Bump the minor-or-patch group across 1 directory with 3 updates

[dependabot]

Bumps the minor-or-patch group with 3 updates in the / directory: beartype, sphinx-substitution-extensions and urllib3.

Updates beartype from 0.22.4 to 0.22.9

Release notes

Sourced from beartype's releases.

Beartype 0.22.9: Party in Da QA House

@​beartype 0.22.9 celebrates one million @​beartype downloads a day! We wanted to rent out a loft warehouse space, flip a dry ice machine off Ebay for pennies, shadow-drop DJ Lorien Testard, invite all our GitHub homies, and get down and funky with this QA quinceañera. It didn't happen. I released instead. The memories we might have made are only another patch release in the 0.22.X dev cycle. Bear friends, it's your time to shine tonight:

# Via "pip", the once-great venerable master packager now fallen on hard times:
$ pip install --upgrade beartype      # <-- you go, pipe-smoking pip
Via "uv", the plucky upstart spiky-haired kid wielding a sword larger than its body:
$ uv pip install --upgrade beartype   # <-- when you no longer have the strength to care about lock files
Via "conda", the corporate scientist in casual lab attire who wants to be your buddy, pal:
$ conda config --add channels conda-forge  # <-- where did python packaging go wrong?
$ conda install conda-forge::beartype      # <-- it all seemed so simple, once.

@​beartype 0.22.9: "Wave your keyboards in the air like those bugs don't care."

one million downloads a day says you can't stop this party

@​beartype 0.22.9 is helping @​leycec and his beautiful science wife to eat food. Thanks entirely to...

GitHub Sponsors: Befriend the Bear and Get a Bear for Life

This release comes courtesy these proud GitHub Sponsors, without whom everyone in the @​leycec family would currently be eating grasshoppers in the abandoned back lot again:

• @​sesco-llc (SESCO Enterprises), "The Power of Innovation in Trading": this inspires me to get out of the house and do something https://sescollc.com
• @​DylanModesitt (Dylan Modesitt), quantitative strategies energy trading associate: ...wikipedia, don't fail me now! https://dylanmodesitt.com
• [Tidelift][], graciously paying out recurring income to security-sensitive open-source projects like @​beartype: so much hype https://www.sonarsource.com/products/sonarqube/advanced-security

If you represent a security-conscious corporate, government, or non-profit, the best way bar none for you to support @​beartype and secure your own workflow is by subscribing to [Tidelift][] through [SonarQube Advanced Security][]. Security giant [Sonar][] recently acquired [Tidelift][], guaranteeing the economic viability of the Tidelift model for billions of future open-source projects that have yet to be born. Join the jargon-laden conversation and pay someone else to think about unreadable acronyms like SAST, SCA, and SBOM for once.

Thanks so much, masters of fintech and lifted tides.

The Masters of Fintech and Lifted Tides. That's who.

PyInstaller: Bundling Your Type-Checked Apps Since Now

@​beartype 0.22.9 brings official support for... wait. [PyInstaller][]? Hasn't @​beartype supported [PyInstaller][] since the beginning? Yeah. We thought so too. Then Meta was all like: "Oh no you don't, @​beartype." 😂

@​beartype has officially supported competing products like Nuitka for years. Now PyInstaller joins the ranks. But it's not just PyInstaller. @​beartype 0.22.9 should also resolve any similar pending issues with other app bundling frameworks like... uhh, Briefcase? No idea, honestly. That's untested wishful thinking. The very best kind.

@​beartype 0.22.9: When you realize a small part of you still cares about desktop apps.

Your bundled app moments after being packaged with @​beartype. It's... not good.

... (truncated)

Commits

• 9430c65 Beartype 0.22.9: Party in Da QA House
• 9a3c642 PyInstaller x 3.
• e29b2d5 Superficial ty compatibility.
• 8cd5e99 PyInstaller x 2.
• 0302808 PyInstaller x 1.
• cf3f9d7 Pytest subprocess sanitization x 1.
• ae62686 Mypy integration test improved.
• fbfddc4 Synchronous generator code optimized.
• eca38eb Beartype 0.23.0 restarted. sigh
• 8a046e0 Beartype 0.22.8: The Return of the Generator Return
• Additional commits viewable in compare view

Updates sphinx-substitution-extensions from 2025.10.24 to 2025.12.15

Release notes

Sourced from sphinx-substitution-extensions's releases.

Release 2025.12.15

2025.12.15 (2025-12-15)

Release 2025.11.17

2025.11.17 (2025-11-17)

Changelog

Sourced from sphinx-substitution-extensions's changelog.

2025.12.15

2025.11.17

• Give version in extension metadata.

• literalinclude directive now supports the following options:

  • :content-substitutions: - Performs substitutions on the included file content.
  • :path-substitutions: - Performs substitutions on the file path.

• image directive now supports the following option:

  • :path-substitutions: - Performs substitutions on the image file path.

• Add substitutions_default_enabled configuration option to enable substitutions by default. When set to True in conf.py:

  • Substitutions are applied to all code-block directives without requiring the :substitutions: flag. Use the :nosubstitutions: flag on individual code blocks to disable substitutions when the default is enabled.
  • Substitutions are applied to all literalinclude directives (both content and path) without requiring the :content-substitutions: or :path-substitutions: flags. Use the :nocontent-substitutions: or :nopath-substitutions: flags on individual literalinclude directives to disable substitutions when the default is enabled.
  • Substitutions are applied to all image directives (path) without requiring the :path-substitutions: flag. Use the :nopath-substitutions: flag on individual image directives to disable substitutions when the default is enabled.

Commits

• c1f6d8e Bump CHANGELOG
• 11b41e0 Merge pull request #1291 from adamtheturtle/detail-bug
• cd42bde Remove unnecessary changes
• 4bf60b7 We need to have the extension loaded to use nosubstitutions
• af9c2a0 Avoid modifying the base CodeBlock
• cd34754 Merge pull request #1290 from adamtheturtle/empty-file-bug
• 47c604c Handle empty file in literalinclude
• 2ffdeca Fix failing test
• 8211d74 Add failing test
• 553c853 Merge pull request #1289 from adamtheturtle/ty
• Additional commits viewable in compare view

Updates urllib3 from 2.5.0 to 2.6.2

Release notes

Sourced from urllib3's releases.

2.6.2

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

• Fixed HTTPResponse.read_chunked() to properly handle leftover data in the decoder's buffer when reading compressed chunked responses. (urllib3/urllib3#3734)

2.6.1

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

• Restore previously removed HTTPResponse.getheaders() and HTTPResponse.getheader() methods. (#3731)

2.6.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

• Fixed a security issue where streaming API could improperly handle highly compressed HTTP content ("decompression bombs") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (CVE-2025-66471 reported by @​Cycloctane, 8.9 High, GHSA-2xpw-w6gg-jr37)
• Fixed a security issue where an attacker could compose an HTTP response with virtually unlimited links in the Content-Encoding header, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (CVE-2025-66418 reported by @​illia-v, 8.9 High, GHSA-gm62-xv2j-4w53)

[!IMPORTANT]

• If urllib3 is not installed with the optional urllib3[brotli] extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security fixes and avoid warnings. Prefer using urllib3[brotli] to install a compatible Brotli package automatically.
• If you use custom decompressors, please make sure to update them to respect the changed API of urllib3.response.ContentDecoder.

Features

• Enabled retrieval, deletion, and membership testing in HTTPHeaderDict using bytes keys. (#3653)
• Added host and port information to string representations of HTTPConnection. (#3666)
• Added support for Python 3.14 free-threading builds explicitly. (#3696)

Removals

• Removed the HTTPResponse.getheaders() method in favor of HTTPResponse.headers. Removed the HTTPResponse.getheader(name, default) method in favor of HTTPResponse.headers.get(name, default). (#3622)

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.6.2 (2025-12-11)

• Fixed HTTPResponse.read_chunked() to properly handle leftover data in the decoder's buffer when reading compressed chunked responses. ([#3734](https://github.com/urllib3/urllib3/issues/3734) <https://github.com/urllib3/urllib3/issues/3734>__)

2.6.1 (2025-12-08)

• Restore previously removed HTTPResponse.getheaders() and HTTPResponse.getheader() methods. ([#3731](https://github.com/urllib3/urllib3/issues/3731) <https://github.com/urllib3/urllib3/issues/3731>__)

2.6.0 (2025-12-05)

Security

• Fixed a security issue where streaming API could improperly handle highly compressed HTTP content ("decompression bombs") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (GHSA-2xpw-w6gg-jr37 <https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37>__)
• Fixed a security issue where an attacker could compose an HTTP response with virtually unlimited links in the Content-Encoding header, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (GHSA-gm62-xv2j-4w53 <https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53>__)

.. caution::

• If urllib3 is not installed with the optional urllib3[brotli] extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security fixes and avoid warnings. Prefer using urllib3[brotli] to install a compatible Brotli package automatically.

• If you use custom decompressors, please make sure to update them to respect the changed API of urllib3.response.ContentDecoder.

Features

• Enabled retrieval, deletion, and membership testing in HTTPHeaderDict using bytes keys. ([#3653](https://github.com/urllib3/urllib3/issues/3653) <https://github.com/urllib3/urllib3/issues/3653>__)
• Added host and port information to string representations of HTTPConnection. ([#3666](https://github.com/urllib3/urllib3/issues/3666) <https://github.com/urllib3/urllib3/issues/3666>__)
• Added support for Python 3.14 free-threading builds explicitly. ([#3696](https://github.com/urllib3/urllib3/issues/3696) <https://github.com/urllib3/urllib3/issues/3696>__)

... (truncated)

Commits

• 83f8643 Release 2.6.2
• 571a9b7 Fix HTTPResponse.read_chunked when leftover data is present in decoder's bu...
• bfe8e19 Release 2.6.1
• 3ceeb84 Restore getheaders() and getheader() (#3732)
• 720f484 Release 2.6.0
• 24d7b67 Merge commit from fork
• c19571d Merge commit from fork
• 816fcf0 Bump actions/setup-python from 6.0.0 to 6.1.0 (#3725)
• 18af0a1 Improve speed of BytesQueueBuffer.get() by using memoryview (#3711)
• 1f6abac Bump versions of pre-commit hooks (#3716)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions