* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
passed to APIs that accept Python buffers, which could lead to buffer
overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
.. _v46-0-6:
46.0.6 - 2026-03-25
SECURITY ISSUE: Fixed a bug where name constraints were not applied
to peer names during verification when the leaf certificate contains a
wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug,
including those used by the Web PKI. Credit to Oleh Konko (1seal) for
reporting the issue. CVE-2026-34073
release(text-splitters): 1.1.2 (#36822)
fix(text-splitters): deprecate and use SSRF-safe transport in split_text_from_url (#36821)
chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (#36797)
chore(deps): bump pytest to 9.0.3 (#36801)
chore: bump pytest from 9.0.2 to 9.0.3 in /libs/text-splitters (#36714)
chore: add comment explaining pygments>=2.20.0 (#36570)
release(core): 1.2.26 (#36511)
chore: pygments>=2.20.0 across all packages (CVE-2026-4539) (#36385)
fix(text-splitters): prevent silent data loss for empty dict values in RecursiveJsonSplitter (#35079)
feat(text-splitters): support spacy tests with Python 3.14 (#36198)
fix(infra): correct lint_diff relative paths in package makefiles (#36333)
chore: bump requests from 2.32.5 to 2.33.0 in /libs/text-splitters (#36238)
chore: bump nltk from 3.9.3 to 3.9.4 in /libs/text-splitters (#36237)
chore(partners): bump langchain-core min to 1.2.21 (#36183)
chore(text-splitters): bump nltk in lock file (#36112)
ci: suppress pytest streaming output in CI (#36092)
chore(text-splitters): speed up ci (#36050)
ci: avoid unnecessary dep installs in lint targets (#36046)
chore: bump orjson from 3.11.5 to 3.11.6 in /libs/text-splitters (#35856)
chore: bump locks, lint (#35985)
perf(.github): set a timeout on get min versions HTTP calls (#35851)
chore: bump tornado from 6.5.2 to 6.5.5 in /libs/text-splitters (#35774)
chore: bump the minor-and-patch group across 3 directories with 3 updates (#35589)
chore: bump the other-deps group across 3 directories with 2 updates (#35512)
chore: bump nltk from 3.9.2 to 3.9.3 in /libs/text-splitters (#35449)
chore: bump the other-deps group across 3 directories with 2 updates (#35407)
Fix ALINE feature matrix errors and add comprehensive tests
Support multiple VerbNet versions, fix longid/shortid regex for VerbNet ids
Let downloader fallback to md5 when sha256 is unavailable
Several other minor bugfixes and code cleanups
Thanks to the following contributors to 3.9.4:
Min-Yen Kan, Eric Kafe, Emily Voss, bowiechen, Hrudhai01,
jancallewaert, Mr-Neutr0n, pollak.peter89, ylwango613,
Version 3.9.3 2026-02-21
Fix CVE-2025-14009: secure ZIP extraction in nltk.downloader (#3468)
Block path traversal/arbitrary reads in nltk.data for protocol-less refs (#3467)
Block path traversal/abs paths in corpus readers and FS pointers (#3479, #3480)
Validate external StanfordSegmenter JARs using SHA256 (#3477)
Add optional sandbox enforcement for filestring() (#3485)
new environment variable NLTK_DOWNLOADER_FORCE_INTERACTIVE_SHELL
Lesk defaults to most frequent sense in case of ties
Thanks to the following contributors to 3.9.2:
Jose Cols, Peter de Blanc, GeneralPoxter, Eric Kafe, William LaCroix, Jason Liu,
Samer Masterson, Mike014, purificant, Andrew Ernest Ritz, samertm, Ikram Ul Haq,
Christopher Smith, Ryan Mannion
#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.
#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.
Previously this resulted in an internal assertion failure during plugin loading.
Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.
#13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.
#14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.
#14343: Fixed use of insecure temporary directory (CVE-2025-71176).
Improved documentation
#13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
#13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
#14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
#14255: TOML integer log levels must be quoted: Updating reference documentation.
Contributor-facing changes
#12689: The test reports are now published to Codecov from GitHub Actions.
The test statistics is visible on the web interface.
-- by aleguy02
9.0.2
pytest 9.0.2 (2025-12-06)
Bug fixes
#13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.
You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.
Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.
#13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.
#13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0.
Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim.
It will be deprecated in pytest 9.1 and removed in pytest 10.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/24441
Author: @dependabot[bot]
Created: 5/8/2026
Status: ❌ Closed
Base:
main← Head:dependabot/uv/uv-b408a9a021📝 Commits (1)
7b3a7d5Bump the uv group across 2 directories with 20 updates📊 Changes
4 files changed (+1943 additions, -1393 deletions)
View changed files
📝
backend/requirements-min.txt(+3 -3)📝
backend/requirements.txt(+9 -9)📝
pyproject.toml(+9 -9)📝
uv.lock(+1922 -1372)📄 Description
Bumps the uv group with 17 updates in the / directory:
0.0.220.0.2746.0.546.0.71.6.101.6.110.86.00.87.01.1.11.1.26.7.56.10.23.9.33.9.412.1.112.2.08.3.49.0.30.19.00.19.23.16.13.20.33.1.03.1.30.4.50.7.315.3.06.1.01.0.11.2.25.10.05.12.03.1.33.1.6Bumps the uv group with 8 updates in the /backend directory:
0.0.220.0.2746.0.546.0.71.6.101.6.110.86.00.87.01.1.11.1.26.7.56.10.23.9.33.9.412.1.112.2.0Updates
python-multipartfrom 0.0.22 to 0.0.27Release notes
Sourced from python-multipart's releases.
Changelog
Sourced from python-multipart's changelog.
Commits
6d1d689Version 0.0.27 (#272)0b10220Run CI on main branch pull requests (#271)3e64f5fAdd multipart header limits (#267)eb109ccPass parse offsets via constructors (#268)78e29abBump pytest from 9.0.2 to 9.0.3 (#266)b2ddd09fuzz: Enhance fuzzing capabilities with new chunked and boundary tests (#264)28f4785Version 0.0.26 (#263)d4452a7Silently discard epilogue data after the closing boundary (#259)6a7b76dSkip preamble before first multipart boundary (#262)4addb60Version 0.0.25 (#261)Updates
cryptographyfrom 46.0.5 to 46.0.7Changelog
Sourced from cryptography's changelog.
Commits
622d67246.0.7 release (#14602)91d7288Cherry-pick #14542 (#14543)Updates
authlibfrom 1.6.10 to 1.6.11Release notes
Sourced from authlib's releases.
Changelog
Sourced from authlib's changelog.
Commits
0dc0e5bchore: bump to 1.6.11aa7b8e4Merge commit from fork401a770fix: CSRF issue with starlette clientUpdates
anthropicfrom 0.86.0 to 0.87.0Release notes
Sourced from anthropic's releases.
Changelog
Sourced from anthropic's changelog.
Commits
ab0c446release: 0.87.06599043fix(memory): return resolved path from async _validate_path715030cfix(memory): use restrictive file mode for memory files6cdbc5fchore(tests): bump steady to v0.20.14beda3cAdd output-300k-2026-03-24 beta header3b77b82chore(ci): run builds on CI even if only spec metadata changed764ddbafeat(internal): implement indices array format for query and form serialization8a06a90codegen metadata7f8cf3cchore(tests): bump steady to v0.19.70eba0ddchore(ci): skip lint on metadata-only changesUpdates
langchain-text-splittersfrom 1.1.1 to 1.1.2Release notes
Sourced from langchain-text-splitters's releases.
Commits
58c4e5brelease(text-splitters): 1.1.2 (#36822)c289bf1fix(text-splitters): deprecate and use SSRF-safe transport in split_text_from...b7447c6fix(infra): skip serdes tests in min-version release step (#36818)41c0cc5release(openai): 1.1.14 (#36820)0516156fix(openai): use SSRF-safe transport for image token counting (#36819)338aa81fix(core): restore cloud metadata IPs and link-local range in SSRF policy (#3...51e9548chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (#36797)e85c418chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/model-profiles (#36798)789126echore: bump langsmith from 0.6.3 to 0.7.31 in /libs/standard-tests (#36799)937b3ebchore: bump langsmith from 0.6.3 to 0.7.31 in /libs/langchain_v1 (#36800)Updates
pypdffrom 6.7.5 to 6.10.2Release notes
Sourced from pypdf's releases.
... (truncated)
Changelog
Sourced from pypdf's changelog.
... (truncated)
Commits
c476b4fREL: 6.10.2c50a010SEC: Do not rely on possibly invalid /Size for incremental cloning (#3735)ac734daSEC: Introduce limits for FlateDecode parameters and image decoding (#3734)b49e7ebREL: 6.10.162338e9SEC: Limit the allowed size of xref and object streams (#3733)5dcc0aeDEV: Update pytest-benchmark to 5.2.3b42e4aaDEV: Update pinned pillow and pytest where possible (#3732)717446bROB: Consider strict mode setting for decryption errors (#3731)9e461d3DEV: Bump softprops/action-gh-release from 2 to 3 (#3730)500d09dTST: Updatetest_embedded_file__basicto usetmp_pathfixture (#3726)Updates
nltkfrom 3.9.3 to 3.9.4Changelog
Sourced from nltk's changelog.
... (truncated)
Commits
ad9c96bUpdate copyright year7edcddfUpdates for 3.9.4 release67a2736Merge pull request #3180 from yzhaoinuw/bug-on-edit_distance_align2b17ac5Fix edit_distance_align backtrace for high substitution costs4b72976Merge pull request #3018 from JuanIMartinezB/bug/shortid-longid8a5619fMerge pull request #3222 from Syzygy2048/feature/texttiling-vocabulary-introd...c6574d7Merge pull request #3289 from ihitamandal/codeflash/optimize-windowdiff-2024-...98ff5d9Merge pull request #3435 from Hrudhai01/fix-3260-detokenize-quotesaec4fceMerge pull request #3522 from ekaf/pathseceec4ee3Merge pull request #3526 from nltk/update-contributingUpdates
pillowfrom 12.1.1 to 12.2.0Release notes
Sourced from pillow's releases.
... (truncated)
Commits
3c41c0912.2.0 version bumpcdaa29eCheck calloc return value (#9527)585b2f5Check calloc return valueecf011eCheck all allocs in the Arrow tree (#9488)cf6de8cReject non-numeric elements inside list coords (#9526)ffdcedeUpdate 12.2.0 release notes (#9522)7929d77Added security release notes (#149)c4f7aa5Added security release notes22cdb5fMove variable declaration inside define (#9525)fc15b3bResize tall images vertically first (#9524)Updates
pytestfrom 8.3.4 to 9.0.3Release notes
Sourced from pytest's releases.
... (truncated)
Commits
- Additional commits viewable in compare view
Description has been truncateda7d58d7Prepare release version 9.0.3089d981Merge pull request #14366 from bluetech/revert-14193-backport8127eafRevert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"99a7e60Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...ddee02aMerge pull request #14343 from bluetech/cve-2025-71176-simple74eac69doc: Update training info (#14298) (#14301)f92dee7Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...7ee58acMerge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...37da870Merge pull request #14259 from mitre88/patch-4 (#14268)c34bfa3Add explanation for string context diffs (#14257) (#14266)🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.