Bump scrapy from 2.6.2 to 2.16.0 in /backend

[dependabot]

Bumps scrapy from 2.6.2 to 2.16.0.

Release notes

Sourced from scrapy's releases.

2.16.0

• Official support for Python 3.14
• Support for Twisted 26.4.0+

Full Changelog

2.15.2

What's Changed

• Fixed links in https://docs.scrapy.org/llms.txt (#7467)

Full Changelog: scrapy/scrapy@2.15.1...2.15.2

2.15.1

• Bug fixes

Full Changelog

2.15.0

• Experimental support for running without a Twisted reactor
• Experimental httpx-based download handler

Full Changelog

2.14.2

• Values from the Referrer-Policy header of HTTP responses are no longer executed as Python callables. See the cwxj-rr6w-m6w7 security advisory for details.
• In line with the standard, 301 redirects of POST requests are converted into GET requests.

Full Changelog

2.14.1

• Deprecate maybeDeferred_coro()
• Pass the spider arg to custom stat collectors {open,close}_spider()
• Replace deprecated Codecov CI action

Full Changelog

2.14.0

• More coroutine-based replacements for Deferred-based APIs
• The default priority queue is now DownloaderAwarePriorityQueue
• Dropped support for Python 3.9 and PyPy 3.10
• Improved and documented the API for custom download handlers

Full changelog

2.13.4

Fix for the CVE-2025-6176 security issue: improved protection against decompression bombs in HttpCompressionMiddleware for responses compressed using the br and deflate methods. Requires brotli >= 1.2.0.

Full changelog

... (truncated)

Changelog

Sourced from scrapy's changelog.

Scrapy 2.16.0 (2026-05-19)

Highlights:

• Official support for Python 3.14

• Support for Twisted 26.4.0+

Modified requirements

-   Increased the minimum versions of the following dependencies:
- service_identity_: 18.1.0 → 23.1.0
(:issue:7347)




Added support for Twisted 26.4.0+.

(:issue:7347, :issue:7505, :issue:7520)


Added support for Python 3.14.

(:issue:6604, :issue:7460)


Backward-incompatible changes

• The following classes and functions, intended for internal use by :class:~scrapy.core.downloader.handlers.http11.HTTP11DownloadHandler and :class:~scrapy.core.downloader.handlers.http2.H2DownloadHandler, have been made private:

  • scrapy.core.downloader.handlers.http11.ScrapyAgent

  • scrapy.core.downloader.handlers.http11.ScrapyProxyAgent

  • scrapy.core.downloader.handlers.http11.TunnelingAgent

  • scrapy.core.downloader.handlers.http11.TunnelingTCP4ClientEndpoint

  • scrapy.core.downloader.handlers.http11.tunnel_request_data()

  • scrapy.core.downloader.handlers.http2.ScrapyH2Agent

  (:issue:7496, :issue:7510)

Deprecations

-   ``scrapy.FormRequest`` is deprecated. You can use the :doc:`form2request
</tr></table> 

... (truncated)

Commits

• abe9c63 Bump version: 2.15.2 → 2.16.0
• a84b785 Release notes for Scrapy 2.16.0. (#7536)
• 55c17a8 Disable mypy allow_any_generics. (#7532)
• f875af4 Add BaseStreamingDownloadHandler and migrate HttpxDownloadHandler to it. (#7524)
• a8a8f20 Remove support for sync process_spider_output(). (#7504)
• 85c616c Fix certificate issuer verification on new Twisted. (#7520)
• ae4a8e3 Document TLS method setting in avoiding bans guide (#7518)
• 4cfe7a0 Add CITATION.cff (#7519)
• 2d007bc Make more of the internal handler helpers private. (#7510)
• 2798c03 Add Python 3.14 to CI. (#6604)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.