Bump the all group across 1 directory with 7 updates

[dependabot]

Bumps the all group with 7 updates in the / directory:

Package	From	To
pydantic	2.13.3	2.13.4
wtforms	3.2.1	3.2.2
nonecorn	0.17.3	0.18.0
python-multipart	0.0.26	0.0.28
idna	3.13	3.15
propcache	0.4.1	0.5.2
pydantic-core	2.46.3	2.46.4

Updates pydantic from 2.13.3 to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

Commits

• cf67d4b Fix linting
• f0d8a21 Prepare release v2.13.4
• 5e3fe1d Check for pydantic tag pattern in CI
• 7f9edcc Document tagging conventions
• b46a0c9 Adapt pydantic-core linker flags on macOS
• 50629c8 Update to PyPy 7.3.22
• 8522ebb Preserve RootModel core metadata
• a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
• 909259a Remove Logfire example in documentation
• 2c4174c Bump libc from 0.2.155 to 0.2.185
• See full diff in compare view

Updates wtforms from 3.2.1 to 3.2.2

Release notes

Sourced from wtforms's releases.

3.2.2

What's Changed

• remove slsa provenance by @​davidism in pallets-eco/wtforms#879
• fix(validators): Disabled validation with provided formdata by @​subnix in pallets-eco/wtforms#880
• Support Python versions from 3.10 to 3.14 by @​azmeuk in pallets-eco/wtforms#883
• Update FAQ to reflect 3.10+ support by @​kurtmckee in pallets-eco/wtforms#884
• GHA improvements by @​azmeuk in pallets-eco/wtforms#888

New Contributors

• @​subnix made their first contribution in pallets-eco/wtforms#880
• @​kurtmckee made their first contribution in pallets-eco/wtforms#884

Full Changelog: pallets-eco/wtforms@3.2.1...3.2.2

Changelog

Sourced from wtforms's changelog.

Version 3.2.2

Released 2026-05-03

• Fix :class:~validators.Disabled validation with provided formdata. :pr:880
• End support for Python 3.9, start support for Python 3.14. :pr:883
• Add Tamil and Serbian translations.

Commits

• ea57c11 chore: bump to 3.2.2
• 326dd44 chore: pre-commit update
• 414e41c doc: translation instructions and changelog
• 383cd0c Added translation using Weblate (Serbian)
• 40d5718 fix: readthedocs build
• 83a4412 chore: allow downstream tests to raise warnings
• 409edac Merge pull request #888 from azmeuk/gha-downstream
• 69b2e67 chore: pyproject and GHA cleaning
• 0117d4a chore: add GHA downstream tests
• e6b503c Merge pull request #884 from kurtmckee/rm-py39-refs
• Additional commits viewable in compare view

Updates nonecorn from 0.17.3 to 0.18.0

Changelog

Sourced from nonecorn's changelog.

0.18.0 2025-11-08

• Add a config and command line argument to daemonise the workers
• Reload workers on SIGHUP.
• Bugfix correct the dispatcher middleware root path and path.
• Bugfix set end_stream when sending trailers.
• Bugfix connection asgi-state isolation.
• Bugfix Remove streams on StreamClosed for h3.
• Bugfix delay sending http headers when serving WSGI apps.
• Drop Python 3.8, 3.9 and support 3.13, 3.14

Commits

• 0e2311f Bump and release 0.18.0
• e303b46 Switch to my composite actions and add Zizmor
• fcc93c8 Reload workers on SIGHUP
• fbcc9c3 Add a config and command line argument to daemonise the workers
• ed6cd40 Minor tweaks to recent commits
• 3a01656 Improve the trio typing
• d3786eb Delay sending http headers
• 7bdaebf h3: Remove streams on StreamClosed
• cd992f8 fix connection state leak
• 50057c4 set end_stream when sending trailers
• Additional commits viewable in compare view

Updates python-multipart from 0.0.26 to 0.0.28

Release notes

Sourced from python-multipart's releases.

Version 0.0.28

What's Changed

• Speed up partial-boundary tail scan via bytes.find by @​Kludex in Kludex/python-multipart#281
• Cap multipart boundary length at 256 bytes by @​Kludex in Kludex/python-multipart#282

Full Changelog: Kludex/python-multipart@0.0.27...0.0.28

Version 0.0.27

What's Changed

• Pass parse offsets via constructors by @​Kludex in Kludex/python-multipart#268
• Add multipart header limits by @​Kludex in Kludex/python-multipart#267

Full Changelog: Kludex/python-multipart@0.0.26...0.0.27

Changelog

Sourced from python-multipart's changelog.

0.0.28 (2026-05-10)

• Speed up partial-boundary tail scan via bytes.find #281.
• Cap multipart boundary length at 256 bytes #282.

0.0.27 (2026-04-27)

• Add multipart header limits #267.
• Pass parse offsets via constructors #268.

Commits

• 7d8d28b Version 0.0.28 (#284)
• b0dd125 Cap multipart boundary length at 256 bytes (#282)
• d1b5739 Speed up partial-boundary tail scan via bytes.find (#281)
• 09cb8c3 Make the long_boundary benchmark dominated by the patched code path (#280)
• a6467c9 Revert "Switch CodSpeed benchmarks to walltime mode" (#279)
• 9a96900 Switch CodSpeed benchmarks to walltime mode (#278)
• 1fc7a62 Make benchmark coverage trigger the partial-boundary fallback (#277)
• 03df045 Add CodSpeed benchmark suite for parser hot paths (#276)
• 79a7c61 Bump the python-packages group with 3 updates (#273)
• bd29332 Bump the github-actions group with 5 updates (#274)
• Additional commits viewable in compare view

Updates idna from 3.13 to 3.15

Changelog

Sourced from idna's changelog.

3.15 (2026-05-12)

• Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.
• Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.
• Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.
• Allow flit_core 4.x in the build backend.
• Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.
• Add Dependabot configuration for GitHub Actions.
• Convert README and HISTORY from reStructuredText to Markdown.
• Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

• Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

Commits

• af30a09 Release 3.15
• 30314d4 Pre-release 3.15rc0
• 05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown
• 2987fdb Convert README and HISTORY from reStructuredText to Markdown
• 59fa800 Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333ea
• def6983 Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea
• bbd8004 Merge pull request #234 from StanFromIreland/patch-1
• edd07c0 Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group
• 5557db0 Merge branch 'master' into patch-1
• f11746c Merge pull request #235 from StanFromIreland/patch-2
• Additional commits viewable in compare view

Updates propcache from 0.4.1 to 0.5.2

Release notes

Sourced from propcache's releases.

0.5.2

0.5.0 and 0.5.1 were tagged earlier today but never reached PyPI: 0.5.0's deploy failed at cibuildwheel's post-build pytest on free-threaded armv7l musllinux (SIGBUS under QEMU emulation while importing the C extension), and 0.5.1's deploy hit a transient sigstore Rekor 502 during the attestation step. 0.5.2 is the first of the three to actually publish.

Features

• Added support for newer type hints and remove Optional and Union from all annotations -- by :user:Vizonex

  Related issues and pull requests on GitHub: #193.

Removals and backward incompatible breaking changes

• Dropped support for Python 3.9 as it has reached end of life.

  Related issues and pull requests on GitHub: #216.

Packaging updates and notes for downstreams

• Changed the Cython build dependency from ~= 3.1.0 to >= 3.2.0, removing the upper version bound to avoid conflicts for downstream packagers -- by :user:jameshilliard and :user:gundalow.

  The upstream Cython version is pinned to 3.2.4 in the CI/CD environment.

  Related issues and pull requests on GitHub: #184, #188, #214.

• Start building and shipping riscv64 wheels -- by :user:justeph.

  Related issues and pull requests on GitHub: #194.

• The :pep:517 build backend now supports a new build-inplace config setting (and PROPCACHE_BUILD_INPLACE environment variable) for controlling whether to build the project in-tree or in a temporary directory. It only affects wheels and is set up to build in a temporary directory by default. It does not affect editable wheel builds; they will keep being built in-tree regardless.

  Here's an example of using this setting:

  .. code-block:: console

... (truncated)

Changelog

Sourced from propcache's changelog.

0.5.2

(2026-05-08)

No significant changes.

---

0.5.1

(2026-05-08)

No significant changes.

---

0.5.0

(2026-05-08)

Features

• Added support for newer type hints and remove Optional and Union from all annotations -- by :user:Vizonex

  Related issues and pull requests on GitHub: :issue:193.

Removals and backward incompatible breaking changes

• Dropped support for Python 3.9 as it has reached end of life.

  Related issues and pull requests on GitHub: :issue:216.

Packaging updates and notes for downstreams

... (truncated)

Commits

• 041f7af Release 0.5.2 (#222)
• 9c374aa Release 0.5.1 (#221)
• c4e2b78 Skip cibuildwheel test on free threaded armv7l musllinux (#220)
• e60bded Release 0.5.0 (#219)
• b88f846 Make wheel builds reproducible (#218)
• fdacd6c Update Typehint annotations (#193)
• 483e9d3 [pre-commit.ci] pre-commit autoupdate (#204)
• d0d45e1 Drop Python 3.9 support (#216)
• c0bacf5 Update pytest-cov requirement from >=2.3.1 to >=7.1.0 (#210)
• 9bfb3e4 Bump pytest-codspeed from 4.3.0 to 4.5.0 (#211)
• Additional commits viewable in compare view

Updates pydantic-core from 2.46.3 to 2.46.4

Commits

• cf67d4b Fix linting
• f0d8a21 Prepare release v2.13.4
• 5e3fe1d Check for pydantic tag pattern in CI
• 7f9edcc Document tagging conventions
• b46a0c9 Adapt pydantic-core linker flags on macOS
• 50629c8 Update to PyPy 7.3.22
• 8522ebb Preserve RootModel core metadata
• a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
• 909259a Remove Logfire example in documentation
• 2c4174c Bump libc from 0.2.155 to 0.2.185
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.