[dependabot]

Bumps the python-dependencies group with 4 updates: python-multipart, pandas, yfinance and hypothesis.

Updates python-multipart from 0.0.32 to 0.0.33

Release notes

Sourced from python-multipart's releases.

Version 0.0.33

🛡️ Safer form parsing

This release lets you cap URL-encoded form fields as they stream in, and fixes several upload and decoding edge cases. It also drops Python 3.10 and adds Python 3.15.

pip install python-multipart==0.0.33

• Limit URL-encoded fields while streaming (#333). The new opt-in MAX_FIELDS and MAX_FIELD_SIZE options for FormParser raise FormParserError before oversized data is buffered. Both default to no limit, and multipart forms are unaffected.
• Nameless uploads no longer crash when spilled to disk (#343). Uploads without a filename used to raise AttributeError when UPLOAD_KEEP_EXTENSIONS or UPLOAD_KEEP_FILENAME was set.
• UPLOAD_DIR accepts str with UPLOAD_KEEP_FILENAME (#335). A str upload directory used to fail on the first write to disk.
• Decoded data is complete before callbacks run (#336, #355). Content-Transfer-Encoding decoders are finalized at the end of each part, and quoted-printable escapes split across writes decode correctly.
• parse_options_header lowercases content types with parameters (#287). Multipart/Form-Data; boundary=abc now returns multipart/form-data, the same as headers without parameters.

⚡ Faster parsing

• Faster opening boundary matching (#328). Complete boundaries are matched in one step.
• Faster parser state lookups (#330). Parser states are module-level enum members, so their repr is now multipart.END instead of <MultipartState.END: 12>.
• Faster querystring callback dispatch (#316).

🐍 Python support

• Python 3.10 is no longer supported (#329). Python 3.11 is now the minimum.
• Python 3.15 is supported (#350).

💜 Thank you

Thanks to @​Edneam, @​sungbin1015, @​carlok, and @​fjvbn2003 for contributing to this release.

Thanks to the individual sponsors who contributed $134.00 to support this work. If python-multipart is useful to you, consider sponsoring me on GitHub.

Full changelog: 0.0.32...0.0.33

Changelog

Sourced from python-multipart's changelog.

0.0.33 (2026-10-31)

• Drop Python 3.10 support #329.
• Add Python 3.15 support #350.
• Add opt-in field-count and field-size limits for URL-encoded forms in FormParser #333.
• Normalize the content type returned by parse_options_header when the header has parameters #287.
• Finalize Content-Transfer-Encoding decoding before invoking field and file callbacks #336.
• Keep only the incomplete escape when quoted-printable data is split across writes #355.
• Handle nameless uploads when UPLOAD_KEEP_FILENAME or UPLOAD_KEEP_EXTENSIONS is set #343.
• Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set #335.
• Speed up parser state lookups #330.
• Speed up opening boundary matching #328.
• Speed up querystring callback dispatch #316.

Commits

• 9217f26 Bump version to 0.0.33 (#357)
• d0344c1 Keep only the incomplete escape when quoted-printable data is split (#355)
• 44871df Handle nameless uploads when keeping the filename or extension (#343)
• b21ea59 Add streaming field limits to FormParser (#333)
• 48f9e21 Fix the In-Depth Example in the docs to return bytes (#338)
• 12a2f8f Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set (#335)
• 95f6376 Use the shared security policy (#353)
• 8ec84ef Migrate documentation from MkDocs to Zensical (#352)
• d7af81c Rewrite README for newcomers (#351)
• b035d14 Add Python 3.15 classifier (#350)
• Additional commits viewable in compare view

Updates pandas from 3.1.0 to 3.1.1

Release notes

Sourced from pandas's releases.

pandas 3.1.1

We are pleased to announce the release of pandas 3.1.1. This is a patch release in the 3.1.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.1.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.1.*

Or from conda-forge

conda install -c conda-forge pandas=3.1

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• 3dcc6fb RLS: 3.1.1
• 01560e3 Backport PR #71896 on branch 3.1.x (DOC: cleanup 3.1.1 whatsnew) (#71898)
• 49709c4 [backport 3.1.x] BUG: ffill/bfill on Arrow arrays without NA returns a view o...
• 55089f8 Backport PR #71025 on branch 3.1.x (BUG: \s and \S in str regex methods missi...
• eea23d0 Backport PR #71782 on branch 3.1.x (BUG: py.path.local treated as an open buf...
• e427eb5 [backport 3.1.x] DOC: avoid system-ui in default font-family for the docs (re...
• 3120a57 Backport PR #71572 on branch 3.1.x (BLD: don't include moments_simd.hpp in mo...
• 378620e Backport PR #71865 on branch 3.1.x (REGR: ensure map() with datetime-like dty...
• ceca8cb Backport PR #71495 on branch 3.1.x (BUG: support python-dateutil 3.0 tzfile (...
• 68fc76e Backport PR #71661 on branch 3.1.x (CI: Remove install requirement-dev.txt sm...
• Additional commits viewable in compare view

Updates yfinance from 1.7.0 to 1.8.0

Release notes

Sourced from yfinance's releases.

1.8.0

Features

• Force curl_cffi >= 0.17 for security updates
• Tickers.calendar and Tickers.info (use at your own risk of being spam-blocked)
• Add methodology to EPS
• Price-split-repair improvement

Lots of fixes! Full changelog #3016

Thanks @​dwaddle @​heykav @​idpfaff @​jackiectl2 @​LeonxLJX @​louis75aubin-prog @​mehdyhaghy @​monody0007 @​ryanduguid @​Shawn-Kim96 @​spicysharkco @​WatchTree-19 @​wavebyrd

Changelog

Sourced from yfinance's changelog.

1.8.0

Feature

• Price repair: fix split-like level shift that has no matching split, using 1h data #2990 @​Shawn-Kim96
• Analysis: add 'methodology' arg to select GAAP or Normalized EPS #2999 @​louis75aubin-prog
• Tickers: add info and calendar, fetched in parallel #3015 @​louis75aubin-prog
• Let ticker lookups recover after a bad response #3029 @​idpfaff Fixes
• fix: set freq on daily/weekly/monthly/quarterly price history #2962 @​LeonxLJX
• Treat "1h" as intraday in safe_merge_dfs #2980 @​WatchTree-19
• Rescale the live row by the detected unit factor for KWF #2979 @​WatchTree-19
• Use the dividend currency's FX ticker when converting to USD #2981 @​WatchTree-19
• Cache earnings dates by limit and offset #2983 @​WatchTree-19
• Support 60m in price reconstruction like 1h #2984 @​WatchTree-19
• fix: keep calendar caches consistent after failed requests #2988 @​monody0007
• Anchor 1wk/1mo/3mo index freq on Yahoo's bar labels #2985 @​WatchTree-19
• Keep earnings dates on their rows after dropping undated rows #2982 @​WatchTree-19
• Shift a start/end date forward when midnight falls in a DST gap #3001 @​spicysharkco
• Round only price columns when rounding=True #3000 @​wavebyrd
• Cache get_news results per count and tab #3003 @​wavebyrd
• Fix dividends/splits/capital_gains returning None instead of empty Series on price fetch failure #2977 @​heykav
• Keep merged dividends when intraday splits are out of range #3005 @​wavebyrd
• fix: keep weekly live bars inside their calendar week #3013 @​jackiectl2
• Send count as size when screen() switches predefined query to the offset API #3006 @​wavebyrd
• fix: replace deprecated inplace=True with assignment to eliminate Pandas4Warning (#3009) #3020 @​dwaddle
• Honour download(threads=N) concurrency cap #3019 @​louis75aubin-prog
• Fix get_news() returning empty list: use Yahoo's news GraphQL API (#3004) #3018 @ mehdyhaghy
• Pass tz and session to FX PriceHistory in dividend conversion #3028 @​ryanduguid Maintenance
• perf: optimize option_chain namedtuple creation and add type hints #2965 @​dwaddle
• Drop the multitasking dependency #3026 @​louis75aubin-prog

Commits

• e2f6104 Version 1.8.0
• caf29f7 Merge pull request #3016 from ranaroussi/dev
• 107598a Update funding sources in FUNDING.yml
• bec1afe Update GH actions
• b339c4e Merge pull request #3028 from ryanduguid/ryan/fx-dividend-history-tz
• eebc2ed Merge pull request #3018 from mehdyhaghy/fix/get-news-newest-first
• 9a4cf3f Fix get_news() returning empty list: use Yahoo's news GraphQL API
• ef26c96 Merge pull request #3026 from louis75aubin-prog/chore/drop-multitasking
• 2cf2220 Pass tz and session to FX PriceHistory in dividend conversion
• 6c3d439 Merge pull request #3029 from idpfaff/fix/lookup-json-retry
• Additional commits viewable in compare view

Updates hypothesis from 6.170.14 to 6.170.15

Commits

• 9ab0be6 Bump hypothesis version to 6.170.15 and update changelog
• 460d72f Merge pull request #4946 from jorenham/typing/errors/coverage
• 26f1634 Enfore 100% public type coverage in CI with pyrefly coverage check
• fb08018 version: fill in the missing type annotation
• 7af7891 Rephrase release note as suggested in review
• 95e0906 Add release notes
• b7d5433 extra.ghostwriter: fill in the missing type annotations
• 3537278 extra.codemods: fill in the missing type annotations
• bd1a894 extra.dpcontracts: fill in the missing type annotation
• 4bb761e errors: remove spurious blank line
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.