Update scrapy requirement from >=2.18.0 to >=2.19.0 in /python

[dependabot]

Updates the requirements on scrapy to permit the latest version.

Release notes

Sourced from scrapy's releases.

2.19.0

• New RemoteControl extension which allows inspecting and controlling a running crawl over HTTP, used by the Scrapy MCP server
• Experimental aiohttp-based download handler (now the default when running without a reactor)

Full Changelog

Changelog

Sourced from scrapy's changelog.

Scrapy 2.19.0 (2026-09-10)

Highlights:

• New RemoteControl extension which allows inspecting and controlling a running crawl over HTTP, used by the :ref:Scrapy MCP server <using-mcp-server>

• Experimental aiohttp-based download handler (now the default when running without a reactor)

Modified requirements

-   Added support for Python 3.15.
    (:gh:`7511`)


New dependencies:


aiohttp_ >= 3.13.3


charset-normalizer_ >= 3.4.0


platformdirs_ >= 2.0.0


(:gh:7866, :gh:8054)


Backward-incompatible changes

• When running :ref:without a Twisted reactor <asyncio-without-reactor>, i.e. with :setting:TWISTED_REACTOR_ENABLED set to False, the default download handler for http and https is now :class:~scrapy.core.downloader.handlers._aiohttp.AiohttpDownloadHandler instead of :class:~scrapy.core.downloader.handlers._httpx.HttpxDownloadHandler. You can configure :class:~scrapy.core.downloader.handlers._httpx.HttpxDownloadHandler in the :setting:DOWNLOAD_HANDLERS setting if you want. (:gh:8118)

• scrapy.http.cookies.WrappedRequest.is_unverifiable() now always returns False, and the undocumented is_unverifiable request meta key that it used to read is ignored. (:gh:7933)

Deprecations

</tr></table> 

... (truncated)

Commits

• 8026dee Bump version: 2.18.0 → 2.19.0
• b1f1cba Release notes for 2.19.0 (#8124)
• a410975 Fix LocalCache evicting a different key when updating an existing key (#8113)
• 41c3f3e Add AiohttpDownloadHandler and switch reactorless to it (#8118)
• 20dcf82 Implement some idioms from newer Python versions. (#8123)
• 3fd2a40 Agents docs page. (#8120)
• 6995549 Exclude news and contributing from llms-full.txt only (#8119)
• 6057f02 Expose HTTP cache storage timestamp via the cache_timestamp meta key (#8034)
• 1d5fa5a Include bind address in HTTP/1.1 and HTTP/2 pool keys (#8081)
• 544f4d2 Fix missing certificate and IP address on HTTP/1.1 responses without a body (...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)