[dependabot]

Updates the requirements on url-normalize to permit the latest version.

Release notes

Sourced from url-normalize's releases.

3.1.0

Upgrade notes

Python 3.11 or newer and idna>=3.20 are now required. Python 3.10 users must upgrade Python before installing this release.

Remove the charset keyword from calls to url_normalize() and url_humanize(), and remove -c / --charset from CLI commands. These options have been removed; Unicode URL characters always use UTF-8 percent encoding.

Hosts ending in Unicode equivalents of a dot now normalize without a trailing dot on the first pass. Query filtering now retains explicitly allowed names containing Unicode or spaces. If normalized URLs are used as cache keys or deduplication identifiers, review stored keys and re-normalize the original URLs where available.

Changed

• BREAKING: Drop support for end-of-life Python 3.10; Python 3.11 or newer is required.
• BREAKING: Remove the legacy charset API argument and -c / --charset CLI option.
• Declare Python 3.15 support in package metadata.
• Require idna>=3.20.

Fixed

• Write CLI error diagnostics in UTF-8, including Unicode arguments on Windows.
• Strip trailing Unicode IDNA label separators from hosts and custom allowlist domain keys in one normalization pass.
• Normalize allowlisted query parameter names consistently with URL query keys, including Unicode and spaces, while keeping literal plus signs, encoded plus signs, and encoded spaces distinct.

Internal

• Refresh dependencies, pre-commit hooks, and GitHub Actions.
• Use the committed dependency lockfile for CI checks and tests.
• Test every supported Python version from 3.11 through 3.15 on Linux, macOS, and Windows.
• Make uv run CI tests with the Python interpreter selected by the matrix.
• Run pytest as a Python module so coverage measures the checkout instead of an installed copy.

Full changes: niksite/url-normalize@v3.0.1...v3.1.0

Changelog

Sourced from url-normalize's changelog.

[3.1.0] - 2026-10-28

Upgrade notes

Python 3.11 or newer and idna>=3.20 are now required. Python 3.10 users must upgrade Python before installing this release.

Remove the charset keyword from calls to url_normalize() and url_humanize(), and remove -c / --charset from CLI commands. These options have been removed; Unicode URL characters always use UTF-8 percent encoding.

Hosts ending in Unicode equivalents of a dot now normalize without a trailing dot on the first pass. Query filtering now retains explicitly allowed names containing Unicode or spaces. If normalized URLs are used as cache keys or deduplication identifiers, review stored keys and re-normalize the original URLs where available.

Changed

• BREAKING: Drop support for end-of-life Python 3.10; Python 3.11 or newer is required.
• BREAKING: Remove the legacy charset API argument and -c / --charset CLI option.
• Declare Python 3.15 support in package metadata.
• Require idna>=3.20.

Fixed

• Write CLI error diagnostics in UTF-8, including Unicode arguments on Windows.
• Strip trailing Unicode IDNA label separators from hosts and custom allowlist domain keys in one normalization pass.
• Normalize allowlisted query parameter names consistently with URL query keys, including Unicode and spaces, while keeping literal plus signs, encoded plus signs, and encoded spaces distinct.

Internal

• Refresh dependencies, pre-commit hooks, and GitHub Actions.
• Use the committed dependency lockfile for CI checks and tests.
• Test every supported Python version from 3.11 through 3.15 on Linux, macOS, and Windows.
• Make uv run CI tests with the Python interpreter selected by the matrix.
• Run pytest as a Python module so coverage measures the checkout instead of an installed copy.

[3.0.1] - 2026-09-22

Upgrade notes

Normalization fixes change canonical output for some URLs, including encoded delimiters, query plus signs, explicit empty query values, and trailing spaces. If normalized URLs are used as cache keys or deduplication identifiers, review stored keys and re-normalize the original URLs where available; information discarded by earlier normalization cannot be recovered from those normalized values alone.

Fixed

• Preserve invalid UTF-8 percent-encoded octets instead of replacing them with U+FFFD; valid UTF-8 still normalizes to NFC.
• Preserve percent-encoded reserved characters in paths, keeping values such as a%2Fb distinct from a/b.
• Preserve encoded plus signs (%2B) in query parameters and explicit empty values such as flag=.
• Normalize Unicode and unsafe characters in URL credentials while preserving encoded delimiters; correctly separate credentials containing @ from the host.
• Correctly parse bracketed IPv6 hosts and ports, lowercase IPv6 addresses, and preserve zone identifier case.
• Recognize long and custom URL schemes, protocol-relative URLs, and bare domains or localhost with numeric ports.
• Remove leading whitespace and parser-ignored control characters before applying default domains and detecting URL schemes, preserving the intended destination.
• Trim trailing authority whitespace without discarding trailing spaces or punctuation belonging to paths, query values, or fragments.
• Convert hashbang fragments (#!) into a single escaped query parameter, preserving existing parameters and leaving ordinary fragments intact.
• Match query parameter allowlists against normalized hosts and equivalent custom domain keys, including Unicode/Punycode aliases, case variants, and trailing dots. Exact canonical keys take precedence over aliases.
• Decode IDNA host output as ASCII regardless of the charset argument.

... (truncated)

Commits

• fc6bde4 fix: emit CLI diagnostics as UTF-8 on Windows
• d9f67de refactor: remove legacy charset options and refresh usage docs
• 2b35206 ci: pin setup-uv to an existing release tag
• 8763d49 chore: prepare 3.1.0 release
• eebf872 chore: refresh dependencies and require Python 3.11
• 3a1f95f Normalize allowed parameter names before query filtering (#45)
• f7d2762 fix: strip trailing IDNA label separators before host encoding (#44)
• b886385 ci: verify Python 3.15 with the selected interpreter
• 6ab6e17 chore: prepare 3.0.1 release
• 2d6749f fix: clean URL input before classification and resolve allowlists once
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)