Bump the pip group across 1 directory with 4 updates by dependabot[bot] · Pull Request #11 · thomasthaddeus/TextToSpeechPython

dependabot · 2026-04-22T00:15:16Z

Bumps the pip group with 4 updates in the / directory: cryptography, lxml, python-dotenv and setuptools.

Updates cryptography from 42.0.4 to 46.0.7

Changelog

Sourced from cryptography's changelog.

46.0.7 - 2026-04-07
* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
  passed to APIs that accept Python buffers, which could lead to buffer
  overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
.. _v46-0-6:
46.0.6 - 2026-03-25
SECURITY ISSUE: Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug, including those used by the Web PKI. Credit to Oleh Konko (1seal) for reporting the issue. CVE-2026-34073

.. _v46-0-5:

46.0.5 - 2026-02-10
* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.
.. v46-0-4:
46.0.4 - 2026-01-27
Dropped support for win_arm64 wheels_.

Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

46.0.3 - 2025-10-15
* Fixed compilation when using LibreSSL 4.2.0.
.. _v46-0-2:

</tr></table>

... (truncated)

Commits

622d672 46.0.7 release (#14602)
91d7288 Cherry-pick #14542 (#14543)
06e120e bump version for 46.0.5 release (#14289)
0eebb9d EC check key on cofactor > 1 (#14287)
bedf6e1 fix openssl version on 46 branch (#14220)
e6f44fc bump for 46.0.4 and drop win arm64 due to CI issues (#14217)
c0af4dd release 46.0.3 (#13681)
99efe5a bump version for 46.0.2 (#13531)
e735cfc release 46.0.1 (#13450)
4e457ff Explicitly specify python in mac uv build invocation (#13447)
Additional commits viewable in compare view

Updates lxml from 5.0.1 to 6.1.0

Release notes

Sourced from lxml's releases.

lxml-6.1.0

No release notes provided.

lxml-6.0.4

No release notes provided.

lxml-6.0.3

No release notes provided.

lxml-6.0.2

No release notes provided.

lxml-6.0.1

No release notes provided.

lxml-6.0.0

No release notes provided.

lxml-5.4.0

5.4.0 (2025-04-22)

Bugs fixed

LP#2107279: Binary wheels use libxml2 2.13.8 and libxslt 1.1.43 to resolve several CVEs. (Binary wheels for Windows continue to use a patched libxml2 2.11.9 and libxslt 1.1.39.) Issue found by Anatoly Katyushin, see https://bugs.launchpad.net/lxml/+bug/2107279

lxml-5.3.2

No release notes provided.

lxml-5.3.1

No release notes provided.

lxml-5.3.0

No release notes provided.

lxml-5.2.2

5.2.2 (2024-05-12)

Bugs fixed

GH#417: The test_feed_parser test could fail if lxml_html_clean was not installed. It is now skipped in that case.

LP#2059910: The minimum CPU architecture for the Linux x86 binary wheels was set back to "core2", without SSE 4.2.

... (truncated)

Changelog

Sourced from lxml's changelog.

6.1.0 (2026-04-17)

This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser.

Features added

GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes in lxml.html.defs. This allows lxml_html_clean to pass them through. Patch by oomsveta.

The default chunk size for reading from file-likes in iterparse() is now configurable with a new chunk_size argument.

Bugs fixed

LP#2146291: The resolve_entities option was still set to True for iterparse and ETCompatXMLParser, allowing for external entity injection (XXE) when using these parsers without setting this option explicitly. The default was now changed to 'internal' only (as for the normal XML and HTML parsers since lxml 5.0). Issue found by Sihao Qiu as CVE-2026-41066.

6.0.4 (2026-04-12)

Bugs fixed

LP#2148019: Spurious MemoryError during namespace cleanup.

6.0.3 (2026-04-09)

Bugs fixed

Several out of memory error cases now raise MemoryError that were not handled before.

Slicing with large step values (outside of +/- sys.maxsize) could trigger undefined C behaviour.

LP#2125399: Some failing tests were fixed or disabled in PyPy.

LP#2138421: Memory leak in error cases when setting the public_id or system_url of a document.

... (truncated)

Commits

43722f4 Update changelog.
8747040 Name version of option change in docstring.
6c36e6c Fix pypistats URL in download statistics script.
c7d76d6 Change security policy to point to Github security advisories.
378ccf8 Update project income report.
315270b Docs: Reduce TOC depth of package pages and move module contents first.
6dbba7f Docs: Show current year in copyright line.
e4385bf Update project income report.
5bed1e1 Validate file hashes in release download script.
c13ee10 Prepare release of 6.1.0.
Additional commits viewable in compare view

Updates python-dotenv from 1.0.0 to 1.2.2

Release notes

Sourced from python-dotenv's releases.

v1.2.2

Added

Support for Python 3.14, including the free-threaded (3.14t) build. (#)

Changed

The dotenv run command now forwards flags directly to the specified command by @bbc2 in theskumar/python-dotenv#607

Improved documentation clarity regarding override behavior and the reference page.

Updated PyPy support to version 3.11.

Documentation for FIFO file support.

Support for Python 3.9.

Fixed

Improved set_key and unset_key behavior when interacting with symlinks by @bbc2 in #790c5

Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by @JYOuyang in theskumar/python-dotenv#590

Breaking Changes

dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

Misc

skip 000 permission tests for root user by @burnout-projects in theskumar/python-dotenv#561

Bump actions/checkout from 5 to 6 in the github-actions group by @dependabot[bot] in theskumar/python-dotenv#593

Add Windows testing to CI by @bbc2 in theskumar/python-dotenv#604

Improve workflow efficiency with best practices by @theskumar in theskumar/python-dotenv#609

Remove the use of sh in tests by @bbc2 in theskumar/python-dotenv#612

New Contributors

@JYOuyang made their first contribution in theskumar/python-dotenv#590

@burnout-projects made their first contribution in theskumar/python-dotenv#561

@cpackham-atlnz made their first contribution in theskumar/python-dotenv#597

Full Changelog: theskumar/python-dotenv@v1.2.1...v1.2.2

v1.2.1

What's Changed

... (truncated)

Changelog

Sourced from python-dotenv's changelog.

[1.2.2] - 2026-03-01

Added

Support for Python 3.14, including the free-threaded (3.14t) build. (#588)

Changed

The dotenv run command now forwards flags directly to the specified command by [@bbc2] in #607

Improved documentation clarity regarding override behavior and the reference page.

Updated PyPy support to version 3.11.

Documentation for FIFO file support.

Dropped Support for Python 3.9.

Fixed

Improved set_key and unset_key behavior when interacting with symlinks by [@bbc2] in [790c5c0]

Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by [@JYOuyang] in #590

Breaking Changes

dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

[1.2.1] - 2025-10-26

Move more config to pyproject.toml, removed setup.cfg

Add support for reading .env from FIFOs (Unix) by [@sidharth-sudhir] in #586

[1.2.0] - 2025-10-26

Upgrade build system to use PEP 517 & PEP 518 to use build and pyproject.toml by [@EpicWink] in #583

Add support for Python 3.14 by [@23f3001135] in #579

Add support for disabling of load_dotenv() using PYTHON_DOTENV_DISABLED env var. by [@matthewfranglen] in #569

[1.1.1] - 2025-06-24

Fixed

CLI: Ensure find_dotenv work reliably on python 3.13 by [@theskumar] in #563

... (truncated)

Commits

36004e0 Bump version: 1.2.1 → 1.2.2
eb20252 docs: update changelog for v1.2.2
790c5c0 Merge commit from fork
43340da Remove the use of sh in tests (#612)
09d7cee docs: clarify override behavior and document FIFO support (#610)
c8de288 ci: improve workflow efficiency with best practices (#609)
7bd9e3d Add Windows testing to CI (#604)
1baaf04 Drop Python 3.9 support and update to PyPy 3.11 (#608)
4a22cf8 ci: enable testing on Python 3.14t (free-threaded) (#588)
e2e8e77 Fix license specifier (#597)
Additional commits viewable in compare view

Updates setuptools from 70.0.0 to 78.1.1

Changelog

Sourced from setuptools's changelog.

v78.1.1

Bugfixes

More fully sanitized the filename in PackageIndex._download. (#4946)

v78.1.0

Features

Restore access to _get_vc_env with a warning. (#4874)

v78.0.2

Bugfixes

Postponed removals of deprecated dash-separated and uppercase fields in setup.cfg. All packages with deprecated configurations are advised to move before 2026. (#4911)

v78.0.1

Misc

#4909

v78.0.0

Bugfixes

Reverted distutils changes that broke the monkey patching of command classes. (#4902)

Deprecations and Removals

Setuptools no longer accepts options containing uppercase or dash characters in setup.cfg.

... (truncated)

Commits

8e4868a Bump version: 78.1.0 → 78.1.1
100e9a6 Merge pull request #4951
8faf1d7 Add news fragment.
2ca4a9f Rely on re.sub to perform the decision in one expression.
e409e80 Extract _sanitize method for sanitizing the filename.
250a6d1 Add a check to ensure the name resolves relative to the tmpdir.
d8390fe Extract _resolve_download_filename with test.
4e1e893 Merge https://github.com/jaraco/skeleton
3a3144f Fix typo: pyproject.license -> project.license (#4931)
d751068 Fix typo: pyproject.license -> project.license
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the pip group with 4 updates in the / directory: [cryptography](https://github.com/pyca/cryptography), [lxml](https://github.com/lxml/lxml), [python-dotenv](https://github.com/theskumar/python-dotenv) and [setuptools](https://github.com/pypa/setuptools). Updates `cryptography` from 42.0.4 to 46.0.7 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@42.0.4...46.0.7) Updates `lxml` from 5.0.1 to 6.1.0 - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](lxml/lxml@lxml-5.0.1...lxml-6.1.0) Updates `python-dotenv` from 1.0.0 to 1.2.2 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.0.0...v1.2.2) Updates `setuptools` from 70.0.0 to 78.1.1 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v70.0.0...v78.1.1) --- updated-dependencies: - dependency-name: cryptography dependency-version: 46.0.7 dependency-type: direct:production dependency-group: pip - dependency-name: lxml dependency-version: 6.1.0 dependency-type: direct:production dependency-group: pip - dependency-name: python-dotenv dependency-version: 1.2.2 dependency-type: direct:production dependency-group: pip - dependency-name: setuptools dependency-version: 78.1.1 dependency-type: indirect dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 22, 2026

thomasthaddeus merged commit dfff6e8 into main Apr 22, 2026

dependabot Bot deleted the dependabot/pip/pip-06cc95fd8d branch April 22, 2026 04:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the pip group across 1 directory with 4 updates#11

Bump the pip group across 1 directory with 4 updates#11
thomasthaddeus merged 1 commit intomainfrom
dependabot/pip/pip-06cc95fd8d

dependabot Bot commented on behalf of github Apr 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Apr 22, 2026

lxml-6.1.0

lxml-6.0.4

lxml-6.0.3

lxml-6.0.2

lxml-6.0.1

lxml-6.0.0

lxml-5.4.0

5.4.0 (2025-04-22)

Bugs fixed

lxml-5.3.2

lxml-5.3.1

lxml-5.3.0

lxml-5.2.2

5.2.2 (2024-05-12)

Bugs fixed

6.1.0 (2026-04-17)

Features added

Bugs fixed

6.0.4 (2026-04-12)

Bugs fixed

6.0.3 (2026-04-09)

Bugs fixed

v1.2.2

Added

Changed

Fixed

Breaking Changes

Misc

New Contributors

v1.2.1

What's Changed

[1.2.2] - 2026-03-01

Added

Changed

Fixed

Breaking Changes

[1.2.1] - 2025-10-26

[1.2.0] - 2025-10-26

[1.1.1] - 2025-06-24

Fixed

v78.1.1

Bugfixes

v78.1.0

Features

v78.0.2

Bugfixes

v78.0.1

Misc

v78.0.0

Bugfixes

Deprecations and Removals

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant