Bump yarl from 1.24.5 to 1.25.1

[dependabot]

Bumps yarl from 1.24.5 to 1.25.1.

Release notes

Sourced from yarl's releases.

1.25.1

[!IMPORTANT] The v1.25.0 release never published: its riscv64 wheel job hit the job timeout, so no packages reached PyPI and no GitHub release was created. No changes were lost; everything intended for v1.25.0 shipped in v1.25.1. Its changelog entries are reproduced below.

---

Contributor-facing changes

• Stopped running the test suite inside the riscv64 wheel builds; every wheel for that architecture is built under emulation and the test run did not fit in the job timeout -- by :user:bdraco.

  Related issues and pull requests on GitHub: #1906.

---

v1.25.0

(2026-09-15)

Bug fixes

• Made the C and pure Python quoting implementations reject % in safe or protected when requoting and a space in safe or protected for query strings, since the two implementations disagreed on those configurations -- by :user:bdraco.

  Related issues and pull requests on GitHub: #1869.

• Made the pure Python quoter reject non-ASCII safe and protected characters when it is created, the same way the C extension does -- by :user:bdraco.

  Related issues and pull requests on GitHub: #1893.

• Fixed :attr:URL.query <yarl.URL.query> returning empty fields and keeping invalid percent-encoded UTF-8 as is, a regression in 1.19.0. It matches :func:urllib.parse.parse_qsl again, and so do the methods built on it, :meth:~yarl.URL.update_query, :meth:~yarl.URL.without_query_params and :meth:~yarl.URL.human_repr, which also no longer double encode those escapes -- by :user:bdraco.

... (truncated)

Changelog

Sourced from yarl's changelog.

v1.25.1

(2026-09-15)

Contributor-facing changes

• Stopped running the test suite inside the riscv64 wheel builds; every wheel for that architecture is built under emulation and the test run did not fit in the job timeout -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1906.

---

v1.25.0

(2026-09-15)

Bug fixes

• Made the C and pure Python quoting implementations reject % in safe or protected when requoting and a space in safe or protected for query strings, since the two implementations disagreed on those configurations -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1869.

• Made the pure Python quoter reject non-ASCII safe and protected characters when it is created, the same way the C extension does -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1893.

• Fixed :attr:URL.query <yarl.URL.query> returning empty fields and keeping invalid percent-encoded UTF-8 as is, a regression in 1.19.0. It matches :func:urllib.parse.parse_qsl again, and so do the methods built on it, :meth:~yarl.URL.update_query, :meth:~yarl.URL.without_query_params and :meth:~yarl.URL.human_repr, which also no longer double encode those escapes -- by :user:bdraco.

... (truncated)

Commits

• 604eb6d Release 1.25.1 (#1907)
• 467b48e Skip the in-build test run for riscv64 wheels (#1906)
• 3dc4b26 Release 1.25.0 (#1905)
• 7f07a89 Write escapes for ignored characters directly in the pure Python unquoter (#1...
• a27544b Write escapes for ignored characters directly in the C unquoter (#1902)
• 1868dae Reject non-ASCII ignore characters in the unquoters (#1903)
• 4a243c1 Reject ignore characters the unquoters decode anyway (#1900)
• e1c4d5d Remove unused constants from the quoting modules (#1901)
• c239085 Add public query_to_pairs with max_fields and encoding (#1899)
• ce45762 Speed up the pure Python unquoter for long and escape heavy strings (#1889)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)