Skip to content

build(deps): bump the patch-and-minor group across 1 directory with 14 updates - #221

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/patch-and-minor-dd320cdf65
Open

build(deps): bump the patch-and-minor group across 1 directory with 14 updates#221
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/patch-and-minor-dd320cdf65

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the patch-and-minor group with 14 updates in the / directory:

Package From To
pydantic 2.13.4 2.13.5
ruff 0.16.5 0.16.6
anyio 4.14.2 4.15.1
coverage 7.15.4 7.16.0
filelock 3.32.4 3.32.5
fonttools 4.63.0 4.64.0
joblib 1.5.3 1.6.0
kiwisolver 1.5.0 1.5.1
lxml 6.1.2 6.1.3
patsy 1.0.2 1.0.3
platformdirs 4.11.5 4.11.7
regex 2026.7.19 2026.9.3
sse-starlette 3.4.8 3.4.11
wrapt 2.3.0 2.4.0

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates ruff from 0.16.5 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

Commits

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

  • Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

  • Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

    • follow_symlinks on exists() (Python 3.12+)
    • follow_symlinks on is_dir() (Python 3.13+)
    • follow_symlinks on is_file() (Python 3.13+)
    • follow_symlinks on owner() (Python 3.13+)
    • follow_symlinks on group() (Python 3.13+)
    • newline on read_text() (Python 3.13+)

    (#1286, #1293; PR by @​jaideeppyne)

  • Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

  • Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

  • Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

  • Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

  • Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

  • Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

  • Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

  • Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

  • Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

  • Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

  • Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

  • Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

  • Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

  • Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

  • Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

  • Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

  • Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

  • Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits
  • ffcd154 Bumped up the version
  • 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
  • 9283662 Bumped up the version
  • d137692 Improved the instructions for AI agents
  • 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
  • 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
  • b825c3b Fixed pyproject.toml changes not triggering the test suite
  • 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
  • b05fe6d Fixed wrong type in move_on_after (#1297)
  • 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
  • Additional commits viewable in compare view

Updates coverage from 7.15.4 to 7.16.0

Release notes

Sourced from coverage's releases.

7.16.0

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
  • The Coverage.switch_context() method now returns the previous context.
  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
  • Fixes to validation of options and configuration settings:
    • Negative precision settings now always cause useful error messages (pull 2261).
    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

Changelog

Sourced from coverage's changelog.

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

  • The :meth:.Coverage.switch_context method now returns the previous context.

  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

  • Fixes to validation of options and configuration settings:

    • Negative precision settings now always cause useful error messages (pull 2261_).

    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with "Can't combine statement coverage data with branch data". Each named concurrency library is now properly considered (pull 2270_).

  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265_).

.. _pull 2261: coveragepy/coveragepy#2261 .. _pull 2262: coveragepy/coveragepy#2262 .. _pull 2263: coveragepy/coveragepy#2263 .. _pull 2265: coveragepy/coveragepy#2265 .. _issue 2266: coveragepy/coveragepy#2266 .. _pull 2268: coveragepy/coveragepy#2268

... (truncated)

Commits
  • 3e9fc16 docs: prep for 7.16.0
  • 38be8d1 build: control check-manifest explicitly
  • 8eb1266 docs(build): no longer commit sample_html
  • 1a8b3fa docs: remove sample_html
  • aeaa79b docs: linklint is now sphinx-linklint
  • d5eaf3f test: a branchless way to re-add extensions
  • 57e52fd docs: adjust CHANGES for #2270
  • b9d304d fix: check for multiprocessing in a --concurrency list (#2270)
  • a6ef928 chore: make upgrade
  • 070461f chore: bump the action-dependencies group with 4 updates (#2271)
  • Additional commits viewable in compare view

Updates filelock from 3.32.4 to 3.32.5

Release notes

Sourced from filelock's releases.

3.32.5

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.4...3.32.5

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.5 (2026-08-31)

  • SoftFileLease.token and AsyncSoftFileLease.token now read None after a failed acquisition, so a contender turned away by a live holder no longer reports a token for a claim it never published. :pr:721
  • Document that mode has no setter: unlike poll_interval, timeout, blocking and lifetime, it is fixed at construction and lock.mode = ... raises AttributeError. :pr:716

3.32.4 (2026-08-23)

  • StrictSoftFileLock always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:705
  • WindowsFileLock waits out a transient STATUS_ACCESS_DENIED from NtCreateFile for up to half a second before raising PermissionError, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:705
  • Every lock class now escapes the hostname it publishes, so a host whose socket.gethostname() carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held SoftReadWriteLock read slot to a peer and could not take a write slot or a StrictSoftFileLock at all. :pr:709

3.32.3 (2026-08-13)

  • The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

3.32.2 (2026-07-29)

  • A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

3.32.1 (2026-07-26)

  • Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

... (truncated)

Commits
  • 1585dfe Release 3.32.5
  • 00177c3 🐛 fix(lease): clear token after failed acquire (#721)
  • 5aeb9b6 📝 docs: say that mode is read-only in the thread-local section (#716)
  • 2634dd1 [pre-commit.ci] pre-commit autoupdate (#720)
  • 37dccf0 🧪 test(fork): report where a stalled fork stops (#715)
  • See full diff in compare view

Updates fonttools from 4.63.0 to 4.64.0

Release notes

Sourced from fonttools's releases.

4.64.0

  • [feaLib] Fix name-table parsing for multibyte Mac encodings (#1196, #4092).
  • [ttProgram] Also indent TrueType assembly following IDEF[ ], like function definitions (#4093).
  • [subset] Keep East Asian spacing palt by default (#4094).
  • [subset] Bug fix for MATH table in which constructions for glyphs that are only added during MATH closure were kept (#4096).
  • [ufoLib] Make glyph-to-group construction accessible outside of lookup function (#4102).
  • [glyf] Use reverse glyph map for O(1) __setitem__ membership (#4103).
  • [ttLib] Fix fixLookupOverFlows() reporting success when it had not promoted any lookup to Extension, masking unresolvable overflows.
  • [ttLib] Add support for TrueType Collection version 2 (#4100).
  • [ttLib] Pin a single head.modified timestamp across TTCollection.save (#4111).
  • [ttLib] Give an actionable error when LookupList overflow is unrecoverable (#4109).
  • [ttLib] Add support for the AAT bitmap tables bhed, bdat, bloc, variants of head, EBDT, EBLC used in legacy Apple bitmap-only fonts (#4115).
  • [ttLib] Check OS/2 fsSelection/macStyle consistency against bhed as well as head (#4118, #4119).
  • [misc.roundTools] Add types and documentation (#4123).
  • [varLib.instancer] Instance the BASE table (#4137).
  • [varLib.instancer] Fix Private-dict vsindex handling in instantiateCFF2 (#4129, #4132).
  • [varLib.instancer] Fix crash instancing CFF2 fonts without a VariationStore (#4130, #4131).
  • [sfnt] Raise TTLibError instead of AssertionError or struct.error when reading a font truncated within the table directory or a table entry (#4147, #4149).
  • [misc.xmlWriter] Escape the ]]> terminator inside CDATA sections, so an SVG document containing it can no longer smuggle markup past a TTX round trip (#4139).
  • [varLib.instancer] Implement avar2 partial-instancing: the avar version 2 ItemVariationStore is adjusted so that remaining axes behave the same after limiting the designspace (#4045).
  • [feaLib] Add shorthand for the value at the default location in a variable scalar: (100 wght=900:120) means (wght=400:100 wght=900:120) when the wght default is 400 (#4024).
  • [cmap] Raise TTLibError for a truncated or out-of-bounds cmap subtable header (#4151).
  • [designspaceLib] Reject conflicting duplicate inputs in axis maps instead of silently keeping the last one (#4153).
  • [designspaceLib] Read an empty <lib> element as an empty lib instead of raising IndexError (#4142, #4144).
  • [colorLib] Raise a legible error when a COLRv0 layer, or a COLRv1 PaintGlyph or PaintColrGlyph, references a glyph missing from the glyphMap, instead of failing obscurely later (#2629, #4141).
  • [cmap] Don't drop subtables in unsupported formats when compiling or dumping a font read from binary (#4136).
  • [ttLib] Implement splitSinglePos so GPOS lookup type 1 offset overflows can be recovered by splitting the subtable (#4091, #4108).
  • [cmap] Round-trip empty Macintosh format 2 subtables (#3663, #4117).
  • [glyf] Raise TTLibError instead of RecursionError when recalcBounds() hits a composite-component reference cycle (#3899, #4116).
  • [svgLib] Fix crash parsing an SVG path with consecutive closepath commands (Z Z) (#4122).
  • [ttLib] Fix DefaultTable type annotations (#4126).
  • [ttLib] Add support for the EBSC (Embedded Bitmap Scaling) table (#4113).
  • [svgLib] Suppress spurious close segments caused by floating-point drift in relative path commands (#3860, #4127).
  • [qu2cu] Fix TypeError in the Cython-compiled build when Qu2CuPen passes tuple splines (#4160).
  • [mort] Add semantic decompilation, TTX, and compilation support for rearrangement, contextual-substitution, ligature, and insertion subtables (#4158, #4159, #4161).
  • [svgLib] Start a new subpath at the just-closed subpath's initial point when a drawto command follows a closepath, per SVG spec (#4154, #4155).
  • [misc.filesystem] SECURITY Reject paths that resolve outside the filesystem root: a malicious UFO could read arbitrary files via .. components in contents.plist, and a crafted .ufoz could create files outside its temporary mirror (#4124).
  • [ttLib] SECURITY Sanitise glyph names used as filenames in EBDT/CBDT ttx -z extfile export, preventing arbitrary file writes from untrusted fonts (#4128).
  • [misc.etree] SECURITY Don't resolve external XML entities in XMLParser when lxml is used, preventing XXE file disclosure on lxml < 5.0 (#4145).
  • [subset] Fully prune VARC auxiliary data: collect and remap variation indices referenced by condition tables when subsetting the MultiVarStore, and drop the AxisIndicesList, ConditionList, and MultiVarStore when they end up empty (#4162).
Changelog

Sourced from fonttools's changelog.

4.64.0 (released 2026-08-31)

  • [feaLib] Fix name-table parsing for multibyte Mac encodings (#1196, #4092).
  • [ttProgram] Also indent TrueType assembly following IDEF[ ], like function definitions (#4093).
  • [subset] Keep East Asian spacing palt by default (#4094).
  • [subset] Bug fix for MATH table in which constructions for glyphs that are only added during MATH closure were kept (#4096).
  • [ufoLib] Make glyph-to-group construction accessible outside of lookup function (#4102).
  • [glyf] Use reverse glyph map for O(1) __setitem__ membership (#4103).
  • [ttLib] Fix fixLookupOverFlows() reporting success when it had not promoted any lookup to Extension, masking unresolvable overflows.
  • [ttLib] Add support for TrueType Collection version 2 (#4100).
  • [ttLib] Pin a single head.modified timestamp across TTCollection.save (#4111).
  • [ttLib] Give an actionable error when LookupList overflow is unrecoverable (#4109).
  • [ttLib] Add support for the AAT bitmap tables bhed, bdat, bloc, variants of head, EBDT, EBLC used in legacy Apple bitmap-only fonts (#4115).
  • [ttLib] Check OS/2 fsSelection/macStyle consistency against bhed as well as head (#4118, #4119).
  • [misc.roundTools] Add types and documentation (#4123).
  • [varLib.instancer] Instance the BASE table (#4137).
  • [varLib.instancer] Fix Private-dict vsindex handling in instantiateCFF2 (#4129, #4132).
  • [varLib.instancer] Fix crash instancing CFF2 fonts without a VariationStore (#4130, #4131).
  • [sfnt] Raise TTLibError instead of AssertionError or struct.error when reading a font truncated within the table directory or a table entry (#4147, #4149).
  • [misc.xmlWriter] Escape the ]]> terminator inside CDATA sections, so an SVG document containing it can no longer smuggle markup past a TTX round trip (#4139).
  • [varLib.instancer] Implement avar2 partial-instancing: the avar version 2 ItemVariationStore is adjusted so that remaining axes behave the same after limiting the designspace (#4045).
  • [feaLib] Add shorthand for the value at the default location in a variable scalar: (100 wght=900:120) means (wght=400:100 wght=900:120) when the wght default is 400 (#4024).
  • [cmap] Raise TTLibError for a truncated or out-of-bounds cmap subtable header (#4151).
  • [designspaceLib] Reject conflicting duplicate inputs in axis maps instead of silently keeping the last one (#4153).
  • [designspaceLib] Read an empty <lib> element as an empty lib instead of raising IndexError (#4142, #4144).
  • [colorLib] Raise a legible error when a COLRv0 layer, or a COLRv1 PaintGlyph or PaintColrGlyph, references a glyph missing from the glyphMap, instead of failing obscurely later (#2629, #4141).
  • [cmap] Don't drop subtables in unsupported formats when compiling or dumping a

... (truncated)

Commits
  • 37dfa71 Release 4.64.0
  • 5cab496 Update NEWS.rst [skip ci]
  • 6f1429b [subset] Fully prune VARC auxiliary data (#4162)
  • 93fc470 Merge pull request #4145 from insaf021/etree-no-external-entities
  • 1ce6993 [misc.etree] only override resolve_entities on lxml < 5.0
  • 9c10287 Merge pull request #4128 from insaf021/ebdt-extfile-basename
  • 53e2b0b [E_B_D_T_] don't let sanitised glyph names collide
  • 3bbd268 Merge pull request #4124 from insaf021/osfs-path-containment
  • 6840516 [misc.filesystem] simplify containment check, pin symlink strictness
  • 8f4b4ee [misc.filesystem] don't publish a half-built zip directory mirror
  • Additional commits viewable in compare view

Updates joblib from 1.5.3 to 1.6.0

Changelog

Sourced from joblib's changelog.

Release 1.6.0 - 2026/08/31

  • Fix caching of functions whose source cannot be retrieved, such as functions defined in a notebook cell. Their identity fell back to str(hash(func.__code__)), which is salted by PYTHONHASHSEED and so differed between processes. A worker reading the func_code.py written by another one concluded that the function had changed and wiped the whole cache directory for it, discarding results computed by its peers. func_code.py is also no longer rewritten in place, so a reader can no longer catch it half-written and draw the same conclusion. joblib/joblib#1694

  • Drop python 3.9 support. The oldest supported Python version is now Python 3.10. joblib/joblib#1773

  • Fix eval_expr (used to evaluate the pre_dispatch argument of Parallel) to raise a ValueError as documented instead of leaking a ZeroDivisionError for expressions that divide or take a modulo by zero. joblib/joblib#1810

  • MemorizedResult now forwards mmap_mode to its store backend, so a cached array reconstructed from a location is memory-mapped as requested instead of being loaded fully into memory. joblib/joblib#1799

  • Unvendor cloudpickle to more quickly benefit from maintenance releases of cloudpickle joblib/joblib#1775

  • Fix Memory.cache for functions with a keyword-only argument that has a default declared before a keyword-only argument without a default. joblib/joblib#1731

  • Fix behavior of filter_args on some precise cases. joblib/joblib#1800

  • Fix a concurrency error that could happen with unordered generator. joblib/joblib#1789

  • Fix: dump() now accepts any input os.PathLike object to be consistent with load. joblib/joblib#1812

  • The documentation now uses pydata sphinx theme. Furthermore, optional dependencies test and docs have been added to pyproject.toml. joblib/joblib#1774

  • Vendor loky 3.6.0

... (truncated)

Commits
  • cd9a6b0 Release 1.6.0 (#1844)
  • d873f97 MNT vendor loky 3.6.0 (#1843)
  • 4ff61af Bump the github-actions group with 4 updates (#1832)
  • 804f472 FIX make func_code stable across processes when the source is unavailable (#1...
  • 65cc49d TST Restore RNG sequence in hash compatibility test (#1837)
  • c1b6541 CI Use pytest-run-parallel on free-threaded build (#1819)
  • f6b80d3 MNT Simplify isinstance check in hashing (#1835)
  • fa4d5af MNT remove python 3.9 from CI (#1773)
  • 53cea7b DOC Update release docs to reflect usage of trusted publishing (#1826)
  • 26500e9 Bump the github-actions group across 1 directory with 3 updates (#1790)
  • Additional commits viewable in compare view

Updates kiwisolver from 1.5.0 to 1.5.1

Release no...

Description has been truncated

@dependabot
build(deps): bump the patch-and-minor group across 1 directory with 1…
33e3a06 
…4 updates

Bumps the patch-and-minor group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.5` | `0.16.6` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.4` | `7.16.0` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.4` | `3.32.5` |
| [fonttools](https://github.com/fonttools/fonttools) | `4.63.0` | `4.64.0` |
| [joblib](https://github.com/joblib/joblib) | `1.5.3` | `1.6.0` |
| [kiwisolver](https://github.com/nucleic/kiwi) | `1.5.0` | `1.5.1` |
| [lxml](https://github.com/lxml/lxml) | `6.1.2` | `6.1.3` |
| [patsy](https://github.com/pydata/patsy) | `1.0.2` | `1.0.3` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.5` | `4.11.7` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.7.19` | `2026.9.3` |
| [sse-starlette](https://github.com/sysid/sse-starlette) | `3.4.8` | `3.4.11` |
| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `2.3.0` | `2.4.0` |



Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `ruff` from 0.16.5 to 0.16.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.5...0.16.6)

Updates `anyio` from 4.14.2 to 4.15.1
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.2...4.15.1)

Updates `coverage` from 7.15.4 to 7.16.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.4...7.16.0)

Updates `filelock` from 3.32.4 to 3.32.5
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.4...3.32.5)

Updates `fonttools` from 4.63.0 to 4.64.0
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.63.0...4.64.0)

Updates `joblib` from 1.5.3 to 1.6.0
- [Release notes](https://github.com/joblib/joblib/releases)
- [Changelog](https://github.com/joblib/joblib/blob/main/CHANGES.rst)
- [Commits](joblib/joblib@1.5.3...1.6.0)

Updates `kiwisolver` from 1.5.0 to 1.5.1
- [Release notes](https://github.com/nucleic/kiwi/releases)
- [Changelog](https://github.com/nucleic/kiwi/blob/main/releasenotes.rst)
- [Commits](nucleic/kiwi@1.5.0...1.5.1)

Updates `lxml` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.1.2...lxml-6.1.3)

Updates `patsy` from 1.0.2 to 1.0.3
- [Release notes](https://github.com/pydata/patsy/releases)
- [Changelog](https://github.com/pydata/patsy/blob/master/doc/changes.rst)
- [Commits](pydata/patsy@v1.0.2...v1.0.3)

Updates `platformdirs` from 4.11.5 to 4.11.7
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.5...4.11.7)

Updates `regex` from 2026.7.19 to 2026.9.3
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.7.19...2026.9.3)

Updates `sse-starlette` from 3.4.8 to 3.4.11
- [Release notes](https://github.com/sysid/sse-starlette/releases)
- [Commits](sysid/sse-starlette@v3.4.8...v3.4.11)

Updates `wrapt` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/GrahamDumpleton/wrapt/releases)
- [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst)
- [Commits](GrahamDumpleton/wrapt@2.3.0...2.4.0)

---
updated-dependencies:
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: ruff
  dependency-version: 0.16.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: anyio
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: coverage
  dependency-version: 7.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: filelock
  dependency-version: 3.32.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: fonttools
  dependency-version: 4.64.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: joblib
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: kiwisolver
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: lxml
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: patsy
  dependency-version: 1.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: platformdirs
  dependency-version: 4.11.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: regex
  dependency-version: 2026.9.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
- dependency-name: sse-starlette
  dependency-version: 3.4.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-and-minor
- dependency-name: wrapt
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: patch-and-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 8, 2026
@dependabot
dependabot Bot requested a review from csmar432 as a code owner September 8, 2026 16:43
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@csmar432 csmar432 Awaiting requested review from csmar432 csmar432 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants