build(deps): bump the dependencies group across 3 directories with 23 updates

[dependabot]

Bumps the dependencies group with 3 updates in the /bazel directory: docutils, markdown and packaging.
Bumps the dependencies group with 3 updates in the /ci directory: envoy-code-check, pyjwt and uvloop.
Bumps the dependencies group with 20 updates in the /py/deps directory:

Package	From	To
packaging	26.2	26.3
pyjwt	2.13.0	2.15.1
uvloop	0.22.1	0.23.0
aiohttp	3.14.3	3.14.4
envoy-base-utils	0.6.10	0.6.12
flake8	7.3.0	7.4.1
gidgethub	5.4.0	6.0.0
mypy	2.3.0	2.4.0
orjson	3.11.9	3.12.0
packaging	26.2	26.3
protobuf	7.35.1	7.36.2
pygments	2.20.0	2.21.0
pyjwt	2.13.0	2.15.1
python-gnupg	0.5.6	0.5.7
sphinx	8.2.3	9.1.0
sphinxcontrib-httpdomain	2.0.0	2.1.0
types-docutils	0.21.0.20250715	0.23.0.20260923
types-protobuf	7.34.1.20260518	7.35.1.20260906
types-pygments	2.20.0.20260518	2.21.0.20260819
types-pyyaml	6.0.12.20260518	6.0.12.20260906
urllib3	2.7.0	2.8.0
uvloop	0.22.1	0.23.0
setuptools	83.0.0	84.0.0

Updates docutils from 0.22.4 to 0.23

Commits

• See full diff in compare view

Updates markdown from 3.10.2 to 3.11

Release notes

Sourced from markdown's releases.

Release 3.11.0

Changed

• Inline processors now resume searching after the previous match, improving performance for repeated inline patterns (#1619).
• Officially support Python 3.15 and drop support for Python 3.10
• Walk backtick runs in BacktickInlineProcessor without a regex (#1620).
• Switch static site generator for documentation from MkDocs to Zensical (#1627, #1635, #1637, and #1638).

Fixed

• Ensure removing Abbreviations does not raise an error (#1634).
• Fix an issue with excessive backtracking when matching inline code blocks (#1617).
• md_in_html now honors tags added to Markdown.block_level_elements after the extension is loaded (#1246).
• Fix quadratic-time regex backtracking in ReferenceProcessor when a link reference definition has no URL, e.g. a line consisting only of [id]: followed by many trailing spaces (#798).
• Document attr_list usage for def_list (#1123).

Release 3.10.3

Fixed

• Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
• Add AI Policy to Contributing Guide.
• Officially document all included extensions as being in maintenance mode.
• Link the Extension API documentation to the API Reference (#1612).

Changelog

Sourced from markdown's changelog.

---

title: Changelog toc_depth: 2

Python-Markdown Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to the Python Version Specification. See the Contributing Guide for details.

[Unreleased]

• Update serializer to be non-recursive (#1644).
• Improve ancestor handling in the inline Treeprocessor (#1646).
• Keep a raw HTML comment inside an inline HTML element that closes in the same paragraph, instead of splitting the paragraph around it (#1643).
• Fix issue where inline HTML attributes were rejected if they had < or > in the attribute (#1647).
• Fix issue where an unterminated end tag (</foo) could cause all remaining content to be dropped (#1651).

[3.11.0] - 2026-09-25

Changed

• Inline processors now resume searching after the previous match, improving performance for repeated inline patterns (#1619).
• Officially support Python 3.15 and drop support for Python 3.10
• Walk backtick runs in BacktickInlineProcessor without a regex (#1620).
• Switch static site generator for documentation from MkDocs to Zensical (#1627, #1635, #1637, and #1638).

Fixed

• Ensure removing Abbreviations does not raise an error (#1634).
• Fix an issue with excessive backtracking when matching inline code blocks (#1617).
• md_in_html now honors tags added to Markdown.block_level_elements after the extension is loaded (#1246).
• Fix quadratic-time regex backtracking in ReferenceProcessor when a link reference definition has no URL, e.g. a line consisting only of [id]: followed by many trailing spaces (#798).
• Document attr_list usage for def_list (#1123).

[3.10.3] - 2026-07-30

Fixed

• Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).

... (truncated)

Commits

• 0ffbf00 Bump version to 3.11.0
• 547a934 Show adminitions as rendered examples in contrbuting guide
• 571f050 Cleanup archived changelog
• a5176b0 Ensure py-render codeblock title in properly escaped.
• 819fff9 Document the use of attr_list with def_list.
• 36cdbd3 Final cleanup for Zensical transition
• 8a96db5 Add py-render custom code block formater
• 5d1363c Fix quadratic-time backtracking when a reference link has no URL
• 0d6afd1 Add Markdown renderer as superfences formatter
• 175fb5a Ensure removing Abbreviations does not raise an error.
• Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates docutils from 0.22.4 to 0.23

Commits

• See full diff in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates envoy-code-check from 0.6.7 to 0.6.9

Commits

• See full diff in compare view

Updates pyjwt from 2.13.0 to 2.15.1

Release notes

Sourced from pyjwt's releases.

2.15.1

See the 2.15.1 changelog for complete release details.

2.15.0

See the 2.15.0 changelog for complete release details.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>__

Fixed

- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`[#1209](https://github.com/jpadilla/pyjwt/issues/1209) <https://github.com/jpadilla/pyjwt/issues/1209>`__).
v2.15.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&gt;__
Security

• Wrap recursion errors from deeply nested JWT payloads in DecodeError instead of exposing a raw RecursionError.

Added

- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__
Changed

• JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS payload, so a cache hit no longer re-parses every key. JWKSetCache.put() accepts either form and raises PyJWKSetError for anything else. As a result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance for as long as it stays cached, rather than a freshly built one per call in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
• PyJWKClient.fetch_data() now raises PyJWKClientError("The JWKS endpoint did not return a JSON object") when the endpoint response is not a JSON object, instead of returning it for get_jwk_set() to reject. Callers reaching the JWKS through get_jwk_set() see the same error as before in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
</tr></table> 

... (truncated)

Commits

• 7d5ef55 chore: prepare 2.15.1 release
• 7bf3252 Accept canonical Base64URL padding in JWT segments (#1216)
• 1d41a64 chore: prepare 2.15.0 release
• 9bc0665 fix: make recursive payload tests deterministic
• 5fde08a fix: normalize recursive JWT payload errors
• 171062d utils: mention bytes in force_bytes type error (#1173)
• c9d4d53 docs/conf: drop duplicate 'and' from read() docstring (#1174)
• 2763752 Add support for Python 3.15 (#1202)
• 4adcd02 Catch http.client.HTTPException in PyJWKClient.fetch_data (#1201)
• 9e501d9 fix: correct docstring typo in _validate_jti (#1179)
• Additional commits viewable in compare view

Updates uvloop from 0.21.0 to 0.23.0

Release notes

Sourced from uvloop's releases.

v0.23.0

Changes

• Add Python 3.15 and 3.15t wheel builds and CI coverage (#758) (by @​honglei @​fantix in f7c05473)

• Add support for the eager_start keyword argument in create_task() (#748) (by @​samypr100 in 3cbb0956 for #746 #718)

• Add thread name prefix to the default thread pool executor (#636) (by @​inikolaev @​fantix in 0582f946 for #562)

• Add support for special hostname <broadcast> (#592) (by @​jpbede in 3060cebc for #540)

• Upgrade libuv to v1.52.1 (#753) (by @​fantix in e8efea40 for #752)

• Improve performance by using Python C API to enter/exit context (#627) (by @​tarasko in 837ef22c)

• Improve performance/latency of Transport.write (#619) (by @​tarasko in 1d9b6e0d)

• Replace some SSL vectorcall with direct methods (#626) (by @​tarasko in 6a27cbe2)

• Optimize SSL buffered reads using C values (#629) (by @​tarasko in a308f75f)

Fixes

• Detach socket on create_connection cancellation to prevent fd double-close (#740) (by @​junjzhang @​fantix in dc680eb2 for #645 #738)

• Remove loop._ready_len in favor of len(loop._ready) (#721) (by @​x42005e1f in 5910a183 for #720)

• Prefer inspect.iscoroutinefunction (#705) (by @​MatthieuDartiailh in fd650276 for #703)

• Fix context tests by explicitly yielding after run_in_executor (#743) (by @​samypr100 in 6cd24cbb)

• Fix test_create_connection_open_con_addr with Python 3.13.9+ (#713) (by @​shadchin in b93141a5 for #701)

• Skip flaky test_cancel_post_init on asyncio 3.13+ (#714)

... (truncated)

Commits

• c5f7deb uvloop 0.23.0
• f7c0547 Add Python 3.15 to CI and fix test issues (#758)
• e8efea4 Upgrade libuv to v1.52.1 (#753)
• 3cbb095 feat: support eager_start kwarg (#748)
• 0582f94 Add thread name prefix to the default thread pool executor (#636)
• 963a5f3 Support any number of flags in UVLOOP_OPT_CFLAGS (#630)
• 173e88c Get rid of wheel as a build dependency (#696)
• b74c2f1 Update the example to work with 3.14 (#710)
• dc680eb Detach socket on create_connection cancellation to prevent fd double-close (#...
• 6cd24cb fix: explicit yield after run_in_executor as it was implicitly needed (#743)
• Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.15.1

Release notes

Sourced from pyjwt's releases.

2.15.1

See the 2.15.1 changelog for complete release details.

2.15.0

See the 2.15.0 changelog for complete release details.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>__

Fixed

- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`[#1209](https://github.com/jpadilla/pyjwt/issues/1209) <https://github.com/jpadilla/pyjwt/issues/1209>`__).
v2.15.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&gt;__
Security

• Wrap recursion errors from deeply nested JWT payloads in DecodeError instead of exposing a raw RecursionError.

Added

- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__
Changed

• JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS payload, so a cache hit no longer re-parses every key. JWKSetCache.put() accepts either form and raises PyJWKSetError for anything else. As a result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance for as long as it stays cached, rather than a freshly built one per call in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
• PyJWKClient.fetch_data() now raises PyJWKClientError("The JWKS endpoint did not return a JSON object") when the endpoint response is not a JSON object, instead of returning it for get_jwk_set() to reject. Callers reaching the JWKS through get_jwk_set() see the same error as before in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
</tr></table> 

... (truncated)

Commits

• 7d5ef55 chore: prepare 2.15.1 release
• 7bf3252 Accept canonical Base64URL padding in JWT segments (#1216)
• 1d41a64 chore: prepare 2.15.0 release
• 9bc0665 fix: make recursive payload tests deterministic
• 5fde08a fix: normalize recursive JWT payload errors
• 171062d utils: mention bytes in force_bytes type error (#1173)
• c9d4d53 docs/conf: drop duplicate 'and' from read() docstring (#1174)
• 2763752 Add support for Python 3.15 (#1202)
• 4adcd02 Catch http.client.HTTPException in PyJWKClient.fetch_data (#1201)
• 9e501d9 fix: correct docstring typo in _validate_jti (#1179)
• Additional commits viewable in compare view

Updates uvloop from 0.21.0 to 0.23.0

Release notes

Sourced from uvloop's releases.

v0.23.0

Changes

• Add Python 3.15 and 3.15t wheel builds and CI coverage (#758) (by @​honglei @​fantix in f7c05473)

• Add support for the eager_start keyword argument in create_task() (#748) (by @​samypr100 in 3cbb0956 for #746 #718)

• Add thread name prefix to the default thread pool executor (#636) (by @​inikolaev @​fantix in 0582f946 for #562)

• Add support for special hostname <broadcast> (#592) (by @​jpbede in 3060cebc for #540)

• Upgrade libuv to v1.52.1 (#753) (by @​fantix in e8efea40 for #752)

• Improve performance by using Python C API to enter/exit context (#627) (by @​tarasko in 837ef22c)

• Improve performance/latency of Transport.write (#619) (by @​tarasko in 1d9b6e0d)

• Replace some SSL vectorcall with direct methods (#626) (by @​tarasko in 6a27cbe2)

• Optimize SSL buffered reads using C values (#629) (by @​tarasko in a308f75f)

Fixes

• Detach socket on create_connection cancellation to prevent fd double-close (#740) (by @​junjzhang @​fantix in dc680eb2 for #645 #738)

• Remove loop._ready_len in favor of len(loop._ready) (#721) (by @​x42005e1f in 5910a183 for #720)

• Prefer inspect.iscoroutinefunction (#705) (by @​MatthieuDartiailh in fd650276 for #703)

• Fix context tests by explicitly yielding after run_in_executor (#743) (by @​samypr100 in 6cd24cbb)

• Fix test_create_connection_open_con_addr with Python 3.13.9+ (#713) (by @​shadchin in b93141a5 for #701)

• Skip flaky test_cancel_post_init on asyncio 3.13+ (#714)

... (truncated)

Commits

• c5f7deb uvloop 0.23.0
• f7c0547 Add Python 3.15 to CI and fix test issues (#758)
• e8efea4 Upgrade libuv to v1.52.1 (#753)
• 3cbb095 feat: support eager_start kwarg (#748)
• 0582f94 Add thread name prefix to the default thread pool executor (#636)
• 963a5f3 Support any number of flags in UVLOOP_OPT_CFLAGS (#630)
• 173e88c Get rid of wheel as a build dependency (#696)
• b74c2f1 Update the example to work with 3.14 (#710)
• dc680eb Detach socket on create_connection cancellation to prevent fd double-close (#...
• 6cd24cb fix: explicit yield after run_in_executor as it was implicitly needed (#743)
• Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the runn...

  Description has been truncated