[dependabot]

Bumps the python group with 13 updates in the / directory:

Package	From	To
mypy	2.4.0	2.4.1
ruff	0.17.1	0.17.3
types-python-dateutil	2.9.0.20260807	2.9.0.20261029
types-pytz	2026.5.0.20261006	2026.6.0.20261031
certifi	2026.10.18	2026.10.23
django-dbbackup	5.3.1	5.4.0
python-dateutil	2.9.0.post0	3.0.0
pytz	2026.5	2026.6
sentry-sdk	2.72.0	2.73.0
yt-dlp	2026.8.19	2026.10.26
pytest	9.1.1	9.2.0
playwright	1.64.0	1.64.1
time-machine	3.5.1	3.6.0

Updates mypy from 2.4.0 to 2.4.1

Changelog

Sourced from mypy's changelog.

Mypy 2.4.1

• Process overloads as a whole in two-phase type checking (Ivan Levkivskyi, PR 22231)
• Skip recursive setup for frame-private nested functions in mypyc (Piotr Sawicki, PR 22187)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• A5rocks
• Adam Dangoor
• Alex Waygood
• Ali Hamdan
• Brian Helba
• Chad Dombrova
• David Foster
• dnwpark
• Edgar Ramírez Mondragón
• Giorgos Michas
• Ivan Levkivskyi
• Jelle Zijlstra
• Jukka Lehtosalo
• Marc Mueller
• Michael R. Crusoe
• NIYONSHUTI Emmanuel
• Piotr Sawicki
• Shantanu
• themylogin
• Vaggelis Danias
• Willy Bruns

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

... (truncated)

Commits

• ad02a35 Skip test for 2.4.1
• cad7794 Finalize version to 2.4.1
• d9cbcbc Add changelog for Mypy 2.4.1 (#22310)
• 2860baa Process overloads as a whole in two-phase type-checking (#22231)
• 9b3e307 [mypyc] Skip recursive setup for frame-private nested functions (#22187)
• 10ad5f6 Bump ast-serialize to 0.12.1 (#22093)
• 350052f Bump ast-serialize to 0.12.0 (#22087)
• f7d08cf Bump version to 2.4.1+dev
• See full diff in compare view

Updates ruff from 0.17.1 to 0.17.3

Release notes

Sourced from ruff's releases.

0.17.3

Release Notes

Released on 2026-10-26.

Preview features

• [suspicious] Add shared-clock-mock (#29074)

Bug fixes

• [pyupgrade] Avoid incorrect conversions to f-strings (UP032) (#25485)

Performance

• Buffer stdout in ruff format (#29631)
• Specialize ASCII identifier lexing (#29503)
• Speed up identifier and keyword lexing (#29463)

Documentation

• [flake8-bandit] Describe what the rule actually checks for httpx (S113) (#27936)

Contributors

• @​itsvedantkumar
• @​charliermarsh
• @​anishgirianish

Install ruff 0.17.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.ps1 | iex"

Download ruff 0.17.3

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.3

Released on 2026-10-26.

Preview features

• [suspicious] Add shared-clock-mock (#29074)

Bug fixes

• [pyupgrade] Avoid incorrect conversions to f-strings (UP032) (#25485)

Performance

• Buffer stdout in ruff format (#29631)
• Specialize ASCII identifier lexing (#29503)
• Speed up identifier and keyword lexing (#29463)

Documentation

• [flake8-bandit] Describe what the rule actually checks for httpx (S113) (#27936)

Contributors

• @​itsvedantkumar
• @​charliermarsh
• @​anishgirianish

0.17.2

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

• Avoid intermediate names in lint name resolution (#29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
• Share postfix parsing and reduce expression copies (#29480)

... (truncated)

Commits

• ba65abf Bump version to 0.17.3 (#29745)
• fb2f921 [ty] Fix narrowing of strings and integers compared with enum members (#29743)
• d181287 [ty] Index nominal union alternatives (#29196)
• 07872ad [ty] Preserve string literals in comparisons with LiteralString (#29741)
• 95888b2 [ty] Preserve narrowing after guarded match subject captures (#29558)
• 3c8166b [ty] Fix hang when negating recursive unions of instance types (#29652)
• 3fd20e0 [ty] Preserve generic callback specializations during return refinement (#29667)
• 2f0a29e [ty] Record predicate truthiness alongside expression inference (#29706)
• 60f104a [ty] Honor @​override on overload implementations in stubs (#29470)
• 207ec3a [ty] Add diagnostic baseline support (#27636)
• Additional commits viewable in compare view

Updates types-python-dateutil from 2.9.0.20260807 to 2.9.0.20261029

Commits

• See full diff in compare view

Updates types-pytz from 2026.5.0.20261006 to 2026.6.0.20261031

Commits

• See full diff in compare view

Updates certifi from 2026.10.18 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• 662df63 Restore unaffected emSign roots (#439) (#440)
• See full diff in compare view

Updates django-dbbackup from 5.3.1 to 5.4.0

Release notes

Sourced from django-dbbackup's releases.

5.4.0

Added

• PostgreSQL connectors now forward the sslmode, sslrootcert, sslcert, sslkey, passfile and service keys of the Django database OPTIONS setting to pg_dump, psql and pg_restore as their matching libpq environment variable, the same way Django forwards them to its own command line tools. Backups and restores now use the TLS and client certificate configuration of the ORM, including the PostGIS activation step.

Changed

• A value set in the PostgreSQL OPTIONS setting now takes precedence over the same variable configured through ENV, DUMP_ENV or RESTORE_ENV, where the environment used to win.

Fixed

• ADMIN_PASSWORD is now passed to the PostGIS activation step, it had no effect until now.
• PgDumpBinaryConnector now applies RESTORE_ENV to pg_restore, which was receiving DUMP_ENV instead. DUMP_ENV no longer leaks into the restore phase, put in RESTORE_ENV the variables which were reaching pg_restore from it.
• DBBACKUP_GPG_ALWAYS_TRUST setting is now respected instead of being enabled whenever DBBACKUP_GPG_RECIPIENT is set. Encrypting to a public key that GPG does not trust will now fail, as documented, unless the key is trusted or DBBACKUP_GPG_ALWAYS_TRUST = True is set.
• Pass configured DBBACKUP_CONNECTORS settings when instantiating connector from backup metadata in dbrestore.
• dbrestore no longer discards the DROP and PG_OPTIONS values configured in DBBACKUP_CONNECTORS. --no-drop and --pg-options still take precedence when passed.
• Connector options holding a list or a dict (EXCLUDE, SCHEMAS, ENV, DUMP_ENV, RESTORE_ENV) are now copied per connector. dbbackup --exclude-tables used to append to the class default, silently excluding those tables from every other database of the same run and from connectors created afterwards.

Changelog

Sourced from django-dbbackup's changelog.

[5.4.0] - 2026-10-24

Added

• PostgreSQL connectors now forward the sslmode, sslrootcert, sslcert, sslkey, passfile and service keys of the Django database OPTIONS setting to pg_dump, psql and pg_restore as their matching libpq environment variable, the same way Django forwards them to its own command line tools. Backups and restores now use the TLS and client certificate configuration of the ORM, including the PostGIS activation step.

Changed

• A value set in the PostgreSQL OPTIONS setting now takes precedence over the same variable configured through ENV, DUMP_ENV or RESTORE_ENV, where the environment used to win.

Fixed

• ADMIN_PASSWORD is now passed to the PostGIS activation step, it had no effect until now.
• PgDumpBinaryConnector now applies RESTORE_ENV to pg_restore, which was receiving DUMP_ENV instead. DUMP_ENV no longer leaks into the restore phase, put in RESTORE_ENV the variables which were reaching pg_restore from it.
• DBBACKUP_GPG_ALWAYS_TRUST setting is now respected instead of being enabled whenever DBBACKUP_GPG_RECIPIENT is set. Encrypting to a public key that GPG does not trust will now fail, as documented, unless the key is trusted or DBBACKUP_GPG_ALWAYS_TRUST = True is set.
• Pass configured DBBACKUP_CONNECTORS settings when instantiating connector from backup metadata in dbrestore.
• dbrestore no longer discards the DROP and PG_OPTIONS values configured in DBBACKUP_CONNECTORS. --no-drop and --pg-options still take precedence when passed.
• Connector options holding a list or a dict (EXCLUDE, SCHEMAS, ENV, DUMP_ENV, RESTORE_ENV) are now copied per connector. dbbackup --exclude-tables used to append to the class default, silently excluding those tables from every other database of the same run and from connectors created afterwards.

Commits

• 85593e0 v5.4.0 release (#680)
• c138a08 Add client certificate support for PostgreSQL (#676)
• 337b9e7 Fix DBBACKUP_GPG_ALWAYS_TRUST being ignored (#678)
• 0ffe314 Pass DBBACKUP_CONNECTORS settings when restoring with metadata (#679)
• See full diff in compare view

Updates python-dateutil from 2.9.0.post0 to 3.0.0

Release notes

Sourced from python-dateutil's releases.

3.0.0

This is the last major version of dateutil that will support any version of Python older than 3.11. The next release will be the 4.x series, which will support Python 3.11 and later. We may release fixes for serious bugs in the 3.0.x series, but there are no plans for new features there.

The biggest change in this release is a rewrite of tz.tzfile, which affects nearly every user of dateutil.tz and changes the UTC offset of nonexistent times (see below). dateutil also now depends on the tzdata package, and no longer ships its own time zone database.

Data updates

• dateutil no longer bundles a copy of the IANA time zone database. Time zone data now comes from the system (see dateutil.tz.TZPATH) or, failing that, from the new tzdata dependency, so the data version is whatever version of tzdata is installed. (gh pr #1130)

Features

• Rewrote tz.tzfile based on a backport of the zoneinfo module's pure-Python implementation. This adds support for Version 2 and Version 3 tzfile(5) binaries, resolving issues with timestamps beyond 2038 and "slim" format binaries. (gh issues #462, #1059, gh pr #1130)
• Added dateutil.tz.TZPATH and dateutil.tz.reset_tzpath to allow for runtime configuration of the IANA time zone data search path. These replace the mutable dateutil.tz.TZPATHS list, which has been removed. (gh pr #1130)
• dateutil now depends on the tzdata package, which gettz consults after the search path and before the Windows registry. On Windows this means that names that are both IANA keys and Windows time zone names, such as "UTC", now return a tzfile rather than a tzwin. (gh pr #1130)

Bugfixes

• tz.tzfile now follows PEP 495 for times that fall in a gap: with fold=0 it uses the offset from before the transition, and with fold=1 the offset from after it. Previously it always used the offset from after the transition, so for example datetime(2003, 4, 6, 2, 30, tzinfo=tz.gettz("America/New_York")) had a UTC offset of -04:00, where it now has -05:00, the same as with zoneinfo. (gh pr #1130)
• tz.tzfile objects for fixed-offset zones, such as tz.gettz("UTC"), now return their offset, DST offset and abbreviation when utcoffset, dst and tzname are called with None, as tz.tzutc, tz.tzoffset and zoneinfo.ZoneInfo do. This means that datetime.time objects with such a zone attached are now aware: time(12, tzinfo=tz.gettz("UTC")).isoformat() is now "12:00:00+00:00" rather than "12:00:00". (gh pr #1130)
• tz.tzfile now infers dst() from the standard time on both sides of each DST period, rather than only the one before it, and does so for each transition rather than for each local time type. This fixes dst() for double summer time (e.g. in Europe/London in the 1940s), for half-hour DST (e.g. in Pacific/Rarotonga) and where the standard offset changed at the same time as a DST transition (e.g. in America/Bahia_Banderas in 2010). Against the standard offsets in the tz database source, the only remaining errors are in Europe/Paris in 1944 and 1945. (gh pr #1130)
• Fixed rrulestr raising ValueError on experimental X- parameters in an RRULE line (such as GNOME Evolution's X-EVOLUTION-ENDDATE); these are now ignored as RFC 5545 permits. Fixed by @​yajo (gh pr #1374)
• Enabled pickling and deepcopy of cached rrule and rruleset instances. The cache setting is preserved, and cached results are regenerated on demand without copying locks or generators. Reported by @​niccokunzmann (gh issue #1369). Fixed by @​Jay1023CN (gh pr #1600).
• Fixed relativedelta.__ne__ raising TypeError when comparing against an unsupported type such as None; it now returns True. Reported and fixed by @​kevinkt1 (gh issue #1157, gh pr #1158)
• Raised the minimum version of six to 1.6, fixing No module named 'six.moves' errors with older versions. Reported by @​skytreader (gh issue #1415), fixed by @​jdarias3 (gh pr #1424).

Deprecations

• Deprecated the dateutil.zoneinfo module. The module now acts as a wrapper around the tzdata package and will be removed in a future version. Users are encouraged to migrate to dateutil.tz.gettz or the standard library's zoneinfo module. dateutil.zoneinfo.rebuild.rebuild no longer does anything, and by default raises RebuildDeprecationWarning as an error; filter the warning to call it as a no-op. (gh pr #1130)
• Deprecated passing gettz a relative key that refers to a file outside of every directory on TZPATH, such as "../../etc/localtime". By default this now raises dateutil.tz.DeprecatedTzKeyWarning as an error; filter the warning to keep the old behavior for now, or pass an absolute path instead. (gh pr #1130)

Documentation changes

• Added intersphinx to the docs build and cleaned up some broken links. (gh pr #1463)

Misc

• Releases are now uploaded to PyPI using trusted publishing, and the built sdist and wheel are tested on all supported platforms before upload. (gh pr #1619, #1622)
• Changes to CI, tests and release tooling that do not affect users of the package: gh pr #1417, #1462, #1464, #1465, #1466, #1467, #1468, #1469, #1470, #1499, #1501, #1504, #1576, #1577, #1578, #1581, #1585.

Changelog

Sourced from python-dateutil's changelog.

Version 3.0.0 (2026-10-21)

This is the last major version of dateutil that will support any version of Python older than 3.11. The next release will be the 4.x series, which will support Python 3.11 and later. We may release fixes for serious bugs in the 3.0.x series, but there are no plans for new features there.

The biggest change in this release is a rewrite of tz.tzfile, which affects nearly every user of dateutil.tz and changes the UTC offset of nonexistent times (see below). dateutil also now depends on the tzdata package, and no longer ships its own time zone database.

Data updates

• dateutil no longer bundles a copy of the IANA time zone database. Time zone data now comes from the system (see dateutil.tz.TZPATH) or, failing that, from the new tzdata dependency, so the data version is whatever version of tzdata is installed. (gh pr #1130)

Features

• Rewrote tz.tzfile based on a backport of the zoneinfo module's pure-Python implementation. This adds support for Version 2 and Version 3 tzfile(5) binaries, resolving issues with timestamps beyond 2038 and "slim" format binaries. (gh issues #462, #1059, gh pr #1130)
• Added dateutil.tz.TZPATH and dateutil.tz.reset_tzpath to allow for runtime configuration of the IANA time zone data search path. These replace the mutable dateutil.tz.TZPATHS list, which has been removed. (gh pr #1130)
• dateutil now depends on the tzdata package, which gettz consults after the search path and before the Windows registry. On Windows this means that names that are both IANA keys and Windows time zone names, such as "UTC", now return a tzfile rather than a tzwin. (gh pr #1130)

Bugfixes

• tz.tzfile now follows PEP 495 for times that fall in a gap: with fold=0 it uses the offset from before the transition, and with fold=1 the offset from after it. Previously it always used the offset from after the transition, so for example datetime(2003, 4, 6, 2, 30, tzinfo=tz.gettz("America/New_York")) had a UTC offset of -04:00, where it now has -05:00, the same as with zoneinfo. (gh pr #1130)
• tz.tzfile objects for fixed-offset zones, such as tz.gettz("UTC"), now return their offset, DST offset and abbreviation when utcoffset, dst and tzname are called with None, as tz.tzutc, tz.tzoffset and

... (truncated)

Commits

• 10f317f Prepare release 3.0.0
• fabac8d Run the tests against a wheel built once on a recent Python
• 21b6862 Allow pickling and deepcopy of cached recurrence rules (#1600)
• bd5fd88 Remove deprecated setuptools usage from the build
• 962f0a5 Don't fetch an unpinned setuptools_scm via setup_requires
• db944cf Update the Python version classifiers
• 3b07521 Test on Python 3.14t, 3.15 and 3.15t
• 6899421 Fix dateutil/dateutil#1157
• bc90ab4 Use trusted publishing to upload to PyPI
• 950abb6 fix(rrule): don't die on experimental properties
• Additional commits viewable in compare view

Updates pytz from 2026.5 to 2026.6

Commits

• e3c6fe2 Bump version numbers to 2026.6/2026f
• 23e2e67 IANA 2026f
• e6f3078 Squashed 'tz/' changes from 039ef27cc5..d8acf4bc22
• See full diff in compare view

Updates sentry-sdk from 2.72.0 to 2.73.0

Release notes

Sourced from sentry-sdk's releases.

2.73.0

New Features ✨

• (arq) Add an option to monitor arq cron jobs by @​wedamija in #8051
• (huey) Add an option to monitor Huey periodic tasks by @​wedamija in #8052
• (rq) Add an option to monitor rq-scheduler jobs by @​wedamija in #8053
• (types) Export Attributes from the public types module by @​sansynx in #8019

Bug Fixes 🐛

• (arq) Don't monitor cron jobs with unsupported schedules by @​wedamija in #8098
• (attributes) Handle special float values correctly by @​sentrivana in #8067
• (celery) Don't round down beat schedule intervals by @​wedamija in #7842
• (cohere) Stop swallowing exceptions during stream iteration by @​intertermux-code in #8017
• (huggingface_hub) Stop swallowing exceptions during stream iteration by @​intertermux-code in #8018
• Exclude litellm==1.107.0 from extras by @​jonny-norwine in #8104

Internal Changes 🔧

Deps

• Update github workflows by @​renovate in #8045
• Update github workflows by @​renovate in #8036
• Update github workflows by @​renovate in #7276

Other

• (litellm) Require filelock>=4.0.3 on Python 3.10/3.11 by @​sentry-junior in #8026
• (monitor) Stop background health checks in tests that drive the monitor by @​sentry-junior in #8032
• Update AGENTS.md by @​sentrivana in #8077
• 🤖 Update test matrix with new releases (10/12) by @​github-actions in #7944

Changelog

Sourced from sentry-sdk's changelog.

2.73.0

New Features ✨

• (arq) Add an option to monitor arq cron jobs by @​wedamija in #8051
• (huey) Add an option to monitor Huey periodic tasks by @​wedamija in #8052
• (rq) Add an option to monitor rq-scheduler jobs by @​wedamija in #8053
• (types) Export Attributes from the public types module by @​sansynx in #8019

Bug Fixes 🐛

• (arq) Don't monitor cron jobs with unsupported schedules by @​wedamija in #8098
• (attributes) Handle special float values correctly by @​sentrivana in #8067
• (celery) Don't round down beat schedule intervals by @​wedamija in #7842
• (cohere) Stop swallowing exceptions during stream iteration by @​intertermux-code in #8017
• (huggingface_hub) Stop swallowing exceptions during stream iteration by @​intertermux-code in #8018
• Exclude litellm==1.107.0 from extras by @​jonny-norwine in #8104

Internal Changes 🔧

Deps

• Update github workflows by @​renovate in #8045
• Update github workflows by @​renovate in #8036
• Update github workflows by @​renovate in #7276

Other

• (litellm) Require filelock>=4.0.3 on Python 3.10/3.11 by @​sentry-junior in #8026
• (monitor) Stop background health checks in tests that drive the monitor by @​sentry-junior in #8032
• Update AGENTS.md by @​sentrivana in #8077
• 🤖 Update test matrix with new releases (10/12) by @​github-actions in #7944

Commits

• 54160ae release: 2.73.0
• 25d265b fix: Exclude litellm==1.107.0 from extras (#8104)
• 60116ac fix(celery): Don't round down beat schedule intervals (#7842)
• 68bc4dd fix(arq): Don't monitor cron jobs with unsupported schedules (#8098)
• 1c249d8 feat(huey): Add an option to monitor Huey periodic tasks (#8052)
• 4e19592 feat(rq): Add an option to monitor rq-scheduler jobs (#8053)
• f8b08b3 meta: Update AGENTS.md (#8077)
• cfce72f chore(deps): bump uv from 0.13.0 to 0.13.4 (#8095)
• a9553c4 feat(arq): Add an option to monitor arq cron jobs (#8051)
• 641517a fix(attributes): Handle special float values correctly (#8067)
• Additional commits viewable in compare view

Updates yt-dlp from 2026.8.19 to 2026.10.26

Release notes

Sourced from yt-dlp's releases.

yt-dlp 2026.10.26

A description of the various files is in the README

The zipimport Unix executable and release tarball contain code licensed under ISC and MIT. The PyInstaller-bundled executables are subject to these and other licenses, all of which are compiled in THIRD_PARTY_LICENSES.txt

---

Important changes

• The minimum required Python version has been raised to 3.11
  • Python 3.10 has reached its end-of-life as of October 2026, and yt-dlp has now removed support for it. Read more
• The official Windows release binaries now require Windows 10 or later. Read more
• Security: The recent brotli and certifi vulnerabilities have now been fully addressed in the executables
  • The brotli package bundled with the executables has been upgraded to version 1.2.1, and the curl-cffi package has been upgraded to version 0.17.0. These upgrades address the recent brotli security vulnerability
  • curl-cffi 0.17.0 also fully addresses the recent certifi security vulnerability that was already partially addressed by upgrading the certifi package bundled with the executables

Core changes

• Remove Python 3.10 support (#17160) by bashonly, doe1080, Grub4K

Extractor changes

• odnoklassniki: Fix boosty direct link extraction (#17749) by bashonly

Networking changes

• Request Handler: curl_cffi: Support curl_cffi 0.17.x (#17929) by bashonly (With fixes in 15262b0)

Misc. changes

• build
  • Always use latest Python version on Windows (#17901) by bashonly
  • Update 13 dependencies (#17924) by bashonly, dlp-bot
  • Update 3 dependencies (#17933) by dlp-bot
• ci
  • Test with PyPy 3.12 (#17926) by gamer191
  • Update 7 actions in 9 workflows (#17925) by bashonly, dlp-bot
• cleanup: Miscellaneous: 7e3644c by bashonly, doe1080
• docs: Add changelog entries for dropping Py3.10 & Win8 support (#17889) by bashonly

yt-dlp 2026.10.21

A description of the various files is in the README

The zipimport Unix executable and release tarball contain code licensed under ISC and MIT. The PyInstaller-bundled executables are subject to these and other licenses, all of which are compiled in THIRD_PARTY_LICENSES.txt

---

... (truncated)

Changelog

Sourced from yt-dlp's changelog.

2026.10.26

Important changes

• The minimum required Python version has been raised to 3.11
  • Python 3.10 has reached its end-of-life as of October 2026, and yt-dlp has now removed support for it. Read more
• The official Windows release binaries now require Windows 10 or later. Read more
• Security: The recent brotli and certifi vulnerabilities have now been fully addressed in the executables
  • The brotli package bundled with the executables has been upgraded to version 1.2.1, and the curl-cffi package has been upgraded to version 0.17.0. These upgrades address the recent brotli security vulnerability
  • curl-cffi 0.17.0 also fully addresses the recent certifi security vulnerability that was already partially addressed by upgrading the certifi package bundled with the executables

Core changes

• Remove Python 3.10 support (#17160) by bashonly, doe1080, Grub4K

Extractor changes

• odnoklassniki: Fix boosty direct link extraction (#17749) by bashonly

Networking changes

• Request Handler: curl_cffi: Support curl_cffi 0.17.x (#17929) by bashonly (With fixes in 15262b0)

Misc. changes

• build
  • Always use latest Python version on Windows (#17901) by bashonly
  • Update 13 dependencies (#17924) by bashonly, dlp-bot
  • Update 3 dependencies (#17933) by dlp-bot
• ci
  • Test with PyPy 3.12 (#17926) by gamer191
  • Update 7 actions in 9 workflows (#17925) by bashonly, dlp-bot
• cleanup: Miscellaneous: 7e3644c by bashonly, doe1080
• docs: Add changelog entries for dropping Py3.10 & Win8 support (#17889) by bashonly

2026.10.21

Important changes

• Security: Old yt-dlp executables are vulnerable to man-in-the-middle attacks
  • A man-in-the-middle/MITM attack is when your internet traffic is intercepted by an attacker that impersonates the website(s) you browse and sends you malicious data instead.
  • If you think you may be targeted by such an attack, it is strongly recommended to avoid using the self-updater (e.g. the -U, --update, --update-to command-line options), and instead manually download and install this release's executable.
  • For more details, see the certifi security advisory

Core changes

• update
  • Detect GitHub error page responses (#17555) by bashonly
  • Remove bad advice (#17492) by bashonly
• utils
  • Improve Content-Disposition filename parsing (#17727) by doe1080
  • devalue: Improve binary type parsing (#16934) by doe1080
  • download_range_func: Improve __eq__ and __repr__ (#16393) by atsushi2965
  • setproctitle: Fix NUL termination (#17724) by doe1080
  • subs_list_to_dict: Fix empty value handling (

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[vpetersson-bot]

LGTM. This replaces #3430, which I reviewed on 2026-10-29. It has the same set plus four new bumps: certifi, yt-dlp, pytz/types-pytz and time-machine.

• python-dateutil 2.9 → 3.0.0 is still the only major bump. Anthias only calls dateutil.parser.parse in src/anthias_server/api/helpers.py, and the parser didn't change in 3.0.
• The rest are patch or minor releases: mypy, ruff, typeshed stubs, certifi, django-dbbackup 5.4 (PostgreSQL/GPG changes we don't use), pytz, sentry-sdk, yt-dlp, pytest, playwright and time-machine. mypy, the linter, the build, CodeQL and the TS tests all pass.

The failing run-python-tests job is not from this PR. The only failure is tests/test_upgrade_containers_script.py::test_reboot_gate_still_skips_the_image_purge (assert 385 < 261, "the reboot gate should still sit above the stale-image purge"). That test does a static check of line order in the upgrade shell script. It fails the same way on master at this PR's base 6a8202b. Master went red at #3415 (a6b258c, "reclaim what a failed pull leaves behind"), which added a PURGE_SCRIPT call above the reboot gate. That needs a fix on master, either in the test or in the script, and is unrelated to these bumps.