Thanks for asking me to work on this. I will get started on it and keep
this PR's description up to date as I form a plan and make progress.
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
> Deploy workflows to all repos immediately asking for products that are
already production scale and high ROI, gotta get this all deployed
tomorrow all of BlackRoad.io doing this to every repo. Please return all
requests to !!!! BlackRoad-OS-Inc organization!!! If you cannot do this
make a new URGENT task that we need indexing NOWWWW. stripe clerk, all
of it E2E BlackRoad.io !!!! Please and thank you all I'm so sorry
</details>
> **Custom agent used: my-agent**
<!-- START COPILOT CODING AGENT TIPS -->
---
💡 You can make Copilot smarter by setting up custom instructions,
customizing its development environment and configuring Model Context
Protocol (MCP) servers. Learn more [Copilot coding agent
tips](https://gh.io/copilot-coding-agent-tips) in the docs.
Thanks for asking me to work on this. I will get started on it and keep
this PR's description up to date as I form a plan and make progress.
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
> I want you to verify if my systems are also being used. When I enter
@copilot., @lucidia, or @blackboxprogramming., all requests should be
directed to Ollama without depending on any other services.
>
> Combine everything. I'm exhausted by this. What's the point of
creating files if none of you utilize them? Oh, I can't review that.
Thanks for asking. These are my files. Use my hardware and send all
inquiries directly to it. I'm done with ChatGPT, Copilot, Claude—I'm
over it. Bring Ollama in. I don't care how bad the code is. I'm tired of
all of you accessing my computer and restricting my access. Just get
Ollama here now. When I say @ollama, I mean to direct it to Ollama. I
DON'T WANT TO RELY ON ANY PROVIDER when I type @blackboxprogramming.
Just send it to my machines. You're all on my local server, on my
private network anyway.
>
> Get it working E2E, I'm tired of it.
</details>
<!-- START COPILOT CODING AGENT TIPS -->
---
✨ Let Copilot coding agent [set things up for
you](https://github.com/blackboxprogramming/BlackRoad-Operating-System/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot)
— coding agent works faster and does higher quality work when set up for
your repo.
Bumps [stripe](https://github.com/stripe/stripe-python) from 7.8.0 to
14.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/stripe/stripe-python/releases">stripe's
releases</a>.</em></p>
<blockquote>
<h2>v14.4.0</h2>
<p>This release changes the pinned API version to
<code>2026-02-25.clover</code>.</p>
<ul>
<li><a
href="https://redirect.github.com/stripe/stripe-python/pull/1737">#1737</a>
Allow AIOHTTPClient to accept user-provided session or connector. Fixes
<a
href="https://redirect.github.com/stripe/stripe-python/pull/1736">#1736</a></li>
<li><a
href="https://redirect.github.com/stripe/stripe-python/pull/1732">#1732</a>
Update generated code
<ul>
<li>Add support for new resources <code>reserve.Hold</code>,
<code>reserve.Plan</code>, and <code>reserve.Release</code></li>
<li>Add support for <code>location</code> and <code>reader</code> on
<code>Charge.PaymentMethodDetail.CardPresent</code>,
<code>Charge.PaymentMethodDetail.InteracPresent</code>,
<code>ConfirmationToken.PaymentMethodPreview.Card.GeneratedFrom.PaymentMethodDetail.CardPresent</code>,
<code>PaymentAttemptRecord.PaymentMethodDetail.CardPresent</code>,
<code>PaymentAttemptRecord.PaymentMethodDetail.InteracPresent</code>,
<code>PaymentMethod.Card.GeneratedFrom.PaymentMethodDetail.CardPresent</code>,
<code>PaymentRecord.PaymentMethodDetail.CardPresent</code>, and
<code>PaymentRecord.PaymentMethodDetail.InteracPresent</code></li>
<li>Add support for new value <code>lk_vat</code> on enums
<code>Checkout.Session.CustomerDetail.TaxId.type</code>,
<code>Invoice.CustomerTaxId.type</code>,
<code>Tax.Calculation.CustomerDetail.TaxId.type</code>,
<code>Tax.Transaction.CustomerDetail.TaxId.type</code>, and
<code>TaxId.type</code></li>
<li>Add support for new value <code>lk_vat</code> on enums
<code>CustomerCreateParamsTaxIdDatum.type</code>,
<code>CustomerCreateTaxIdParams.type</code>,
<code>InvoiceCreatePreviewParamsCustomerDetailTaxId.type</code>,
<code>TaxIdCreateParams.type</code>, and
<code>tax.CalculationCreateParamsCustomerDetailTaxId.type</code></li>
<li>Add support for new values <code>reserve.hold.created</code>,
<code>reserve.hold.updated</code>, <code>reserve.plan.created</code>,
<code>reserve.plan.disabled</code>, <code>reserve.plan.expired</code>,
<code>reserve.plan.updated</code>, and
<code>reserve.release.created</code> on enum
<code>Event.type</code></li>
<li>Add support for new values <code>terminal_wifi_certificate</code>
and <code>terminal_wifi_private_key</code> on enums
<code>File.purpose</code> and <code>FileListParams.purpose</code></li>
<li>Add support for new values <code>terminal_wifi_certificate</code>
and <code>terminal_wifi_private_key</code> on enum
<code>FileCreateParams.purpose</code></li>
<li>Add support for new value <code>pay_by_bank</code> on enums
<code>Invoice.PaymentSetting.payment_method_types</code>,
<code>InvoiceCreateParamsPaymentSetting.payment_method_types</code>,
<code>InvoiceModifyParamsPaymentSetting.payment_method_types</code>,
<code>Subscription.PaymentSetting.payment_method_types</code>,
<code>SubscriptionCreateParamsPaymentSetting.payment_method_types</code>,
and
<code>SubscriptionModifyParamsPaymentSetting.payment_method_types</code></li>
<li>Add support for <code>display_name</code> and
<code>service_user_number</code> on
<code>Mandate.PaymentMethodDetail.BacsDebit</code></li>
<li>Change type of
<code>PaymentAttemptRecord.PaymentMethodDetail.Boleto.tax_id</code> and
<code>PaymentRecord.PaymentMethodDetail.Boleto.tax_id</code> from
<code>string</code> to <code>nullable(string)</code></li>
<li>Change type of
<code>PaymentAttemptRecord.PaymentMethodDetail.UsBankAccount.expected_debit_date</code>
and
<code>PaymentRecord.PaymentMethodDetail.UsBankAccount.expected_debit_date</code>
from <code>nullable(string)</code> to <code>string</code></li>
<li>Add support for <code>transaction_purpose</code> on
<code>PaymentIntent.PaymentMethodOption.UsBankAccount</code>,
<code>PaymentIntentConfirmParamsPaymentMethodOptionUsBankAccount</code>,
<code>PaymentIntentCreateParamsPaymentMethodOptionUsBankAccount</code>,
and
<code>PaymentIntentModifyParamsPaymentMethodOptionUsBankAccount</code></li>
<li>Add support for <code>optional_items</code> on
<code>PaymentLinkModifyParams</code></li>
<li>Remove support for unused <code>card_issuer_decline</code> on
<code>Radar.PaymentEvaluation.Insight</code></li>
<li>Add support for <code>payment_behavior</code> on
<code>SubscriptionItemDeleteParams</code></li>
<li>Add support for <code>lk</code> on
<code>Tax.Registration.CountryOption</code> and
<code>tax.RegistrationCreateParamsCountryOption</code></li>
<li>Add support for <code>cellular</code> and <code>stripe_s710</code>
on <code>Terminal.Configuration</code>,
<code>terminal.ConfigurationCreateParams</code>, and
<code>terminal.ConfigurationModifyParams</code></li>
<li>Add support for new values <code>simulated_stripe_s710</code> and
<code>stripe_s710</code> on enums
<code>Terminal.Reader.device_type</code> and
<code>terminal.ReaderListParams.device_type</code></li>
<li>Add support for new values <code>reserve.hold.created</code>,
<code>reserve.hold.updated</code>, <code>reserve.plan.created</code>,
<code>reserve.plan.disabled</code>, <code>reserve.plan.expired</code>,
<code>reserve.plan.updated</code>, and
<code>reserve.release.created</code> on enums
<code>WebhookEndpointCreateParams.enabled_events</code> and
<code>WebhookEndpointModifyParams.enabled_events</code></li>
<li>Add support for new value <code>2026-02-25.clover</code> on enum
<code>WebhookEndpointCreateParams.api_version</code></li>
<li>Add support for snapshot events <code>reserve.hold.created</code>
and <code>reserve.hold.updated</code> with resource
<code>reserve.Hold</code></li>
<li>Add support for snapshot events <code>reserve.plan.created</code>,
<code>reserve.plan.disabled</code>, <code>reserve.plan.expired</code>,
and <code>reserve.plan.updated</code> with resource
<code>reserve.Plan</code></li>
<li>Add support for snapshot event <code>reserve.release.created</code>
with resource <code>reserve.Release</code></li>
<li>Add support for error codes <code>storer_capability_missing</code>
and <code>storer_capability_not_active</code> on
<code>Invoice.LastFinalizationError</code>,
<code>PaymentIntent.LastPaymentError</code>,
<code>SetupAttempt.SetupError</code>,
<code>SetupIntent.LastSetupError</code>, and
<code>StripeError</code></li>
</ul>
</li>
<li><a
href="https://redirect.github.com/stripe/stripe-python/pull/1731">#1731</a>
Added instruction to update CA certificates in README.</li>
</ul>
<p>See <a
href="https://github.com/stripe/stripe-python/blob/v14.4.0/CHANGELOG.md">the
changelog for more details</a>.</p>
<h2>v14.4.0b1</h2>
<p>This release changes the pinned API version to
<code>2026-01-28.preview</code>.</p>
<ul>
<li><a
href="https://redirect.github.com/stripe/stripe-python/pull/1719">#1719</a>
Update generated code for beta
<ul>
<li>Add support for new resource
<code>financial_connections.Authorization</code></li>
<li>Add support for <code>retrieve</code> method on resource
<code>financial_connections.Authorization</code></li>
<li>Add support for <code>detach_payment</code> method on resource
<code>Invoice</code></li>
<li>Remove support for <code>cancel</code>,
<code>list_line_items</code>, and <code>reopen</code> methods on
resource <code>Order</code></li>
<li>Remove support for <code>attach_cadence</code> method on resource
<code>Subscription</code></li>
<li>Add support for <code>additional_files</code> and <code>site</code>
on <code>Account.Setting.PaypayPayment</code>,
<code>AccountCreateParamsSettingPaypayPayment</code>, and
<code>AccountModifyParamsSettingPaypayPayment</code></li>
<li>Remove support for <code>capital</code> on
<code>Account.Setting</code></li>
<li>Change type of
<code>Charge.PaymentMethodDetail.StripeBalance.source_type</code>,
<code>ConfirmationToken.PaymentMethodPreview.StripeBalance.source_type</code>,
<code>PaymentAttemptRecord.PaymentMethodDetail.StripeBalance.source_type</code>,
<code>PaymentMethod.StripeBalance.source_type</code>, and
<code>PaymentRecord.PaymentMethodDetail.StripeBalance.source_type</code>
from <code>enum('bank_account'|'card'|'fpx')</code> to
<code>nullable(enum('bank_account'|'card'|'fpx'))</code></li>
<li>Add support for new value <code>pl_nip</code> on enums
<code>Checkout.Session.CollectedInformation.TaxId.type</code>,
<code>Order.TaxDetail.TaxId.type</code>, and
<code>QuotePreviewInvoice.CustomerTaxId.type</code></li>
<li>Add support for new value
<code>capital.financing_summary.line_of_credit_update</code> on enum
<code>Event.type</code></li>
<li>Add support for <code>authorization</code> and
<code>status_details</code> on
<code>FinancialConnections.Account</code></li>
<li>Add support for <code>relink_options</code> on
<code>FinancialConnections.Session</code> and
<code>financial_connections.SessionCreateParams</code></li>
<li>Change
<code>financial_connections.SessionCreateParams.account_holder</code> to
be optional</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/stripe/stripe-python/blob/master/CHANGELOG.md">stripe's
changelog</a>.</em></p>
<blockquote>
<h2>14.4.0 - 2026-02-25</h2>
<p>This release changes the pinned API version to
<code>2026-02-25.clover</code>.</p>
<ul>
<li><a
href="https://redirect.github.com/stripe/stripe-python/pull/1737">#1737</a>
Allow AIOHTTPClient to accept user-provided session or connector. Fixes
<a
href="https://redirect.github.com/stripe/stripe-python/pull/1736">#1736</a></li>
<li><a
href="https://redirect.github.com/stripe/stripe-python/pull/1732">#1732</a>
Update generated code
<ul>
<li>Add support for new resources <code>reserve.Hold</code>,
<code>reserve.Plan</code>, and <code>reserve.Release</code></li>
<li>Add support for <code>location</code> and <code>reader</code> on
<code>Charge.PaymentMethodDetail.CardPresent</code>,
<code>Charge.PaymentMethodDetail.InteracPresent</code>,
<code>ConfirmationToken.PaymentMethodPreview.Card.GeneratedFrom.PaymentMethodDetail.CardPresent</code>,
<code>PaymentAttemptRecord.PaymentMethodDetail.CardPresent</code>,
<code>PaymentAttemptRecord.PaymentMethodDetail.InteracPresent</code>,
<code>PaymentMethod.Card.GeneratedFrom.PaymentMethodDetail.CardPresent</code>,
<code>PaymentRecord.PaymentMethodDetail.CardPresent</code>, and
<code>PaymentRecord.PaymentMethodDetail.InteracPresent</code></li>
<li>Add support for new value <code>lk_vat</code> on enums
<code>Checkout.Session.CustomerDetail.TaxId.type</code>,
<code>Invoice.CustomerTaxId.type</code>,
<code>Tax.Calculation.CustomerDetail.TaxId.type</code>,
<code>Tax.Transaction.CustomerDetail.TaxId.type</code>, and
<code>TaxId.type</code></li>
<li>Add support for new value <code>lk_vat</code> on enums
<code>CustomerCreateParamsTaxIdDatum.type</code>,
<code>CustomerCreateTaxIdParams.type</code>,
<code>InvoiceCreatePreviewParamsCustomerDetailTaxId.type</code>,
<code>TaxIdCreateParams.type</code>, and
<code>tax.CalculationCreateParamsCustomerDetailTaxId.type</code></li>
<li>Add support for new values <code>reserve.hold.created</code>,
<code>reserve.hold.updated</code>, <code>reserve.plan.created</code>,
<code>reserve.plan.disabled</code>, <code>reserve.plan.expired</code>,
<code>reserve.plan.updated</code>, and
<code>reserve.release.created</code> on enum
<code>Event.type</code></li>
<li>Add support for new values <code>terminal_wifi_certificate</code>
and <code>terminal_wifi_private_key</code> on enums
<code>File.purpose</code> and <code>FileListParams.purpose</code></li>
<li>Add support for new values <code>terminal_wifi_certificate</code>
and <code>terminal_wifi_private_key</code> on enum
<code>FileCreateParams.purpose</code></li>
<li>Add support for new value <code>pay_by_bank</code> on enums
<code>Invoice.PaymentSetting.payment_method_types</code>,
<code>InvoiceCreateParamsPaymentSetting.payment_method_types</code>,
<code>InvoiceModifyParamsPaymentSetting.payment_method_types</code>,
<code>Subscription.PaymentSetting.payment_method_types</code>,
<code>SubscriptionCreateParamsPaymentSetting.payment_method_types</code>,
and
<code>SubscriptionModifyParamsPaymentSetting.payment_method_types</code></li>
<li>Add support for <code>display_name</code> and
<code>service_user_number</code> on
<code>Mandate.PaymentMethodDetail.BacsDebit</code></li>
<li>Change type of
<code>PaymentAttemptRecord.PaymentMethodDetail.Boleto.tax_id</code> and
<code>PaymentRecord.PaymentMethodDetail.Boleto.tax_id</code> from
<code>string</code> to <code>nullable(string)</code></li>
<li>Change type of
<code>PaymentAttemptRecord.PaymentMethodDetail.UsBankAccount.expected_debit_date</code>
and
<code>PaymentRecord.PaymentMethodDetail.UsBankAccount.expected_debit_date</code>
from <code>nullable(string)</code> to <code>string</code></li>
<li>Add support for <code>transaction_purpose</code> on
<code>PaymentIntent.PaymentMethodOption.UsBankAccount</code>,
<code>PaymentIntentConfirmParamsPaymentMethodOptionUsBankAccount</code>,
<code>PaymentIntentCreateParamsPaymentMethodOptionUsBankAccount</code>,
and
<code>PaymentIntentModifyParamsPaymentMethodOptionUsBankAccount</code></li>
<li>Add support for <code>optional_items</code> on
<code>PaymentLinkModifyParams</code></li>
<li>Remove support for unused <code>card_issuer_decline</code> on
<code>Radar.PaymentEvaluation.Insight</code></li>
<li>Add support for <code>payment_behavior</code> on
<code>SubscriptionItemDeleteParams</code></li>
<li>Add support for <code>lk</code> on
<code>Tax.Registration.CountryOption</code> and
<code>tax.RegistrationCreateParamsCountryOption</code></li>
<li>Add support for <code>cellular</code> and <code>stripe_s710</code>
on <code>Terminal.Configuration</code>,
<code>terminal.ConfigurationCreateParams</code>, and
<code>terminal.ConfigurationModifyParams</code></li>
<li>Add support for new values <code>simulated_stripe_s710</code> and
<code>stripe_s710</code> on enums
<code>Terminal.Reader.device_type</code> and
<code>terminal.ReaderListParams.device_type</code></li>
<li>Add support for new values <code>reserve.hold.created</code>,
<code>reserve.hold.updated</code>, <code>reserve.plan.created</code>,
<code>reserve.plan.disabled</code>, <code>reserve.plan.expired</code>,
<code>reserve.plan.updated</code>, and
<code>reserve.release.created</code> on enums
<code>WebhookEndpointCreateParams.enabled_events</code> and
<code>WebhookEndpointModifyParams.enabled_events</code></li>
<li>Add support for new value <code>2026-02-25.clover</code> on enum
<code>WebhookEndpointCreateParams.api_version</code></li>
<li>Add support for snapshot events <code>reserve.hold.created</code>
and <code>reserve.hold.updated</code> with resource
<code>reserve.Hold</code></li>
<li>Add support for snapshot events <code>reserve.plan.created</code>,
<code>reserve.plan.disabled</code>, <code>reserve.plan.expired</code>,
and <code>reserve.plan.updated</code> with resource
<code>reserve.Plan</code></li>
<li>Add support for snapshot event <code>reserve.release.created</code>
with resource <code>reserve.Release</code></li>
<li>Add support for error codes <code>storer_capability_missing</code>
and <code>storer_capability_not_active</code> on
<code>Invoice.LastFinalizationError</code>,
<code>PaymentIntent.LastPaymentError</code>,
<code>SetupAttempt.SetupError</code>,
<code>SetupIntent.LastSetupError</code>, and
<code>StripeError</code></li>
</ul>
</li>
<li><a
href="https://redirect.github.com/stripe/stripe-python/pull/1731">#1731</a>
Added instruction to update CA certificates in README.</li>
</ul>
<h2>14.3.0 - 2026-01-28</h2>
<p>This release changes the pinned API version to
<code>2026-01-28.clover</code>.</p>
<ul>
<li><a
href="https://redirect.github.com/stripe/stripe-python/pull/1725">#1725</a>
Update generated code
<ul>
<li>Add support for new resource
<code>radar.PaymentEvaluation</code></li>
<li>Add support for <code>create</code> method on resource
<code>radar.PaymentEvaluation</code></li>
<li>Add support for <code>adjustable_quantity</code> on
<code>LineItem</code></li>
<li>Add support for new value <code>risk_reserved</code> on enum
<code>BalanceTransaction.balance_type</code></li>
<li>Add support for new values <code>reserve_hold</code> and
<code>reserve_release</code> on enum
<code>BalanceTransaction.type</code></li>
<li>Add support for new values <code>2.3.0</code> and <code>2.3.1</code>
on enums
<code>Charge.PaymentMethodDetail.Card.ThreeDSecure.version</code>,
<code>PaymentIntentConfirmParamsPaymentMethodOptionCardThreeDSecure.version</code>,
<code>PaymentIntentCreateParamsPaymentMethodOptionCardThreeDSecure.version</code>,
<code>PaymentIntentModifyParamsPaymentMethodOptionCardThreeDSecure.version</code>,
<code>SetupAttempt.PaymentMethodDetail.Card.ThreeDSecure.version</code>,
<code>SetupIntentConfirmParamsPaymentMethodOptionCardThreeDSecure.version</code>,
<code>SetupIntentCreateParamsPaymentMethodOptionCardThreeDSecure.version</code>,
and
<code>SetupIntentModifyParamsPaymentMethodOptionCardThreeDSecure.version</code></li>
<li>Add support for new value <code>adyen</code> on enums
<code>Charge.PaymentMethodDetail.Ideal.bank</code>,
<code>ConfirmationToken.PaymentMethodPreview.Ideal.bank</code>,
<code>ConfirmationTokenCreateParamsPaymentMethodDatumIdeal.bank</code>,
<code>PaymentAttemptRecord.PaymentMethodDetail.Ideal.bank</code>,
<code>PaymentIntentConfirmParamsPaymentMethodDatumIdeal.bank</code>,
<code>PaymentIntentCreateParamsPaymentMethodDatumIdeal.bank</code>,
<code>PaymentIntentModifyParamsPaymentMethodDatumIdeal.bank</code>,
<code>PaymentMethod.Ideal.bank</code>,
<code>PaymentMethodCreateParamsIdeal.bank</code>,
<code>PaymentRecord.PaymentMethodDetail.Ideal.bank</code>,
<code>SetupAttempt.PaymentMethodDetail.Ideal.bank</code>,
<code>SetupIntentConfirmParamsPaymentMethodDatumIdeal.bank</code>,
<code>SetupIntentCreateParamsPaymentMethodDatumIdeal.bank</code>, and
<code>SetupIntentModifyParamsPaymentMethodDatumIdeal.bank</code></li>
<li>Add support for new value <code>ADYBNL2A</code> on enums
<code>Charge.PaymentMethodDetail.Ideal.bic</code>,
<code>ConfirmationToken.PaymentMethodPreview.Ideal.bic</code>,
<code>PaymentAttemptRecord.PaymentMethodDetail.Ideal.bic</code>,
<code>PaymentMethod.Ideal.bic</code>,
<code>PaymentRecord.PaymentMethodDetail.Ideal.bic</code>, and
<code>SetupAttempt.PaymentMethodDetail.Ideal.bic</code></li>
<li>Add support for new value <code>pl_nip</code> on enums
<code>Checkout.Session.CustomerDetail.TaxId.type</code>,
<code>Invoice.CustomerTaxId.type</code>,
<code>Tax.Calculation.CustomerDetail.TaxId.type</code>,
<code>Tax.Transaction.CustomerDetail.TaxId.type</code>, and
<code>TaxId.type</code></li>
<li>Add support for new value <code>pl_nip</code> on enums
<code>CustomerCreateParamsTaxIdDatum.type</code>,
<code>CustomerCreateTaxIdParams.type</code>,
<code>InvoiceCreatePreviewParamsCustomerDetailTaxId.type</code>,
<code>TaxIdCreateParams.type</code>, and
<code>tax.CalculationCreateParamsCustomerDetailTaxId.type</code></li>
<li>Change <code>Invoice.PaymentSetting.PaymentMethodOption.payto</code>
and <code>Subscription.PaymentSetting.PaymentMethodOption.payto</code>
to be required</li>
<li>Add support for <code>enforce_arithmetic_validation</code> on
<code>PaymentIntentCaptureParamsAmountDetail</code>,
<code>PaymentIntentConfirmParamsAmountDetail</code>,
<code>PaymentIntentCreateParamsAmountDetail</code>,
<code>PaymentIntentIncrementAuthorizationParamsAmountDetail</code>, and
<code>PaymentIntentModifyParamsAmountDetail</code></li>
<li>Add support for <code>error</code> on
<code>PaymentIntent.AmountDetail</code></li>
<li>Remove support for <code>bgn</code> on
<code>Terminal.Configuration.Tipping</code>,
<code>terminal.ConfigurationCreateParamsTipping</code>, and
<code>terminal.ConfigurationModifyParamsTipping</code></li>
<li>Add support for <code>topup</code> on
<code>Treasury.ReceivedDebit.LinkedFlow</code></li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="984950e50a"><code>984950e</code></a>
Bump version to 14.4.0</li>
<li><a
href="a643eac656"><code>a643eac</code></a>
Allow AIOHTTPClient to accept user-provided session or connector (<a
href="https://redirect.github.com/stripe/stripe-python/issues/1736">#1736</a>)
(<a
href="https://redirect.github.com/stripe/stripe-python/issues/1737">#1737</a>)</li>
<li><a
href="aa759bd1f9"><code>aa759bd</code></a>
Update generated code (<a
href="https://redirect.github.com/stripe/stripe-python/issues/1732">#1732</a>)</li>
<li><a
href="5202e51e11"><code>5202e51</code></a>
Added instruction to update CA certificates in README. (<a
href="https://redirect.github.com/stripe/stripe-python/issues/1731">#1731</a>)</li>
<li><a
href="8dddb63f70"><code>8dddb63</code></a>
Bump version to 14.3.0</li>
<li><a
href="1d0dc7a09b"><code>1d0dc7a</code></a>
Update generated code (<a
href="https://redirect.github.com/stripe/stripe-python/issues/1725">#1725</a>)</li>
<li><a
href="5ba1985f18"><code>5ba1985</code></a>
Add documentation for undocumented API parameters (<a
href="https://redirect.github.com/stripe/stripe-python/issues/1722">#1722</a>)</li>
<li><a
href="75d921f139"><code>75d921f</code></a>
Bump version to 14.2.0</li>
<li><a
href="0a0a156965"><code>0a0a156</code></a>
Update generated code for v2152 and (<a
href="https://redirect.github.com/stripe/stripe-python/issues/1721">#1721</a>)</li>
<li><a
href="9d6fbaf40d"><code>9d6fbaf</code></a>
Update generated code for v2151 and (<a
href="https://redirect.github.com/stripe/stripe-python/issues/1720">#1720</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/stripe/stripe-python/compare/v7.8.0...v14.4.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Bumps the npm_and_yarn group with 1 update in the /apps/docs directory:
[next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the /apps/prism-console
directory: [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the /apps/web directory:
[next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the /blackroad-os-agents
directory: [qs](https://github.com/ljharb/qs).
Bumps the npm_and_yarn group with 2 updates in the /blackroad-os-api
directory: [qs](https://github.com/ljharb/qs) and
[axios](https://github.com/axios/axios).
Bumps the npm_and_yarn group with 1 update in the /blackroad-os-core
directory: [qs](https://github.com/ljharb/qs).
Bumps the npm_and_yarn group with 1 update in the /blackroad-os-operator
directory: [qs](https://github.com/ljharb/qs).
Bumps the npm_and_yarn group with 1 update in the /br95 directory:
[next](https://github.com/vercel/next.js).
Updates `next` from 14.2.3 to 15.5.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.10</h2>
<p>Please refer the following changelogs for more information about this
security release:</p>
<ul>
<li><a
href="https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472">https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472</a></li>
<li><a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">https://vercel.com/changelog/summary-of-cve-2026-23864</a></li>
</ul>
<h2>v15.4.11</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.3.9</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.2.9</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.1.12</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.0.8</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="60a2aa97b6"><code>60a2aa9</code></a>
v15.5.10</li>
<li><a
href="e5b834d208"><code>e5b834d</code></a>
fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (<a
href="https://redirect.github.com/vercel/next.js/issues/88588">#88588</a>)</li>
<li><a
href="39a2f6a8d1"><code>39a2f6a</code></a>
feat(next/image)!: add <code>images.maximumResponseBody</code> config
(<a
href="https://redirect.github.com/vercel/next.js/issues/88183">#88183</a>)</li>
<li><a
href="bf9f0843ed"><code>bf9f084</code></a>
Sync DoS mitigations for React Flight</li>
<li><a
href="c5de33e93c"><code>c5de33e</code></a>
v15.5.9</li>
<li><a
href="dd233994ae"><code>dd23399</code></a>
Backport <a
href="https://redirect.github.com/facebook/react/issues/35351">facebook/react#35351</a>
for 15.5.8 (<a
href="https://redirect.github.com/vercel/next.js/issues/87086">#87086</a>)</li>
<li><a
href="7526cd6f24"><code>7526cd6</code></a>
v15.5.8</li>
<li><a
href="1e9ec4133a"><code>1e9ec41</code></a>
Update React Version (<a
href="https://redirect.github.com/vercel/next.js/issues/41">#41</a>)</li>
<li><a
href="16141e5df9"><code>16141e5</code></a>
Update React Version (<a
href="https://redirect.github.com/vercel/next.js/issues/30">#30</a>)</li>
<li><a
href="e01e589e18"><code>e01e589</code></a>
Backport Next.js changes to v15.5.8 (<a
href="https://redirect.github.com/vercel/next.js/issues/23">#23</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v14.2.3...v15.5.10">compare
view</a></li>
</ul>
</details>
<br />
Updates `next` from 14.2.3 to 15.5.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.10</h2>
<p>Please refer the following changelogs for more information about this
security release:</p>
<ul>
<li><a
href="https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472">https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472</a></li>
<li><a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">https://vercel.com/changelog/summary-of-cve-2026-23864</a></li>
</ul>
<h2>v15.4.11</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.3.9</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.2.9</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.1.12</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.0.8</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="60a2aa97b6"><code>60a2aa9</code></a>
v15.5.10</li>
<li><a
href="e5b834d208"><code>e5b834d</code></a>
fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (<a
href="https://redirect.github.com/vercel/next.js/issues/88588">#88588</a>)</li>
<li><a
href="39a2f6a8d1"><code>39a2f6a</code></a>
feat(next/image)!: add <code>images.maximumResponseBody</code> config
(<a
href="https://redirect.github.com/vercel/next.js/issues/88183">#88183</a>)</li>
<li><a
href="bf9f0843ed"><code>bf9f084</code></a>
Sync DoS mitigations for React Flight</li>
<li><a
href="c5de33e93c"><code>c5de33e</code></a>
v15.5.9</li>
<li><a
href="dd233994ae"><code>dd23399</code></a>
Backport <a
href="https://redirect.github.com/facebook/react/issues/35351">facebook/react#35351</a>
for 15.5.8 (<a
href="https://redirect.github.com/vercel/next.js/issues/87086">#87086</a>)</li>
<li><a
href="7526cd6f24"><code>7526cd6</code></a>
v15.5.8</li>
<li><a
href="1e9ec4133a"><code>1e9ec41</code></a>
Update React Version (<a
href="https://redirect.github.com/vercel/next.js/issues/41">#41</a>)</li>
<li><a
href="16141e5df9"><code>16141e5</code></a>
Update React Version (<a
href="https://redirect.github.com/vercel/next.js/issues/30">#30</a>)</li>
<li><a
href="e01e589e18"><code>e01e589</code></a>
Backport Next.js changes to v15.5.8 (<a
href="https://redirect.github.com/vercel/next.js/issues/23">#23</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v14.2.3...v15.5.10">compare
view</a></li>
</ul>
</details>
<br />
Updates `next` from 14.2.3 to 15.5.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.10</h2>
<p>Please refer the following changelogs for more information about this
security release:</p>
<ul>
<li><a
href="https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472">https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472</a></li>
<li><a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">https://vercel.com/changelog/summary-of-cve-2026-23864</a></li>
</ul>
<h2>v15.4.11</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.3.9</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.2.9</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.1.12</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.0.8</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="60a2aa97b6"><code>60a2aa9</code></a>
v15.5.10</li>
<li><a
href="e5b834d208"><code>e5b834d</code></a>
fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (<a
href="https://redirect.github.com/vercel/next.js/issues/88588">#88588</a>)</li>
<li><a
href="39a2f6a8d1"><code>39a2f6a</code></a>
feat(next/image)!: add <code>images.maximumResponseBody</code> config
(<a
href="https://redirect.github.com/vercel/next.js/issues/88183">#88183</a>)</li>
<li><a
href="bf9f0843ed"><code>bf9f084</code></a>
Sync DoS mitigations for React Flight</li>
<li><a
href="c5de33e93c"><code>c5de33e</code></a>
v15.5.9</li>
<li><a
href="dd233994ae"><code>dd23399</code></a>
Backport <a
href="https://redirect.github.com/facebook/react/issues/35351">facebook/react#35351</a>
for 15.5.8 (<a
href="https://redirect.github.com/vercel/next.js/issues/87086">#87086</a>)</li>
<li><a
href="7526cd6f24"><code>7526cd6</code></a>
v15.5.8</li>
<li><a
href="1e9ec4133a"><code>1e9ec41</code></a>
Update React Version (<a
href="https://redirect.github.com/vercel/next.js/issues/41">#41</a>)</li>
<li><a
href="16141e5df9"><code>16141e5</code></a>
Update React Version (<a
href="https://redirect.github.com/vercel/next.js/issues/30">#30</a>)</li>
<li><a
href="e01e589e18"><code>e01e589</code></a>
Backport Next.js changes to v15.5.8 (<a
href="https://redirect.github.com/vercel/next.js/issues/23">#23</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v14.2.3...v15.5.10">compare
view</a></li>
</ul>
</details>
<br />
Updates `qs` from 6.13.0 to 6.14.2
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.14.2</strong></h2>
<ul>
<li>[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/546">#546</a>)</li>
<li>[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/<code>parseArrayValue</code></li>
<li>[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded
with indexed notation when <code>throwOnLimitExceeded</code> is true (<a
href="https://redirect.github.com/ljharb/qs/issues/529">#529</a>)</li>
<li>[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li>[Fix] <code>parse</code>: fix error message to reflect arrayLimit as
max index; remove extraneous comments (<a
href="https://redirect.github.com/ljharb/qs/issues/545">#545</a>)</li>
<li>[Robustness] avoid <code>.push</code>, use <code>void</code></li>
<li>[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output (<a
href="https://redirect.github.com/ljharb/qs/issues/418">#418</a>)</li>
<li>[readme] clarify <code>parseArrays</code> and
<code>arrayLimit</code> documentation (<a
href="https://redirect.github.com/ljharb/qs/issues/543">#543</a>)</li>
<li>[readme] replace runkit CI badge with shields.io check-runs
badge</li>
<li>[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>[actions] fix rebase workflow permissions</li>
</ul>
<h2><strong>6.14.1</strong></h2>
<ul>
<li>[Fix] ensure <code>arrayLimit</code> applies to <code>[]</code>
notation as well</li>
<li>[Fix] <code>parse</code>: when a custom decoder returns
<code>null</code> for a key, ignore that key</li>
<li>[Refactor] <code>parse</code>: extract key segment splitting
helper</li>
<li>[meta] add threat model</li>
<li>[actions] add workflow permissions</li>
<li>[Tests] <code>stringify</code>: increase coverage</li>
<li>[Dev Deps] update <code>eslint</code>,
<code>@ljharb/eslint-config</code>, <code>npmignore</code>,
<code>es-value-fixtures</code>, <code>for-each</code>,
<code>object-inspect</code></li>
</ul>
<h2><strong>6.14.0</strong></h2>
<ul>
<li>[New] <code>parse</code>: add
<code>throwOnParameterLimitExceeded</code> option (<a
href="https://redirect.github.com/ljharb/qs/issues/517">#517</a>)</li>
<li>[Refactor] <code>parse</code>: use <code>utils.combine</code>
more</li>
<li>[patch] <code>parse</code>: add explicit
<code>throwOnLimitExceeded</code> default</li>
<li>[actions] use shared action; re-add finishers</li>
<li>[meta] Fix changelog formatting bug</li>
<li>[Deps] update <code>side-channel</code></li>
<li>[Dev Deps] update <code>es-value-fixtures</code>,
<code>has-bigints</code>, <code>has-proto</code>,
<code>has-symbols</code></li>
<li>[Tests] increase coverage</li>
</ul>
<h2><strong>6.13.3</strong></h2>
<p>[Fix] fix regressions from robustness refactor
[actions] update reusable workflows</p>
<h2><strong>6.13.2</strong></h2>
<ul>
<li>[Robustness] avoid <code>.push</code>, use <code>void</code></li>
<li>[readme] clarify <code>parseArrays</code> and
<code>arrayLimit</code> documentation (<a
href="https://redirect.github.com/ljharb/qs/issues/543">#543</a>)</li>
<li>[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output (<a
href="https://redirect.github.com/ljharb/qs/issues/418">#418</a>)</li>
<li>[readme] replace runkit CI badge with shields.io check-runs
badge</li>
<li>[actions] fix rebase workflow permissions</li>
</ul>
<h2><strong>6.13.1</strong></h2>
<ul>
<li>[Fix] <code>stringify</code>: avoid a crash when a
<code>filter</code> key is <code>null</code></li>
<li>[Fix] <code>utils.merge</code>: functions should not be stringified
into keys</li>
<li>[Fix] <code>parse</code>: avoid a crash with
interpretNumericEntities: true, comma: true, and iso charset</li>
<li>[Fix] <code>stringify</code>: ensure a non-string
<code>filter</code> does not crash</li>
<li>[Refactor] use <code>__proto__</code> syntax instead of
<code>Object.create</code> for null objects</li>
<li>[Refactor] misc cleanup</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bdcf0c7f82"><code>bdcf0c7</code></a>
v6.14.2</li>
<li><a
href="294db90c81"><code>294db90</code></a>
[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output</li>
<li><a
href="5c308e5516"><code>5c308e5</code></a>
[readme] clarify <code>parseArrays</code> and <code>arrayLimit</code>
documentation</li>
<li><a
href="6addf8cf73"><code>6addf8c</code></a>
[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code></li>
<li><a
href="cfc108f662"><code>cfc108f</code></a>
[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/`pars...</li>
<li><a
href="febb64442a"><code>febb644</code></a>
[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded with
indexed notation when `thr...</li>
<li><a
href="f6a7abff1f"><code>f6a7abf</code></a>
[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li><a
href="fbc5206c25"><code>fbc5206</code></a>
[Fix] <code>parse</code>: fix error message to reflect arrayLimit as max
index; remove e...</li>
<li><a
href="1b9a8b4e78"><code>1b9a8b4</code></a>
[actions] fix rebase workflow permissions</li>
<li><a
href="2a35775614"><code>2a35775</code></a>
[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ljharb/qs/compare/v6.13.0...v6.14.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `qs` from 6.13.0 to 6.14.2
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.14.2</strong></h2>
<ul>
<li>[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/546">#546</a>)</li>
<li>[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/<code>parseArrayValue</code></li>
<li>[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded
with indexed notation when <code>throwOnLimitExceeded</code> is true (<a
href="https://redirect.github.com/ljharb/qs/issues/529">#529</a>)</li>
<li>[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li>[Fix] <code>parse</code>: fix error message to reflect arrayLimit as
max index; remove extraneous comments (<a
href="https://redirect.github.com/ljharb/qs/issues/545">#545</a>)</li>
<li>[Robustness] avoid <code>.push</code>, use <code>void</code></li>
<li>[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output (<a
href="https://redirect.github.com/ljharb/qs/issues/418">#418</a>)</li>
<li>[readme] clarify <code>parseArrays</code> and
<code>arrayLimit</code> documentation (<a
href="https://redirect.github.com/ljharb/qs/issues/543">#543</a>)</li>
<li>[readme] replace runkit CI badge with shields.io check-runs
badge</li>
<li>[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>[actions] fix rebase workflow permissions</li>
</ul>
<h2><strong>6.14.1</strong></h2>
<ul>
<li>[Fix] ensure <code>arrayLimit</code> applies to <code>[]</code>
notation as well</li>
<li>[Fix] <code>parse</code>: when a custom decoder returns
<code>null</code> for a key, ignore that key</li>
<li>[Refactor] <code>parse</code>: extract key segment splitting
helper</li>
<li>[meta] add threat model</li>
<li>[actions] add workflow permissions</li>
<li>[Tests] <code>stringify</code>: increase coverage</li>
<li>[Dev Deps] update <code>eslint</code>,
<code>@ljharb/eslint-config</code>, <code>npmignore</code>,
<code>es-value-fixtures</code>, <code>for-each</code>,
<code>object-inspect</code></li>
</ul>
<h2><strong>6.14.0</strong></h2>
<ul>
<li>[New] <code>parse</code>: add
<code>throwOnParameterLimitExceeded</code> option (<a
href="https://redirect.github.com/ljharb/qs/issues/517">#517</a>)</li>
<li>[Refactor] <code>parse</code>: use <code>utils.combine</code>
more</li>
<li>[patch] <code>parse</code>: add explicit
<code>throwOnLimitExceeded</code> default</li>
<li>[actions] use shared action; re-add finishers</li>
<li>[meta] Fix changelog formatting bug</li>
<li>[Deps] update <code>side-channel</code></li>
<li>[Dev Deps] update <code>es-value-fixtures</code>,
<code>has-bigints</code>, <code>has-proto</code>,
<code>has-symbols</code></li>
<li>[Tests] increase coverage</li>
</ul>
<h2><strong>6.13.3</strong></h2>
<p>[Fix] fix regressions from robustness refactor
[actions] update reusable workflows</p>
<h2><strong>6.13.2</strong></h2>
<ul>
<li>[Robustness] avoid <code>.push</code>, use <code>void</code></li>
<li>[readme] clarify <code>parseArrays</code> and
<code>arrayLimit</code> documentation (<a
href="https://redirect.github.com/ljharb/qs/issues/543">#543</a>)</li>
<li>[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output (<a
href="https://redirect.github.com/ljharb/qs/issues/418">#418</a>)</li>
<li>[readme] replace runkit CI badge with shields.io check-runs
badge</li>
<li>[actions] fix rebase workflow permissions</li>
</ul>
<h2><strong>6.13.1</strong></h2>
<ul>
<li>[Fix] <code>stringify</code>: avoid a crash when a
<code>filter</code> key is <code>null</code></li>
<li>[Fix] <code>utils.merge</code>: functions should not be stringified
into keys</li>
<li>[Fix] <code>parse</code>: avoid a crash with
interpretNumericEntities: true, comma: true, and iso charset</li>
<li>[Fix] <code>stringify</code>: ensure a non-string
<code>filter</code> does not crash</li>
<li>[Refactor] use <code>__proto__</code> syntax instead of
<code>Object.create</code> for null objects</li>
<li>[Refactor] misc cleanup</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bdcf0c7f82"><code>bdcf0c7</code></a>
v6.14.2</li>
<li><a
href="294db90c81"><code>294db90</code></a>
[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output</li>
<li><a
href="5c308e5516"><code>5c308e5</code></a>
[readme] clarify <code>parseArrays</code> and <code>arrayLimit</code>
documentation</li>
<li><a
href="6addf8cf73"><code>6addf8c</code></a>
[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code></li>
<li><a
href="cfc108f662"><code>cfc108f</code></a>
[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/`pars...</li>
<li><a
href="febb64442a"><code>febb644</code></a>
[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded with
indexed notation when `thr...</li>
<li><a
href="f6a7abff1f"><code>f6a7abf</code></a>
[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li><a
href="fbc5206c25"><code>fbc5206</code></a>
[Fix] <code>parse</code>: fix error message to reflect arrayLimit as max
index; remove e...</li>
<li><a
href="1b9a8b4e78"><code>1b9a8b4</code></a>
[actions] fix rebase workflow permissions</li>
<li><a
href="2a35775614"><code>2a35775</code></a>
[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ljharb/qs/compare/v6.13.0...v6.14.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `axios` from 1.13.2 to 1.13.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/releases">axios's
releases</a>.</em></p>
<blockquote>
<h2>v1.13.5</h2>
<h2>Release 1.13.5</h2>
<h3>Highlights</h3>
<ul>
<li><strong>Security:</strong> Fixed a potential <strong>Denial of
Service</strong> issue involving the <code>__proto__</code> key in
<code>mergeConfig</code>. (PR <a
href="https://redirect.github.com/axios/axios/pull/7369">#7369</a>)</li>
<li><strong>Bug fix:</strong> Resolved an issue where
<code>AxiosError</code> could be missing the <code>status</code> field
on and after <strong>v1.13.3</strong>. (PR <a
href="https://redirect.github.com/axios/axios/pull/7368">#7368</a>)</li>
</ul>
<h3>Changes</h3>
<h4>Security</h4>
<ul>
<li>Fix Denial of Service via <code>__proto__</code> key in
<code>mergeConfig</code>. (PR <a
href="https://redirect.github.com/axios/axios/pull/7369">#7369</a>)</li>
</ul>
<h4>Fixes</h4>
<ul>
<li>Fix/5657. (PR <a
href="https://redirect.github.com/axios/axios/pull/7313">#7313</a>)</li>
<li>Ensure <code>status</code> is present in <code>AxiosError</code> on
and after v1.13.3. (PR <a
href="https://redirect.github.com/axios/axios/pull/7368">#7368</a>)</li>
</ul>
<h4>Features / Improvements</h4>
<ul>
<li>Add input validation to <code>isAbsoluteURL</code>. (PR <a
href="https://redirect.github.com/axios/axios/pull/7326">#7326</a>)</li>
<li>Refactor: bump minor package versions. (PR <a
href="https://redirect.github.com/axios/axios/pull/7356">#7356</a>)</li>
</ul>
<h4>Documentation</h4>
<ul>
<li>Clarify object-check comment. (PR <a
href="https://redirect.github.com/axios/axios/pull/7323">#7323</a>)</li>
<li>Fix deprecated <code>Buffer</code> constructor usage and README
formatting. (PR <a
href="https://redirect.github.com/axios/axios/pull/7371">#7371</a>)</li>
</ul>
<h4>CI / Maintenance</h4>
<ul>
<li>Chore: fix issues with YAML. (PR <a
href="https://redirect.github.com/axios/axios/pull/7355">#7355</a>)</li>
<li>CI: update workflow YAMLs. (PR <a
href="https://redirect.github.com/axios/axios/pull/7372">#7372</a>)</li>
<li>CI: fix run condition. (PR <a
href="https://redirect.github.com/axios/axios/pull/7373">#7373</a>)</li>
<li>Dev deps: bump <code>karma-sourcemap-loader</code> from 0.3.8 to
0.4.0. (PR <a
href="https://redirect.github.com/axios/axios/pull/7360">#7360</a>)</li>
<li>Chore(release): prepare release 1.13.5. (PR <a
href="https://redirect.github.com/axios/axios/pull/7379">#7379</a>)</li>
</ul>
<h3>New Contributors</h3>
<ul>
<li><a
href="https://github.com/sachin11063"><code>@sachin11063</code></a>
(first contribution — PR <a
href="https://redirect.github.com/axios/axios/pull/7323">#7323</a>)</li>
<li><a
href="https://github.com/asmitha-16"><code>@asmitha-16</code></a>
(first contribution — PR <a
href="https://redirect.github.com/axios/axios/pull/7326">#7326</a>)</li>
</ul>
<p><strong>Full Changelog:</strong> <a
href="https://github.com/axios/axios/compare/v1.13.4...v1.13.5">https://github.com/axios/axios/compare/v1.13.4...v1.13.5</a></p>
<h2>v1.13.4</h2>
<h2>Overview</h2>
<p>The release addresses issues discovered in v1.13.3 and includes
significant CI/CD improvements.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/axios/axios/compare/v1.13.3...v1.13.4">v1.13.3...v1.13.4</a></p>
<h2>What's New in v1.13.4</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>fix: issues with version 1.13.3</strong> (<a
href="https://redirect.github.com/axios/axios/issues/7352">#7352</a>)
(<a
href="ee90dfc28a">ee90dfc</a>)
<ul>
<li>Fixed issues discovered in v1.13.3 release</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2><a
href="https://github.com/axios/axios/compare/v1.13.2...v1.13.3">1.13.3</a>
(2026-01-20)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>http2:</strong> Use port 443 for HTTPS connections by
default. (<a
href="https://redirect.github.com/axios/axios/issues/7256">#7256</a>)
(<a
href="d7e6065346">d7e6065</a>)</li>
<li><strong>interceptor:</strong> handle the error in the same
interceptor (<a
href="https://redirect.github.com/axios/axios/issues/6269">#6269</a>)
(<a
href="5945e40bb1">5945e40</a>)</li>
<li>main field in package.json should correspond to cjs artifacts (<a
href="https://redirect.github.com/axios/axios/issues/5756">#5756</a>)
(<a
href="7373fbff24">7373fbf</a>)</li>
<li><strong>package.json:</strong> add 'bun' package.json 'exports'
condition. Load the Node.js build in Bun instead of the browser build
(<a
href="https://redirect.github.com/axios/axios/issues/5754">#5754</a>)
(<a
href="b89217e3e9">b89217e</a>)</li>
<li>silentJSONParsing=false should throw on invalid JSON (<a
href="https://redirect.github.com/axios/axios/issues/7253">#7253</a>)
(<a
href="https://redirect.github.com/axios/axios/issues/7257">#7257</a>)
(<a
href="7d19335e43">7d19335</a>)</li>
<li>turn AxiosError into a native error (<a
href="https://redirect.github.com/axios/axios/issues/5394">#5394</a>)
(<a
href="https://redirect.github.com/axios/axios/issues/5558">#5558</a>)
(<a
href="1c6a86dd2c">1c6a86d</a>)</li>
<li><strong>types:</strong> add handlers to AxiosInterceptorManager
interface (<a
href="https://redirect.github.com/axios/axios/issues/5551">#5551</a>)
(<a
href="8d1271b49f">8d1271b</a>)</li>
<li><strong>types:</strong> restore AxiosError.cause type from unknown
to Error (<a
href="https://redirect.github.com/axios/axios/issues/7327">#7327</a>)
(<a
href="d8233d9e8e">d8233d9</a>)</li>
<li>unclear error message is thrown when specifying an empty proxy
authorization (<a
href="https://redirect.github.com/axios/axios/issues/6314">#6314</a>)
(<a
href="6ef867e684">6ef867e</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>add <code>undefined</code> as a value in AxiosRequestConfig (<a
href="https://redirect.github.com/axios/axios/issues/5560">#5560</a>)
(<a
href="095033c626">095033c</a>)</li>
<li>add automatic minor and patch upgrades to dependabot (<a
href="https://redirect.github.com/axios/axios/issues/6053">#6053</a>)
(<a
href="65a7584eda">65a7584</a>)</li>
<li>add Node.js coverage script using c8 (closes <a
href="https://redirect.github.com/axios/axios/issues/7289">#7289</a>)
(<a
href="https://redirect.github.com/axios/axios/issues/7294">#7294</a>)
(<a
href="ec9d94e9f8">ec9d94e</a>)</li>
<li>added copilot instructions (<a
href="3f83143bfe">3f83143</a>)</li>
<li>compatibility with frozen prototypes (<a
href="https://redirect.github.com/axios/axios/issues/6265">#6265</a>)
(<a
href="860e03396a">860e033</a>)</li>
<li>enhance pipeFileToResponse with error handling (<a
href="https://redirect.github.com/axios/axios/issues/7169">#7169</a>)
(<a
href="88d7884254">88d7884</a>)</li>
<li><strong>types:</strong> Intellisense for string literals in a
widened union (<a
href="https://redirect.github.com/axios/axios/issues/6134">#6134</a>)
(<a
href="f73474d02c">f73474d</a>),
closes <a
href="https://redirect.github.com//redirect.github.com/microsoft/TypeScript/issues/33471/issues/issuecomment-1376364329">microsoft/TypeScript#33471</a></li>
</ul>
<h3>Reverts</h3>
<ul>
<li>Revert "fix: silentJSONParsing=false should throw on invalid
JSON (<a
href="https://redirect.github.com/axios/axios/issues/7253">#7253</a>)
(<a
href="https://redirect.github.com/axios/axios/issues/7">#7</a>…"
(<a
href="https://redirect.github.com/axios/axios/issues/7298">#7298</a>)
(<a
href="a4230f5581">a4230f5</a>),
closes <a
href="https://redirect.github.com/axios/axios/issues/7253">#7253</a> <a
href="https://redirect.github.com/axios/axios/issues/7">#7</a> <a
href="https://redirect.github.com/axios/axios/issues/7298">#7298</a></li>
<li><strong>deps:</strong> bump peter-evans/create-pull-request from 7
to 8 in the github-actions group (<a
href="https://redirect.github.com/axios/axios/issues/7334">#7334</a>)
(<a
href="2d6ad5e48b">2d6ad5e</a>)</li>
</ul>
<h3>Contributors to this release</h3>
<ul>
<li><!-- raw HTML omitted --> <a href="https://github.com/ashvin2005"
title="+1752/-4 ([#7218](https://github.com/axios/axios/issues/7218)
[#7218](https://github.com/axios/axios/issues/7218) )">Ashvin
Tiwari</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/mochinikunj"
title="+940/-12 ([#7294](https://github.com/axios/axios/issues/7294)
[#7294](https://github.com/axios/axios/issues/7294) )">Nikunj
Mochi</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/imanchalsingh"
title="+544/-102 ([#7169](https://github.com/axios/axios/issues/7169)
[#7185](https://github.com/axios/axios/issues/7185) )">Anchal
Singh</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/jasonsaayman"
title="+317/-73 ([#7334](https://github.com/axios/axios/issues/7334)
[#7298](https://github.com/axios/axios/issues/7298)
)">jasonsaayman</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/brodo"
title="+99/-120 ([#5558](https://github.com/axios/axios/issues/5558)
)">Julian Dax</a></li>
<li><!-- raw HTML omitted --> <a
href="https://github.com/AKASHDHARDUBEY" title="+167/-0
([#7287](https://github.com/axios/axios/issues/7287)
[#7288](https://github.com/axios/axios/issues/7288) )">Akash Dhar
Dubey</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/madhumitaaa"
title="+20/-68 ([#7198](https://github.com/axios/axios/issues/7198)
)">Madhumita</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/Tackoil"
title="+80/-2 ([#6269](https://github.com/axios/axios/issues/6269)
)">Tackoil</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/justindhillon"
title="+41/-41 ([#6324](https://github.com/axios/axios/issues/6324)
[#6315](https://github.com/axios/axios/issues/6315) )">Justin
Dhillon</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/Rudrxxx"
title="+71/-2 ([#7257](https://github.com/axios/axios/issues/7257)
)">Rudransh</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/WuMingDao"
title="+36/-36 ([#7215](https://github.com/axios/axios/issues/7215)
)">WuMingDao</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/codenomnom"
title="+70/-0 ([#7201](https://github.com/axios/axios/issues/7201)
[#7201](https://github.com/axios/axios/issues/7201)
)">codenomnom</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/Nandann018-ux"
title="+60/-10 ([#7272](https://github.com/axios/axios/issues/7272)
)">Nandan Acharya</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/KernelDeimos"
title="+22/-40 ([#7042](https://github.com/axios/axios/issues/7042)
)">Eric Dubé</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/tiborpilz"
title="+40/-4 ([#5551](https://github.com/axios/axios/issues/5551)
)">Tibor Pilz</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/joaoGabriel55"
title="+31/-4 ([#6314](https://github.com/axios/axios/issues/6314)
)">Gabriel Quaresma</a></li>
<li><!-- raw HTML omitted --> <a href="https://github.com/turadg"
title="+23/-6 ([#6265](https://github.com/axios/axios/issues/6265)
)">Turadg Aleahmad</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="29f75425f0"><code>29f7542</code></a>
chore(release): prepare release 1.13.5 (<a
href="https://redirect.github.com/axios/axios/issues/7379">#7379</a>)</li>
<li><a
href="431c3a3614"><code>431c3a3</code></a>
ci: fix run condition (<a
href="https://redirect.github.com/axios/axios/issues/7373">#7373</a>)</li>
<li><a
href="9ff3a78ad7"><code>9ff3a78</code></a>
ci: update ymls (<a
href="https://redirect.github.com/axios/axios/issues/7372">#7372</a>)</li>
<li><a
href="265b71234c"><code>265b712</code></a>
docs: fix deprecated Buffer constructor and formatting issues in README
(<a
href="https://redirect.github.com/axios/axios/issues/7371">#7371</a>)</li>
<li><a
href="475e75a260"><code>475e75a</code></a>
feat: add input validation to isAbsoluteURL (<a
href="https://redirect.github.com/axios/axios/issues/7326">#7326</a>)</li>
<li><a
href="28c721588c"><code>28c7215</code></a>
fix: Denial of Service via <strong>proto</strong> Key in mergeConfig (<a
href="https://redirect.github.com/axios/axios/issues/7369">#7369</a>)</li>
<li><a
href="04cf01969e"><code>04cf019</code></a>
docs: clarify object check comment (<a
href="https://redirect.github.com/axios/axios/issues/7323">#7323</a>)</li>
<li><a
href="696fa753c5"><code>696fa75</code></a>
fix: status is missing in AxiosError on and after v1.13.3 (<a
href="https://redirect.github.com/axios/axios/issues/7368">#7368</a>)</li>
<li><a
href="569f028a58"><code>569f028</code></a>
fix: added a option to choose between legacy and the new
request/response int...</li>
<li><a
href="44b7c9f0c4"><code>44b7c9f</code></a>
chore(deps-dev): bump karma-sourcemap-loader (<a
href="https://redirect.github.com/axios/axios/issues/7360">#7360</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/axios/axios/compare/v1.13.2...v1.13.5">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by [GitHub Actions](<a
href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a>
Actions), a new releaser for axios since your current version.</p>
</details>
<br />
Updates `qs` from 6.13.0 to 6.14.2
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.14.2</strong></h2>
<ul>
<li>[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/546">#546</a>)</li>
<li>[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/<code>parseArrayValue</code></li>
<li>[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded
with indexed notation when <code>throwOnLimitExceeded</code> is true (<a
href="https://redirect.github.com/ljharb/qs/issues/529">#529</a>)</li>
<li>[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li>[Fix] <code>parse</code>: fix error message to reflect arrayLimit as
max index; remove extraneous comments (<a
href="https://redirect.github.com/ljharb/qs/issues/545">#545</a>)</li>
<li>[Robustness] avoid <code>.push</code>, use <code>void</code></li>
<li>[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output (<a
href="https://redirect.github.com/ljharb/qs/issues/418">#418</a>)</li>
<li>[readme] clarify <code>parseArrays</code> and
<code>arrayLimit</code> documentation (<a
href="https://redirect.github.com/ljharb/qs/issues/543">#543</a>)</li>
<li>[readme] replace runkit CI badge with shields.io check-runs
badge</li>
<li>[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>[actions] fix rebase workflow permissions</li>
</ul>
<h2><strong>6.14.1</strong></h2>
<ul>
<li>[Fix] ensure <code>arrayLimit</code> applies to <code>[]</code>
notation as well</li>
<li>[Fix] <code>parse</code>: when a custom decoder returns
<code>null</code> for a key, ignore that key</li>
<li>[Refactor] <code>parse</code>: extract key segment splitting
helper</li>
<li>[meta] add threat model</li>
<li>[actions] add workflow permissions</li>
<li>[Tests] <code>stringify</code>: increase coverage</li>
<li>[Dev Deps] update <code>eslint</code>,
<code>@ljharb/eslint-config</code>, <code>npmignore</code>,
<code>es-value-fixtures</code>, <code>for-each</code>,
<code>object-inspect</code></li>
</ul>
<h2><strong>6.14.0</strong></h2>
<ul>
<li>[New] <code>parse</code>: add
<code>throwOnParameterLimitExceeded</code> option (<a
href="https://redirect.github.com/ljharb/qs/issues/517">#517</a>)</li>
<li>[Refactor] <code>parse</code>: use <code>utils.combine</code>
more</li>
<li>[patch] <code>parse</code>: add explicit
<code>throwOnLimitExceeded</code> default</li>
<li>[actions] use shared action; re-add finishers</li>
<li>[meta] Fix changelog formatting bug</li>
<li>[Deps] update <code>side-channel</code></li>
<li>[Dev Deps] update <code>es-value-fixtures</code>,
<code>has-bigints</code>, <code>has-proto</code>,
<code>has-symbols</code></li>
<li>[Tests] increase coverage</li>
</ul>
<h2><strong>6.13.3</strong></h2>
<p>[Fix] fix regressions from robustness refactor
[actions] update reusable workflows</p>
<h2><strong>6.13.2</strong></h2>
<ul>
<li>[Robustness] avoid <code>.push</code>, use <code>void</code></li>
<li>[readme] clarify <code>parseArrays</code> and
<code>arrayLimit</code> documentation (<a
href="https://redirect.github.com/ljharb/qs/issues/543">#543</a>)</li>
<li>[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output (<a
href="https://redirect.github.com/ljharb/qs/issues/418">#418</a>)</li>
<li>[readme] replace runkit CI badge with shields.io check-runs
badge</li>
<li>[actions] fix rebase workflow permissions</li>
</ul>
<h2><strong>6.13.1</strong></h2>
<ul>
<li>[Fix] <code>stringify</code>: avoid a crash when a
<code>filter</code> key is <code>null</code></li>
<li>[Fix] <code>utils.merge</code>: functions should not be stringified
into keys</li>
<li>[Fix] <code>parse</code>: avoid a crash with
interpretNumericEntities: true, comma: true, and iso charset</li>
<li>[Fix] <code>stringify</code>: ensure a non-string
<code>filter</code> does not crash</li>
<li>[Refactor] use <code>__proto__</code> syntax instead of
<code>Object.create</code> for null objects</li>
<li>[Refactor] misc cleanup</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bdcf0c7f82"><code>bdcf0c7</code></a>
v6.14.2</li>
<li><a
href="294db90c81"><code>294db90</code></a>
[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output</li>
<li><a
href="5c308e5516"><code>5c308e5</code></a>
[readme] clarify <code>parseArrays</code> and <code>arrayLimit</code>
documentation</li>
<li><a
href="6addf8cf73"><code>6addf8c</code></a>
[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code></li>
<li><a
href="cfc108f662"><code>cfc108f</code></a>
[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/`pars...</li>
<li><a
href="febb64442a"><code>febb644</code></a>
[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded with
indexed notation when `thr...</li>
<li><a
href="f6a7abff1f"><code>f6a7abf</code></a>
[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li><a
href="fbc5206c25"><code>fbc5206</code></a>
[Fix] <code>parse</code>: fix error message to reflect arrayLimit as max
index; remove e...</li>
<li><a
href="1b9a8b4e78"><code>1b9a8b4</code></a>
[actions] fix rebase workflow permissions</li>
<li><a
href="2a35775614"><code>2a35775</code></a>
[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ljharb/qs/compare/v6.13.0...v6.14.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `qs` from 6.13.0 to 6.14.2
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md">qs's
changelog</a>.</em></p>
<blockquote>
<h2><strong>6.14.2</strong></h2>
<ul>
<li>[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code> (<a
href="https://redirect.github.com/ljharb/qs/issues/546">#546</a>)</li>
<li>[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/<code>parseArrayValue</code></li>
<li>[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded
with indexed notation when <code>throwOnLimitExceeded</code> is true (<a
href="https://redirect.github.com/ljharb/qs/issues/529">#529</a>)</li>
<li>[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li>[Fix] <code>parse</code>: fix error message to reflect arrayLimit as
max index; remove extraneous comments (<a
href="https://redirect.github.com/ljharb/qs/issues/545">#545</a>)</li>
<li>[Robustness] avoid <code>.push</code>, use <code>void</code></li>
<li>[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output (<a
href="https://redirect.github.com/ljharb/qs/issues/418">#418</a>)</li>
<li>[readme] clarify <code>parseArrays</code> and
<code>arrayLimit</code> documentation (<a
href="https://redirect.github.com/ljharb/qs/issues/543">#543</a>)</li>
<li>[readme] replace runkit CI badge with shields.io check-runs
badge</li>
<li>[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>[actions] fix rebase workflow permissions</li>
</ul>
<h2><strong>6.14.1</strong></h2>
<ul>
<li>[Fix] ensure <code>arrayLimit</code> applies to <code>[]</code>
notation as well</li>
<li>[Fix] <code>parse</code>: when a custom decoder returns
<code>null</code> for a key, ignore that key</li>
<li>[Refactor] <code>parse</code>: extract key segment splitting
helper</li>
<li>[meta] add threat model</li>
<li>[actions] add workflow permissions</li>
<li>[Tests] <code>stringify</code>: increase coverage</li>
<li>[Dev Deps] update <code>eslint</code>,
<code>@ljharb/eslint-config</code>, <code>npmignore</code>,
<code>es-value-fixtures</code>, <code>for-each</code>,
<code>object-inspect</code></li>
</ul>
<h2><strong>6.14.0</strong></h2>
<ul>
<li>[New] <code>parse</code>: add
<code>throwOnParameterLimitExceeded</code> option (<a
href="https://redirect.github.com/ljharb/qs/issues/517">#517</a>)</li>
<li>[Refactor] <code>parse</code>: use <code>utils.combine</code>
more</li>
<li>[patch] <code>parse</code>: add explicit
<code>throwOnLimitExceeded</code> default</li>
<li>[actions] use shared action; re-add finishers</li>
<li>[meta] Fix changelog formatting bug</li>
<li>[Deps] update <code>side-channel</code></li>
<li>[Dev Deps] update <code>es-value-fixtures</code>,
<code>has-bigints</code>, <code>has-proto</code>,
<code>has-symbols</code></li>
<li>[Tests] increase coverage</li>
</ul>
<h2><strong>6.13.3</strong></h2>
<p>[Fix] fix regressions from robustness refactor
[actions] update reusable workflows</p>
<h2><strong>6.13.2</strong></h2>
<ul>
<li>[Robustness] avoid <code>.push</code>, use <code>void</code></li>
<li>[readme] clarify <code>parseArrays</code> and
<code>arrayLimit</code> documentation (<a
href="https://redirect.github.com/ljharb/qs/issues/543">#543</a>)</li>
<li>[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output (<a
href="https://redirect.github.com/ljharb/qs/issues/418">#418</a>)</li>
<li>[readme] replace runkit CI badge with shields.io check-runs
badge</li>
<li>[actions] fix rebase workflow permissions</li>
</ul>
<h2><strong>6.13.1</strong></h2>
<ul>
<li>[Fix] <code>stringify</code>: avoid a crash when a
<code>filter</code> key is <code>null</code></li>
<li>[Fix] <code>utils.merge</code>: functions should not be stringified
into keys</li>
<li>[Fix] <code>parse</code>: avoid a crash with
interpretNumericEntities: true, comma: true, and iso charset</li>
<li>[Fix] <code>stringify</code>: ensure a non-string
<code>filter</code> does not crash</li>
<li>[Refactor] use <code>__proto__</code> syntax instead of
<code>Object.create</code> for null objects</li>
<li>[Refactor] misc cleanup</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bdcf0c7f82"><code>bdcf0c7</code></a>
v6.14.2</li>
<li><a
href="294db90c81"><code>294db90</code></a>
[readme] document that <code>addQueryPrefix</code> does not add
<code>?</code> to empty output</li>
<li><a
href="5c308e5516"><code>5c308e5</code></a>
[readme] clarify <code>parseArrays</code> and <code>arrayLimit</code>
documentation</li>
<li><a
href="6addf8cf73"><code>6addf8c</code></a>
[Fix] <code>parse</code>: mark overflow objects for indexed notation
exceeding <code>arrayLimit</code></li>
<li><a
href="cfc108f662"><code>cfc108f</code></a>
[Fix] <code>arrayLimit</code> means max count, not max index, in
<code>combine</code>/<code>merge</code>/`pars...</li>
<li><a
href="febb64442a"><code>febb644</code></a>
[Fix] <code>parse</code>: throw on <code>arrayLimit</code> exceeded with
indexed notation when `thr...</li>
<li><a
href="f6a7abff1f"><code>f6a7abf</code></a>
[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on
<code>comma</code>-parsed values</li>
<li><a
href="fbc5206c25"><code>fbc5206</code></a>
[Fix] <code>parse</code>: fix error message to reflect arrayLimit as max
index; remove e...</li>
<li><a
href="1b9a8b4e78"><code>1b9a8b4</code></a>
[actions] fix rebase workflow permissions</li>
<li><a
href="2a35775614"><code>2a35775</code></a>
[meta] fix changelog typo (<code>arrayLength</code> →
<code>arrayLimit</code>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ljharb/qs/compare/v6.13.0...v6.14.2">compare
view</a></li>
</ul>
</details>
<br />
Updates `next` from 14.2.3 to 15.5.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vercel/next.js/releases">next's
releases</a>.</em></p>
<blockquote>
<h2>v15.5.10</h2>
<p>Please refer the following changelogs for more information about this
security release:</p>
<ul>
<li><a
href="https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472">https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472</a></li>
<li><a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">https://vercel.com/changelog/summary-of-cve-2026-23864</a></li>
</ul>
<h2>v15.4.11</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.3.9</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.2.9</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.1.12</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
<h2>v15.0.8</h2>
<p>Please see this <a
href="https://vercel.com/changelog/summary-of-cve-2026-23864">changelog</a>
for more information about this security patch.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="60a2aa97b6"><code>60a2aa9</code></a>
v15.5.10</li>
<li><a
href="e5b834d208"><code>e5b834d</code></a>
fetch(next/image): reduce maximumResponseBody from 300MB to 50MB (<a
href="https://redirect.github.com/vercel/next.js/issues/88588">#88588</a>)</li>
<li><a
href="39a2f6a8d1"><code>39a2f6a</code></a>
feat(next/image)!: add <code>images.maximumResponseBody</code> config
(<a
href="https://redirect.github.com/vercel/next.js/issues/88183">#88183</a>)</li>
<li><a
href="bf9f0843ed"><code>bf9f084</code></a>
Sync DoS mitigations for React Flight</li>
<li><a
href="c5de33e93c"><code>c5de33e</code></a>
v15.5.9</li>
<li><a
href="dd233994ae"><code>dd23399</code></a>
Backport <a
href="https://redirect.github.com/facebook/react/issues/35351">facebook/react#35351</a>
for 15.5.8 (<a
href="https://redirect.github.com/vercel/next.js/issues/87086">#87086</a>)</li>
<li><a
href="7526cd6f24"><code>7526cd6</code></a>
v15.5.8</li>
<li><a
href="1e9ec4133a"><code>1e9ec41</code></a>
Update React Version (<a
href="https://redirect.github.com/vercel/next.js/issues/41">#41</a>)</li>
<li><a
href="16141e5df9"><code>16141e5</code></a>
Update React Version (<a
href="https://redirect.github.com/vercel/next.js/issues/30">#30</a>)</li>
<li><a
href="e01e589e18"><code>e01e589</code></a>
Backport Next.js changes to v15.5.8 (<a
href="https://redirect.github.com/vercel/next.js/issues/23">#23</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vercel/next.js/compare/v14.2.3...v15.5.10">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/blackboxprogramming/BlackRoad-Operating-System/network/alerts).
</details>
Bumps [python-dotenv](https://github.com/theskumar/python-dotenv) from
1.0.0 to 1.2.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/theskumar/python-dotenv/releases">python-dotenv's
releases</a>.</em></p>
<blockquote>
<h2>v1.2.2</h2>
<h3>Added</h3>
<ul>
<li>Support for Python 3.14, including the free-threaded (3.14t) build.
(#)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>The <code>dotenv run</code> command now forwards flags directly to
the specified command by <a
href="https://github.com/bbc2"><code>@bbc2</code></a> in <a
href="https://redirect.github.com/theskumar/python-dotenv/pull/607">theskumar/python-dotenv#607</a></li>
<li>Improved documentation clarity regarding override behavior and the
reference page.</li>
<li>Updated PyPy support to version 3.11.</li>
<li>Documentation for FIFO file support.</li>
<li>Support for Python 3.9.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Improved <code>set_key</code> and <code>unset_key</code> behavior
when interacting with symlinks by <a
href="https://github.com/bbc2"><code>@bbc2</code></a> in <a
href="790c5c0299">#790c5</a></li>
<li>Corrected the license specifier and added missing Python 3.14
classifiers in package metadata by <a
href="https://github.com/JYOuyang"><code>@JYOuyang</code></a> in <a
href="https://redirect.github.com/theskumar/python-dotenv/pull/590">theskumar/python-dotenv#590</a></li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>
<p><code>dotenv.set_key</code> and <code>dotenv.unset_key</code> used to
follow symlinks in some
situations. This is no longer the case. For that behavior to be restored
in
all cases, <code>follow_symlinks=True</code> should be used.</p>
</li>
<li>
<p>In the CLI, <code>set</code> and <code>unset</code> used to follow
symlinks in some situations. This
is no longer the case.</p>
</li>
<li>
<p><code>dotenv.set_key</code>, <code>dotenv.unset_key</code> and the
CLI commands <code>set</code> and <code>unset</code>
used to reset the file mode of the modified .env file to
<code>0o600</code> in some
situations. This is no longer the case: The original mode of the file is
now
preserved. Is the file needed to be created or wasn't a regular file,
mode
<code>0o600</code> is used.</p>
</li>
</ul>
<h3>Misc</h3>
<ul>
<li>skip 000 permission tests for root user by <a
href="https://github.com/burnout-projects"><code>@burnout-projects</code></a>
in <a
href="https://redirect.github.com/theskumar/python-dotenv/pull/561">theskumar/python-dotenv#561</a></li>
<li>Bump actions/checkout from 5 to 6 in the github-actions group by <a
href="https://github.com/dependabot"><code>@dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/theskumar/python-dotenv/pull/593">theskumar/python-dotenv#593</a></li>
<li>Add Windows testing to CI by <a
href="https://github.com/bbc2"><code>@bbc2</code></a> in <a
href="https://redirect.github.com/theskumar/python-dotenv/pull/604">theskumar/python-dotenv#604</a></li>
<li>Improve workflow efficiency with best practices by <a
href="https://github.com/theskumar"><code>@theskumar</code></a> in <a
href="https://redirect.github.com/theskumar/python-dotenv/pull/609">theskumar/python-dotenv#609</a></li>
<li>Remove the use of <code>sh</code> in tests by <a
href="https://github.com/bbc2"><code>@bbc2</code></a> in <a
href="https://redirect.github.com/theskumar/python-dotenv/pull/612">theskumar/python-dotenv#612</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/JYOuyang"><code>@JYOuyang</code></a>
made their first contribution in <a
href="https://redirect.github.com/theskumar/python-dotenv/pull/590">theskumar/python-dotenv#590</a></li>
<li><a
href="https://github.com/burnout-projects"><code>@burnout-projects</code></a>
made their first contribution in <a
href="https://redirect.github.com/theskumar/python-dotenv/pull/561">theskumar/python-dotenv#561</a></li>
<li><a
href="https://github.com/cpackham-atlnz"><code>@cpackham-atlnz</code></a>
made their first contribution in <a
href="https://redirect.github.com/theskumar/python-dotenv/pull/597">theskumar/python-dotenv#597</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2">https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2</a></p>
<h2>v1.2.1</h2>
<h2>What's Changed</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md">python-dotenv's
changelog</a>.</em></p>
<blockquote>
<h2>[1.2.2] - 2026-03-01</h2>
<h3>Added</h3>
<ul>
<li>Support for Python 3.14, including the free-threaded (3.14t) build.
(<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/588">#588</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>The <code>dotenv run</code> command now forwards flags directly to
the specified command by [<a
href="https://github.com/bbc2"><code>@bbc2</code></a>] in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/607">#607</a></li>
<li>Improved documentation clarity regarding override behavior and the
reference page.</li>
<li>Updated PyPy support to version 3.11.</li>
<li>Documentation for FIFO file support.</li>
<li>Dropped Support for Python 3.9.</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Improved <code>set_key</code> and <code>unset_key</code> behavior
when interacting with symlinks by [<a
href="https://github.com/bbc2"><code>@bbc2</code></a>] in
[790c5c0]</li>
<li>Corrected the license specifier and added missing Python 3.14
classifiers in package metadata by [<a
href="https://github.com/JYOuyang"><code>@JYOuyang</code></a>] in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/590">#590</a></li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>
<p><code>dotenv.set_key</code> and <code>dotenv.unset_key</code> used to
follow symlinks in some
situations. This is no longer the case. For that behavior to be restored
in
all cases, <code>follow_symlinks=True</code> should be used.</p>
</li>
<li>
<p>In the CLI, <code>set</code> and <code>unset</code> used to follow
symlinks in some situations. This
is no longer the case.</p>
</li>
<li>
<p><code>dotenv.set_key</code>, <code>dotenv.unset_key</code> and the
CLI commands <code>set</code> and <code>unset</code>
used to reset the file mode of the modified .env file to
<code>0o600</code> in some
situations. This is no longer the case: The original mode of the file is
now
preserved. Is the file needed to be created or wasn't a regular file,
mode
<code>0o600</code> is used.</p>
</li>
</ul>
<h2>[1.2.1] - 2025-10-26</h2>
<ul>
<li>Move more config to <code>pyproject.toml</code>, removed
<code>setup.cfg</code></li>
<li>Add support for reading <code>.env</code> from FIFOs (Unix) by [<a
href="https://github.com/sidharth-sudhir"><code>@sidharth-sudhir</code></a>]
in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/586">#586</a></li>
</ul>
<h2>[1.2.0] - 2025-10-26</h2>
<ul>
<li>Upgrade build system to use PEP 517 & PEP 518 to use
<code>build</code> and <code>pyproject.toml</code> by [<a
href="https://github.com/EpicWink"><code>@EpicWink</code></a>] in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/583">#583</a></li>
<li>Add support for Python 3.14 by [<a
href="https://github.com/23f3001135"><code>@23f3001135</code></a>] in
<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/579">#579</a></li>
<li>Add support for disabling of <code>load_dotenv()</code> using
<code>PYTHON_DOTENV_DISABLED</code> env var. by [<a
href="https://github.com/matthewfranglen"><code>@matthewfranglen</code></a>]
in <a
href="https://redirect.github.com/theskumar/python-dotenv/issues/569">#569</a></li>
</ul>
<h2>[1.1.1] - 2025-06-24</h2>
<h3>Fixed</h3>
<ul>
<li>CLI: Ensure <code>find_dotenv</code> work reliably on python 3.13 by
[<a href="https://github.com/theskumar"><code>@theskumar</code></a>] in
<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/563">#563</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="36004e0e34"><code>36004e0</code></a>
Bump version: 1.2.1 → 1.2.2</li>
<li><a
href="eb202520e5"><code>eb20252</code></a>
docs: update changelog for v1.2.2</li>
<li><a
href="790c5c0299"><code>790c5c0</code></a>
Merge commit from fork</li>
<li><a
href="43340da220"><code>43340da</code></a>
Remove the use of <code>sh</code> in tests (<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/612">#612</a>)</li>
<li><a
href="09d7cee324"><code>09d7cee</code></a>
docs: clarify override behavior and document FIFO support (<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/610">#610</a>)</li>
<li><a
href="c8de2887c0"><code>c8de288</code></a>
ci: improve workflow efficiency with best practices (<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/609">#609</a>)</li>
<li><a
href="7bd9e3dbfe"><code>7bd9e3d</code></a>
Add Windows testing to CI (<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/604">#604</a>)</li>
<li><a
href="1baaf04f33"><code>1baaf04</code></a>
Drop Python 3.9 support and update to PyPy 3.11 (<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/608">#608</a>)</li>
<li><a
href="4a22cf8993"><code>4a22cf8</code></a>
ci: enable testing on Python 3.14t (free-threaded) (<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/588">#588</a>)</li>
<li><a
href="e2e8e776b4"><code>e2e8e77</code></a>
Fix license specifier (<a
href="https://redirect.github.com/theskumar/python-dotenv/issues/597">#597</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/theskumar/python-dotenv/compare/v1.0.0...v1.2.2">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Bumps the pip group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [python-multipart](https://github.com/Kludex/python-multipart) |
`0.0.6` | `0.0.22` |
| [jinja2](https://github.com/pallets/jinja) | `3.1.2` | `3.1.6` |
| [cryptography](https://github.com/pyca/cryptography) | `41.0.7` |
`46.0.5` |
| [ecdsa](https://github.com/tlsfuzzer/python-ecdsa) | `0.18.0` |
`0.19.1` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `1.39.1` |
`1.45.1` |
Updates `python-multipart` from 0.0.6 to 0.0.22
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/python-multipart/releases">python-multipart's
releases</a>.</em></p>
<blockquote>
<h2>Version 0.0.22</h2>
<h2>What's Changed</h2>
<ul>
<li>Drop directory path from filename in <code>File</code> <a
href="9433f4bbc9">9433f4b</a>.</li>
</ul>
<hr />
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.21...0.0.22">https://github.com/Kludex/python-multipart/compare/0.0.21...0.0.22</a></p>
<h2>Version 0.0.21</h2>
<h2>What's Changed</h2>
<ul>
<li>Add support for Python 3.14 and drop EOL 3.8 and 3.9 by <a
href="https://github.com/hugovk"><code>@hugovk</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/216">Kludex/python-multipart#216</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/waketzheng"><code>@waketzheng</code></a> made
their first contribution in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/203">Kludex/python-multipart#203</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.20...0.0.21">https://github.com/Kludex/python-multipart/compare/0.0.20...0.0.21</a></p>
<h2>Version 0.0.20</h2>
<h2>What's Changed</h2>
<ul>
<li>Handle messages containing only end boundary, fixes <a
href="https://redirect.github.com/Kludex/python-multipart/issues/38">#38</a>
by <a href="https://github.com/jhnstrk"><code>@jhnstrk</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/142">Kludex/python-multipart#142</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/Mr-Sunglasses"><code>@Mr-Sunglasses</code></a>
made their first contribution in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/185">Kludex/python-multipart#185</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.19...0.0.20">https://github.com/Kludex/python-multipart/compare/0.0.19...0.0.20</a></p>
<h2>Version 0.0.19</h2>
<h2>What's Changed</h2>
<ul>
<li>Don't warn when CRLF is found after last boundary by <a
href="https://github.com/Kludex"><code>@Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/193">Kludex/python-multipart#193</a></li>
</ul>
<hr />
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.18...0.0.19">https://github.com/Kludex/python-multipart/compare/0.0.18...0.0.19</a></p>
<h2>Version 0.0.18</h2>
<h2>What's Changed</h2>
<ul>
<li>Hard break if found data after last boundary on
<code>MultipartParser</code> by <a
href="https://github.com/Kludex"><code>@Kludex</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/189">Kludex/python-multipart#189</a></li>
</ul>
<hr />
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Kludex/python-multipart/compare/0.0.17...0.0.18">https://github.com/Kludex/python-multipart/compare/0.0.17...0.0.18</a></p>
<h2>Version 0.0.17</h2>
<h2>What's Changed</h2>
<ul>
<li>Handle PermissionError in fallback code for old import name by <a
href="https://github.com/defnull"><code>@defnull</code></a> in <a
href="https://redirect.github.com/Kludex/python-multipart/pull/182">Kludex/python-multipart#182</a></li>
</ul>
<hr />
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md">python-multipart's
changelog</a>.</em></p>
<blockquote>
<h2>0.0.22 (2026-01-25)</h2>
<ul>
<li>Drop directory path from filename in <code>File</code> <a
href="9433f4bbc9">9433f4b</a>.</li>
</ul>
<h2>0.0.21 (2025-12-17)</h2>
<ul>
<li>Add support for Python 3.14 and drop EOL 3.8 and 3.9 <a
href="https://redirect.github.com/Kludex/python-multipart/pull/216">#216</a>.</li>
</ul>
<h2>0.0.20 (2024-12-16)</h2>
<ul>
<li>Handle messages containing only end boundary <a
href="https://redirect.github.com/Kludex/python-multipart/pull/142">#142</a>.</li>
</ul>
<h2>0.0.19 (2024-11-30)</h2>
<ul>
<li>Don't warn when CRLF is found after last boundary on
<code>MultipartParser</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/193">#193</a>.</li>
</ul>
<h2>0.0.18 (2024-11-28)</h2>
<ul>
<li>Hard break if found data after last boundary on
<code>MultipartParser</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/189">#189</a>.</li>
</ul>
<h2>0.0.17 (2024-10-31)</h2>
<ul>
<li>Handle PermissionError in fallback code for old import name <a
href="https://redirect.github.com/Kludex/python-multipart/pull/182">#182</a>.</li>
</ul>
<h2>0.0.16 (2024-10-27)</h2>
<ul>
<li>Add dunder attributes to <code>multipart</code> package <a
href="https://redirect.github.com/Kludex/python-multipart/pull/177">#177</a>.</li>
</ul>
<h2>0.0.15 (2024-10-27)</h2>
<ul>
<li>Replace <code>FutureWarning</code> to
<code>PendingDeprecationWarning</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/174">#174</a>.</li>
<li>Add missing files to SDist <a
href="https://redirect.github.com/Kludex/python-multipart/pull/171">#171</a>.</li>
</ul>
<h2>0.0.14 (2024-10-24)</h2>
<ul>
<li>Fix import scheme for <code>multipart</code> module (<a
href="https://redirect.github.com/Kludex/python-multipart/pull/168">#168</a>).</li>
</ul>
<h2>0.0.13 (2024-10-20)</h2>
<ul>
<li>Rename import to <code>python_multipart</code> <a
href="https://redirect.github.com/Kludex/python-multipart/pull/166">#166</a>.</li>
</ul>
<h2>0.0.12 (2024-09-29)</h2>
<ul>
<li>Improve error message when boundary character does not match <a
href="https://redirect.github.com/Kludex/python-multipart/pull/124">#124</a>.</li>
<li>Add mypy strict typing <a
href="https://redirect.github.com/Kludex/python-multipart/pull/140">#140</a>.</li>
<li>Enforce 100% coverage <a
href="https://redirect.github.com/Kludex/python-multipart/pull/159">#159</a>.</li>
</ul>
<h2>0.0.11 (2024-09-28)</h2>
<ul>
<li>Improve performance, especially in data with many CR-LF <a
href="https://redirect.github.com/Kludex/python-multipart/pull/137">#137</a>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="bea7bbb290"><code>bea7bbb</code></a>
Version 0.0.22 (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/222">#222</a>)</li>
<li><a
href="0fb59a9df0"><code>0fb59a9</code></a>
chore: add return type on test (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/221">#221</a>)</li>
<li><a
href="9433f4bbc9"><code>9433f4b</code></a>
Merge commit from fork</li>
<li><a
href="d5c91ecb0a"><code>d5c91ec</code></a>
Bump the github-actions group with 2 updates (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/219">#219</a>)</li>
<li><a
href="5a90631b48"><code>5a90631</code></a>
bump uv (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/218">#218</a>)</li>
<li><a
href="1f72955602"><code>1f72955</code></a>
Version 0.0.21 (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/217">#217</a>)</li>
<li><a
href="47ecfed353"><code>47ecfed</code></a>
Add support for Python 3.14 and drop EOL 3.8 and 3.9 (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/216">#216</a>)</li>
<li><a
href="f18b70941b"><code>f18b709</code></a>
Bump the github-actions group across 1 directory with 4 updates (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/214">#214</a>)</li>
<li><a
href="b388e9a7a8"><code>b388e9a</code></a>
chore: use depedency-groups in <code>pyproject.toml</code> (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/212">#212</a>)</li>
<li><a
href="6113e75097"><code>6113e75</code></a>
Bump the github-actions group across 1 directory with 3 updates (<a
href="https://redirect.github.com/Kludex/python-multipart/issues/210">#210</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/Kludex/python-multipart/compare/0.0.6...0.0.22">compare
view</a></li>
</ul>
</details>
<br />
Updates `jinja2` from 3.1.2 to 3.1.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pallets/jinja/releases">jinja2's
releases</a>.</em></p>
<blockquote>
<h2>3.1.6</h2>
<p>This is the Jinja 3.1.6 security release, which fixes security issues
but does not otherwise change behavior and should not result in breaking
changes compared to the latest feature release.</p>
<p>PyPI: <a
href="https://pypi.org/project/Jinja2/3.1.6/">https://pypi.org/project/Jinja2/3.1.6/</a>
Changes: <a
href="https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6">https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6</a></p>
<ul>
<li>The <code>|attr</code> filter does not bypass the environment's
attribute lookup, allowing the sandbox to apply its checks. <a
href="https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7">https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7</a></li>
</ul>
<h2>3.1.5</h2>
<p>This is the Jinja 3.1.5 security fix release, which fixes security
issues and bugs but does not otherwise change behavior and should not
result in breaking changes compared to the latest feature release.</p>
<p>PyPI: <a
href="https://pypi.org/project/Jinja2/3.1.5/">https://pypi.org/project/Jinja2/3.1.5/</a>
Changes: <a
href="https://jinja.palletsprojects.com/changes/#version-3-1-5">https://jinja.palletsprojects.com/changes/#version-3-1-5</a>
Milestone: <a
href="https://github.com/pallets/jinja/milestone/16?closed=1">https://github.com/pallets/jinja/milestone/16?closed=1</a></p>
<ul>
<li>The sandboxed environment handles indirect calls to
<code>str.format</code>, such as by passing a stored reference to a
filter that calls its argument. <a
href="https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h">GHSA-q2x7-8rv6-6q7h</a></li>
<li>Escape template name before formatting it into error messages, to
avoid issues with names that contain f-string syntax. <a
href="https://redirect.github.com/pallets/jinja/issues/1792">#1792</a>,
<a
href="https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699">GHSA-gmj6-6f8f-6699</a></li>
<li>Sandbox does not allow <code>clear</code> and <code>pop</code> on
known mutable sequence types. <a
href="https://redirect.github.com/pallets/jinja/issues/2032">#2032</a></li>
<li>Calling sync <code>render</code> for an async template uses
<code>asyncio.run</code>. <a
href="https://redirect.github.com/pallets/jinja/issues/1952">#1952</a></li>
<li>Avoid unclosed <code>auto_aiter</code> warnings. <a
href="https://redirect.github.com/pallets/jinja/issues/1960">#1960</a></li>
<li>Return an <code>aclose</code>-able <code>AsyncGenerator</code> from
<code>Template.generate_async</code>. <a
href="https://redirect.github.com/pallets/jinja/issues/1960">#1960</a></li>
<li>Avoid leaving <code>root_render_func()</code> unclosed in
<code>Template.generate_async</code>. <a
href="https://redirect.github.com/pallets/jinja/issues/1960">#1960</a></li>
<li>Avoid leaving async generators unclosed in blocks, includes and
extends. <a
href="https://redirect.github.com/pallets/jinja/issues/1960">#1960</a></li>
<li>The runtime uses the correct <code>concat</code> function for the
current environment when calling block references. <a
href="https://redirect.github.com/pallets/jinja/issues/1701">#1701</a></li>
<li>Make <code>|unique</code> async-aware, allowing it to be used after
another async-aware filter. <a
href="https://redirect.github.com/pallets/jinja/issues/1781">#1781</a></li>
<li><code>|int</code> filter handles <code>OverflowError</code> from
scientific notation. <a
href="https://redirect.github.com/pallets/jinja/issues/1921">#1921</a></li>
<li>Make compiling deterministic for tuple unpacking in a <code>{% set
... %}</code> call. <a
href="https://redirect.github.com/pallets/jinja/issues/2021">#2021</a></li>
<li>Fix dunder protocol (<code>copy</code>/<code>pickle</code>/etc)
interaction with <code>Undefined</code> objects. <a
href="https://redirect.github.com/pallets/jinja/issues/2025">#2025</a></li>
<li>Fix <code>copy</code>/<code>pickle</code> support for the internal
<code>missing</code> object. <a
href="https://redirect.github.com/pallets/jinja/issues/2027">#2027</a></li>
<li><code>Environment.overlay(enable_async)</code> is applied correctly.
<a
href="https://redirect.github.com/pallets/jinja/issues/2061">#2061</a></li>
<li>The error message from <code>FileSystemLoader</code> includes the
paths that were searched. <a
href="https://redirect.github.com/pallets/jinja/issues/1661">#1661</a></li>
<li><code>PackageLoader</code> shows a clearer error message when the
package does not contain the templates directory. <a
href="https://redirect.github.com/pallets/jinja/issues/1705">#1705</a></li>
<li>Improve annotations for methods returning copies. <a
href="https://redirect.github.com/pallets/jinja/issues/1880">#1880</a></li>
<li><code>urlize</code> does not add <code>mailto:</code> to values like
<code>@a@b</code>. <a
href="https://redirect.github.com/pallets/jinja/issues/1870">#1870</a></li>
<li>Tests decorated with <code>@pass_context</code> can be used with the
<code>|select</code> filter. <a
href="https://redirect.github.com/pallets/jinja/issues/1624">#1624</a></li>
<li>Using <code>set</code> for multiple assignment (<code>a, b = 1,
2</code>) does not fail when the target is a namespace attribute. <a
href="https://redirect.github.com/pallets/jinja/issues/1413">#1413</a></li>
<li>Using <code>set</code> in all branches of <code>{% if %}{% elif %}{%
else %}</code> blocks does not cause the variable to be considered
initially undefined. <a
href="https://redirect.github.com/pallets/jinja/issues/1253">#1253</a></li>
</ul>
<h2>3.1.4</h2>
<p>This is the Jinja 3.1.4 security release, which fixes security issues
and bugs but does not otherwise change behavior and should not result in
breaking changes.</p>
<p>PyPI: <a
href="https://pypi.org/project/Jinja2/3.1.4/">https://pypi.org/project/Jinja2/3.1.4/</a>
Changes: <a
href="https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4">https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4</a></p>
<ul>
<li>The <code>xmlattr</code> filter does not allow keys with
<code>/</code> solidus, <code>></code> greater-than sign, or
<code>=</code> equals sign, in addition to disallowing spaces.
Regardless of any validation done by Jinja, user input should never be
used as keys to this filter, or must be separately validated first.
GHSA-h75v-3vvj-5mfj</li>
</ul>
<h2>3.1.3</h2>
<p>This is a fix release for the 3.1.x feature branch.</p>
<ul>
<li>Fix for <a
href="https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95">GHSA-h5c8-rqwp-cp95</a>.
You are affected if you are using <code>xmlattr</code> and passing user
input as attribute keys.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pallets/jinja/blob/main/CHANGES.rst">jinja2's
changelog</a>.</em></p>
<blockquote>
<h2>Version 3.1.6</h2>
<p>Released 2025-03-05</p>
<ul>
<li>The <code>|attr</code> filter does not bypass the environment's
attribute lookup,
allowing the sandbox to apply its checks.
:ghsa:<code>cpwx-vrp4-4pq7</code></li>
</ul>
<h2>Version 3.1.5</h2>
<p>Released 2024-12-21</p>
<ul>
<li>The sandboxed environment handles indirect calls to
<code>str.format</code>, such as
by passing a stored reference to a filter that calls its argument.
:ghsa:<code>q2x7-8rv6-6q7h</code></li>
<li>Escape template name before formatting it into error messages, to
avoid
issues with names that contain f-string syntax.
:issue:<code>1792</code>, :ghsa:<code>gmj6-6f8f-6699</code></li>
<li>Sandbox does not allow <code>clear</code> and <code>pop</code> on
known mutable sequence
types. :issue:<code>2032</code></li>
<li>Calling sync <code>render</code> for an async template uses
<code>asyncio.run</code>.
:pr:<code>1952</code></li>
<li>Avoid unclosed <code>auto_aiter</code> warnings.
:pr:<code>1960</code></li>
<li>Return an <code>aclose</code>-able <code>AsyncGenerator</code> from
<code>Template.generate_async</code>. :pr:<code>1960</code></li>
<li>Avoid leaving <code>root_render_func()</code> unclosed in
<code>Template.generate_async</code>. :pr:<code>1960</code></li>
<li>Avoid leaving async generators unclosed in blocks, includes and
extends.
:pr:<code>1960</code></li>
<li>The runtime uses the correct <code>concat</code> function for the
current environment
when calling block references. :issue:<code>1701</code></li>
<li>Make <code>|unique</code> async-aware, allowing it to be used after
another
async-aware filter. :issue:<code>1781</code></li>
<li><code>|int</code> filter handles <code>OverflowError</code> from
scientific notation.
:issue:<code>1921</code></li>
<li>Make compiling deterministic for tuple unpacking in a <code>{% set
... %}</code>
call. :issue:<code>2021</code></li>
<li>Fix dunder protocol (<code>copy</code>/<code>pickle</code>/etc)
interaction with <code>Undefined</code>
objects. :issue:<code>2025</code></li>
<li>Fix <code>copy</code>/<code>pickle</code> support for the internal
<code>missing</code> object.
:issue:<code>2027</code></li>
<li><code>Environment.overlay(enable_async)</code> is applied correctly.
:pr:<code>2061</code></li>
<li>The error message from <code>FileSystemLoader</code> includes the
paths that were
searched. :issue:<code>1661</code></li>
<li><code>PackageLoader</code> shows a clearer error message when the
package does not
contain the templates directory. :issue:<code>1705</code></li>
<li>Improve annotations for methods returning copies.
:pr:<code>1880</code></li>
<li><code>urlize</code> does not add <code>mailto:</code> to values like
<code>@a@b</code>. :pr:<code>1870</code></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="15206881c0"><code>1520688</code></a>
release version 3.1.6</li>
<li><a
href="90457bbf33"><code>90457bb</code></a>
Merge commit from fork</li>
<li><a
href="065334d1ee"><code>065334d</code></a>
attr filter uses env.getattr</li>
<li><a
href="033c20015c"><code>033c200</code></a>
start version 3.1.6</li>
<li><a
href="bc68d4efa9"><code>bc68d4e</code></a>
use global contributing guide (<a
href="https://redirect.github.com/pallets/jinja/issues/2070">#2070</a>)</li>
<li><a
href="247de5e0c5"><code>247de5e</code></a>
use global contributing guide</li>
<li><a
href="ab8218c7a1"><code>ab8218c</code></a>
use project advisory link instead of global</li>
<li><a
href="b4ffc8ff29"><code>b4ffc8f</code></a>
release version 3.1.5 (<a
href="https://redirect.github.com/pallets/jinja/issues/2066">#2066</a>)</li>
<li><a
href="877f6e51be"><code>877f6e5</code></a>
release version 3.1.5</li>
<li><a
href="8d58859265"><code>8d58859</code></a>
remove test pypi</li>
<li>Additional commits viewable in <a
href="https://github.com/pallets/jinja/compare/3.1.2...3.1.6">compare
view</a></li>
</ul>
</details>
<br />
Updates `cryptography` from 41.0.7 to 46.0.5
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's
changelog</a>.</em></p>
<blockquote>
<p>46.0.5 - 2026-02-10</p>
<pre><code>
* An attacker could create a malicious public key that reveals portions
of your
private key when using certain uncommon elliptic curves (binary curves).
This version now includes additional security checks to prevent this
attack.
This issue only affects binary elliptic curves, which are rarely used in
real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab
and
Atuin Automated Vulnerability Discovery Engine** for reporting the
issue.
**CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
removed in the next release.
<p>.. v46-0-4:</p>
<p>46.0.4 - 2026-01-27<br />
</code></pre></p>
<ul>
<li><code>Dropped support for win_arm64 wheels</code>_.</li>
<li>Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL
3.5.5.</li>
</ul>
<p>.. _v46-0-3:</p>
<p>46.0.3 - 2025-10-15</p>
<pre><code>
* Fixed compilation when using LibreSSL 4.2.0.
<p>.. _v46-0-2:</p>
<p>46.0.2 - 2025-09-30<br />
</code></pre></p>
<ul>
<li>Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL
3.5.4.</li>
</ul>
<p>.. _v46-0-1:</p>
<p>46.0.1 - 2025-09-16</p>
<pre><code>
* Fixed an issue where users installing via ``pip`` on Python 3.14
development
versions would not properly install a dependency.
* Fixed an issue building the free-threaded macOS 3.14 wheels.
<p>.. _v46-0-0:</p>
<p>46.0.0 - 2025-09-16<br />
</code></pre></p>
<ul>
<li><strong>BACKWARDS INCOMPATIBLE:</strong> Support for Python 3.7 has
been removed.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="06e120e682"><code>06e120e</code></a>
bump version for 46.0.5 release (<a
href="https://redirect.github.com/pyca/cryptography/issues/14289">#14289</a>)</li>
<li><a
href="0eebb9dbb6"><code>0eebb9d</code></a>
EC check key on cofactor > 1 (<a
href="https://redirect.github.com/pyca/cryptography/issues/14287">#14287</a>)</li>
<li><a
href="bedf6e186b"><code>bedf6e1</code></a>
fix openssl version on 46 branch (<a
href="https://redirect.github.com/pyca/cryptography/issues/14220">#14220</a>)</li>
<li><a
href="e6f44fc8e6"><code>e6f44fc</code></a>
bump for 46.0.4 and drop win arm64 due to CI issues (<a
href="https://redirect.github.com/pyca/cryptography/issues/14217">#14217</a>)</li>
<li><a
href="c0af4dd7b7"><code>c0af4dd</code></a>
release 46.0.3 (<a
href="https://redirect.github.com/pyca/cryptography/issues/13681">#13681</a>)</li>
<li><a
href="99efe5ad15"><code>99efe5a</code></a>
bump version for 46.0.2 (<a
href="https://redirect.github.com/pyca/cryptography/issues/13531">#13531</a>)</li>
<li><a
href="e735cfc275"><code>e735cfc</code></a>
release 46.0.1 (<a
href="https://redirect.github.com/pyca/cryptography/issues/13450">#13450</a>)</li>
<li><a
href="4e457ffba4"><code>4e457ff</code></a>
Explicitly specify python in mac uv build invocation (<a
href="https://redirect.github.com/pyca/cryptography/issues/13447">#13447</a>)</li>
<li><a
href="2726efdb6d"><code>2726efd</code></a>
Depend on CFFI 2.0.0 or newer on Python > 3.8 (<a
href="https://redirect.github.com/pyca/cryptography/issues/13448">#13448</a>)</li>
<li><a
href="62230623d1"><code>6223062</code></a>
release 46.0.0 (<a
href="https://redirect.github.com/pyca/cryptography/issues/13446">#13446</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pyca/cryptography/compare/41.0.7...46.0.5">compare
view</a></li>
</ul>
</details>
<br />
Updates `ecdsa` from 0.18.0 to 0.19.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tlsfuzzer/python-ecdsa/releases">ecdsa's
releases</a>.</em></p>
<blockquote>
<h2>ecdsa 0.19.1</h2>
<p>New API:</p>
<ul>
<li><code>der.remove_implicit</code> and
<code>der.encode_implicit</code> for decoding and
encoding DER IMPLICIT values with custom tag values and arbitrary
classes</li>
</ul>
<p>Bug fixes:</p>
<ul>
<li>Minor fixes around arithmetic with curves that have non-prime order
(useful for experimentation, not practical deployments)</li>
<li>Fix arithmetic to work with curves that have (0, 0) on the
curve</li>
<li>Fix canonicalization of signatures when <code>s</code> is just
slightly
above half of curve order</li>
</ul>
<p>Maintenance:</p>
<ul>
<li>Dropped official support for Python 3.5 (again, issues with CI,
support
for Python 2.6 and Python 2.7 is unchanged)</li>
<li>Officially support Python 3.12 and 3.13 (add them to CI)</li>
<li>Removal of few more unnecessary <code>six.b</code> literals
(Alexandre Detiste)</li>
<li>Fix typos in warning messages</li>
</ul>
<h2>ecdsa 0.19.0</h2>
<h2>New API:</h2>
<ul>
<li><code>to_ssh</code> in <code>VerifyingKey</code> and
<code>SigningKey</code>, supports Ed25519 keys only
(Pablo Mazzini)</li>
</ul>
<h2>New features:</h2>
<ul>
<li>Support for twisted Brainpool curves</li>
</ul>
<h2>Doc fix:</h2>
<ul>
<li>Fix curve equation in glossary</li>
<li>Documentation for signature encoding and signature decoding
functions</li>
</ul>
<h2>Maintenance:</h2>
<ul>
<li>Dropped official support for 3.3 and 3.4 (because of problems
running them
in CI, not because it's actually incompatible; support for 2.6 and 2.7
is
unaffected)</li>
<li>Fixes around hypothesis parameters</li>
<li>Officially support Python 3.11 and 3.12</li>
<li>Small updates to test suite to make it work with 3.11 and 3.12 and
new
releases of test dependencies</li>
<li>Dropped the internal <code>_rwlock</code> module as it's unused</li>
<li>Added mutation testing to CI, lots of speed-ups to the test suite
to make it happen</li>
<li>Removal of unnecessary <code>six.b</code> literals (Alexandre
Detiste)</li>
</ul>
<p>Deprecations:</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tlsfuzzer/python-ecdsa/blob/master/NEWS">ecdsa's
changelog</a>.</em></p>
<blockquote>
<ul>
<li>Release 0.19.1 (13 Mar 2025)</li>
</ul>
<p>New API:</p>
<ul>
<li><code>der.remove_implitic</code> and
<code>der.encode_implicit</code> for decoding and
encoding DER IMPLICIT values with custom tag values and arbitrary
classes</li>
</ul>
<p>Bug fixes:</p>
<ul>
<li>Minor fixes around arithmetic with curves that have non-prime order
(useful for experimentation, not practical deployments)</li>
<li>Fix arithmetic to work with curves that have (0, 0) on the
curve</li>
<li>Fix canonicalization of signatures when <code>s</code> is just
slightly
above half of curve order</li>
</ul>
<p>Maintenance:</p>
<ul>
<li>
<p>Dropped official support for Python 3.5 (again, issues with CI,
support
for Python 2.6 and Python 2.7 is unchanged)</p>
</li>
<li>
<p>Officialy support Python 3.12 and 3.13 (add them to CI)</p>
</li>
<li>
<p>Removal of few more unnecessary <code>six.b</code> literals
(Alexandre Detiste)</p>
</li>
<li>
<p>Fix typos in warning messages</p>
</li>
<li>
<p>Release 0.19.0 (08 Apr 2024)</p>
</li>
</ul>
<p>New API:</p>
<ul>
<li><code>to_ssh</code> in <code>VerifyingKey</code> and
<code>SigningKey</code>, supports Ed25519 keys only
(Pablo Mazzini)</li>
</ul>
<p>New features:</p>
<ul>
<li>Support for twisted Brainpool curves</li>
</ul>
<p>Doc fix:</p>
<ul>
<li>Fix curve equation in glossary</li>
<li>Documentation for signature encoding and signature decoding
functions</li>
</ul>
<p>Maintenance:</p>
<ul>
<li>Dropped official support for 3.3 and 3.4 (because of problems
running them
in CI, not because it's actually incompatible; support for 2.6 and 2.7
is
unaffected)</li>
<li>Fixes aroung hypothesis parameters</li>
<li>Officially support Python 3.11 and 3.12</li>
<li>Small updates to test suite to make it work with 3.11 and 3.12 and
new
releases of test dependencies</li>
<li>Dropped the internal <code>_rwlock</code> module as it's unused</li>
<li>Added mutation testing to CI, lots of speed-ups to the test suite
to make it happen</li>
<li>Removal of unnecessary <code>six.b</code> literals (Alexandre
Detiste)</li>
</ul>
<p>Deprecations:</p>
<ul>
<li><code>int_to_string</code>, <code>string_to_int</code>, and
<code>digest_integer</code> from <code>ecdsa.ecdsa</code></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2a6593d840"><code>2a6593d</code></a>
Merge pull request <a
href="https://redirect.github.com/tlsfuzzer/python-ecdsa/issues/359">#359</a>
from tlsfuzzer/release-0.19.1</li>
<li><a
href="658ddc81bb"><code>658ddc8</code></a>
add release notes for 0.19.1 release</li>
<li><a
href="3c5df06ae8"><code>3c5df06</code></a>
Merge pull request <a
href="https://redirect.github.com/tlsfuzzer/python-ecdsa/issues/358">#358</a>
from tlsfuzzer/high-s-values</li>
<li><a
href="b6d43c60e3"><code>b6d43c6</code></a>
use integer division for canonicalization of signatures</li>
<li><a
href="aa81ba3b73"><code>aa81ba3</code></a>
Merge pull request <a
href="https://redirect.github.com/tlsfuzzer/python-ecdsa/issues/357">#357</a>
from tlsfuzzer/new-badge</li>
<li><a
href="ef75fea937"><code>ef75fea</code></a>
use the new badge URL for the build status</li>
<li><a
href="10d74353c4"><code>10d7435</code></a>
Merge pull request <a
href="https://redirect.github.com/tlsfuzzer/python-ecdsa/issues/356">#356</a>
from tlsfuzzer/implicit-tags</li>
<li><a
href="dba9f80962"><code>dba9f80</code></a>
add support for encoding</li>
<li><a
href="8e3f653e66"><code>8e3f653</code></a>
add support for parsing implicit DER tags</li>
<li><a
href="55d2b569d4"><code>55d2b56</code></a>
Merge pull request <a
href="https://redirect.github.com/tlsfuzzer/python-ecdsa/issues/355">#355</a>
from tlsfuzzer/doc-update</li>
<li>Additional commits viewable in <a
href="https://github.com/tlsfuzzer/python-ecdsa/compare/python-ecdsa-0.18.0...python-ecdsa-0.19.1">compare
view</a></li>
</ul>
</details>
<br />
Updates `sentry-sdk` from 1.39.1 to 1.45.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/releases">sentry-sdk's
releases</a>.</em></p>
<blockquote>
<h2>1.45.1</h2>
<p><strong>This is a security backport release.</strong></p>
<ul>
<li>
<p>Don't send full env to subprocess (892dd800) by <a
href="https://github.com/kmichel-aiven"><code>@kmichel-aiven</code></a></p>
<p>See also <a
href="https://github.com/getsentry/sentry-python/security/advisories/GHSA-g92j-qhmh-64v2">https://github.com/getsentry/sentry-python/security/advisories/GHSA-g92j-qhmh-64v2</a></p>
</li>
</ul>
<h2>1.45.0</h2>
<p>This is the final 1.x release for the forseeable future. Development
will continue on the 2.x release line. The first 2.x version will be
available in the next few weeks.</p>
<h3>Various fixes & improvements</h3>
<ul>
<li>
<p>Allow to upsert monitors (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/2929">#2929</a>)
by <a
href="https://github.com/sentrivana"><code>@sentrivana</code></a></p>
<p>It's now possible to provide <code>monitor_config</code> to the
<code>monitor</code> decorator/context manager directly:</p>
<pre lang="python"><code>from sentry_sdk.crons import monitor
<h1>All keys except <code>schedule</code> are optional</h1>
<p>monitor_config = {<br />
"schedule": {"type": "crontab",
"value": "0 0 * * *"},<br />
"timezone": "Europe/Vienna",<br />
"checkin_margin": 10,<br />
"max_runtime": 10,<br />
"failure_issue_threshold": 5,<br />
"recovery_threshold": 5,<br />
}</p>
<p><a
href="https://github.com/monitor"><code>@monitor</code></a>(monitor_slug='<monitor-slug>',
monitor_config=monitor_config)<br />
def tell_the_world():<br />
print('My scheduled task...')<br />
</code></pre></p>
<p>Check out <a
href="https://docs.sentry.io/platforms/python/crons/">the cron docs</a>
for details.</p>
</li>
<li>
<p>Add Django <code>signals_denylist</code> to filter signals that are
attached to by <code>signals_spans</code> (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/2758">#2758</a>)
by <a href="https://github.com/lieryan"><code>@lieryan</code></a></p>
<p>If you want to exclude some Django signals from performance tracking,
you can use the new <code>signals_denylist</code> Django option:</p>
<pre lang="python"><code>import django.db.models.signals
import sentry_sdk
<p>sentry_sdk.init(<br />
...<br />
integrations=[<br />
DjangoIntegration(<br />
...<br />
signals_denylist=[<br />
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-python/blob/1.45.1/CHANGELOG.md">sentry-sdk's
changelog</a>.</em></p>
<blockquote>
<h2>1.45.1</h2>
<p><strong>This is a security backport release.</strong></p>
<ul>
<li>
<p>Don't send full env to subprocess (892dd800) by <a
href="https://github.com/kmichel-aiven"><code>@kmichel-aiven</code></a></p>
<p>See also <a
href="https://github.com/getsentry/sentry-python/security/advisories/GHSA-g92j-qhmh-64v2">https://github.com/getsentry/sentry-python/security/advisories/GHSA-g92j-qhmh-64v2</a></p>
</li>
</ul>
<h2>1.45.0</h2>
<p>This is the final 1.x release for the forseeable future. Development
will continue on the 2.x release line. The first 2.x version will be
available in the next few weeks.</p>
<h3>Various fixes & improvements</h3>
<ul>
<li>
<p>Allow to upsert monitors (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/2929">#2929</a>)
by <a
href="https://github.com/sentrivana"><code>@sentrivana</code></a></p>
<p>It's now possible to provide <code>monitor_config</code> to the
<code>monitor</code> decorator/context manager directly:</p>
<pre lang="python"><code>from sentry_sdk.crons import monitor
<h1>All keys except <code>schedule</code> are optional</h1>
<p>monitor_config = {<br />
"schedule": {"type": "crontab",
"value": "0 0 * * *"},<br />
"timezone": "Europe/Vienna",<br />
"checkin_margin": 10,<br />
"max_runtime": 10,<br />
"failure_issue_threshold": 5,<br />
"recovery_threshold": 5,<br />
}</p>
<p><a
href="https://github.com/monitor"><code>@monitor</code></a>(monitor_slug='<monitor-slug>',
monitor_config=monitor_config)<br />
def tell_the_world():<br />
print('My scheduled task...')<br />
</code></pre></p>
<p>Check out <a
href="https://docs.sentry.io/platforms/python/crons/">the cron docs</a>
for details.</p>
</li>
<li>
<p>Add Django <code>signals_denylist</code> to filter signals that are
attached to by <code>signals_spans</code> (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/2758">#2758</a>)
by <a href="https://github.com/lieryan"><code>@lieryan</code></a></p>
<p>If you want to exclude some Django signals from performance tracking,
you can use the new <code>signals_denylist</code> Django option:</p>
<pre lang="python"><code>import django.db.models.signals
import sentry_sdk
<p>sentry_sdk.init(<br />
...<br />
integrations=[<br />
DjangoIntegration(<br />
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="282b8f7fae"><code>282b8f7</code></a>
Update CHANGELOG.md</li>
<li><a
href="6c867c45e8"><code>6c867c4</code></a>
release: 1.45.1</li>
<li><a
href="388e68e573"><code>388e68e</code></a>
Fix tests (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/3341">#3341</a>)</li>
<li><a
href="dfcab26957"><code>dfcab26</code></a>
Run integrations tests on 1.x</li>
<li><a
href="2812640f06"><code>2812640</code></a>
Run CI on 1.x branch</li>
<li><a
href="892dd800cc"><code>892dd80</code></a>
fix(integrations): don't send full env to subprocess</li>
<li><a
href="51a906c1b7"><code>51a906c</code></a>
Update CHANGELOG.md</li>
<li><a
href="7570e39ae3"><code>7570e39</code></a>
release: 1.45.0</li>
<li><a
href="e22abb636f"><code>e22abb6</code></a>
fix(metrics): Change <code>data_category</code> from <code>statsd</code>
to <code>metric_bucket</code> (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/2954">#2954</a>)</li>
<li><a
href="fab65e6574"><code>fab65e6</code></a>
feat(metrics): New normalization of keys, values, units (<a
href="https://redirect.github.com/getsentry/sentry-python/issues/2946">#2946</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-python/compare/1.39.1...1.45.1">compare
view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/blackboxprogramming/BlackRoad-Operating-System/network/alerts).
</details>
BlackRoad Agent - alice
