Skip to content

⬆ Bump the dev-dependencies group across 1 directory with 5 updates - #232

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/dev-dependencies-8be7b810ce
Closed

⬆ Bump the dev-dependencies group across 1 directory with 5 updates#232
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/dev-dependencies-8be7b810ce

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on prek, ty, ruff, vcrpy and uv-build to permit the latest version.
Updates prek from 0.4.3 to 0.4.12

Release notes

Sourced from prek's releases.

0.4.12

Release Notes

Released on 2026-08-03.

Enhancements

  • Add --require-group for hook group intersections (#2472)
  • Align fast-path and builtin pre-commit hooks (#2433)
  • Do not shuffle file list for verbose output (#2431)
  • Improve top-level command descriptions (#2429)
  • Install uv from Astral CDN and drop source racing (#2455)
  • Make prek install --force bypass external hooks paths (#2437)
  • Show builtin hook flags in verbose list output (#2427)
  • Verify uv release archive checksums (#2456)

Performance

  • Precompute file tags in parallel (#2440)
  • Skip diffs after known hook modifications (#2447)
  • Skip worktree diffs for read-only languages (#2432)
  • Track builtin hook file changes directly (#2404)

Bug fixes

  • Use full object IDs in diff snapshots (#2448)

Documentation

  • Add a multi-repository configuration example (#2434)
  • Rewrite benchmark documentation (#2469)

Contributors

Install prek 0.4.12

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.12/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.12/prek-installer.ps1 | iex"
</tr></table>

... (truncated)

Changelog

Sourced from prek's changelog.

0.4.12

Released on 2026-08-03.

Enhancements

  • Add --require-group for hook group intersections (#2472)
  • Align fast-path and builtin pre-commit hooks (#2433)
  • Do not shuffle file list for verbose output (#2431)
  • Improve top-level command descriptions (#2429)
  • Install uv from Astral CDN and drop source racing (#2455)
  • Make prek install --force bypass external hooks paths (#2437)
  • Show builtin hook flags in verbose list output (#2427)
  • Verify uv release archive checksums (#2456)

Performance

  • Precompute file tags in parallel (#2440)
  • Skip diffs after known hook modifications (#2447)
  • Skip worktree diffs for read-only languages (#2432)
  • Track builtin hook file changes directly (#2404)

Bug fixes

  • Use full object IDs in diff snapshots (#2448)

Documentation

  • Add a multi-repository configuration example (#2434)
  • Rewrite benchmark documentation (#2469)

Contributors

0.4.11

Released on 2026-07-25.

Highlights

  • This release adds two new builtin hooks, deny-pattern and require-pattern, as native alternatives for pygrep use cases. deny-pattern fails when a configured pattern is found, while require-pattern ensures every selected file contains a match. By matching natively without spawning a Python subprocess, they run over 4x faster than pygrep in benchmarks. Note that they use Rust regex syntax, which does

... (truncated)

Commits

Updates ty from 0.0.65 to 0.0.66

Release notes

Sourced from ty's releases.

0.0.66

Release Notes

Released on 2026-08-03.

LSP server

  • Index with-statement targets as symbols (#27256)
  • Trigger signature help after completing callable with parentheses (#27084)

Library support

  • Pydantic: Recognize models installed on extra search paths (#27429)

Diagnostics

  • Detect __aenter__ and __aexit__ that do not return awaitables (#27414)
  • Diagnose dataclass fields after inherited defaults (#27327)
  • Emit diagnostic when specializing a non-generic class (#26883)
  • Improve error context for incompatible callable signatures (#27422)
  • Preserve forwarded expanded-variadic diagnostic sources (#27266)

Core type checking

  • Avoid over-materializing user-defined TypeIs return types (#26864)
  • Fix enum class container assignability (#27318)
  • Hide stub-only helpers from implicit builtin lookup (#27423)
  • Move Unknown out of the experimental ty_extensions API (#27430)
  • Preserve TypeVarTuple context during Generic recovery (#27381)
  • Preserve exact numeric types in covariant collections (#27311)
  • Reject ClassVar and Final qualifiers in NamedTuple fields (#27380)
  • Reject out-of-scope ParamSpec components (#27378)
  • Reject specializing non-generic subclasses (#27377)
  • Respect bounds and constraints in generic materializations (#27228)
  • Sync vendored typeshed stubs (#27401). Typeshed diff

Contributors

Install ty 0.0.66

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.66

Released on 2026-08-03.

LSP server

  • Index with-statement targets as symbols (#27256)
  • Trigger signature help after completing callable with parentheses (#27084)

Library support

  • Pydantic: Recognize models installed on extra search paths (#27429)

Diagnostics

  • Detect __aenter__ and __aexit__ that do not return awaitables (#27414)
  • Diagnose dataclass fields after inherited defaults (#27327)
  • Emit diagnostic when specializing a non-generic class (#26883)
  • Improve error context for incompatible callable signatures (#27422)
  • Preserve forwarded expanded-variadic diagnostic sources (#27266)

Core type checking

  • Avoid over-materializing user-defined TypeIs return types (#26864)
  • Fix enum class container assignability (#27318)
  • Hide stub-only helpers from implicit builtin lookup (#27423)
  • Move Unknown out of the experimental ty_extensions API (#27430)
  • Preserve TypeVarTuple context during Generic recovery (#27381)
  • Preserve exact numeric types in covariant collections (#27311)
  • Reject ClassVar and Final qualifiers in NamedTuple fields (#27380)
  • Reject out-of-scope ParamSpec components (#27378)
  • Reject specializing non-generic subclasses (#27377)
  • Respect bounds and constraints in generic materializations (#27228)
  • Sync vendored typeshed stubs (#27401). Typeshed diff

Contributors

Commits

Updates ruff from 0.15.18 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Commits
  • 80790b3 Bump 0.16.1 (#27330)
  • 63830f3 [ty] Borrow from constraint set storage less often (#27328)
  • f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
  • 0d80497 Lint TOML files in the LSP (#26862)
  • d91586b Update prek dependencies (#27293)
  • 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
  • b20daf7 [ty] refactor: add helper function to send partial results (#27249)
  • 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
  • 7c3e2db [ty] Fix enum class container assignability (#27318)
  • d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
  • Additional commits viewable in compare view

Updates vcrpy from 8.2.1 to 8.3.0

Release notes

Sourced from vcrpy's releases.

v8.3.0

What's Changed

  • Add support for niquests (#980) — thanks @​ionelmc
  • Recording now fails fast if a request or response contains a Python object the safe YAML loader (introduced in 8.2.1) couldn't read back, instead of writing a cassette that breaks on replay. The error shows exactly how to register the object if you need it (#1007, #1009) — thanks @​Polandia94
  • New vcr.serializers.yamlserializer.with_custom_tags(...) builds a YAML serializer supporting custom Python object tags on both record and replay, registered per VCR instance via register_serializer (#1007, #1009) — thanks @​Polandia94
  • Clearer error when a cassette contains an unsupported YAML tag, and the stale git.io migration link is gone (#1007, #1008) — thanks @​gaoflow
  • Fix stale keep-alive connection reuse across cassettes; unpin werkzeug (#1001)

Full Changelog: kevin1024/vcrpy@v8.2.1...v8.3.0

Changelog

Sourced from vcrpy's changelog.

Changelog

All help in providing PRs to close out bug issues is appreciated. Even if that is providing a repo that fully replicates issues. We have very generous contributors that have added these to bug issues which meant another contributor picked up the bug and closed it out.

  • 8.3.0

    • Add support for niquests (#980) - thanks @​ionelmc
    • Refuse to record a cassette containing a Python object the safe YAML loader could not read back, so recording fails fast instead of producing a cassette that breaks on replay (#1007, #1009) - thanks @​Polandia94
    • Add vcr.serializers.yamlserializer.with_custom_tags to build a YAML serializer supporting custom Python object tags on both record and replay, registered per VCR instance via register_serializer (#1007, #1009) - thanks @​Polandia94
    • Clearer error when a cassette contains an unsupported YAML tag, and remove the stale git.io migration link (#1007, #1008) - thanks @​gaoflow
    • Fix stale keep-alive connection reuse across cassettes; unpin werkzeug (#1001)

  • 8.2.1

    • SECURITY: Load cassettes with a safe YAML loader, preventing arbitrary code execution when a cassette from an untrusted source is loaded (GHSA-rpj2-4hq8-938g) - thanks @​RamiAltai and @​EQSTLab
    • Validate record_mode and raise a clear error on an invalid value (#208)
    • Recommend pytest-recording over the unmaintained pytest-vcr in the docs (#986)

  • 8.2.0

    • Add support for httpx 2.x (#993) - thanks @​dsfaccini
    • Patch httpx transports instead of httpcore (#972) - thanks @​seowalex
    • Fix aiohttp 3.14 compatibility: AsyncStreamReaderMixin removed and ClientResponse now requires stream_writer (#995) - thanks @​dsfaccini
    • Account for modified requests when storing played cassettes, so drop_unused_requests honours before_record_request filtering (#962) - thanks @​jamesbraza
    • Make the request URL available on VCRHTTPResponse (#976) - thanks @​dAnjou
    • Improve error message when a matching request has already been consumed (#985) - thanks @​Polandia94
    • Fix body check in convert_body_to_unicode to use an explicit type check (#982) - thanks @​Polandia94
    • Add env proxy cassette regression test (#994) - thanks @​tine1117
    • Remove milestone references from docs (#984) - thanks @​Polandia94
    • CI: bump sphinx-rtd-theme from 3.0.2 to 3.1.0 (#973)

  • 8.1.1

    • Fix sync requests in async contexts for HTTPX (#965) - thanks @​seowalex
    • CI: bump peter-evans/create-pull-request from 7 to 8 (#969)

  • 8.1.0

  • 8.0.0

    • BREAKING: Drop support for Python 3.9 (major version bump) - thanks @​jairhenrique
    • BREAKING: Drop support for urllib3 < 2 - fixes CVE warnings from urllib3 1.x (#926, #880) - thanks @​jairhenrique
    • New feature: drop_unused_requests option to remove unused interactions from cassettes (#763) - thanks @​danielnsilva
    • Rewrite httpx support to patch httpcore instead of httpx (#943) - thanks @​seowalex
      • Fixes httpx.ResponseNotRead exceptions (#832, #834)
      • Fixes KeyError: 'follow_redirects' (#945)
      • Adds support for custom httpx transports
    • Fix HTTPS proxy handling - proxy address no longer ends up in cassette URIs (#809, #914) - thanks @​alga

... (truncated)

Commits

Updates uv-build to 0.12.1

Release notes

Sourced from uv-build's releases.

0.12.1

Release Notes

Released on 2026-07-31.

Enhancements

  • Add package-specific pre-release policies with --prerelease-package (#20837)
  • Support local HTML files as flat indexes (#20802)
  • Add Xonsh virtual environment activation scripts (activate.xsh) (#19740)
  • Preserve filesystem paths passed to uv add --index when updating pyproject.toml (#20817)

Preview features

  • Add automatic fixes to uv check with --fix (#20793)
  • Avoid rejecting unchanged metadata-free lockfiles when workspace dependencies share direct sources (#20847)
  • Honor direct URL constraints when validating metadata-free lockfiles (#20796)
  • Ignore malformed PEP 723 scripts discovered during project checks (#20784)
  • Use ty's native script exclusion in uv check (#20742)

Performance

  • Parse canonical uv lockfiles directly, with a fallback for other valid TOML syntax (#20648)
  • Accelerate SHA-256 hashing on non-Windows ARM64 platforms (#20805)

Bug fixes

  • Flush shell startup file updates before uv tool update-shell and uv python update-shell exit (#20842)
  • Make workspace-root dependency groups available to commands run from workspace members (#20840)
  • Resolve --find-links paths in requirements files relative to the containing file (#20832)
  • Respect configured indexes in uv tool list --outdated (#20770)

Documentation

  • Document Astral GPU indexes in the PyTorch guide (#20785)
  • Use consistent dependency-group argument descriptions throughout the CLI documentation (#20823)

Install uv 0.12.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.1/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.1/uv-installer.ps1 | iex"

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.12.1

Released on 2026-07-31.

Enhancements

  • Add package-specific pre-release policies with --prerelease-package (#20837)
  • Support local HTML files as flat indexes (#20802)
  • Add Xonsh virtual environment activation scripts (activate.xsh) (#19740)
  • Preserve filesystem paths passed to uv add --index when updating pyproject.toml (#20817)

Preview features

  • Add automatic fixes to uv check with --fix (#20793)
  • Avoid rejecting unchanged metadata-free lockfiles when workspace dependencies share direct sources (#20847)
  • Honor direct URL constraints when validating metadata-free lockfiles (#20796)
  • Ignore malformed PEP 723 scripts discovered during project checks (#20784)
  • Use ty's native script exclusion in uv check (#20742)

Performance

  • Parse canonical uv lockfiles directly, with a fallback for other valid TOML syntax (#20648)
  • Accelerate SHA-256 hashing on non-Windows ARM64 platforms (#20805)

Bug fixes

  • Flush shell startup file updates before uv tool update-shell and uv python update-shell exit (#20842)
  • Make workspace-root dependency groups available to commands run from workspace members (#20840)
  • Resolve --find-links paths in requirements files relative to the containing file (#20832)
  • Respect configured indexes in uv tool list --outdated (#20770)

Documentation

  • Document Astral GPU indexes in the PyTorch guide (#20785)
  • Use consistent dependency-group argument descriptions throughout the CLI documentation (#20823)

0.12.0

Released on 2026-07-28.

Since we released uv 0.11.0 in March, we've accumulated changes that improve correctness, safety, and compatibility with specifications, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution.

We expect most users to be able to upgrade without making changes.

There are no breaking changes to the configuration of the uv build backend. If your [build-system] table includes an upper bound on uv_build, update it to allow uv_build 0.12, e.g., uv_build>=0.11.32,<0.13.

Breaking changes

  • Define build systems by default with uv init (#19197)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
⬆ Bump the dev-dependencies group across 1 directory with 5 updates
50909a5 
Updates the requirements on [prek](https://github.com/j178/prek), [ty](https://github.com/astral-sh/ty), [ruff](https://github.com/astral-sh/ruff), [vcrpy](https://github.com/kevin1024/vcrpy) and [uv-build](https://github.com/astral-sh/uv) to permit the latest version.

Updates `prek` from 0.4.3 to 0.4.12
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.3...v0.4.12)

Updates `ty` from 0.0.65 to 0.0.66
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.65...0.0.66)

Updates `ruff` from 0.15.18 to 0.16.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.18...0.16.1)

Updates `vcrpy` from 8.2.1 to 8.3.0
- [Release notes](https://github.com/kevin1024/vcrpy/releases)
- [Changelog](https://github.com/kevin1024/vcrpy/blob/master/docs/changelog.rst)
- [Commits](kevin1024/vcrpy@v8.2.1...v8.3.0)

Updates `uv-build` to 0.12.1
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.11.23...0.12.1)

---
updated-dependencies:
- dependency-name: prek
  dependency-version: 0.4.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: ty
  dependency-version: 0.0.66
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: ruff
  dependency-version: 0.16.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: vcrpy
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: uv-build
  dependency-version: 0.12.1
  dependency-type: direct:development
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 7, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 8, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/dev-dependencies-8be7b810ce branch August 8, 2026 21:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants