Bump the pip group with 3 updates by dependabot[bot] · Pull Request #338 · python/docsbuild-scripts

dependabot · 2026-06-01T03:02:09Z

Updates the requirements on sentry-sdk, tomlkit and urllib3 to permit the latest version.
Updates sentry-sdk to 2.60.0

Release notes

Sourced from sentry-sdk's releases.

2.60.0

Adds a new stream_gen_ai_spans option that controls how gen_ai spans are sent to Sentry. When set, the SDK extracts all gen_ai spans out of a transaction and sends them as v2 envelope items.

Enable this option if gen_ai spans are being dropped because the transaction payload exceeds size limits.
import sentry_sdk
sentry_sdk.init(
dsn='https://examplePublicKey@o0.ingest.sentry.io/0',
stream_gen_ai_spans=True,
)
New Features ✨

(asyncpg) Add cursor span support via BaseCursor method patching by @ericapisani in #6252

(integrations) Pass along the conversation ID for openai responses calls by @constantinius in #6199

(wsgi,asgi) Introduce substitute values for filtered fields in span-streaming mode by @ericapisani in #6178

Remove truncation when stream_gen_ai_spans is enabled by @alexander-alderman-webb in #6260

Add option to send GenAI spans in the new span format by @alexander-alderman-webb in #6079

Bug Fixes 🐛

Openai

Guard against choices=None by @cla7aye15I4nd in #6216

Stop setting transaction status when child span fails by @alexander-alderman-webb in #6192

Only finish relevant spans in Responses patches by @alexander-alderman-webb in #6191

Only finish relevant spans in Chat Completions patches by @alexander-alderman-webb in #6190

Other

(stdlib) Instrument response body read for chunked HTTP responses by @sentrivana in #6202

(typing) Add @sentry_sdk.traces.trace overloads to fix typing by @sentrivana in #6236

Use proto version 2 to fix backfilled user agent and IP by @sentrivana in #6256

Make sure http.server spans are segments by @sentrivana in #6230

Handle mypy 2.0 related failures by @alexander-alderman-webb in #6218

Internal Changes 🔧

Django

Check transaction annotations on transaction events by @alexander-alderman-webb in #6251

Reload middleware on test teardown by @alexander-alderman-webb in #6249

Openai

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.60.0

Adds a new stream_gen_ai_spans option that controls how gen_ai spans are sent to Sentry. When set, the SDK extracts all gen_ai spans out of a transaction and sends them as v2 envelope items.

Enable this option if gen_ai spans are being dropped because the transaction payload exceeds size limits.
import sentry_sdk
sentry_sdk.init(
dsn='https://examplePublicKey@o0.ingest.sentry.io/0',
stream_gen_ai_spans=True,
)
New Features ✨

(asyncpg) Add cursor span support via BaseCursor method patching by @ericapisani in #6252

(integrations) Pass along the conversation ID for openai responses calls by @constantinius in #6199

(wsgi,asgi) Introduce substitute values for filtered fields in span-streaming mode by @ericapisani in #6178

Remove truncation when stream_gen_ai_spans is enabled by @alexander-alderman-webb in #6260

Add option to send GenAI spans in the new span format by @alexander-alderman-webb in #6079

Bug Fixes 🐛

Openai

Guard against choices=None by @cla7aye15I4nd in #6216

Stop setting transaction status when child span fails by @alexander-alderman-webb in #6192

Only finish relevant spans in Responses patches by @alexander-alderman-webb in #6191

Only finish relevant spans in Chat Completions patches by @alexander-alderman-webb in #6190

Other

(stdlib) Instrument response body read for chunked HTTP responses by @sentrivana in #6202

(typing) Add @sentry_sdk.traces.trace overloads to fix typing by @sentrivana in #6236

Use proto version 2 to fix backfilled user agent and IP by @sentrivana in #6256

Make sure http.server spans are segments by @sentrivana in #6230

Handle mypy 2.0 related failures by @alexander-alderman-webb in #6218

Internal Changes 🔧

Django

Check transaction annotations on transaction events by @alexander-alderman-webb in #6251

Reload middleware on test teardown by @alexander-alderman-webb in #6249

Openai

... (truncated)

Commits

e30caaa Update CHANGELOG.md
d31ac85 release: 2.60.0
fcb9305 feat: Remove truncation when stream_gen_ai_spans is enabled (#6260)
253a4d4 feat: Add option to send GenAI spans in the new span format (#6079)
619d803 test(langchain): Inline global state (#6261)
f92c803 Revert "fix: Work around compromised transitive dependency (#6257)" (#6262)
7a303dc Add option to drop scrubbed user IP addresses (#6241)
edaa6d6 feat(pymongo): Add span streaming support (#6253)
0e47ead feat(asyncpg): Add cursor span support via BaseCursor method patching (#6252)
17cc8c7 fix: Use proto version 2 to fix backfilled user agent and IP (#6256)
Additional commits viewable in compare view

Updates tomlkit to 0.15.0

Release notes

Sourced from tomlkit's releases.

0.15.0

What's Changed

feat(spec): update to toml spec v1.1 by @frostming in python-poetry/tomlkit#456

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-poetry/tomlkit#455

chore(deps-dev): bump virtualenv from 20.26.6 to 20.36.1 by @dependabot[bot] in python-poetry/tomlkit#454

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-poetry/tomlkit#458

chore(deps): bump pygments from 2.18.0 to 2.20.0 in /docs by @dependabot[bot] in python-poetry/tomlkit#464

chore(deps-dev): bump pygments from 2.17.2 to 2.20.0 by @dependabot[bot] in python-poetry/tomlkit#463

chore(deps): bump requests from 2.32.4 to 2.33.0 in /docs by @dependabot[bot] in python-poetry/tomlkit#462

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-poetry/tomlkit#461

Type annotations by @dimbleby in python-poetry/tomlkit#460

Honor sort_keys for parsed TOML documents by @ShipItAndPray in python-poetry/tomlkit#471

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-poetry/tomlkit#469

fix: fix a parser hang by @dimbleby in python-poetry/tomlkit#470

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-poetry/tomlkit#472

chore: bump version to 0.15.0 and update changelog for release by @frostming in python-poetry/tomlkit#473

New Contributors

@dimbleby made their first contribution in python-poetry/tomlkit#460

@ShipItAndPray made their first contribution in python-poetry/tomlkit#471

Full Changelog: python-poetry/tomlkit@0.14.0...0.15.0

Changelog

Sourced from tomlkit's changelog.

[0.15.0] - 2026-05-10

Changed

Update parser to support TOML spec v1.1.0. (#456)

[0.14.0] - 2026-01-13

Changed

Drop support for Python older than 3.9. Remove 3.8 from the CI matrix.

Added

Custom encoders can now receive _parent and _sort_keys parameters to enable proper encoding of nested structures. (#429)

Add String.type property to get the string type. (#443)

Fixed

Fixed tomlkit.boolean() API to correctly handle boolean inputs. (#442)

[0.13.3] - 2025-06-05

Added

Add .item() method to array and tables to retrieve an item by key. (#390)

Fixed

Fix missing newline when parsing a separated array of tables without trailing new line. (#381)

Fix non-existing key error when deleting an item from an out-of-order table. (#383)

Ensure newline is added between the plain values and the first table. (#387)

Fix repeated whitespace when removing an array item. (#405)

Fix invalid serialization after removing array item if the comma is on its own line. (#408)

Fix serialization of a nested dotted key table. (#411)

Refine the error message when use non-string as single key. (#412)

Fix invalid serialization after overwriting a key of a out-of-order table. (#414)

[0.13.2] - 2024-08-14

Fixed

Fix deleting keys from an out-of-order table does not remove all table parts. (#379)

[0.13.1] - 2024-08-14

Fixed

Fix the Table.is_super_table() check for tables with dotted key as the only child. (#374)

Count table as a super table if it has children and all children are either tables or arrays of tables. (#377)

... (truncated)

Commits

8694e4d chore: bump version to 0.15.0 and update changelog for release (#473)
e636a51 [pre-commit.ci] pre-commit autoupdate (#472)
96a4d22 fix: fix a parser hang (#470)
843f799 [pre-commit.ci] pre-commit autoupdate (#469)
2c87eaf Honor sort_keys for parsed TOML documents (#471)
8e32f9c Type annotations (#460)
df98af4 [pre-commit.ci] pre-commit autoupdate (#461)
4bd97db chore(deps): bump requests from 2.32.4 to 2.33.0 in /docs (#462)
b2d7030 chore(deps-dev): bump pygments from 2.17.2 to 2.20.0 (#463)
87d98b1 chore(deps): bump pygments from 2.18.0 to 2.20.0 in /docs (#464)
Additional commits viewable in compare view

Updates urllib3 to 2.7.0

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @Cycloctane)

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @kimkou2024)

See GHSA-mf9v-mfxr-j63j for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @christos-spearbit)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)

Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)

Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)

Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)

Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)

Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)

Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)

Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)

Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)

Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)

Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)

Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

9a950b9 Release 2.7.0
5ec0de4 Merge commit from fork
2bdcc44 Merge commit from fork
f45b0df Fix a misleading example for ProxyManager (#4970)
577193c Switch to nightly PyPy3.11 in CI for now (#4984)
e90af45 Avoid infinite loop in HTTPResponse.read_chunked when amt=0 (#4974)
67ed74f Bump dev dependencies (#4972)
3abd481 Upgrade mypy to version 1.20.2 (#4978)
2b8725d Drop support for EOL PyPy3.10 (#4979)
2944b2a Upgrade setup-chrome and setup-firefox to fix warnings (#4973)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Updates the requirements on [sentry-sdk](https://github.com/getsentry/sentry-python), [tomlkit](https://github.com/python-poetry/tomlkit) and [urllib3](https://github.com/urllib3/urllib3) to permit the latest version. Updates `sentry-sdk` to 2.60.0 - [Release notes](https://github.com/getsentry/sentry-python/releases) - [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md) - [Commits](getsentry/sentry-python@2.58.0...2.60.0) Updates `tomlkit` to 0.15.0 - [Release notes](https://github.com/python-poetry/tomlkit/releases) - [Changelog](https://github.com/python-poetry/tomlkit/blob/master/CHANGELOG.md) - [Commits](python-poetry/tomlkit@0.14.0...0.15.0) Updates `urllib3` to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.6.3...2.7.0) --- updated-dependencies: - dependency-name: sentry-sdk dependency-version: 2.60.0 dependency-type: direct:production dependency-group: pip - dependency-name: tomlkit dependency-version: 0.15.0 dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot assigned ezio-melotti Jun 1, 2026

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jun 1, 2026

ezio-melotti approved these changes Jun 1, 2026

View reviewed changes

ezio-melotti merged commit 4706ad8 into main Jun 1, 2026
24 checks passed

dependabot Bot deleted the dependabot/pip/pip-fe9d60cdf8 branch June 1, 2026 03:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the pip group with 3 updates#338

Bump the pip group with 3 updates#338
ezio-melotti merged 1 commit into
mainfrom
dependabot/pip/pip-fe9d60cdf8

dependabot Bot commented on behalf of github Jun 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 1, 2026

2.60.0

New Features ✨

Bug Fixes 🐛

Openai

Other

Internal Changes 🔧

Django

Openai

2.60.0

New Features ✨

Bug Fixes 🐛

Openai

Other

Internal Changes 🔧

Django

Openai

0.15.0

What's Changed

New Contributors

[0.15.0] - 2026-05-10

Changed

[0.14.0] - 2026-01-13

Changed

Added

Fixed

[0.13.3] - 2025-06-05

Added

Fixed

[0.13.2] - 2024-08-14

Fixed

[0.13.1] - 2024-08-14

Fixed

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

Security

Deprecations and Removals

Bugfixes

2.7.0 (2026-05-07)

Security

Deprecations and Removals

Bugfixes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant