Update all Python dependencies

renovate-bot commented

2026-10-01 08:02:23 +02:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
authlib	`==1.8.0` -> `==1.9.1`
python-dotenv	`==1.2.3` -> `==1.2.4`
tenacity (changelog)	`==9.1.4` -> `==9.2.1`

Release Notes

authlib/authlib (authlib)

`v1.9.1`

Compare Source

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

Use scriv to handle the changelog by @azmeuk in #954

Full Changelog: https://github.com/authlib/authlib/compare/v1.9.0...v1.9.1

`v1.9.0`

Compare Source

What's Changed

feat: add Identity Assertion JWT Authorization Grant (ID-JAG) by @BinoyOza-okta in #898
Fix empty signatures validation in JWS JSON deserialization by @loporto in #938
fix(jose): reject boolean values for NumericDate claims by @cpruijsen in #942
fix(client): avoid duplicated OAuth 1.0 parameters in signed requests by @cpruijsen in #943
OAuth2 token fetch crashes with JSONDecodeError instead of a catchable error on rate-limit responses by @juneja-varun in #929
docs: add i18n wrappers in conf.py and templates by @hwhsu1231 in #901
fix(oauth): enforce JOSE key, scope, and audience validation by @lepture in #945
AsyncOpenIDMixin.parse_id_token: return None when id_token is absent, matching the sync client by @ckarnell in #924
fix(oauth): enforce nonce and JAR request validation by @lepture in #949
fix(oauth): require client authentication for ID-JAG grants by @lepture in #955

New Contributors

@BinoyOza-okta made their first contribution in #898
@loporto made their first contribution in #938
@cpruijsen made their first contribution in #942
@juneja-varun made their first contribution in #929
@hwhsu1231 made their first contribution in #901
@ckarnell made their first contribution in #924

Full Changelog: https://github.com/authlib/authlib/compare/v1.8.0...v1.9.0

theskumar/python-dotenv (python-dotenv)

`v1.2.4`

Compare Source

Fixed

dotenv get no longer exits with code 1 for empty string values (KEY=) by [@ShamikOfficial] in [#700]
An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@Noethix55555] in [#663]
dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@ROTl24] in [#698]

jd/tenacity (tenacity)

`v9.2.1`

Compare Source

9.2.0 was tagged but never reached PyPI: the upload rejected its package description (#714). 9.2.1 is the first release on PyPI with everything in 9.2.0, plus the changes below.

What's Changed

chore(mypy): drop vestigial tornado ignore_missing_imports override by @jd in #676
fix: annotate wait_base.radd as taking the int seed from sum() by @jd in #677
chore(mypy): enable the strictness options strict leaves off by @jd in #678
refactor: drop always-true truthiness checks and enable truthy-bool by @jd in #679
refactor: declare BaseAction's REPR_FIELDS and NAME as ClassVar by @jd in #680
test: fix possibly-undefined and deprecated call sites by @jd in #681
refactor: mark overridden methods with @override by @jd in #682
fix: restore support for falsy wait values and callable + strategy by @jd in #694
fix: read the tornado global live instead of an import-time snapshot by @jd in #696
Respect enabled=False on the direct-call path by @mahirhir in #645
fix: only treat None and 0 as "no wait" by @jd in #741
fix: restore PyPI-compatible package description by @arindamsikder in #725
ci: check built distributions with twine by @jd in #742

New Contributors

@mahirhir made their first contribution in #645
@kozlek made their first contribution in #733
@arindamsikder made their first contribution in #725

Full Changelog: https://github.com/jd/tenacity/compare/9.2.0...9.2.1

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [authlib](https://github.com/authlib/authlib) | `==1.8.0` -> `==1.9.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/authlib/1.9.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/authlib/1.8.0/1.9.1?slim=true) | | [python-dotenv](https://github.com/theskumar/python-dotenv) | `==1.2.3` -> `==1.2.4` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/python-dotenv/1.2.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/python-dotenv/1.2.3/1.2.4?slim=true) | | [tenacity](https://github.com/jd/tenacity) ([changelog](https://tenacity.readthedocs.io/en/latest/changelog.html)) | `==9.1.4` -> `==9.2.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/tenacity/9.2.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/tenacity/9.1.4/9.2.1?slim=true) | --- ### Release Notes <details> <summary>authlib/authlib (authlib)</summary> ### [`v1.9.1`](https://github.com/authlib/authlib/releases/tag/v1.9.1) [Compare Source](https://github.com/authlib/authlib/compare/v1.9.0...v1.9.1) Changelog: <https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1> #### What's Changed - Use scriv to handle the changelog by [@azmeuk](https://github.com/azmeuk) in [#954](https://github.com/authlib/authlib/pull/954) **Full Changelog**: <https://github.com/authlib/authlib/compare/v1.9.0...v1.9.1> ### [`v1.9.0`](https://github.com/authlib/authlib/releases/tag/v1.9.0) [Compare Source](https://github.com/authlib/authlib/compare/v1.8.0...v1.9.0) #### What's Changed - feat: add Identity Assertion JWT Authorization Grant (ID-JAG) by [@BinoyOza-okta](https://github.com/BinoyOza-okta) in [#898](https://github.com/authlib/authlib/pull/898) - Fix empty signatures validation in JWS JSON deserialization by [@loporto](https://github.com/loporto) in [#938](https://github.com/authlib/authlib/pull/938) - fix(jose): reject boolean values for NumericDate claims by [@cpruijsen](https://github.com/cpruijsen) in [#942](https://github.com/authlib/authlib/pull/942) - fix(client): avoid duplicated OAuth 1.0 parameters in signed requests by [@cpruijsen](https://github.com/cpruijsen) in [#943](https://github.com/authlib/authlib/pull/943) - OAuth2 token fetch crashes with JSONDecodeError instead of a catchable error on rate-limit responses by [@juneja-varun](https://github.com/juneja-varun) in [#929](https://github.com/authlib/authlib/pull/929) - docs: add i18n wrappers in conf.py and templates by [@hwhsu1231](https://github.com/hwhsu1231) in [#901](https://github.com/authlib/authlib/pull/901) - fix(oauth): enforce JOSE key, scope, and audience validation by [@lepture](https://github.com/lepture) in [#945](https://github.com/authlib/authlib/pull/945) - AsyncOpenIDMixin.parse\_id\_token: return None when id\_token is absent, matching the sync client by [@ckarnell](https://github.com/ckarnell) in [#924](https://github.com/authlib/authlib/pull/924) - fix(oauth): enforce nonce and JAR request validation by [@lepture](https://github.com/lepture) in [#949](https://github.com/authlib/authlib/pull/949) - fix(oauth): require client authentication for ID-JAG grants by [@lepture](https://github.com/lepture) in [#955](https://github.com/authlib/authlib/pull/955) #### New Contributors - [@BinoyOza-okta](https://github.com/BinoyOza-okta) made their first contribution in [#898](https://github.com/authlib/authlib/pull/898) - [@loporto](https://github.com/loporto) made their first contribution in [#938](https://github.com/authlib/authlib/pull/938) - [@cpruijsen](https://github.com/cpruijsen) made their first contribution in [#942](https://github.com/authlib/authlib/pull/942) - [@juneja-varun](https://github.com/juneja-varun) made their first contribution in [#929](https://github.com/authlib/authlib/pull/929) - [@hwhsu1231](https://github.com/hwhsu1231) made their first contribution in [#901](https://github.com/authlib/authlib/pull/901) - [@ckarnell](https://github.com/ckarnell) made their first contribution in [#924](https://github.com/authlib/authlib/pull/924) **Full Changelog**: <https://github.com/authlib/authlib/compare/v1.8.0...v1.9.0> </details> <details> <summary>theskumar/python-dotenv (python-dotenv)</summary> ### [`v1.2.4`](https://github.com/theskumar/python-dotenv/blob/HEAD/CHANGELOG.md#124---2026-10-01) [Compare Source](https://github.com/theskumar/python-dotenv/compare/v1.2.3...v1.2.4) ##### Fixed - `dotenv get` no longer exits with code 1 for empty string values (`KEY=`) by \[[@ShamikOfficial](https://github.com/ShamikOfficial)] in \[[#700](https://github.com/theskumar/python-dotenv/issues/700)] - An unquoted empty value followed by an inline comment (e.g. `KEY= # comment`) is now parsed as an empty string instead of the comment text by \[[@Noethix55555](https://github.com/Noethix55555)] in \[[#663](https://github.com/theskumar/python-dotenv/issues/663)] - `dotenv run --no-override` now expands variable references with the same precedence as `load_dotenv(override=False)`, so a value like `${BASE}/suffix` uses the existing `BASE` from the environment instead of the one from the `.env` file by \[[@ROTl24](https://github.com/ROTl24)] in \[[#698](https://github.com/theskumar/python-dotenv/issues/698)] </details> <details> <summary>jd/tenacity (tenacity)</summary> ### [`v9.2.1`](https://github.com/jd/tenacity/releases/tag/9.2.1) [Compare Source](https://github.com/jd/tenacity/compare/9.1.4...9.2.1) 9.2.0 was tagged but never reached PyPI: the upload rejected its package description ([#714](https://github.com/jd/tenacity/issues/714)). 9.2.1 is the first release on PyPI with everything in [9.2.0](https://github.com/jd/tenacity/releases/tag/9.2.0), plus the changes below. #### What's Changed - chore(mypy): drop vestigial tornado ignore\_missing\_imports override by [@jd](https://github.com/jd) in [#676](https://github.com/jd/tenacity/pull/676) - fix: annotate wait\_base.**radd** as taking the int seed from sum() by [@jd](https://github.com/jd) in [#677](https://github.com/jd/tenacity/pull/677) - chore(mypy): enable the strictness options `strict` leaves off by [@jd](https://github.com/jd) in [#678](https://github.com/jd/tenacity/pull/678) - refactor: drop always-true truthiness checks and enable truthy-bool by [@jd](https://github.com/jd) in [#679](https://github.com/jd/tenacity/pull/679) - refactor: declare BaseAction's REPR\_FIELDS and NAME as ClassVar by [@jd](https://github.com/jd) in [#680](https://github.com/jd/tenacity/pull/680) - test: fix possibly-undefined and deprecated call sites by [@jd](https://github.com/jd) in [#681](https://github.com/jd/tenacity/pull/681) - refactor: mark overridden methods with [@override](https://github.com/override) by [@jd](https://github.com/jd) in [#682](https://github.com/jd/tenacity/pull/682) - fix: restore support for falsy wait values and callable + strategy by [@jd](https://github.com/jd) in [#694](https://github.com/jd/tenacity/pull/694) - fix: read the tornado global live instead of an import-time snapshot by [@jd](https://github.com/jd) in [#696](https://github.com/jd/tenacity/pull/696) - Respect enabled=False on the direct-call path by [@mahirhir](https://github.com/mahirhir) in [#645](https://github.com/jd/tenacity/pull/645) - fix: only treat None and 0 as "no wait" by [@jd](https://github.com/jd) in [#741](https://github.com/jd/tenacity/pull/741) - fix: restore PyPI-compatible package description by [@arindamsikder](https://github.com/arindamsikder) in [#725](https://github.com/jd/tenacity/pull/725) - ci: check built distributions with twine by [@jd](https://github.com/jd) in [#742](https://github.com/jd/tenacity/pull/742) #### New Contributors - [@mahirhir](https://github.com/mahirhir) made their first contribution in [#645](https://github.com/jd/tenacity/pull/645) - [@kozlek](https://github.com/kozlek) made their first contribution in [#733](https://github.com/jd/tenacity/pull/733) - [@arindamsikder](https://github.com/arindamsikder) made their first contribution in [#725](https://github.com/jd/tenacity/pull/725) **Full Changelog**: <https://github.com/jd/tenacity/compare/9.2.0...9.2.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-10-01 08:02:23 +02:00

Update dependency python-dotenv to v1.2.4

Run Tests on PRs / Run tests (pull_request) Failing after 24s

Details

97ae9c9d1a