DEP exactly.

The changes to import maps and attributes are backwards-incompatible.

Import maps:

• Pass import maps as Media(importmap=ImportMap(...)); import maps in js lists raise a TypeError. The import maps of media added together are merged and rendered first by {{ media }}, or separately by {{ media.importmap }}. Widgets define media = Media(importmap=..., js=[...]), since class Media doesn't support import maps. The admin's change list only renders {{ media.js }}, the README shows how to add the import map.
• ImportMap(imports, *, scopes=None, integrity=None) takes the parts of the import map separately. Passing a full import map is deprecated.
• Relative paths are passed through static() when rendering, so static_lazy() isn't needed anymore.
• Import maps are immutable, combine them with |. ImportMap.update() and ImportMap.__bool__ have been removed.

Attributes and nonces work like Django 6.1's MediaAsset.render(attrs=...):

• render(attrs=...) adds the attributes to every tag, including the import map and JSON blocks, and raises a ValueError for attributes an asset defines itself, e.g. its own nonce.
• render(nonce=...) of ImportMap and JSON is deprecated, use render(attrs={"nonce": ...}).
• Media.from_media() keeps the nonce of the media it wraps.

Also:

• CSS() accepts attrs= like JS(), and JSON is a MediaAsset.
• Fixed losing lazy nonces and js_asset.Media subclasses when adding

... (truncated)

Commits

• e9c9d7d django-js-asset 4.2
• 542dc68 Update the agent notes
• d385a17 Recommend listing import maps first
• 88ccb6b Accept attrs= in JSON.render()
• 69d460d Accept attrs= in ImportMap.render()
• 11a633b Copy the data passed to ImportMap and deprecate update()
• e949cd0 [pre-commit.ci] pre-commit autoupdate (#36)
• 05cc8de [pre-commit.ci] pre-commit autoupdate (#35)
• 667cf93 [pre-commit.ci] pre-commit autoupdate (#34)
• a9102b9 [pre-commit.ci] pre-commit autoupdate (#33)
• See full diff in compare view

Updates django-otp from 1.3.0 to 1.7.3

Changelog

Sourced from django-otp's changelog.

v1.7.3 - September 06, 2026 - Admin asset fixes

• [#191](https://github.com/django-otp/django-otp/issues/191)_: Improve admin page compatibility with CSP (Varun Juneja)

.. _#191: django-otp/django-otp#191

v1.7.2 - September 03, 2026 - Fix throttling overflow

• [#190](https://github.com/django-otp/django-otp/issues/190)_: OverflowError on the admin login page when a device's throttling failure count is high (Varun Juneja)

.. _#190: django-otp/django-otp#190

v1.7.1 - September 02, 2026 - Form improvement

• Routine test matrix update
• [#188](https://github.com/django-otp/django-otp/issues/188)_: Fix authentication form inappropriately triggering rate-limiting

Thanks to Varun Juneja.

.. _#188: django-otp/django-otp#188

v1.7.0 - January 07, 2026 - Async support

• [#185](https://github.com/django-otp/django-otp/issues/185)_: Make OTPMiddleware async capable

Thanks to Aljosha Papsch.

.. _#185: django-otp/django-otp#185

v1.6.3 - October 25, 2025 - Spanish update

• [#182](https://github.com/django-otp/django-otp/issues/182)_: Correct missing Spanish translations
• [#181](https://github.com/django-otp/django-otp/issues/181)_: Wrong :rtype: in StaticToken.random_token docstring

.. _#181: django-otp/django-otp#181 .. _#182: django-otp/django-otp#182

v1.6.2 - October 21, 2025 - Cleanup

... (truncated)

Commits

• 88cf497 Version 1.7.3
• 4f8a5d2 Add a justfile
• 9b64aaf Move admin template inline styles/scripts into static files for CSP compatibi...
• a3be9e8 Version 1.7.2
• 2db531b Cap the exponential throttle delay so a high failure count doesn't overflow
• 3bc09de Version 1.7.1
• 8e32455 Test matrix update
• 82dafe2 Fix #186: Remove use of match_token from authentication forms (#188)
• fc0d50b Version 1.7.0
• 56e4ce3 Refactor test utilities
• Additional commits viewable in compare view

Updates fonttools from 4.65.0 to 4.66.1

Release notes

Sourced from fonttools's releases.

4.66.1

• [designspaceLib] When splitting a DesignSpace v5 document with makeNames=True (as varLib.build_many does), family and style names set explicitly on an instance now take precedence over the ones computed from the STAT labels, in all languages, and a PostScript name is no longer made up from the labels for an instance that has its own style name (#3131, #4206, #4208).
• [cmap] Decompiling a format 4 subtable whose idRangeOffset points outside glyphIndexArray now raises TTLibError. A negative index used to silently map the code point to the wrong glyph, and one past the end raised a bare AssertionError (#4209).
• [cmap] Fix compiling a format 2 subtable when the lowest glyph ID in a lead-byte row is 32768 or higher, which failed with struct.error (#4210).

4.66.0

• Drop support for EOL Python 3.10; fontTools now requires Python 3.11 or later. fontTools.misc.enumTools now only re-exports enum.StrEnum and is deprecated. Explicitly test and declare support for Python 3.15 (#4183, #4196).
• [unicodedata] Update the bundled script, script extension, block and bidi-mirroring tables to Unicode 18.0.0, and require unicodedata2 18.0.0 when it is used (#4192, #4197).
• [feaLib] Support language statements listing multiple language tags, e.g. language AZE CRT;adobe-type-tools/feature_file_workshops#8dflt cannot be combined with other tags. LanguageStatement.language is still the first tag; all of them are in the new languages attribute (#4201, #4202).
• [feaLib] Fix lookups being dropped when a script/language pair is repeated within a feature block: the repeated statement replaced the language system's lookups with a fresh copy of the default ones (#4189).
• [feaLib] Raise FeatureLibError instead of UnboundLocalError when a STAT table block lacks ElidedFallbackName or ElidedFallbackNameID (#3834, #4179).
• [cffLib] Always recompile the CFF2 VarStore when saving. Previously the bytes compiled by an earlier save were reused, so a CFF2 variable font that was saved and then modified in place, e.g. by the instancer, was written with a stale VarStore next to its updated charstrings (#4199).
• [ttLib] Support static VARC fonts that omit fvar while retaining gvar or CFF2 variation data for component-internal axes: hidden axes are addressed by index and gvar can compile, decompile and round-trip through TTX without fvar, reading the axis count from a new axisCount element (#4187, #4188).
• [ttLib] Fix drawing VARC components whose condition is negated (format 5), which raised AttributeError (#4191).
• [instancer] Fix VARC axis references left stale when removing an unrelated axis, reject pinning or restricting axes referenced by VARC components, and stop culling avar2 ranges for component-internal variations, which can reach outside the font-level ranges (#4190, #4193).
• [bezierTools] Preserve exact endpoints in splitQuadraticAtT and splitCubicAtTC as well, like splitCubicAtT since 4.55.4 (#3742, #4194).
• [bezierTools] Fix ZeroDivisionError in lineLineIntersections for collinear vertical lines; they are now treated as parallel like horizontal ones (#3515, #4181).
• [subset] pyftsubset now preserves the input font's flavor (WOFF, WOFF2) when --flavor is omitted, instead of writing uncompressed sfnt data under the same extension; pass --flavor=none to force uncompressed output (#3630, #4182).
• [merge] Report incompatible unitsPerEm values by name, with the input values, instead of a bare assertion (#2844, #4184).
• [designspaceLib] Fix the type annotation and documentation of DesignSpaceDocument.default, which holds a SourceDescriptor, not a source name (#2994, #4186).
• [ttLib.sfnt] Raise TTLibError instead of AssertionError for inconsistent WOFF table, metadata and private-data lengths, so the checks also hold under python -O (#4178).
• [misc.etree] Disable entity resolution altogether on lxml >= 5.0 as well: lxml's resolve_entities="internal" still fetched external parameter entities before lxml 6.1.3, so a crafted DTD could read local files into parsed XML content (#4195).
• [cmap] Bound the expansion of format 4 segments and format 12/13 groups when decompiling, like HarfBuzz does: groups are clamped to U+10FFFF, inverted or overlapping groups are skipped with a warning, and groups mapped to the missing glyph are not expanded. A crafted font could previously exhaust memory with a single group ending at 0xFFFFFFFF (#4204).
• [varLib.avar] Escape axis names and tags when varLib.avar.unbuild emits its designspace snippet, so a crafted font cannot inject markup (#4203).

Changelog

Sourced from fonttools's changelog.

4.66.1 (released 2026-09-29)

• [designspaceLib] When splitting a DesignSpace v5 document with makeNames=True (as varLib.build_many does), family and style names set explicitly on an instance now take precedence over the ones computed from the STAT labels, in all languages, and a PostScript name is no longer made up from the labels for an instance that has its own style name (#3131, #4206, #4208).
• [cmap] Decompiling a format 4 subtable whose idRangeOffset points outside glyphIndexArray now raises TTLibError. A negative index used to silently map the code point to the wrong glyph, and one past the end raised a bare AssertionError (#4209).
• [cmap] Fix compiling a format 2 subtable when the lowest glyph ID in a lead-byte row is 32768 or higher, which failed with struct.error (#4210).

4.66.0 (released 2026-09-23)

• Drop support for EOL Python 3.10; fontTools now requires Python 3.11 or later. fontTools.misc.enumTools now only re-exports enum.StrEnum and is deprecated. Explicitly test and declare support for Python 3.15 (#4183, #4196).
• [unicodedata] Update the bundled script, script extension, block and bidi-mirroring tables to Unicode 18.0.0, and require unicodedata2 18.0.0 when it is used (#4192, #4197).
• [feaLib] Support language statements listing multiple language tags, e.g. language AZE CRT;, as Glyphs does and as proposed for the spec adobe-type-tools/feature_file_workshops#8 references are registered under every listed language. dflt cannot be combined with other tags. LanguageStatement.language is still the first tag; all of them are in the new languages attribute (#4201, #4202).
• [feaLib] Fix lookups being dropped when a script/language pair is repeated within a feature block: the repeated statement replaced the language system's lookups with a fresh copy of the default ones (#4189).
• [feaLib] Raise FeatureLibError instead of UnboundLocalError when a STAT table block lacks ElidedFallbackName or ElidedFallbackNameID (#3834, #4179).
• [cffLib] Always recompile the CFF2 VarStore when saving. Previously the bytes compiled by an earlier save were reused, so a CFF2 variable font that was saved and then modified in place, e.g. by the instancer, was written with a stale VarStore next to its updated charstrings (#4199).
• [ttLib] Support static VARC fonts that omit fvar while retaining gvar or CFF2 variation data for component-internal axes: hidden axes are addressed by index and gvar can compile, decompile and round-trip through TTX without fvar, reading the axis count from a new axisCount element (#4187, #4188).
• [ttLib] Fix drawing VARC components whose condition is negated (format 5), which raised AttributeError (#4191).
• [instancer] Fix VARC axis references left stale when removing an unrelated axis, reject pinning or restricting axes referenced by VARC components, and stop culling avar2 ranges for component-internal variations,

... (truncated)

Commits

• 9e95795 Release 4.66.1
• 8fc91fb Update NEWS.rst [skip ci]
• 82dc507 Merge pull request #4209 from insaf021/cmap4-idrangeoffset-bounds
• a83553e trim comments
• 85049d3 Merge pull request #4208 from fonttools/fix-split-stat-names-override
• 1ad111d Merge pull request #4210 from youdie006/cmap-format2-high-gids
• c9e9d68 [cmap] fix format 2 compile for glyph IDs above 32767
• 85625c5 raise TTLibError for out-of-range glyphIndexArray offset in cmap format 4
• 879173e [designspaceLib] Let explicit instance names win over STAT labels when splitting
• 718b61b Bump version: 4.66.0 → 4.66.1.dev0
• Additional commits viewable in compare view

Updates googleapis-common-protos from 1.75.3 to 1.75.5

Release notes

Sourced from googleapis-common-protos's releases.

google-cloud-compute-v1beta: v0.12.8

0.12.8 (2026-10-08)

Features

• update API sources and regenerate (#18593) (d0505e8)

Commits

• d6bed5a chore: release main (#18464)
• 78ff458 feat(gapic-generator): add schema support for resumable uploads (#18480)
• af2100a tests: add showcase to golden files (#18479)
• e1d306a fix: resolve error where google/longrunning/operations.proto is missing (#18477)
• 7871fa9 fix(gapic-generator): init mock response in version header test (#18488)
• 0b488a3 feat(bigtable): Reroute Mutations Batcher to use data client (#18200)
• 30b4f44 fix(google-auth-oauthlib): prevent ipv6 address reuse (#18463)
• 1d9f468 chore(main): release google-auth 2.59.0 (#18465)
• c7c133a chore(bigtable): Added an internal batch completed callback to the data clien...
• 8cb3c6a perf(spanner): optimize query option merging and prevent in-place mutation (#...
• Additional commits viewable in compare view

Updates markdown from 3.10.3 to 3.11

Release notes

Sourced from markdown's releases.

Release 3.11.0

Changed

• Inline processors now resume searching after the previous match, improving performance for repeated inline patterns (#1619).
• Officially support Python 3.15 and drop support for Python 3.10
• Walk backtick runs in BacktickInlineProcessor without a regex (#1620).
• Switch static site generator for documentation from MkDocs to Zensical (#1627, #1635, #1637, and #1638).

Fixed

• Ensure removing Abbreviations does not raise an error (#1634).
• Fix an issue with excessive backtracking when matching inline code blocks (#1617).
• md_in_html now honors tags added to Markdown.block_level_elements after the extension is loaded (#1246).
• Fix quadratic-time regex backtracking in ReferenceProcessor when a link reference definition has no URL, e.g. a line consisting only of [id]: followed by many trailing spaces (#798).
• Document attr_list usage for def_list (#1123).

Changelog

Sourced from markdown's changelog.

---

title: Changelog toc_depth: 2

Python-Markdown Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to the Python Version Specification. See the Contributing Guide for details.

[Unreleased]

• Update serializer to be non-recursive (#1644).
• Improve ancestor handling in the inline Treeprocessor (#1646).
• Keep a raw HTML comment inside an inline HTML element that closes in the same paragraph, instead of splitting the paragraph around it (#1643).
• Fix issue where inline HTML attributes were rejected if they had < or > in the attribute (#1647).
• Fix issue where an unterminated end tag (</foo) could cause all remaining content to be dropped (#1651).

[3.11.0] - 2026-09-25

Changed

• Inline processors now resume searching after the previous match, improving performance for repeated inline patterns (#1619).
• Officially support Python 3.15 and drop support for Python 3.10
• Walk backtick runs in BacktickInlineProcessor without a regex (#1620).
• Switch static site generator for documentation from MkDocs to Zensical (#1627, #1635, #1637, and #1638).

Fixed

• Ensure removing Abbreviations does not raise an error (#1634).
• Fix an issue with excessive backtracking when matching inline code blocks (#1617).
• md_in_html now honors tags added to Markdown.block_level_elements after the extension is loaded (#1246).
• Fix quadratic-time regex backtracking in ReferenceProcessor when a link reference definition has no URL, e.g. a line consisting only of [id]: followed by many trailing spaces (#798).
• Document attr_list usage for def_list (#1123).

Commits

• 0ffbf00 Bump version to 3.11.0
• 547a934 Show adminitions as rendered examples in contrbuting guide
• 571f050 Cleanup archived changelog
• a5176b0 Ensure py-render codeblock title in properly escaped.
• 819fff9 Document the use of attr_list with def_list.
• 36cdbd3 Final cleanup for Zensical transition
• 8a96db5 Add py-render custom code block formater
• 5d1363c Fix quadratic-time backtracking when a reference link has no URL
• 0d6afd1 Add Markdown renderer as superfences formatter
• 175fb5a Ensure removing Abbreviations does not raise an error.
• Additional commits viewable in compare view

Updates opentelemetry-exporter-otlp-proto-common from 1.44.0 to 1.45.0

Release notes

Sourced from opentelemetry-exporter-otlp-proto-common's releases.

Version 1.45.0/0.66b0

Added

• opentelemetry-exporter-prometheus: add support to configure Resource attributes as metric labels (#5122)
• infra: add renovate (#5202)
• opentelemetry-api, opentelemetry-sdk: add support for extended attribute values everywhere. (#5266)
• opentelemetry-sdk: wire the top-level log_level field in declarative configuration — when set, maps the OTel SeverityNumber value to a Python logging level and applies it to the opentelemetry logger so SDK internal diagnostics respect the configured severity. (#5351)
• opentelemetry-sdk: add the new stable AlwaysRecordSampler (#5354)
• opentelemetry-configuration, opentelemetry-sdk: wire top-level attribute_limits into per-signal providers via declarative config; add log_record_limits support to LoggerProvider (#5365)
• opentelemetry-exporter-otlp-json-http: add OTLP JSON HTTP exporter package (#5374)
• opentelemetry-api, opentelemetry-sdk: add enabled() support to the Logger API, SDK, and LogRecordProcessor to let instrumentation skip expensive work when logging is disabled (#5380)
• opentelemetry-exporter-otlp-json-file: add OTLP JSON file Docker tests (#5412)
• opentelemetry-configuration: wire the experimental tracer_configurator/development, meter_configurator/development and logger_configurator/development fields into create_tracer_provider, create_meter_provider and create_logger_provider, so per-instrumentation-scope enabled overrides dec...

  Description has been truncated

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud