From b62df19ea242710224806945583298ce607809a5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 25 Sep 2026 11:15:33 +0000 Subject: [PATCH 1/2] Bump platformdirs from 4.11.11 to 4.11.12 (#13817) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.11 to 4.11.12.
Release notes

Sourced from platformdirs's releases.

4.11.12

What's Changed

New Contributors

Full Changelog: https://github.com/tox-dev/platformdirs/compare/4.11.11...4.11.12

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start


4.11.13 (2026-09-25)



4.11.12 (2026-09-22)



4.11.11 (2026-09-19)



4.11.10 (2026-09-18)



4.11.9 (2026-09-16)


... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=platformdirs&package-manager=pip&previous-version=4.11.11&new-version=4.11.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index b7eac45bb2b..41d6edfc626 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -168,7 +168,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.11 +platformdirs==4.11.12 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 69636ebd834..523968d9984 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -165,7 +165,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.11 +platformdirs==4.11.12 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index 5e0051c3a14..cea58ada437 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -86,7 +86,7 @@ packaging==26.3 # via pytest pathspec==1.1.1 # via mypy -platformdirs==4.11.11 +platformdirs==4.11.12 # via virtualenv pluggy==1.6.0 # via pytest From 1133ceb762e67f27d6b64f0c541e01c53a60760b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 25 Sep 2026 11:17:28 +0000 Subject: [PATCH 2/2] Bump multidict from 6.9.0 to 6.9.1 (#13818) Bumps [multidict](https://github.com/aio-libs/multidict) from 6.9.0 to 6.9.1.
Release notes

Sourced from multidict's releases.

6.9.1

Bug fixes

  • Fixed the C extension reading freed memory on free-threaded builds when a list handed to :py:meth:~multidict.MultiDict.update, :py:meth:~multidict.MultiDict.extend, :py:meth:~multidict.MultiDict.merge or the :py:class:~multidict.MultiDict and :py:class:~multidict.CIMultiDict constructors, a [key, value] item inside any iterable handed to them, or a list tested with in against :py:meth:~multidict.MultiDict.items, is changed by another thread; a call that catches the list shrinking under it now raises :py:exc:RuntimeError -- by :user:rodrigobnogueira.

    Related issues and pull requests on GitHub: #1437.

  • Fixed a data race on the free-threaded build where a retired hash table's reader count used relaxed atomics, letting a lock-free get()/getone()/ __getitem__() read race a concurrent free of that table. The reader-exit decrement and the drain's free check now use release/acquire ordering instead -- by :user:asvetlov.

    Related issues and pull requests on GitHub: #1481.

  • Fixed a free-threaded build bug where two threads calling update(), merge(), or __setitem__() on the same key at the same time could lose the key entirely instead of just racing on which value wins. A decref of the replaced value could transiently suspend the writer's critical section, letting a second writer for the same key observe the first writer's in-progress entry as absent and, once both settled, mistake it for a stale duplicate and delete it. Every such decref is now deferred until the writer has released its critical section, so the window can no longer open. setdefault() had an unrelated instance of the same blind spot (it could insert a duplicate rather than recognizing an in-flight key), fixed alongside it -- by :user:asvetlov.

    Related issues and pull requests on GitHub: #1483.

  • Fixed a free-threaded build bug where getall() and the items()/ keys()/values() equality path could raise KeyError or report a present, never-deleted key as missing. A concurrent update()/extend()/ __setitem__() call can have its critical section transiently suspended (a decref triggering a blocking allocator call) while an entry is marked as part of its own bookkeeping; a reader landing in that window used to treat the mark as "not found" instead of "still there, in flight" -- by :user:asvetlov.

    Related issues and pull requests on GitHub:

... (truncated)

Changelog

Sourced from multidict's changelog.

6.9.1

(2026-09-21)

Bug fixes

  • Fixed the C extension reading freed memory on free-threaded builds when a list handed to :py:meth:~multidict.MultiDict.update, :py:meth:~multidict.MultiDict.extend, :py:meth:~multidict.MultiDict.merge or the :py:class:~multidict.MultiDict and :py:class:~multidict.CIMultiDict constructors, a [key, value] item inside any iterable handed to them, or a list tested with in against :py:meth:~multidict.MultiDict.items, is changed by another thread; a call that catches the list shrinking under it now raises :py:exc:RuntimeError -- by :user:rodrigobnogueira.

    Related issues and pull requests on GitHub: :issue:1437.

  • Fixed a data race on the free-threaded build where a retired hash table's reader count used relaxed atomics, letting a lock-free get()/getone()/ __getitem__() read race a concurrent free of that table. The reader-exit decrement and the drain's free check now use release/acquire ordering instead -- by :user:asvetlov.

    Related issues and pull requests on GitHub: :issue:1481.

  • Fixed a free-threaded build bug where two threads calling update(), merge(), or __setitem__() on the same key at the same time could lose the key entirely instead of just racing on which value wins. A decref of the replaced value could transiently suspend the writer's critical section, letting a second writer for the same key observe the first writer's in-progress entry as absent and, once both settled, mistake it for a stale duplicate and delete it. Every such decref is now deferred until the writer has released its critical section, so the window can no longer open. setdefault() had an unrelated instance of the same blind spot (it could insert a duplicate rather than recognizing an in-flight key), fixed alongside it -- by :user:asvetlov.

    Related issues and pull requests on GitHub: :issue:1483.

  • Fixed a free-threaded build bug where getall() and the items()/ keys()/values() equality path could raise KeyError or report a present, never-deleted key as missing. A concurrent update()/extend()/ __setitem__() call can have its critical section transiently suspended (a decref triggering a blocking allocator call) while an entry is marked as

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=multidict&package-manager=pip&previous-version=6.9.0&new-version=6.9.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/base-ft.txt | 2 +- requirements/base.txt | 2 +- requirements/constraints.txt | 2 +- requirements/cython.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/multidict.txt | 2 +- requirements/runtime-deps.txt | 2 +- requirements/test-common-base.txt | 2 +- requirements/test-common.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test-mobile.txt | 2 +- requirements/test.txt | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt index 276c5e5f940..ac3a23f6eaf 100644 --- a/requirements/base-ft.txt +++ b/requirements/base-ft.txt @@ -30,7 +30,7 @@ gunicorn==26.2.0 # via -r requirements/base-ft.in idna==3.20 # via yarl -multidict==6.9.0 +multidict==6.9.1 # via # -r requirements/runtime-deps.in # yarl diff --git a/requirements/base.txt b/requirements/base.txt index a939804c3ae..41ce0f59a0b 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -30,7 +30,7 @@ gunicorn==26.2.0 # via -r requirements/base.in idna==3.20 # via yarl -multidict==6.9.0 +multidict==6.9.1 # via # -r requirements/runtime-deps.in # yarl diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 41d6edfc626..8dfe975c2e2 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -138,7 +138,7 @@ mdit-py-plugins==0.6.1 # via myst-parser mdurl==0.1.2 # via markdown-it-py -multidict==6.9.0 +multidict==6.9.1 # via # -r requirements/multidict.in # -r requirements/runtime-deps.in diff --git a/requirements/cython.txt b/requirements/cython.txt index feccea82a59..edffaac9ebf 100644 --- a/requirements/cython.txt +++ b/requirements/cython.txt @@ -6,7 +6,7 @@ # cython==3.3.0 # via -r requirements/cython.in -multidict==6.9.0 +multidict==6.9.1 # via -r requirements/multidict.in typing-extensions==4.16.0 # via multidict diff --git a/requirements/dev.txt b/requirements/dev.txt index 523968d9984..74456608e4b 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -136,7 +136,7 @@ mdit-py-plugins==0.6.1 # via myst-parser mdurl==0.1.2 # via markdown-it-py -multidict==6.9.0 +multidict==6.9.1 # via # -r requirements/runtime-deps.in # aiohttp diff --git a/requirements/lint.txt b/requirements/lint.txt index cea58ada437..d6b73071913 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -72,7 +72,7 @@ markdown-it-py==4.2.0 # via rich mdurl==0.1.2 # via markdown-it-py -multidict==6.9.0 +multidict==6.9.1 # via # aiohttp # yarl diff --git a/requirements/multidict.txt b/requirements/multidict.txt index 56dd76f5f3e..458cd971bbd 100644 --- a/requirements/multidict.txt +++ b/requirements/multidict.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/multidict.txt --resolver=backtracking --strip-extras requirements/multidict.in # -multidict==6.9.0 +multidict==6.9.1 # via -r requirements/multidict.in typing-extensions==4.16.0 # via multidict diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt index 719c81111f8..09a7139ea13 100644 --- a/requirements/runtime-deps.txt +++ b/requirements/runtime-deps.txt @@ -28,7 +28,7 @@ frozenlist==1.8.0 # aiosignal idna==3.20 # via yarl -multidict==6.9.0 +multidict==6.9.1 # via # -r requirements/runtime-deps.in # yarl diff --git a/requirements/test-common-base.txt b/requirements/test-common-base.txt index f0c3fc8704f..895d771ae8c 100644 --- a/requirements/test-common-base.txt +++ b/requirements/test-common-base.txt @@ -28,7 +28,7 @@ idna==3.20 # via yarl iniconfig==2.3.0 # via pytest -multidict==6.9.0 +multidict==6.9.1 # via # aiohttp # yarl diff --git a/requirements/test-common.txt b/requirements/test-common.txt index 7002471632d..c88c4bc4c60 100644 --- a/requirements/test-common.txt +++ b/requirements/test-common.txt @@ -54,7 +54,7 @@ markdown-it-py==4.2.0 # via rich mdurl==0.1.2 # via markdown-it-py -multidict==6.9.0 +multidict==6.9.1 # via # aiohttp # yarl diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index 3675bc4e6b3..1f47cc63304 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -75,7 +75,7 @@ markdown-it-py==4.2.0 # via rich mdurl==0.1.2 # via markdown-it-py -multidict==6.9.0 +multidict==6.9.1 # via # -r requirements/runtime-deps.in # aiohttp diff --git a/requirements/test-mobile.txt b/requirements/test-mobile.txt index 5ae9b21b677..d0b26da46f0 100644 --- a/requirements/test-mobile.txt +++ b/requirements/test-mobile.txt @@ -55,7 +55,7 @@ idna==3.20 # via yarl iniconfig==2.3.0 # via pytest -multidict==6.9.0 +multidict==6.9.1 # via # -r requirements/runtime-deps.in # aiohttp diff --git a/requirements/test.txt b/requirements/test.txt index 51d755b8aed..ba602c82cf2 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -75,7 +75,7 @@ markdown-it-py==4.2.0 # via rich mdurl==0.1.2 # via markdown-it-py -multidict==6.9.0 +multidict==6.9.1 # via # -r requirements/runtime-deps.in # aiohttp