Skip to content

build(deps): bump the pip group across 1 directory with 10 updates - #3832

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/pip-0b2c69be81
Closed

build(deps): bump the pip group across 1 directory with 10 updates#3832
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/pip-0b2c69be81

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 10 updates in the / directory:

Package From To
python-dateutil 2.9.0.post0 3.0.0
boltons 21.0.0 26.2.0
docutils 0.22.4 0.23
exceptiongroup 1.2.2 1.3.1
glom 22.1.0 25.12.0
peewee 3.19.0 4.5.3
ruamel-yaml 0.17.40 0.19.1
semgrep 1.79.0 1.182.1
tomli 2.0.2 2.5.0
wcmatch 8.5.2 11.1

Updates python-dateutil from 2.9.0.post0 to 3.0.0

Release notes

Sourced from python-dateutil's releases.

3.0.0

This is the last major version of dateutil that will support any version of Python older than 3.11. The next release will be the 4.x series, which will support Python 3.11 and later. We may release fixes for serious bugs in the 3.0.x series, but there are no plans for new features there.

The biggest change in this release is a rewrite of tz.tzfile, which affects nearly every user of dateutil.tz and changes the UTC offset of nonexistent times (see below). dateutil also now depends on the tzdata package, and no longer ships its own time zone database.

Data updates

  • dateutil no longer bundles a copy of the IANA time zone database. Time zone data now comes from the system (see dateutil.tz.TZPATH) or, failing that, from the new tzdata dependency, so the data version is whatever version of tzdata is installed. (gh pr #1130)

Features

  • Rewrote tz.tzfile based on a backport of the zoneinfo module's pure-Python implementation. This adds support for Version 2 and Version 3 tzfile(5) binaries, resolving issues with timestamps beyond 2038 and "slim" format binaries. (gh issues #462, #1059, gh pr #1130)
  • Added dateutil.tz.TZPATH and dateutil.tz.reset_tzpath to allow for runtime configuration of the IANA time zone data search path. These replace the mutable dateutil.tz.TZPATHS list, which has been removed. (gh pr #1130)
  • dateutil now depends on the tzdata package, which gettz consults after the search path and before the Windows registry. On Windows this means that names that are both IANA keys and Windows time zone names, such as "UTC", now return a tzfile rather than a tzwin. (gh pr #1130)

Bugfixes

  • tz.tzfile now follows PEP 495 for times that fall in a gap: with fold=0 it uses the offset from before the transition, and with fold=1 the offset from after it. Previously it always used the offset from after the transition, so for example datetime(2003, 4, 6, 2, 30, tzinfo=tz.gettz("America/New_York")) had a UTC offset of -04:00, where it now has -05:00, the same as with zoneinfo. (gh pr #1130)
  • tz.tzfile objects for fixed-offset zones, such as tz.gettz("UTC"), now return their offset, DST offset and abbreviation when utcoffset, dst and tzname are called with None, as tz.tzutc, tz.tzoffset and zoneinfo.ZoneInfo do. This means that datetime.time objects with such a zone attached are now aware: time(12, tzinfo=tz.gettz("UTC")).isoformat() is now "12:00:00+00:00" rather than "12:00:00". (gh pr #1130)
  • tz.tzfile now infers dst() from the standard time on both sides of each DST period, rather than only the one before it, and does so for each transition rather than for each local time type. This fixes dst() for double summer time (e.g. in Europe/London in the 1940s), for half-hour DST (e.g. in Pacific/Rarotonga) and where the standard offset changed at the same time as a DST transition (e.g. in America/Bahia_Banderas in 2010). Against the standard offsets in the tz database source, the only remaining errors are in Europe/Paris in 1944 and 1945. (gh pr #1130)
  • Fixed rrulestr raising ValueError on experimental X- parameters in an RRULE line (such as GNOME Evolution's X-EVOLUTION-ENDDATE); these are now ignored as RFC 5545 permits. Fixed by @​yajo (gh pr #1374)
  • Enabled pickling and deepcopy of cached rrule and rruleset instances. The cache setting is preserved, and cached results are regenerated on demand without copying locks or generators. Reported by @​niccokunzmann (gh issue #1369). Fixed by @​Jay1023CN (gh pr #1600).
  • Fixed relativedelta.__ne__ raising TypeError when comparing against an unsupported type such as None; it now returns True. Reported and fixed by @​kevinkt1 (gh issue #1157, gh pr #1158)
  • Raised the minimum version of six to 1.6, fixing No module named 'six.moves' errors with older versions. Reported by @​skytreader (gh issue #1415), fixed by @​jdarias3 (gh pr #1424).

Deprecations

  • Deprecated the dateutil.zoneinfo module. The module now acts as a wrapper around the tzdata package and will be removed in a future version. Users are encouraged to migrate to dateutil.tz.gettz or the standard library's zoneinfo module. dateutil.zoneinfo.rebuild.rebuild no longer does anything, and by default raises RebuildDeprecationWarning as an error; filter the warning to call it as a no-op. (gh pr #1130)
  • Deprecated passing gettz a relative key that refers to a file outside of every directory on TZPATH, such as "../../etc/localtime". By default this now raises dateutil.tz.DeprecatedTzKeyWarning as an error; filter the warning to keep the old behavior for now, or pass an absolute path instead. (gh pr #1130)

Documentation changes

  • Added intersphinx to the docs build and cleaned up some broken links. (gh pr #1463)

Misc

Changelog

Sourced from python-dateutil's changelog.

Version 3.0.0 (2026-10-21)

This is the last major version of dateutil that will support any version of Python older than 3.11. The next release will be the 4.x series, which will support Python 3.11 and later. We may release fixes for serious bugs in the 3.0.x series, but there are no plans for new features there.

The biggest change in this release is a rewrite of tz.tzfile, which affects nearly every user of dateutil.tz and changes the UTC offset of nonexistent times (see below). dateutil also now depends on the tzdata package, and no longer ships its own time zone database.

Data updates

  • dateutil no longer bundles a copy of the IANA time zone database. Time zone data now comes from the system (see dateutil.tz.TZPATH) or, failing that, from the new tzdata dependency, so the data version is whatever version of tzdata is installed. (gh pr #1130)

Features

  • Rewrote tz.tzfile based on a backport of the zoneinfo module's pure-Python implementation. This adds support for Version 2 and Version 3 tzfile(5) binaries, resolving issues with timestamps beyond 2038 and "slim" format binaries. (gh issues #462, #1059, gh pr #1130)
  • Added dateutil.tz.TZPATH and dateutil.tz.reset_tzpath to allow for runtime configuration of the IANA time zone data search path. These replace the mutable dateutil.tz.TZPATHS list, which has been removed. (gh pr #1130)
  • dateutil now depends on the tzdata package, which gettz consults after the search path and before the Windows registry. On Windows this means that names that are both IANA keys and Windows time zone names, such as "UTC", now return a tzfile rather than a tzwin. (gh pr #1130)

Bugfixes

  • tz.tzfile now follows PEP 495 for times that fall in a gap: with fold=0 it uses the offset from before the transition, and with fold=1 the offset from after it. Previously it always used the offset from after the transition, so for example datetime(2003, 4, 6, 2, 30, tzinfo=tz.gettz("America/New_York")) had a UTC offset of -04:00, where it now has -05:00, the same as with zoneinfo. (gh pr #1130)
  • tz.tzfile objects for fixed-offset zones, such as tz.gettz("UTC"), now return their offset, DST offset and abbreviation when utcoffset, dst and tzname are called with None, as tz.tzutc, tz.tzoffset and

... (truncated)

Commits
  • 10f317f Prepare release 3.0.0
  • fabac8d Run the tests against a wheel built once on a recent Python
  • 21b6862 Allow pickling and deepcopy of cached recurrence rules (#1600)
  • bd5fd88 Remove deprecated setuptools usage from the build
  • 962f0a5 Don't fetch an unpinned setuptools_scm via setup_requires
  • db944cf Update the Python version classifiers
  • 3b07521 Test on Python 3.14t, 3.15 and 3.15t
  • 6899421 Fix dateutil/dateutil#1157
  • bc90ab4 Use trusted publishing to upload to PyPI
  • 950abb6 fix(rrule): don't die on experimental properties
  • Additional commits viewable in compare view

Updates boltons from 21.0.0 to 26.2.0

Release notes

Sourced from boltons's releases.

26.2.0

Full Changelog: mahmoud/boltons@26.1.0...26.2.0

26.1.0

  • Fixed strutils.singularize mangling words ending in 'ss'

... (truncated)

Changelog

Sourced from boltons's changelog.

26.2.0

(September 7, 2026)

  • Added [statsutils.mode][statsutils.mode] to return the most common value, breaking ties by first appearance (#453)
  • Fixed [setutils.IndexedSet.update][setutils.IndexedSet.update] adding the iterables themselves instead of their elements when given multiple inputs (#474)
  • Fixed [strutils.iter_splitlines][strutils.iter_splitlines] and [strutils.indent][strutils.indent] splitting dates containing 28 or 29 instead of recognizing Unicode line separators (#475)
  • Added [strutils.ellipsize][strutils.ellipsize] for word-boundary-aware text truncation with an ellipsis
  • Fixed [funcutils.wraps][funcutils.wraps] passing arguments positionally to wrappers that only accept them as keywords (#261)
  • Fixed [tableutils.Table.to_text][tableutils.Table] crashes on empty tables, None headers, and short header rows; empty headers now render no header row, matching to_html
  • Fixed [timeutils.isoparse][timeutils.isoparse] misreading fractional seconds (.851 parsed as 851µs instead of 851000µs); >6-digit fractions now truncate instead of raising
  • Fixed [timeutils.daterange][timeutils.daterange] looping forever on non-advancing steps: zero and self-cancelling month/day steps now raise ValueError, wrong-direction steps yield nothing like range()
  • Fixed [strutils.MultiReplace][strutils.MultiReplace] raising KeyError on empty substitution maps (now a no-op)
  • Fixed [jsonutils.JSONLIterator][jsonutils.JSONLIterator] hanging when a seek lands past the last newline, and negative rel_seek values seeking past EOF (sign bug)
  • Fixed [iterutils.xfrange][iterutils.xfrange] yielding nothing for descending ranges; now shares [frange][iterutils.frange]'s count-based semantics, so both agree at inexact float boundaries
  • Fixed [urlutils.parse_qsl][urlutils.parse_qsl] ignoring its encoding argument when decoding keys and values (#455)
  • Fixed [dictutils.OrderedMultiDict.addlist][dictutils.OrderedMultiDict.addlist] dropping values from one-shot iterables, including the vendored copy in urlutils (#458)
  • Fixed [ecoutils.get_profile][ecoutils.get_profile] looking up identifying host, username, and working-directory information when scrub=True (#461)
  • Fixed [namedutils.namedtuple][namedutils.namedtuple] and [namedutils.namedlist][namedutils.namedlist] raising IndexError instead of ValueError for empty type and field names (#462)
  • Fixed [iterutils.GUIDerator][iterutils.GUIDerator] error text to reflect the inclusive minimum size of 20 (#451)
  • Fixed [timeutils.decimal_relative_time][timeutils.decimal_relative_time] and relative_time rejecting aware datetimes when the comparison time is omitted (#469)
  • Fixed [timeutils.USTimeZone][timeutils.USTimeZone] handling of repeated and missing DST hours, including fold on UTC conversion (#441)
  • Fixed [mathutils.Bits][mathutils.Bits] negative indexing (#450)
  • Fixed [mathutils.Bits][mathutils.Bits] empty binary, hexadecimal, and byte round trips (#468)
  • Sped up [setutils.IndexedSet][setutils.IndexedSet] bulk difference and intersection updates with a single-pass rebuild (#440)
  • Fixed [listutils.BarrelList][listutils.BarrelList] out-of-range indexing returning unrelated values (#440)
  • Fixed [listutils.BarrelList][listutils.BarrelList] insertion clamping across multiple internal lists (#440)
  • Fixed [listutils.BarrelList][listutils.BarrelList] popping after an internal list was emptied by indexed removals (#440)
  • Fixed [listutils.BarrelList.iter_slice][listutils.BarrelList.iter_slice] slice normalization and reverse steps (#471)
  • Fixed [listutils.BarrelList.del_slice][listutils.BarrelList.del_slice] deletion across internal lists and through the end of the list (#472)
  • Fixed [jsonutils.JSONLIterator][jsonutils.JSONLIterator] rejecting the documented rel_seek=1.0 endpoint (#465)
  • Fixed [jsonutils.JSONLIterator][jsonutils.JSONLIterator] relative seeking in binary streams (#464)
  • Fixed [statsutils.Stats.get_histogram_counts][statsutils.Stats.get_histogram_counts] division by zero for data with no interquartile spread (#467)
  • Fixed [jsonutils.reverse_iter_lines][jsonutils.reverse_iter_lines] ignoring explicit and stream encodings (#463)
  • Fixed [jsonutils.reverse_iter_lines][jsonutils.reverse_iter_lines] detaching the caller's text stream, preventing later reads and context-manager cleanup (#466)
  • Fixed [cacheutils.ThresholdCounter.update][cacheutils.ThresholdCounter.update] ignoring mapping and keyword counts (#476)
  • Fixed [cacheutils.LRI.update][cacheutils.LRI.update] and [cacheutils.LRU.update][cacheutils.LRU.update] rejecting empty and keyword-only updates, and ignoring keywords when the source is the cache itself (#478)
  • Fixed [cacheutils.ThresholdCounter.most_common][cacheutils.ThresholdCounter.most_common] returning no pairs when the limit is omitted (#460)
  • Fixed [strutils.bytes2human][strutils.bytes2human] failing to use the Y suffix for yottabyte-sized values (#459)
  • Fixed [urlutils.URL.get_authority][urlutils.URL.get_authority] dropping passwords when the username is empty (#477)
  • Fixed [strutils.args2sh][strutils.args2sh] and [strutils.args2cmd][strutils.args2cmd] ignoring the sep argument (#454)
  • Fixed [statsutils.Stats.pearson_type][statsutils.Stats.pearson_type] raising RuntimeError instead of classifying Pearson types IV, V, and VI (#434)
  • Fixed [statsutils.Stats.pearson_type][statsutils.Stats.pearson_type] division by zero at the exact coefficient boundary, preserving the existing Normal and Gamma cases (#434)
  • Fixed [setutils.complement][setutils.complement] subset and superset comparisons raising AttributeError (#438)
  • Fixed [mathutils.Bits][mathutils.Bits] accepting values too large for the requested bit length
  • Fixed [tbutils.ParsedException][tbutils.ParsedException] dropping Python 3.11+ traceback anchor lines during round trips (#333)
  • Fixed [strutils.pluralize][strutils.pluralize] handling of words ending in x, such as box
  • Fixed [iterutils.backoff_iter][iterutils.backoff_iter] division by zero with factor=1.0 and no count; equal bounds yield once, and unequal bounds raise ValueError

26.1.0

... (truncated)

Commits
  • 4332b35 boltons version 26.2.0
  • 1216b46 Complete September PR sweep for 26.2.0 (#481)
  • 8bb31ba statsutils: complete Pearson classification and maintainer review (#434)
  • 73e22c9 statsutils: finish Pearson zero-denominator review and regression coverage
  • 3913220 Merge current master into Pearson classification branch
  • 45a2511 strutils: recognize Unicode line separators without splitting dates (#475)
  • 1cdc0e9 statsutils: handle zero interquartile range in histograms (#467)
  • 805c803 jsonutils: align binary streams to binary newlines (#464)
  • 5150802 jsonutils: accept explicit end-of-file relative seek (#465)
  • 574393a listutils: preserve barrel endpoints during slice deletion (#472)
  • Additional commits viewable in compare view

Updates docutils from 0.22.4 to 0.23

Commits

Updates exceptiongroup from 1.2.2 to 1.3.1

Release notes

Sourced from exceptiongroup's releases.

1.3.1

  • Fixed AttributeError: 'TracebackException' object has no attribute 'exceptions' when formatting unpickled TBEs from another Python process which did not apply the exceptiongroup patches (#144)

1.3.0

  • Added **kwargs to function and method signatures as appropriate to match the signatures in the standard library
  • In line with the stdlib typings in typeshed, updated (Base)ExceptionGroup generic types to define defaults for their generic arguments (defaulting to BaseExceptionGroup[BaseException] and ExceptionGroup[Exception]) (PR by @​mikenerone)
  • Changed BaseExceptionGroup.__init__() to directly call BaseException.__init__() instead of the superclass __init__() in order to emulate the CPython behavior (broken or not) (PR by @​cfbolz)
  • Changed the exceptions attribute to always return the same tuple of exceptions, created from the original exceptions sequence passed to BaseExceptionGroup to match CPython behavior (#143)
Changelog

Sourced from exceptiongroup's changelog.

Version history

This library adheres to Semantic Versioning 2.0 <http://semver.org/>_.

UNRELEASED

  • Fixed the repr() of exception groups being affected by mutation of the original exception sequence after construction ([#154](https://github.com/agronholm/exceptiongroup/issues/154) <https://github.com/agronholm/exceptiongroup/issues/154>_)
  • Fixed traceback limits being ignored for exceptions nested inside exception groups
  • Fixed catch() overwriting earlier handlers when distinct mapping keys normalize to the same exception types ([#164](https://github.com/agronholm/exceptiongroup/issues/164) <https://github.com/agronholm/exceptiongroup/pull/164>_)
  • Fixed catch() flattening exception groups raised by handlers when they were not the original matched group. Such groups are now propagated as-is, like with native except*, so code that previously received the bare exception(s) from such a group will now receive the exception group itself ([#157](https://github.com/agronholm/exceptiongroup/issues/157) <https://github.com/agronholm/exceptiongroup/issues/157>_)
  • Fixed catch() overwriting the __cause__ and __context__ of exceptions propagating out of it, to match native except*. Exceptions raised by handlers now keep the chaining they were raised with (e.g. raise ... from None) instead of inheriting the original group's __cause__, and re-raised exceptions now keep the original group's __context__ ([#157](https://github.com/agronholm/exceptiongroup/issues/157) <https://github.com/agronholm/exceptiongroup/issues/157>_)
  • Fixed catch() dropping exceptions that no handler matched when a handler raises an exception. Such exceptions are now propagated along with the handler's exception, like with native except*, so code that previously received only the handler's exception will now receive an exception group containing both ([#161](https://github.com/agronholm/exceptiongroup/issues/161) <https://github.com/agronholm/exceptiongroup/issues/161>_)

1.3.1

  • Fixed AttributeError: 'TracebackException' object has no attribute 'exceptions' when formatting unpickled TBEs from another Python process which did not apply the exceptiongroup patches ([#144](https://github.com/agronholm/exceptiongroup/issues/144) <https://github.com/agronholm/exceptiongroup/issues/144>_)

1.3.0

  • Added **kwargs to function and method signatures as appropriate to match the signatures in the standard library
  • In line with the stdlib typings in typeshed, updated (Base)ExceptionGroup generic types to define defaults for their generic arguments (defaulting to BaseExceptionGroup[BaseException] and ExceptionGroup[Exception]) (PR by @​mikenerone)
  • Changed BaseExceptionGroup.__init__() to directly call BaseException.__init__() instead of the superclass __init__() in order to emulate the CPython behavior (broken or not) (PR by @​cfbolz)
  • Changed the exceptions attribute to always return the same tuple of exceptions,

... (truncated)

Commits
  • ddddb6f Added the release version
  • 49c5e60 Fixed AttributeError when formatting unpickled TBEs from an unpatched process
  • 1be517f [pre-commit.ci] pre-commit autoupdate (#152)
  • af0ea2f [pre-commit.ci] pre-commit autoupdate (#149)
  • 7c980a8 Removed pin on pyright version
  • ef85336 Fixed typing job not finding Python 3.14
  • 080b3f4 Pinned pyright version to fix typeshed related failure
  • ac66090 Added Python 3.14 to the test matrix
  • a0da94d Fixed test failures on Python 3.14
  • 77fba8a Added the release version
  • Additional commits viewable in compare view

Updates glom from 22.1.0 to 25.12.0

Changelog

Sourced from glom's changelog.

25.12.0

(December 28, 2025)

Maintenance release, adding tests and test fixes for Python 3.13 and 3.14.

24.11.0

(November 2, 2024)

  • Add support for Python 3.12, dropping pre-Python 3.7 syntax.
  • Add --scalar flag to CLI to enable cleaner way to get single values at the console and in scripts
  • Upgrade requirements, fixing face pin (see issue 284

23.5.0

(November 26, 2023)

Add TOML support to the CLI. Thanks, Julian! Uses the built-in tomllib on Python 3.11+. pip install glom[toml] on Python 3.10 and earlier.

23.4.0

(November 7, 2023)

Officially add Python 3.11 support, fixing traceback formatting issues.

Also, change the implementation of T under the hood, no expected behavioral changes.

23.3.0

(March 30, 2023)

Officially drop Python 2/3.6 support and fix a small warning caused by a docstring (#258i258).

23.1.1

(January 19, 2023)

Fix a dependency issue by pinning the face library.

23.1.0

(January 18, 2023)

... (truncated)

Commits

Updates peewee from 3.19.0 to 4.5.3

Release notes

Sourced from peewee's releases.

4.5.3

  • JSON path keys on Postgres are rendered inline (data->>'key', '{"a","b"}'::text[]) instead of as bound parameters, so GROUP BY and ORDER BY on a JSON lookup work under psycopg3, which binds each as a distinct parameter.
  • Cast() etc over a python value no longer break result row processing.
  • A write query with a RETURNING clause now runs again on every explicit execute() call (like a write query without one). Iterating the query still reads the result of the last execution. Previously, repeated execute() calls returned the cached result without running the query.
  • Fix regression in model select .exists(), #3086.

View commits

4.5.2

  • Don't cache None on unselected FK join trees, see #3083.
  • Some fixes for edge-cases around non-unique aliases and unicode aliases, see #3081 and #3078.
  • Ensure subqueries get appropriate parens inside single argument functions. Functions that do not want the extra parens (exists, e.g.) will not add extra parens.
  • exists() wraps the query in EXISTS(...) rather than replacing its columns, fixing queries that order by or filter on a selected alias, and queries on MySQL that select two columns w/the same name.
  • Composite primary key columns are introspected in key-order.

View commits

4.5.1

Couple little things for EnumField.

  • EnumField and IntEnumField validate member value types (str and int respectively) at field construction.
  • EnumField and IntEnumField default choices to (value, name) pairs derived from the enum.
  • Fix #3075, migration generation for EnumField. Generated migrations will emit the storage field type (e.g. IntegerField) rather than EnumField().

View commits

4.5.0

Backwards-incompatible:

  • MySQL and MariaDB connections no longer set sql_mode. Peewee had been setting PIPES_AS_CONCAT, but the param replaced the server's mode rather than adding to it, which silently disabled STRICT_TRANS_TABLES (etc). Going forward Peewee will not modify sql_mode by default and use CONCAT() rather than || for MySQL/MariaDB.
  • MySQL and MariaDB connection charset defaults to utf8mb4 instead of utf8, which is an alias for utf8mb3 and cannot store 4-byte characters.
  • A field's sequence= is now qualified with the model's Meta.schema. If the name you pass already contains a dot it is treated as fully-qualified and used as-is, so sequence='other.seq' is unaffected by Meta.schema. Also, sequence_exists() accepts a schema-qualified name.
  • SQLite BEGIN, COMMIT and ROLLBACK are issued directly on a cursor rather than through execute_sql(), so they are no longer debug-logged, do not fire query hooks and are not counted by count_queries(). This matches Postgres and MySQL.
  • atomic() and transaction() on a closed database with autoconnect=False now raise InterfaceError on Postgres and MySQL, as they already did on SQLite (and as queries do). Previously begin() opened a connection regardless of autoconnect.

Improvements:

  • Add SqliteDatabase(..., lock_type=...) to set the default locking strategy for transactions that do not specify one, e.g. lock_type='IMMEDIATE'.
  • Postgres introspection (get_tables(), get_columns(), get_indexes(), get_primary_keys(), get_foreign_keys(), get_views()) with no schema now follows the search path via current_schema() instead of assuming public, matching MySQL's DATABASE() behavior.
  • Add Runner(db, schema=...) and pwmigrate --schema for running migrations against a specific schema. The history table lives in that schema, so each schema tracks its own applied set and one set of migration files can be run against any number of schemas.
  • Add SchemaMigrator(db, schema=...), which qualifies every table name w/the given schema (or database on MySQL). Not supported for SQLite, as the table-rebuild rewrites DDL straight from sqlite_master.
  • Add websearch=True to TSVectorField.match() and Match() to parse the query using websearch_to_tsquery() (pg 11+). Accepts user input without raising (quoted phrases, or, and -negation).
  • Add Database.query_hooks, a list of callables invoked after every query with a QueryEvent named tuple (sql, params, duration, exception), on success and failure both. No timing overhead when the list is empty.
  • Add Database.after_commit(fn), which runs a callable after the outermost transaction commits. Hook is discarded on rollback and runs immediately if no transaction is active. Use for, e.g., writing a row PK to a task queue.

... (truncated)

Changelog

Sourced from peewee's changelog.

4.5.3

  • JSON path keys on Postgres are rendered inline (data->>'key', '{"a","b"}'::text[]) instead of as bound parameters, so GROUP BY and ORDER BY on a JSON lookup work under psycopg3, which binds each occurrence of a key as a distinct parameter. Applies to the core JSONField and to playhouse.postgres_ext.
  • Cast() and other wrapped nodes over a plain value no longer break result row processing.
  • A write query with a RETURNING clause now runs again on every explicit execute() call (like a write query without one). Iterating the query still reads the result of the last execution. Previously repeated execute() calls returned the cached result without running the query.
  • Fix regression in model select .exists(), #3086.

View commits

4.5.2

  • Don't cache None on unselected FK join trees, see #3083.
  • Some fixes for edge-cases around non-unique aliases and unicode aliases, see #3081 and #3078.
  • Ensure subqueries get appropriate parens inside single argument functions. Functions that do not want the extra parens (exists, e.g.) will not add extra parens.
  • exists() wraps the query in EXISTS(...) rather than replacing its columns, fixing queries that order by or filter on a selected alias, and queries on MySQL that select two columns w/the same name.
  • Composite primary key columns are introspected in key-order.

View commits

4.5.1

  • EnumField and IntEnumField validate member value types (str and int respectively) at field construction.
  • EnumField and IntEnumField default choices to (value, name) pairs derived from the enum.
  • Fix #3075, migration generation for EnumField. Generated migrations will emit the storage field type (e.g. IntegerField) rather than EnumField().

View commits

4.5.0

Backwards-incompatible:

  • MySQL and MariaDB connections no longer set sql_mode. Peewee had been setting PIPES_AS_CONCAT, but the param replaced the server's mode rather than adding to it, which silently disabled STRICT_TRANS_TABLES (etc).

... (truncated)

Commits
  • e245a01 4.5.3
  • c6d0f30 Fix regression in exists() #3086
  • db793d7 Fix up sqlite version checking in ci
  • 6970f1e Small fixup for 'title:-phrase' in fts parser
  • 4b55949 Ensure we handle text passed as json paths w/psycopg3.
  • f0d16ee Explicit .execute() re-executes a write query w/returning.
  • fe92ad6 Docs cleanup pass 2, verifying sig's, etc.
  • bea93b9 Docs trim

@dependabot
build(deps): bump the pip group across 1 directory with 10 updates
3ba5b09 
Bumps the pip group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [python-dateutil](https://github.com/dateutil/dateutil) | `2.9.0.post0` | `3.0.0` |
| [boltons](https://github.com/mahmoud/boltons) | `21.0.0` | `26.2.0` |
| [docutils](https://github.com/rtfd/recommonmark) | `0.22.4` | `0.23` |
| [exceptiongroup](https://github.com/agronholm/exceptiongroup) | `1.2.2` | `1.3.1` |
| [glom](https://github.com/mahmoud/glom) | `22.1.0` | `25.12.0` |
| [peewee](https://github.com/coleifer/peewee) | `3.19.0` | `4.5.3` |
| ruamel-yaml | `0.17.40` | `0.19.1` |
| [semgrep](https://github.com/semgrep/semgrep) | `1.79.0` | `1.182.1` |
| [tomli](https://github.com/hukkin/tomli) | `2.0.2` | `2.5.0` |
| [wcmatch](https://github.com/facelessuser/wcmatch) | `8.5.2` | `11.1` |



Updates `python-dateutil` from 2.9.0.post0 to 3.0.0
- [Release notes](https://github.com/dateutil/dateutil/releases)
- [Changelog](https://github.com/dateutil/dateutil/blob/master/NEWS)
- [Commits](dateutil/dateutil@2.9.0.post0...3.0.0)

Updates `boltons` from 21.0.0 to 26.2.0
- [Release notes](https://github.com/mahmoud/boltons/releases)
- [Changelog](https://github.com/mahmoud/boltons/blob/master/CHANGELOG.md)
- [Commits](mahmoud/boltons@21.0.0...26.2.0)

Updates `docutils` from 0.22.4 to 0.23
- [Changelog](https://github.com/readthedocs/recommonmark/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rtfd/recommonmark/commits)

Updates `exceptiongroup` from 1.2.2 to 1.3.1
- [Release notes](https://github.com/agronholm/exceptiongroup/releases)
- [Changelog](https://github.com/agronholm/exceptiongroup/blob/main/CHANGES.rst)
- [Commits](agronholm/exceptiongroup@1.2.2...1.3.1)

Updates `glom` from 22.1.0 to 25.12.0
- [Changelog](https://github.com/mahmoud/glom/blob/master/CHANGELOG.md)
- [Commits](mahmoud/glom@v22.1.0...v25.12.0)

Updates `peewee` from 3.19.0 to 4.5.3
- [Release notes](https://github.com/coleifer/peewee/releases)
- [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md)
- [Commits](coleifer/peewee@3.19.0...4.5.3)

Updates `ruamel-yaml` from 0.17.40 to 0.19.1

Updates `semgrep` from 1.79.0 to 1.182.1
- [Release notes](https://github.com/semgrep/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/semgrep/semgrep/commits)

Updates `tomli` from 2.0.2 to 2.5.0
- [Changelog](https://github.com/hukkin/tomli/blob/master/CHANGELOG.md)
- [Commits](hukkin/tomli@2.0.2...2.5.0)

Updates `wcmatch` from 8.5.2 to 11.1
- [Release notes](https://github.com/facelessuser/wcmatch/releases)
- [Commits](facelessuser/wcmatch@8.5.2...11.1)

---
updated-dependencies:
- dependency-name: python-dateutil
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip
- dependency-name: boltons
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: pip
- dependency-name: docutils
  dependency-version: '0.23'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: exceptiongroup
  dependency-version: 1.3.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: glom
  dependency-version: 25.12.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: pip
- dependency-name: peewee
  dependency-version: 4.5.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: pip
- dependency-name: ruamel-yaml
  dependency-version: 0.19.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: semgrep
  dependency-version: 1.182.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: tomli
  dependency-version: 2.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: wcmatch
  dependency-version: '11.1'
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 31, 2026
@nicolargo nicolargo closed this Oct 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nicolargo