[dependabot]

Bumps django-ses from 4.1.1 to 4.9.0.

Release notes

Sourced from django-ses's releases.

v4.9.0

Features

Add support for sending email through an Amazon SES tenant with the AWS_SES_TENANT setting (string or per-message callable) or an X-SES-TENANT message header. Requires SES v2 and boto3/botocore 1.40.0+ (Python 3.9+). SESBackend raises ValueError if AWS_SES_TENANT is set with an older botocore.

• Add SES Tenant configuration support in django-ses/django-ses#379

Fixes

send_messages() now treats boto3 ClientError as a send failure when fail_silently is true. Previously only urllib3 ResponseError was caught, so EmailMessage.send(fail_silently=True) still raised when SES rejected the message.

get_ses_statistics refreshes a stored daily row when any of the four aggregate counters changes. Previously an existing row was updated only when delivery attempts changed, so bounces, complaints, and rejects could stay stale.

• Swallow SES ClientError when fail_silently is true in django-ses/django-ses#381
• Refresh SES statistics when any aggregate counter changes in django-ses/django-ses#384

Documentation

README examples for a custom inbound email parser and the statistics URL configuration now use valid imports.

• Correct imports and URL helper in README examples in django-ses/django-ses#385

Full Changelog: django-ses/django-ses@v4.8.2...v4.9.0

v4.8.2

Fixes

Keep the test suite compatible with Python 3.8 and 3.9. Parenthesized with statements from the Ruff format were a syntax error on those versions, so tests.test_views failed to import. Ruff now targets Python 3.8.

This does not change runtime behavior. The library code in 4.8.1 already ran on Python 3.8.

• Keep webhook tests compatible with Python 3.8 by @​pcraciunoiu in django-ses/django-ses#380

Full Changelog: django-ses/django-ses@v4.8.1...v4.8.2

v4.8.1

Security

The SES event webhook now rejects notifications and subscription confirmations whose TopicArn is not listed in AWS_SNS_EVENT_TRUSTED_TOPIC_ARNS. A valid SNS signature only proves a message came from some AWS topic, not from yours.

The setting defaults to an empty list, which keeps the previous behavior. Set it to the topic ARN(s) you actually use:

AWS_SNS_EVENT_TRUSTED_TOPIC_ARNS = ["arn:aws:sns:us-east-1:123456789012:ses-events"]

SubscribeURL fetches during subscription confirmation are limited to https SNS hosts.

Tracked as GHSA-2vww-32j3-5v92. GHSA-j9gg-2fwp-h62h is the same issue.

... (truncated)

Changelog

Sourced from django-ses's changelog.

Change Log

For a list of releases, see: https://github.com/django-ses/django-ses/releases/

Upcoming (dev)

The following changes are not yet released, but are code complete:

Pulls and Issues:

• None

Features:

• None

Changes:

• None

Deprecations:

• None

Fixes:

• None

Current

4.9.0

Add support for sending email through an Amazon SES tenant with the AWS_SES_TENANT setting (string or per-message callable) or an X-SES-TENANT message header. Requires SES v2 and boto3/botocore 1.40.0+ (Python 3.9+); SESBackend raises ValueError if AWS_SES_TENANT is set with an older botocore.

send_messages() now treats boto3 ClientError as a send failure when fail_silently is true. Previously only urllib3 ResponseError was caught, so EmailMessage.send(fail_silently=True) still raised when SES rejected the message.

get_ses_statistics refreshes a stored daily row when any of the four aggregate counters changes. Previously an existing row was updated only when delivery attempts changed, so bounces, complaints, and rejects could stay stale.

README examples for a custom inbound email parser and the statistics URL configuration now use valid imports.

Pulls:

• django-ses/django-ses#379
• django-ses/django-ses#381
• django-ses/django-ses#384

... (truncated)

Commits

• e515464 Update changelog, bump minor
• 6746b66 Bump certifi from 2026.2.25 to 2026.10.19 (#386)
• 6b27dc2 Refresh SES statistics when any aggregate counter changes (#384)
• 13a0724 Correct imports and URL helper in README examples (#385)
• 1dd240f Add SES Tenant configuration support (#379)
• d6da0cf Run Python 3.8 and 3.9 CI jobs on Ubuntu 24.04 (#387)
• 8355851 Swallow SES ClientError when fail_silently is true. (#381)
• ea5427e Update changelog, bump patch
• 98da9d6 Keep webhook tests compatible with Python 3.8. (#380)
• 0da26fc Format with ruff
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pycon	Ready	Preview	Nov 3, 2026 4:09am UTC