deps(backend): bump the minor-and-patch group across 1 directory with 7 updates by dependabot[bot] · Pull Request #35 · e-scheer/hostcraft

dependabot · 2026-08-10T04:21:08Z

Bumps the minor-and-patch group with 7 updates in the /backend directory:

Package	From	To
django	`6.0.5`	`6.1`
djangorestframework	`3.17.1`	`3.17.2`
pyotp	`2.9.0`	`2.10.0`
docker	`7.1.0`	`7.2.0`
croniter	`6.2.2`	`6.2.4`
boto3	`1.43.9`	`1.43.66`
pillow	`12.2.0`	`12.3.0`

Updates django from 6.0.5 to 6.1

Commits

fe0a859 [6.1.x] Bumped version for 6.1 release.
6277045 [6.1.x] Updated man page for Django 6.1.
fc78c5c [6.1.x] Finalized release notes for Django 6.1.
c58d861 [6.1.x] Updated translations from Transifex.
dc1b8de [6.1.x] Added missing lang override in translation fetching helper for Serbia...
1f5bf63 [6.1.x] Refs #36735 -- Added DatabaseFeatures.supports_uuid4_function_in_defa...
8099984 [6.1.x] Added CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, and CVE-2026-15...
5a260d3 [6.1.x] Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before...
9e4a3f1 [6.1.x] Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry c...
5b3523d [6.1.x] Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language().
Additional commits viewable in compare view

Updates djangorestframework from 3.17.1 to 3.17.2

Release notes

Sourced from djangorestframework's releases.

3.17.2

What's Changed

Bug fixes

Fix disclosure of GET-protected data in case of validation error with AdminRenderer by @browniebroke in encode/django-rest-framework#10012. Thanks, @zainnadeem786 for the report.

Enforce DATA_UPLOAD_MAX_MEMORY_SIZE for request.data parsing by @zainnadeem786 in encode/django-rest-framework#10013. Thanks, @zainnadeem786 for the report.

Full Changelog: encode/django-rest-framework@3.17.1...3.17.2

Commits

ad309f3 Release 3.17.2 (#10014)
2912dc9 Enforce DATA_UPLOAD_MAX_MEMORY_SIZE for request.data parsing (#10013)
71f8194 Fix disclosure of GET-protected data in case of validation error with `AdminR...
See full diff in compare view

Updates pyotp from 2.9.0 to 2.10.0

Release notes

Sourced from pyotp's releases.

v2.10.0

Fix parse_uri mis-parsing of encoded colon in issuer/account name (#187)

Simplified and improved generate_otp() performance in Steam class (#179)

Check digest function to prevent error on OTP Generation (#170)

Ignore non-standard otpauth parameters

use strings as immutable default arguments (#162)

Changelog

Sourced from pyotp's changelog.

Changes for v2.10.0 (2026-06-13)

Fix parse_uri mis-parsing of encoded colon in issuer/account name (#187)

Simplified and improved generate_otp() performance in Steam class (#179)

Check digest function to prevent error on OTP Generation (#170)

Ignore non-standard otpauth parameters

use strings as immutable default arguments (#162)

Commits

81ed54a v2.10.0
d44e98a Fix parse_uri mis-parsing of encoded colon in issuer/account name (#187)
a25dbbb Simplified and improved generate_otp() performance in Steam class (#179)
89ebf90 Update CI matrix
2c152d4 Replace ubuntu-20.04 with 22.04 in CI (#177)
6e25ce2 Replace license classifier with license expression (#176)
3419136 Use trusted publishing and hatch
0c3b765 Format files with ruff
a398c80 Update CI configuration
92b1dbc docs: fix deprecated intersphinx_mapping format (#173)
Additional commits viewable in compare view

Updates docker from 7.1.0 to 7.2.0

Release notes

Sourced from docker's releases.

7.2.0

Upgrade Notes

docker.from_env() now honors the active Docker CLI context when DOCKER_HOST is not set.

This means the client may connect to the daemon selected by DOCKER_CONTEXT or the current context in ~/.docker/config.json, matching Docker CLI behavior more closely.

If your application relied on the previous default connection behavior, set DOCKER_HOST explicitly, set DOCKER_CONTEXT=default, or pass use_context=False to DockerClient.from_env().

Added docker.from_context() / DockerClient.from_context() for explicitly creating a client from a Docker CLI context.

Features

Added support for Docker contexts when creating the default client

Added subpath support for volumes

Bugfixes

Fixed exec_run documentation for the stream parameter

Fixed image loading to avoid depending on the deprecated JSONMessage.error field

Preserved the rotated unlock key in swarm integration tests

Fixed SSL certificate generation in tests

Fixed IPv6 integration tests by explicitly enabling IPv6 where required

Miscellaneous

Updated tests for newer Docker Engine behavior

CI and build updates

What's Changed

tests/exec: expect 127 exit code for missing executable by @laurazard in docker/docker-py#3290

fixing doc for stream param in exec_run by @yasonk in docker/docker-py#3292

Bump default API version to 1.45 (Moby 26.0/26.1) by @thaJeztah in docker/docker-py#3261

Set a dummy-version if none set, and remove unused APT_MIRROR build-arg by @thaJeztah in docker/docker-py#3267

test_service_logs: stop testing experimental versions by @thaJeztah in docker/docker-py#2442

Makefile: fix circular reference for integration-dind by @thaJeztah in docker/docker-py#3297

image load: don't depend on deprecated JSONMessage.error field by @thaJeztah in docker/docker-py#3307

integration: test_create_volume_invalid_driver allow either 400 or 404 by @thaJeztah in docker/docker-py#3296

integration: adjust tests for omitted "OnBuild" by @thaJeztah in docker/docker-py#3336

Implement Subpath Support for Volumes in Docker-Py (#3243) by @Khushiyant in docker/docker-py#3270

tests: fix ssl generation by @thaJeztah in docker/docker-py#3365

test/integration: don't check for deprecated Networks field by @thaJeztah in docker/docker-py#3362

test: Skip from_env_unix tests if DOCKER_HOST is network socket by @ricardobranco777 in docker/docker-py#3366

test_connect_with_ipv6_address: enable IPv6 by @robmry in docker/docker-py#3372

test_create_with_ipv6_address: enable IPv6 by @robmry in docker/docker-py#3373

tests: Migrate off gpg2 and regenerate key ed25519 by @vvoland in docker/docker-py#3399

gha: Pin to digests by @vvoland in docker/docker-py#3408

Fix integration tests on non-amd64 hosts and add ARM64 CI by @vvoland in docker/docker-py#3407

integration/swarm: Preserve rotated unlock key by @vvoland in docker/docker-py#3410

[DKP-2535] Honour context if present for default client, add contexts support by @ebriney in docker/docker-py#3401

docs: 7.2.0 changelog by @vvoland in docker/docker-py#3415

New Contributors

@laurazard made their first contribution in docker/docker-py#3290

@yasonk made their first contribution in docker/docker-py#3292

@ricardobranco777 made their first contribution in docker/docker-py#3366

... (truncated)

Commits

5ad5327 Merge pull request #3415 from vvoland/update-changelog
d242230 docs: 7.2.0 changelog
ba01cc7 Merge pull request #3401 from ebriney/client-from-context
ae5dfe9 Merge pull request #3410 from vvoland/fix-flaky
aa99999 integration/swarm: Preserve rotated unlock key
059d371 Merge pull request #3407 from vvoland/fix-arm64
9b4b9b8 gha: Add arm64 integration CI
9e9f8ff Skip tests incompatible with host architecture
e0542d9 Merge pull request #3408 from vvoland/gha-pin
578a11d gha: Pin to digests
Additional commits viewable in compare view

Updates croniter from 6.2.2 to 6.2.4

Release notes

Sourced from croniter's releases.

6.2.4

croniter 6.2.4

Bugfixes

Fix expand_from_start_time day-of-week low bound so Sunday wraps correctly for stepped day-of-week ranges (isoweekday() % 7 instead of weekday() + 1). (#239, thanks @alhudz)

Packaging

Bump pinned GitHub Actions via dependabot. (#238, #240)

Install: pip install croniter==6.2.4 · PyPI

6.2.3

No release notes provided.

Changelog

Sourced from croniter's changelog.

6.2.4 (2026-07-10)

Bugfixes

- Fix ``expand_from_start_time`` day-of-week low bound so Sunday wraps correctly for stepped day-of-week ranges (``isoweekday() % 7`` instead of ``weekday() + 1``). [44e3090, [#239](https://github.com/pallets-eco/croniter/issues/239), @alhudz]
Packaging

Bump pinned GitHub Actions via dependabot. [fd13d2e, #240; 5cd2e46, #238]

6.2.3 (2026-07-02)

Features and Improvements

- Fix quadratic expansion of comma-separated range lists for a large speed-up on expressions with many ranges. [1d79fc6, [#231](https://github.com/pallets-eco/croniter/issues/231), @alhudz]
Bugfixes
- Reject a zero step (e.g. ``5-5/0``) in equal and reversed cron ranges instead of silently accepting it. [ab27767, [#232](https://github.com/pallets-eco/croniter/issues/232), @alhudz]
- Fix ``expand_from_start_time`` month low-bound off-by-one so stepped month ranges start on the correct month. [f329964, [#235](https://github.com/pallets-eco/croniter/issues/235), @alhudz]
Packaging



Fix zizmor-reported security findings in GitHub Actions workflows. [ed19f94, #230]
Bump pinned build and CI dependencies via dependabot.
Upgrade locked development and build dependencies (uv lock --upgrade).

Commits

5853499 Prepare for release 6.2.4 (#241)
fd13d2e Bump the github-actions group with 2 updates (#240)
44e3090 wrap sunday in expand_from_start_time day-of-week low bound (#239)
5cd2e46 Bump the github-actions group with 2 updates (#238)
f1eeddd Prepare for 6.2.4 development (#237)
22b59e0 Prepare for release 6.2.3 (#236)
ab27767 reject zero step in equal and reversed cron ranges (#232)
f329964 fix expand_from_start_time month low bound off-by-one (#235)
9810279 Bump the github-actions group with 2 updates (#233)
d051aaf Bump hatchling from 1.29.0 to 1.30.1 in the pip-dependencies group (#234)
Additional commits viewable in compare view

Updates boto3 from 1.43.9 to 1.43.66

Commits

f53e30a Merge branch 'release-1.43.66'
7ac6cf8 Bumping version to 1.43.66
c69aee1 Add changelog entries from botocore
b74eb20 Merge branch 'release-1.43.65'
75469d6 Merge branch 'release-1.43.65' into develop
d25fa39 Bumping version to 1.43.65
6081dfd Add changelog entries from botocore
06a2e1b Merge branch 'release-1.43.64'
c7b4afa Merge branch 'release-1.43.64' into develop
f2f83e3 Bumping version to 1.43.64
Additional commits viewable in compare view

Updates pillow from 12.2.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Remove non-image ImageCms modes #9697 [@radarhere]

Documentation

Add release notes for SBOM and performance improvements #9747 [@radarhere]

Add security release notes #9741 [@radarhere]

Add release notes for Python 3.15 beta wheels #9696 [@radarhere]

ImageFont can also be used with ImageText #9597 [@radarhere]

Additional guidelines for security reports #9659 [@wiredfool]

Fixed typo #9636 [@radarhere]

Added CVEs to 12.2.0 release notes #9591 [@radarhere]

Revise development support information in README #9583 [@aclark4life]

Add INCIDENT_RESPONSE.md #9555 [@aclark4life]

Add STRIDE threat model to security docs #9562 [@aclark4life]

Add CVEs to 12.2.0 release notes #9556 [@radarhere]

Update README with revised security policy #9553 [@radarhere]

Update security policy #9552 [@aclark4life]

Update macOS tested Python versions #9534 [@radarhere]

Dependencies

Update dependency harfbuzz to v14.2.1 #9720 [@renovate[bot]]

Update dependency mypy to v2 #9653 [@renovate[bot]]

Update dependency cibuildwheel to v4 #9665 [@renovate[bot]]

Update github-actions #9655 [@renovate[bot]]

Update dependency libavif to v1.4.2 #9652 [@renovate[bot]]

Update dependency lcms2 to v2.19.1 #9651 [@renovate[bot]]

Update dependency check-jsonschema to v0.37.2 #9650 [@renovate[bot]]

Update google/oss-fuzz digest to d872252 #9614 [@renovate[bot]]

Update dependency lcms2 to v2.19 #9609 [@renovate[bot]]

Update dependency libpng to v1.6.58 - autoclosed #9608 [@renovate[bot]]

Update dependency harfbuzz to v14 #9610 [@renovate[bot]]

Update dependency mypy to v1.20.2 #9599 [@renovate[bot]]

Update github-actions #9611 [@renovate[bot]]

Update dependency cibuildwheel to v3.4.1 #9607 [@renovate[bot]]

Move dependency versions to single JSON and enable Renovate #9559 [@hugovk]

Updated raqm to 0.10.5 #9557 [@radarhere]

Update dependency cibuildwheel to v3.4.0 #9532 [@renovate[bot]]

Testing

Remove matrix.os from benchmark #9735 [@radarhere]

Remove references to libavif patch #9734 [@radarhere]

Add benchmark tests #9654 [@akx]

Use reshape() instead of setting NumPy array shape directly #9728 [@radarhere]

... (truncated)

Commits

bb1d8e8 12.3.0 version bump
e63fc48 Add release notes for SBOM and performance improvements (#9747)
13b701b Add release notes for #9679
5564ca7 List methods
a0920fd Speed up ImageChops operations (#9738)
07e9a6c Speed up Image.filter() (#9736)
a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
af03747 Speed up Image.resample() (#9739)
5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… 7 updates Bumps the minor-and-patch group with 7 updates in the /backend directory: | Package | From | To | | --- | --- | --- | | [django](https://github.com/django/django) | `6.0.5` | `6.1` | | [djangorestframework](https://github.com/encode/django-rest-framework) | `3.17.1` | `3.17.2` | | [pyotp](https://github.com/pyauth/pyotp) | `2.9.0` | `2.10.0` | | [docker](https://github.com/docker/docker-py) | `7.1.0` | `7.2.0` | | [croniter](https://github.com/pallets-eco/croniter) | `6.2.2` | `6.2.4` | | [boto3](https://github.com/boto/boto3) | `1.43.9` | `1.43.66` | | [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` | Updates `django` from 6.0.5 to 6.1 - [Commits](django/django@6.0.5...6.1) Updates `djangorestframework` from 3.17.1 to 3.17.2 - [Release notes](https://github.com/encode/django-rest-framework/releases) - [Commits](encode/django-rest-framework@3.17.1...3.17.2) Updates `pyotp` from 2.9.0 to 2.10.0 - [Release notes](https://github.com/pyauth/pyotp/releases) - [Changelog](https://github.com/pyauth/pyotp/blob/main/Changes.rst) - [Commits](pyauth/pyotp@v2.9.0...v2.10.0) Updates `docker` from 7.1.0 to 7.2.0 - [Release notes](https://github.com/docker/docker-py/releases) - [Commits](docker/docker-py@7.1.0...7.2.0) Updates `croniter` from 6.2.2 to 6.2.4 - [Release notes](https://github.com/pallets-eco/croniter/releases) - [Changelog](https://github.com/pallets-eco/croniter/blob/main/CHANGELOG.rst) - [Commits](pallets-eco/croniter@6.2.2...6.2.4) Updates `boto3` from 1.43.9 to 1.43.66 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.9...1.43.66) Updates `pillow` from 12.2.0 to 12.3.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.2.0...12.3.0) --- updated-dependencies: - dependency-name: django dependency-version: '6.1' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: djangorestframework dependency-version: 3.17.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: pyotp dependency-version: 2.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: docker dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: croniter dependency-version: 6.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: boto3 dependency-version: 1.43.66 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: pillow dependency-version: 12.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-10T04:21:09Z

Labels

The following labels could not be found: backend, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Navigation Menu

deps(backend): bump the minor-and-patch group across 1 directory with 7 updates - #35

deps(backend): bump the minor-and-patch group across 1 directory with 7 updates#35
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend/minor-and-patch-0cff92e710

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 10, 2026

3.17.2

What's Changed

Bug fixes

v2.10.0

Changes for v2.10.0 (2026-06-13)

7.2.0

Upgrade Notes

Features

Bugfixes

Miscellaneous

What's Changed

New Contributors

6.2.4

croniter 6.2.4

Bugfixes

Packaging

6.2.3

6.2.4 (2026-07-10)

6.2.3 (2026-07-02)

12.3.0

Removals

Documentation

Dependencies

Testing

Uh oh!

dependabot Bot commented on behalf of github Aug 10, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants