chore: bump the pip group across 3 directories with 3 updates by dependabot[bot] · Pull Request #4 · senih25/umap

dependabot · 2026-05-19T20:59:18Z

Bumps the pip group with 3 updates in the / directory: pillow, requests and pymdown-extensions.
Bumps the pip group with 1 update in the /docs directory: pymdown-extensions.
Bumps the pip group with 1 update in the /docs-users directory: pymdown-extensions.

Updates pillow from 12.1.1 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Update 12.2.0 release notes #9522 [@hugovk]

Add loader plugins: AMOS abk, Atari Degas, 40+ more obscure formats via Netpbm #9482 [@bitplane]

Update Python versions #9515 [@radarhere]

Jeffrey A. Clark -> Jeffrey 'Alex' Clark #9513 [@aclark4life]

Add release notes for #9394, #9419 and #9456 #9467 [@radarhere]

Add Amiga Workbench .info loader to 3rd party plugins list #9459 [@bitplane]

Merge PFM documentation into PPM #9434 [@radarhere]

Update macOS tested Pillow versions #9431 [@radarhere]

Fix CVE number #9430 [@hugovk]

Dependencies

Update xz to 5.8.3 #9523 [@radarhere]

Update libjpeg-turbo to 3.1.4.1 #9507 [@radarhere]

Update libpng to 1.6.56 #9499 [@radarhere]

Update freetype to 2.14.3 #9485 [@radarhere]

Updated libavif to 1.4.1 #9479 [@radarhere]

Updated harfbuzz to 13.2.1 #9461 [@radarhere]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Update harfbuzz to 13.0.1 #9453 [@radarhere]

Update libavif to 1.4.0 #9460 [@radarhere]

Update freetype to 2.14.2 #9449 [@radarhere]

Update actions/download-artifact action to v8 #9451 [@renovate[bot]]

Updated libpng to 1.6.55 #9425 [@radarhere]

Testing

Cleanup .spider extension in the same test where it is added #9517 [@radarhere]

Run tests in parallel via tox for 3.5x speedup #9516 [@hugovk]

Enable colour in CI logs #9486 [@hugovk]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Simplify TGA test code #9477 [@radarhere]

Update tests to check for ValueError when encoding an empty image #9464 [@radarhere]

Upgrade CI from macos-15-intel to macos-26-intel #9454 [@hugovk]

Add check-case-conflict hook #9446 [@radarhere]

Specify platform when pulling docker image #9440 [@radarhere]

GHA: Cache libavif and webp builds for Ubuntu #9437 [@hugovk]

Update macOS tested Pillow versions #9431 [@radarhere]

Other changes

Check calloc return value #9527 [@radarhere]

Check all allocs in the Arrow tree #9488 [@wiredfool]

Reject non-numeric elements inside list coords #9526 [@hugovk]

Move variable declaration inside define #9525 [@radarhere]

... (truncated)

Commits

3c41c09 12.2.0 version bump
cdaa29e Check calloc return value (#9527)
585b2f5 Check calloc return value
ecf011e Check all allocs in the Arrow tree (#9488)
cf6de8c Reject non-numeric elements inside list coords (#9526)
ffdcede Update 12.2.0 release notes (#9522)
7929d77 Added security release notes (#149)
c4f7aa5 Added security release notes
22cdb5f Move variable declaration inside define (#9525)
fc15b3b Resize tall images vertically first (#9524)
Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates pymdown-extensions from 10.21 to 10.21.3

Release notes

Sourced from pymdown-extensions's releases.

10.21.3

FIX: Fix regression that allows a snippet to be loaded outside of the base path using directory traversal when restrict_base_path is enabled (the default). Found by @gistrec.

10.21. 2

10.21.2

FIX: Highlight: Latest Pygments versions cannot handle a "filename" for code block titles of None.

10.20.1

FIX: Quotes: Ensure the first class for callouts (the alert type) is always rendered lowercase.

Commits

4262841 Fix spelling
63b7835 Merge commit from fork
3d18550 Docs: update js deps
a4fdd73 Skip tag 10.21.1 has we accidentally already used it
8afb4cd Docs: Update JS deps
7bf5b29 Pygments needs a non-None value for code block title (#2863)
20b11eb Fix some spelling and formatting
c9edba3 Docs: strengthen Snippets warning and add security considerations
See full diff in compare view

Updates pymdown-extensions from 10.21 to 10.21.3

Release notes

Sourced from pymdown-extensions's releases.

10.21.3

FIX: Fix regression that allows a snippet to be loaded outside of the base path using directory traversal when restrict_base_path is enabled (the default). Found by @gistrec.

10.21. 2

10.21.2

FIX: Highlight: Latest Pygments versions cannot handle a "filename" for code block titles of None.

10.20.1

FIX: Quotes: Ensure the first class for callouts (the alert type) is always rendered lowercase.

Commits

4262841 Fix spelling
63b7835 Merge commit from fork
3d18550 Docs: update js deps
a4fdd73 Skip tag 10.21.1 has we accidentally already used it
8afb4cd Docs: Update JS deps
7bf5b29 Pygments needs a non-None value for code block title (#2863)
20b11eb Fix some spelling and formatting
c9edba3 Docs: strengthen Snippets warning and add security considerations
See full diff in compare view

Updates pymdown-extensions from 10.21 to 10.21.3

Release notes

Sourced from pymdown-extensions's releases.

10.21.3

FIX: Fix regression that allows a snippet to be loaded outside of the base path using directory traversal when restrict_base_path is enabled (the default). Found by @gistrec.

10.21. 2

10.21.2

FIX: Highlight: Latest Pygments versions cannot handle a "filename" for code block titles of None.

10.20.1

FIX: Quotes: Ensure the first class for callouts (the alert type) is always rendered lowercase.

Commits

4262841 Fix spelling
63b7835 Merge commit from fork
3d18550 Docs: update js deps
a4fdd73 Skip tag 10.21.1 has we accidentally already used it
8afb4cd Docs: Update JS deps
7bf5b29 Pygments needs a non-None value for code block title (#2863)
20b11eb Fix some spelling and formatting
c9edba3 Docs: strengthen Snippets warning and add security considerations
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the pip group with 3 updates in the / directory: [pillow](https://github.com/python-pillow/Pillow), [requests](https://github.com/psf/requests) and [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions). Bumps the pip group with 1 update in the /docs directory: [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions). Bumps the pip group with 1 update in the /docs-users directory: [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions). Updates `pillow` from 12.1.1 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.1...12.2.0) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `pymdown-extensions` from 10.21 to 10.21.3 - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](facelessuser/pymdown-extensions@10.21...10.21.3) Updates `pymdown-extensions` from 10.21 to 10.21.3 - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](facelessuser/pymdown-extensions@10.21...10.21.3) Updates `pymdown-extensions` from 10.21 to 10.21.3 - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](facelessuser/pymdown-extensions@10.21...10.21.3) --- updated-dependencies: - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: pymdown-extensions dependency-version: 10.21.3 dependency-type: direct:production dependency-group: pip - dependency-name: pymdown-extensions dependency-version: 10.21.3 dependency-type: direct:production dependency-group: pip - dependency-name: pymdown-extensions dependency-version: 10.21.3 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels May 19, 2026

dependabot Bot mentioned this pull request May 19, 2026

chore: bump requests from 2.32.5 to 2.33.0 in the pip group across 1 directory #2

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: bump the pip group across 3 directories with 3 updates#4

chore: bump the pip group across 3 directories with 3 updates#4
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/pip-8796e18245

dependabot Bot commented on behalf of github May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 19, 2026

12.2.0

Documentation

Dependencies

Testing

Other changes

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

10.21.3

10.21. 2

10.21.2

10.20.1

10.21.3

10.21. 2

10.21.2

10.20.1

10.21.3

10.21. 2

10.21.2

10.20.1

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants