chore: bump the python-dependencies group across 1 directory with 10 updates

[dependabot]

Bumps the python-dependencies group with 10 updates in the / directory:

Package	From	To
django	5.2.11	6.1
tzdata	2025.3	2026.3
django-environ	0.13.0	0.14.0
gunicorn	25.1.0	26.1.0
django-upgrade	1.29.1	1.32.0
whitenoise	6.11.0	6.12.0
django-structlog	10.0.0	10.1.0
djlint	1.36.4	1.44.2
pytest	9.0.2	9.1.1
pytest-django	4.12.0	4.14.0

Updates django from 5.2.11 to 6.1

Commits

• fe0a859 [6.1.x] Bumped version for 6.1 release.
• 6277045 [6.1.x] Updated man page for Django 6.1.
• fc78c5c [6.1.x] Finalized release notes for Django 6.1.
• c58d861 [6.1.x] Updated translations from Transifex.
• dc1b8de [6.1.x] Added missing lang override in translation fetching helper for Serbia...
• 1f5bf63 [6.1.x] Refs #36735 -- Added DatabaseFeatures.supports_uuid4_function_in_defa...
• 8099984 [6.1.x] Added CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, and CVE-2026-15...
• 5a260d3 [6.1.x] Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before...
• 9e4a3f1 [6.1.x] Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry c...
• 5b3523d [6.1.x] Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language().
• Additional commits viewable in compare view

Updates tzdata from 2025.3 to 2026.3

Release notes

Sourced from tzdata's releases.

2026.3: Release of upstream tzdata 2026c

Version 2026.3

Upstream version 2026c released 2026-07-08T17:23:58+00:00

Briefly:

Alberta moved to permanent -06 on 2026-06-18. Morocco moves to permanent +00 on 2026-09-20. More integer overflow bugs have been fixed in zic.

Changes to future timestamps

Alberta’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -06 thereafter. (Thanks to Roozbeh Pournader and others.) Model this with its traditional abbreviation CST. Although the change to permanent -06 legally took place on 2026-06-18, temporarily model the change to occur on 2026-11-01 at 02:00 instead, for the same reason we introduced a similarly temporary hack for British Columbia in 2026b.

Although another TZDB release will likely be needed soon because Northwest Territories will likely follow Alberta, the legal formalities have not yet taken place.

Morocco plans to move back to permanent UTC, without daylight saving time transitions, on 2026-09-20 at 02:00. This also affects Western Sahara.

Changes to commentary

Northwest Territories is expected to move to permanent -06 prior to 2026-11-01 02:00, when clocks would otherwise fall back. (Thanks to Tim Parenti and James Bellaire.) Model this with its traditional abbreviation CST. Unfortunately the change is not yet official, so it is currently present only as comments that can be uncommented as needed.

2026.2: Release of upstream tzdata 2026b

Version 2026.2

Upstream version 2026b released 2026-04-23T06:06:43+00:00

Briefly:

British Columbia moved to permanent -07 on 2026-03-09. Some more overflow bugs have been fixed in zic.

Changes to future timestamps

British Columbia’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -07 thereafter. (Thanks to Arthur David Olson.) Although the change to permanent -07 legally took place on 2026-03-09, temporarily model the change to occur on 2026-11-01 at 02:00 instead. This

... (truncated)

Changelog

Sourced from tzdata's changelog.

Version 2026.3

Upstream version 2026c released 2026-07-08T17:23:58+00:00

Briefly:

Alberta moved to permanent -06 on 2026-06-18. Morocco moves to permanent +00 on 2026-09-20. More integer overflow bugs have been fixed in zic.

Changes to future timestamps

Alberta’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -06 thereafter. (Thanks to Roozbeh Pournader and others.) Model this with its traditional abbreviation CST. Although the change to permanent -06 legally took place on 2026-06-18, temporarily model the change to occur on 2026-11-01 at 02:00 instead, for the same reason we introduced a similarly temporary hack for British Columbia in 2026b.

Although another TZDB release will likely be needed soon because Northwest Territories will likely follow Alberta, the legal formalities have not yet taken place.

Morocco plans to move back to permanent UTC, without daylight saving time transitions, on 2026-09-20 at 02:00. This also affects Western Sahara.

Changes to commentary

Northwest Territories is expected to move to permanent -06 prior to 2026-11-01 02:00, when clocks would otherwise fall back. (Thanks to Tim Parenti and James Bellaire.) Model this with its traditional abbreviation CST. Unfortunately the change is not yet official, so it is currently present only as comments that can be uncommented as needed.

---

Version 2026.2

Upstream version 2026b released 2026-04-23T06:06:43+00:00

Briefly:

British Columbia moved to permanent -07 on 2026-03-09. Some more overflow bugs have been fixed in zic.

Changes to future timestamps

British Columbia’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -07 thereafter. (Thanks to Arthur David Olson.) Although the change to permanent -07 legally took place on 2026-03-09, temporarily model the change to occur on 2026-11-01 at 02:00 instead. This works around a limitation in CLDR v48.2 (2026-03-17). This temporary hack is planned to be removed after CLDR is fixed.

... (truncated)

Commits

• a442794 Update tzdata to version 2026c (#145)
• 8f35937 Use the release environment for TestPyPI publishes (#146)
• ba0b891 Few fixes to the maintaining doc
• 9a7e6a0 Add Stan Ulbrych to license
• 1cab5e2 Bump actions/checkout from 6.0.2 to 7.0.0 (#144)
• e71cff9 Bump hynek/build-and-inspect-python-package action (#143)
• 14b2953 Make open PR check stricter (#141)
• 68d4d51 Isolate package build and publish (#137)
• 5bb6232 Fix punctuation in README.
• e313d95 Raise with an informative message when release is missing from NEWS file
• Additional commits viewable in compare view

Updates django-environ from 0.13.0 to 0.14.0

Release notes

Sourced from django-environ's releases.

v0.14.0

django-environ 0.14.0 improves type annotations across Env and updates Env.read_env() to support caller-owned file-like objects without closing them.

This is the final django-environ release supporting Python 3.9.

Added

• Type annotations and matching docstring information for Env methods.
• A conditional typing_extensions dependency providing TypeAlias on Python 3.9.

Changed

• Env.read_env() now accepts path-like and file-like objects without closing file-like objects supplied by the caller.

Fixed

• Env.read_env() now raises an explicit error when it cannot determine the caller frame used to resolve the default .env path.

Full changelog: joke2k/django-environ@v0.13.0...v0.14.0

PyPI: https://pypi.org/project/django-environ/0.14.0/

Changelog

Sourced from django-environ's changelog.

v0.14.0_ - 18-June-2026

Added +++++

• Added type annotations and matching docstring information to Env methods [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.
• Added a Python 3.9 compatibility dependency on typing_extensions for TypeAlias [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.

Changed +++++++

• Updated Env.read_env() to accept path-like and file-like objects without closing file-like objects supplied by the caller [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.

Fixed +++++

• Added an explicit error when Env.read_env() cannot determine its caller frame while resolving the default .env path [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.

Commits

• 6e1b461 Merge pull request #635 from joke2k/release/0.14.0
• b65f66e chore(release): prepare 0.14.0
• 39f980a Merge pull request #633 from joke2k/hotfix/0.14-apply-pr-600
• 020825c ci: allow release and hotfix PRs to target main
• 6c1dd5b fix(typing): support TypeAlias on Python 3.9
• c0d7b2b Ensure Env.read_env supports any file-like object
• c41ee54 Guard against an inability to read stack frames
• 64bfe4b Add type information to docstrings
• 791df95 Add type annotations to str and bool parameters of methods in Env
• 4370592 Merge branch 'develop' into main
• See full diff in compare view

Updates gunicorn from 25.1.0 to 26.1.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.1.0

New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [ are treated as patterns, so ui/*/config.json watches every view's config without listing them one by one. Patterns are re-expanded on every reload check rather than once at startup, so a file created later starts being watched without restarting gunicorn, and ** recurses. A pattern matching nothing warns instead of failing, since with live expansion it may match later (#1643, #3662).

Security

• Dependency floors raised past known advisories: every declared floor was checked against the advisory database. tornado, h2, setuptools and pymdown-extensions permitted vulnerable versions and now require the first clean release; pytest and httpx were unpinned and now carry floors. The tornado example pinned tornado<6, which was both the source of several advisories and older than the >=6.5.0 the tornado worker needs, so the example could not run as pinned.

Bug Fixes

• SIGHUP did not reload the logger configuration: Arbiter.reload() re-read the configuration file but kept using the logger built at startup, calling only reopen_files() on its existing handlers. Changes to logconfig, logconfig_dict, logconfig_json and loglevel were ignored until a full restart, which in containers meant replacing the pod. The existing logger now re-runs its setup on reload, so new handlers, formats and levels take effect while the process identity and its listeners are preserved, and re-running the setup no longer stacks duplicate syslog handlers. An invalid log configuration on reload is not fatal either: the error is reported on stderr, the previous working configuration is restored and the master keeps running with it (#3353).

• Truncated chunked bodies accepted: RFC 9112 section 7.1.2 ends a chunked body with 0 CRLF CRLF, the second CRLF being the mandatory empty trailer section. ChunkedReader.parse_chunk_size() swallowed the NoMoreData raised while scanning for it, so a body cut short right after the last chunk line was treated as complete instead of rejected. It now raises ChunkMissingTerminator (#3382, #3685).

• --spew crashed on dynamically generated code: the trace hook indexed the 2-tuple returned by inspect.getsourcelines() by line number rather than indexing the list of lines, so a frame with no __file__ raised AttributeError: 'int' object has no attribute 'rstrip' on line 1 and

... (truncated)

Commits

• 71b59a7 Merge pull request #3698 from benoitc/fix/docker-health-check-readerror
• 48287de test: catch every transport error in the docker health check
• 3110e8c Merge pull request #3696 from benoitc/docs/roadmap
• cc56c41 Merge pull request #3693 from benoitc/release/26.1.0
• 5cf1f16 docs: surface the roadmap on the site home page
• 7e35f72 docs: add FastCGI to the roadmap and point items at Ideas
• 18ddc58 docs: drop the framework and reverse-proxy non-goals from the roadmap
• 1ecae56 docs: add a roadmap and make the chat easy to find
• ca412e3 docs: sync the Latest changelog page with 26.1.0
• 640936f docs: note the dependency security work in 26.1.0
• Additional commits viewable in compare view

Updates django-upgrade from 1.29.1 to 1.32.0

Changelog

Sourced from django-upgrade's changelog.

1.32.0 (2026-08-18)

• Support Python 3.15.

  PR [#681](https://github.com/adamchainz/django-upgrade/issues/681) <https://github.com/adamchainz/django-upgrade/pull/681>__.

• Fix :ref:utils_text <utils_text> fixer to rewrite unescape_entities() calls with html.unescape(). Previously it incorrectly used html.escape(), which performs the inverse operation.

  PR [#684](https://github.com/adamchainz/django-upgrade/issues/684) <https://github.com/adamchainz/django-upgrade/pull/684>__.

• Fix :ref:index_together <index_together> fixer crash on empty index_together declarations.

  PR [#685](https://github.com/adamchainz/django-upgrade/issues/685) <https://github.com/adamchainz/django-upgrade/pull/685>__.

• Fix :ref:index_together <index_together> fixer to not add a duplicate indexes declaration when the existing one is not a list or tuple literal.

  PR [#686](https://github.com/adamchainz/django-upgrade/issues/686) <https://github.com/adamchainz/django-upgrade/pull/686>__.

• Fix :ref:index_together <index_together> fixer to add a missing comma when extending a multiline indexes list that has no trailing comma.

  PR [#687](https://github.com/adamchainz/django-upgrade/issues/687) <https://github.com/adamchainz/django-upgrade/pull/687>__.

• Fix :ref:index_together <index_together> fixer to keep an empty indexes tuple a tuple when extending it with a single index.

  PR [#716](https://github.com/adamchainz/django-upgrade/issues/716) <https://github.com/adamchainz/django-upgrade/pull/716>__.

• Fix :ref:format_html <format_html> fixer to skip calls with a parenthesized argument, where removing the .format() call would create a tuple.

  PR [#717](https://github.com/adamchainz/django-upgrade/issues/717) <https://github.com/adamchainz/django-upgrade/pull/717>__.

• Fix :ref:null_boolean_field <null_boolean_field> fixer to add a missing comma before null=True when the final argument contains commas within brackets.

  PR [#688](https://github.com/adamchainz/django-upgrade/issues/688) <https://github.com/adamchainz/django-upgrade/pull/688>__.

• Fix fixers that modify call arguments to not treat a comment inside otherwise empty parentheses as an argument, which made the :ref:null_boolean_field <null_boolean_field> fixer produce invalid syntax.

  PR [#718](https://github.com/adamchainz/django-upgrade/issues/718) <https://github.com/adamchainz/django-upgrade/pull/718>__.

• Fix :ref:test_http_headers <test_http_headers> fixer to avoid a double comma when the existing headers= dict has a trailing comma.

  PR [#689](https://github.com/adamchainz/django-upgrade/issues/689) <https://github.com/adamchainz/django-upgrade/pull/689>__.

• Fix :ref:test_http_headers <test_http_headers> fixer to insert converted headers at the start of an existing headers= dict. Django gives headers= entries precedence over HTTP_ arguments, and the last duplicate key wins in a dict literal, so appending converted entries at the end previously flipped which value took effect.

  PR [#723](https://github.com/adamchainz/django-upgrade/issues/723) <https://github.com/adamchainz/django-upgrade/pull/723>__.

• Fix :ref:testcase_databases <testcase_databases> fixer to rewrite multi_db = False to databases = ["default"] rather than databases = [].

... (truncated)

Commits

• 423ab50 Version 1.32.0
• 7b1224a Tidy changelog (#729)
• 6360789 Fix forms_model_multiple_choice_field corrupting concatenated keys (#728)
• 02a4683 Fix testcase_databases mapping of multi_db = False (#727)
• bc85eb9 Fix admin_decorators hoisting values above their definitions (#726)
• 4eb5abf Fix admin_register referencing models defined after the admin class (#725)
• d782084 Fix settings_storages erasing settings referenced elsewhere (#724)
• 2f3eb75 Fix test_http_headers precedence when merging into headers= (#723)
• d750615 Fix stringagg moving import despite bare StringAgg references (#722)
• 49cb8b9 Fix utils_timezone matching aliased utc imports (#720)
• Additional commits viewable in compare view

Updates whitenoise from 6.11.0 to 6.12.0

Changelog

Sourced from whitenoise's changelog.

6.12.0 (2026-02-27)

• Drop Python 3.9 support.
• Fix potential unauthorised file access vulnerability in "autorefesh" mode. See PR [#684](https://github.com/evansd/whitenoise/issues/684) <https://github.com/evansd/whitenoise/pull/684>__ for details, and a reminder that autorefresh mode has always been documented as unsuitable for production use. Thanks Seth Larson for reporting.

Commits

• 1e3a30b Version 6.12.0
• bc4c738 Merge pull request #684 from evansd/use-commonpath
• 505ed8d Use os.path.commonpath() to identify child paths
• b6d8ed4 Upgrade dependencies (#683)
• edc79de [pre-commit.ci] pre-commit autoupdate (#682)
• 79fb2f1 Bump the github-actions group with 2 updates (#680)
• 2b245df [pre-commit.ci] pre-commit autoupdate (#681)
• dcb50f3 Upgrade dependencies (#678)
• 1c4a746 [pre-commit.ci] pre-commit autoupdate (#677)
• e7f970a Bump actions/checkout from 5 to 6 in the github-actions group (#676)
• Additional commits viewable in compare view

Updates django-structlog from 10.0.0 to 10.1.0

Changelog

Sourced from django-structlog's changelog.

10.1.0 (May 30, 2025)

New: - Add settings to configure the logging levels for the request middleware and celery task events. See [#1022](https://github.com/jrobichaud/django-structlog/issues/1022) <https://github.com/jrobichaud/django-structlog/issues/1022>_.

Commits

• a53b04e Bump version
• 4c2e49a Merge pull request #1024 from offbyone/push-tkpuvxrrvkvu
• 770a6b2 Make the log level for the request middleware fully configurable
• dd60535 Merge pull request #1001 from jrobichaud/dependabot/pip/docs/sphinx-9.1.0
• 1cc4dc0 Merge pull request #1011 from jrobichaud/dependabot/pip/requirements/coverage...
• e110580 Merge pull request #1012 from jrobichaud/dependabot/github_actions/peter-evan...
• 960a1ea Merge pull request #1014 from jrobichaud/dependabot/pip/docs/importlib-metada...
• f0c6d5c Merge pull request #1015 from jrobichaud/dependabot/github_actions/codecov/co...
• d3383c0 Merge pull request #1016 from jrobichaud/dependabot/pip/docs/celery-5.6.3
• 944199e chore(deps): bump celery from 5.6.2 to 5.6.3 in /docs
• Additional commits viewable in compare view

Updates djlint from 1.36.4 to 1.44.2

Release notes

Sourced from djlint's releases.

v1.44.2

Fix

• H037 no longer reports two attributes whose names differ only before a . as duplicates (data-a.checked and data-b.checked, or alpine's x-on:click.prevent and x-on:keyup.prevent).
• An attribute whose name merely ends in the name a rule looks for is no longer mistaken for it. data-alt and data-x.alt left H013 silent on an image with no alt, data-lang and xml:lang silenced H005, data-height and data-width silenced H006, data-name="description" silenced H030 and data-name="keywords" silenced H031, and data-x.id satisfied a <label for> for H042.
• A name written inside an attribute value is no longer read as an attribute. title="alt=x" left H013 silent, class="language-en" silenced H005, and title="the ID=5" was reported by H010 as an uppercase attribute name.
• H005 no longer reports a tag whose name only starts with html, such as <htmlx>, and points at the <html> tag itself rather than at everything up to the last > in the file.

v1.44.1

Fix

• Formatting no longer changes what the page renders. A space that shows was dropped (<span>a</span><span> b </span> rendered as ab, a{% if x %} b {% endif %}c as abc), a space that shows nothing was added (<span> </span> became <span> </span>), and moving a tag onto its own line could add one (x<img>y, or across a comment as in a{# c #}<img>). Whitespace is now kept where it renders and dropped where it does not.
• A line break inside an attribute value is kept, so a title tooltip no longer loses a line and a data- value read by script no longer comes back different. Line breaks in class, style, srcset and sizes mean nothing and are still joined.
• Indentation inside <pre> and <textarea> is left alone when the closing tag has something after it on its line (<pre> a\n b</pre> tail).
• Whitespace css does not collapse, such as U+2005, is text, and is no longer stripped from the edges of an element or of the file.
• Two indenting fixes: a line that closes one tag and opens another (</b><i>) indents its contents again, and a line that closes more tags than it opens unindents even when a whole tag ends it (</b><small></small>). Both left the lines after them at the wrong level.
• --line-break-after-multiline-tag now applies only to tags actually written over several lines, as its help says. It was holding back the content of every element, splitting tags that fit on one line.
• A class value is tidied wherever it was written: class=" a b " becomes class="a b". A tag whose attribute value holds a line break is spread over lines, since it cannot fit on one.

v1.44.0

Feature

• New --allow-empty-input option, and the matching allow_empty_input config key, exits 0 instead of 2 when the given paths match no files.

Fix

• An html close tag inside an inline {% if %}...{% endif %} no longer dedents everything that follows it by one level, collapsing nested structures toward column 0 - a regression in 1.43.0. A close tag already at the content level of the template block it sits in is held there, but the level it was denied was then taken off the end of the line instead, so {% if r %}</strong>{% endif %} moved the rest of the block left. The matching open tag never took a level to give back, since {% endif %} had already returned it.
• A run where every file found was skipped by exclude, extend_exclude, use_gitignore or require_pragma now exits 0 instead of 1. Skipping them is the configuration doing its job, and it is what lets exclude work under pre-commit, which passes the names of every staged file. Paths that match no files at all now exit 2 rather than 1, so exit 1 means only that djLint found something to report.
• An unhandled error exits 2 instead of 1, so a crash is no longer indistinguishable from a lint error. The traceback is still printed.
• An unrecognized --profile, or profile in a config file, is now a usage error. A typo used to lint with a silently different rule set and exit 0, and raised KeyError with --require-pragma.
• A directory whose name matches the file extension (build.html/) is no longer picked up as a template and opened as a file, crashing the run.
• No files to check! is written to stderr instead of stdout, where formatted code is written.
• Input piped to djlint - --reformat that --require-pragma skips is handed back byte for byte instead of being replaced by No files to check!.

v1.43.2

Fix

• blank_line_before_tag no longer inserts a blank line when the previous line opens a block and increases the indentation, e.g. between <div> and {% block %}. Since 1.41.0 blank_line_after_tag has left the closing edge of a block alone ({% endblock %} before </div>), while the opening edge kept its padding, so a template using both options came out lopsided.

v1.43.1

Fix

• H025 no longer reports the closing tag of a multi-line <script> or <style> as an orphan - a regression in 1.43.0. A genuinely unmatched </script> is still reported.

v1.43.0

Feature

• New --stdin-filename option gives content piped in on stdin (djlint -) its real path, so per-file-ignores matches against that name and linter messages report it. Per-file ignores were previously dead for piped input, since nothing matches the name -. Path separators are normalized as they are for files on disk.

Fix

... (truncated)

Changelog

Sourced from djlint's changelog.

[1.44.2] - 2026-08-08

Fix

• H037 no longer reports two attributes whose names differ only before a . as duplicates (data-a.checked and data-b.checked, or alpine's x-on:click.prevent and x-on:keyup.prevent).
• An attribute whose name merely ends in the name a rule looks for is no longer mistaken for it. data-alt and data-x.alt left H013 silent on an image with no alt, data-lang and xml:lang silenced H005, data-height and data-width silenced H006, data-name="description" silenced H030 and data-name="keywords" silenced H031, and data-x.id satisfied a <label for> for H042.
• A name written inside an attribute value is no longer read as an attribute. title="alt=x" left H013 silent, class="language-en" silenced H005, and title="the ID=5" was reported by H010 as an uppercase attribute name.
• H005 no longer reports a tag whose name only starts with html, such as <htmlx>, and points at the <html> tag itself rather than at everything up to the last > in the file.

[1.44.1] - 2026-08-07

Fix

• Formatting no longer changes what the page renders. A space that shows was dropped (<span>a</span><span> b </span> rendered as ab, a{% if x %} b {% endif %}c as abc), a space that shows nothing was added (<span> </span> became <span> </span>), and moving a tag onto its own line could add one (x<img>y, or across a comment as in a{# c #}<img>). Whitespace is now kept where it renders and dropped where it does not.
• A line break inside an attribute value is kept, so a title tooltip no longer loses a line and a data- value read by script no longer comes back different. Line breaks in class, style, srcset and sizes mean nothing and are still joined.
• Indentation inside <pre> and <textarea> is left alone when the closing tag has something after it on its line (<pre> a\n b</pre> tail).
• Whitespace css does not collapse, such as U+2005, is text, and is no longer stripped from the edges of an element or of the file.
• Two indenting fixes: a line that closes one tag and opens another (</b><i>) indents its contents again, and a line that closes more tags than it opens unindents even when a whole tag ends it (</b><small></small>). Both left the lines after them at the wrong level.
• --line-break-after-multiline-tag now applies only to tags actually written over several lines, as its help says. It was holding back the content of every element, splitting tags that fit on one line.
• A class value is tidied wherever it was written: class=" a b " becomes class="a b". A tag whose attribute value holds a line break is spread over lines, since it cannot fit on one.

[1.44.0] - 2026-08-04

Feature

• New --allow-empty-input option, and the matching allow_empty_input config key, exits 0 instead of 2 when the given paths match no files.

Fix

• An html close tag inside an inline {% if %}...{% endif %} no longer dedents everything that follows it by one level, collapsing nested structures toward column 0 - a regression in 1.43.0. A close tag already at the content level of the template block it sits in is held there, but the level it was denied was then taken off the end of the line instead, so {% if r %}</strong>{% endif %} moved the rest of the block left. The matching open tag never took a level to give back, since {% endif %} had already returned it.
• A run where every file found was skipped by exclude, extend_exclude, use_gitignore or require_pragma now exits 0 instead of 1. Skipping them is the configuration doing its job, and it is what lets exclude work under pre-commit, which passes the names of every staged file. Paths that match no files at all now exit 2 rather than 1, so exit 1 means only that djLint found something to report.
• An unhandled error exits 2 instead of 1, so a crash is no longer indistinguishable from a lint error. The traceback is still printed.
• An unrecognized --profile, or profile in a config file, is now a usage error. A typo used to lint with a silently different rule set and exit 0, and raised KeyError with --require-pragma.
• A directory whose name matches the file extension (build.html/) is no longer picked up as a template and opened as a file, crashing the run.
• No files to check! is written to stderr instead of stdout, where formatted code is written.
• Input piped to djlint - --reformat that --require-pragma skips is handed back byte for byte instead of being replaced by No files to check!.

[1.43.2] - 2026-08-01

Fix

• blank_line_before_tag no longer inserts a blank line when the previous line opens a block and increases the indentation, e.g. between <div> and {% block %}. Since 1.41.0 blank_line_after_tag has left the closing edge of a block alone ({% endblock %} before </div>), while the opening edge kept its padding, so a template using both options came out lopsided.

[1.43.1] - 2026-07-28

Fix

• H025 no longer reports the closing tag of a multi-line <script> or <style> as an orphan - a regression in 1.43.0. A genuinely unmatched </script> is still reported.

[1.43.0] - 2026-07-27

... (truncated)

Commits

• 76675b6 v1.44.2
• c6016b2 fix(linter): don't read an attribute name from the middle in H037
• 9de6448 chore(deps): lock file maintenance (#2351)
• e7d5056 chore(deps): update dependency cssnano to v8.0.3 (#2350)
• 8c7a95b chore(deps): lock file maintenance (#2349)
• 03a5f48 chore(deps): update dependency @​codemirror/lang-html to v6.4.12 (#2348)
• fb312f9 improve docs & code comments
• 919439f chore(deps): lock file maintenance (#2347)
• 9f86586 chore(deps): lock file maintenance (#2346)
• d3310dc chore(deps): lock file maintenance (#2345)
• Additional commits viewable in compare view

Updates pytest from 9.0.2 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates pytest-django from 4.12.0 to 4.14.0

Release notes

Sourced from pytest-django's releases.

v4.14.0

https://pytest-django.readthedocs.io/en/stable/changelog.html#v4-14-0-2026-08-10

v4.13.0

https://pytest-django.readthedocs.io/en/latest/changelog.html#v4-13-0-2026-08-06

Changelog

Sourced from pytest-django's changelog.

v4.14.0 (2026-08-10)

Compatibility ^^^^^^^^^^^^^

• Restored (unofficial) support for Django 5.0 and Django 5.1.

Improvements ^^^^^^^^^^^^

• Added a django extra to the package. By depending on this extra (e.g. pip install pytest-django[django]), the dependency resolver will ensure you get a version of pytest-django that is compatible with your version of Django (lower bound only). At least from now on...

v4.13.0 (2026-08-06)

Compatibility ^^^^^^^^^^^^^

• Dropped support for Django 4.2 and 5.1.

Improvements ^^^^^^^^^^^^

• Export pytest_django.Settings from the top-level pytest_django module so the :fixture:settings fixture can be type-annotated ([#1257](https://github.com/pytest-dev/pytest-django/issues/1257) <https://github.com/pytest-dev/pytest-django/issues/1257>__).

Bugfixes ^^^^^^^^

• Fixed type hints of assert methods to match actual signature (PR [#1271](https://github.com/pytest-dev/pytest-django/issues/1271) <https://github.com/pytest-dev/pytest-django/pull/1271>__)
• Handled Django 6.2's ImproperlyConfigured (in addition to ImportError) when the configured DJANGO_SETTINGS_MODULE cannot be imported, so pytest-django still shows its guidance message.
• Fixed django_db(transaction=True) tests being set up twice, which repeated the serialized_rollback restore and the fixtures load, and sent setting_changed and post_migrate twice when available_apps is set.
• Fixed --help/--version failing with AppRegistryNotReady (surfaced as a could not load initial conftests warning) when a conftest.py imports Django models at the top level. Django is now set up even when --help/--version are passed, before the initial conftests are loaded for these options ([#1152](https://github.com/pytest-dev/pytest-django/issues/1152) <https://github.com/pytest-dev/pytest-django/issues/1152>__).

Commits

• 1a6b612 Release 4.14.0
• fffb11d docs: remove $ for consistency
• e8c0606 docs: move the django extra explanation
• b66deb6 tests: strict import to make pyright happy
• 823db39 tests: fix wrong type (typing only)
• a1eaf5d Drop django<5 message asserts compat
• 2ea1423 Fix _pre_setup_ran_eagerly on Django 5.0 and 5.1
• 903429c Add django extra to ensure Django dependency compatible lower bound
• 9661589 docs: prefer newer pytest config TOML format
• 7646196 docs: remove needless comment
• Additional commits viewable in compare view