Bump validators from 0.35.0 to 0.36.0

[dependabot]

Bumps validators from 0.35.0 to 0.36.0.

Release notes

Sourced from validators's releases.

0.36.0

Breaking ⚠️

• Drops support for Python v3.9 and v3.10. Python v3.11 or newer is required. (#488)
• Stricter validation: the following inputs, previously accepted by mistake, are now rejected.
  • isin() now verifies the check digit, which was previously ignored. Lowercase ISINs are still accepted. (#464)
  • cusip() and sedol() require a numeric check digit. (#487)
  • md5(), sha1(), sha224(), sha256(), sha384(), sha512(), base16(), base32(), base58() and base64() reject trailing characters, such as a trailing newline. (#486)
  • ind_pan() requires a full-string match. (#478)
  • fr_ssn() no longer accepts a comma as the gender or Corsica department character. (#469, merged as #491)
  • domain() rejects an underscore in the last label (#485) and names longer than 253 octets once IDNA-encoded, as defined by RFC 1035. (#461)
  • mastercard() accepts only the 2221-2720 range of the 2-series BINs. (#467)
  • eth_address() rejects non-hexadecimal characters. (#466)
  • mac_address() rejects mixed separators. (#432)
  • slug() rejects a trailing newline, and telnet URIs reject control characters. (#492)

Features

• feat(uri): add telnet URI validation per RFC 4248 by @​tofetpuzo in #446
• Accept file:// URLs per RFC 8089 by @​itzzdev09 in #483
• cron: accept a step over a range (e.g. 1-5/2) and in list items by @​itzzdev09 in #482
• Accept lowercase IBANs in iban() by @​sayantanmandal1 in #471
• fix(cron): accept day-of-week 7 as a Sunday alias by @​binggao1230 in #470
• Accept a trailing dot on simple hostnames with rfc_1034 by @​assinscreedFC in #462
• fix(crypto_addresses): accept testnet (tb) segwit addresses by @​Jordan-Bourillot in #466

Maintenance

• chore(deps): bump requests from 2.32.3 to 2.32.4 in /package by @​dependabot in #430
• fix: reject MAC addresses with mixed separators by @​iCasture in #432
• feat: Optimize slug. Extend tests. by @​welder87 in #439
• chore: update codebase to reflect new username by @​nandgator in #447
• docs: correct PossibleValueTypes note in between to include None by @​SAY-5 in #460
• chore!: drop Python 3.9 and 3.10, bump vulnerable dev dependencies by @​nandgator in #488
• fix: restore certifi and jinja2 pins downgraded by stale lock by @​nandgator in #489
• chore: use native pyproject config for tox and pytest by @​nandgator in #490
• test: cover RFC length limits for domain() and hostname() by @​nandgator in #493
• chore!: adopt uv and PEP 735 dependency groups by @​nandgator in #495
• ci: update GitHub Actions to their latest versions by @​nandgator in #496
• docs: explain why the documentation is hosted on the maintainer's fork by @​nandgator in #497
• docs: hide badges from the man page; upgrade docs tooling to latest stable by @​nandgator in #498
• ci: deploy versioned documentation with mike from the fork by @​nandgator in #500
• docs!: build and version the online documentation with Zensical by @​nandgator in #502
• ci: publish to PyPI with trusted publishing by @​nandgator in #504

Full Changelog: 0.35.0...0.36.0

Changelog

Sourced from validators's changelog.

0.36.0 (2026-10-10)

Breaking ⚠️

• Drops support for Python v3.9 and v3.10. Python v3.11 or newer is required. (#488)
• Stricter validation: the following inputs, previously accepted by mistake, are now rejected.
  • isin() now verifies the check digit, which was previously ignored. Lowercase ISINs are still accepted. (#464)
  • cusip() and sedol() require a numeric check digit. (#487)
  • md5(), sha1(), sha224(), sha256(), sha384(), sha512(), base16(), base32(), base58() and base64() reject trailing characters, such as a trailing newline. (#486)
  • ind_pan() requires a full-string match. (#478)
  • fr_ssn() no longer accepts a comma as the gender or Corsica department character. (#469, merged as #491)
  • domain() rejects an underscore in the last label (#485) and names longer than 253 octets once IDNA-encoded, as defined by RFC 1035. (#461)
  • mastercard() accepts only the 2221-2720 range of the 2-series BINs. (#467)
  • eth_address() rejects non-hexadecimal characters. (#466)
  • mac_address() rejects mixed separators. (#432)
  • slug() rejects a trailing newline, and telnet URIs reject control characters. (#492)

Features

• feat(uri): add telnet URI validation per RFC 4248 by @​tofetpuzo in #446
• Accept file:// URLs per RFC 8089 by @​itzzdev09 in #483
• cron: accept a step over a range (e.g. 1-5/2) and in list items by @​itzzdev09 in #482
• Accept lowercase IBANs in iban() by @​sayantanmandal1 in #471
• fix(cron): accept day-of-week 7 as a Sunday alias by @​binggao1230 in #470
• Accept a trailing dot on simple hostnames with rfc_1034 by @​assinscreedFC in #462
• fix(crypto_addresses): accept testnet (tb) segwit addresses by @​Jordan-Bourillot in #466

Maintenance

• chore(deps): bump requests from 2.32.3 to 2.32.4 in /package by @​dependabot in #430
• fix: reject MAC addresses with mixed separators by @​iCasture in #432
• feat: Optimize slug. Extend tests. by @​welder87 in #439
• chore: update codebase to reflect new username by @​nandgator in #447
• docs: correct PossibleValueTypes note in between to include None by @​SAY-5 in #460
• chore!: drop Python 3.9 and 3.10, bump vulnerable dev dependencies by @​nandgator in #488
• fix: restore certifi and jinja2 pins downgraded by stale lock by @​nandgator in #489
• chore: use native pyproject config for tox and pytest by @​nandgator in #490
• test: cover RFC length limits for domain() and hostname() by @​nandgator in #493
• chore!: adopt uv and PEP 735 dependency groups by @​nandgator in #495
• ci: update GitHub Actions to their latest versions by @​nandgator in #496
• docs: explain why the documentation is hosted on the maintainer's fork by @​nandgator in #497
• docs: hide badges from the man page; upgrade docs tooling to latest stable by @​nandgator in #498
• ci: deploy versioned documentation with mike from the fork by @​nandgator in #500
• docs!: build and version the online documentation with Zensical by @​nandgator in #502
• ci: publish to PyPI with trusted publishing by @​nandgator in #504

Full Changelog: 0.35.0...0.36.0

Commits

• e2e49fb ci: publish to PyPI with trusted publishing
• f749c78 docs!: build and version the online documentation with Zensical
• 7bffa5e ci: deploy versioned documentation with mike from the fork
• 3bf8a58 docs: add #498 to the 0.36.0 changelog
• 9176e63 docs: add #496 and #497 to the 0.36.0 changelog
• e035f1b docs: add #495 to the 0.36.0 changelog
• d3f0048 chore: prepare for release 0.36.0
• cdbe4af docs: hide badges from the man page; regenerate docs with current tooling
• fd5333a chore: loosen docs tooling bounds, rename mkdocstrings 'import' to 'inventories'
• 16ec0ef ci: update GitHub Actions to their latest versions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)