Bump the python-minor-and-patch group across 1 directory with 45 updates

[dependabot]

Bumps the python-minor-and-patch group with 44 updates in the / directory:

Package	From	To
click	8.4.2	8.5.0
huggingface-hub	1.27.0	1.29.0
litellm	1.97.0	1.99.0
google-genai	2.18.1	2.21.0
sphinx-autodoc-typehints	3.13.2	3.13.4
ruff	0.16.3	0.16.5
aiohappyeyeballs	2.6.1	2.7.1
annotated-types	0.7.0	0.8.0
anyio	4.12.0	4.14.2
babel	2.17.0	2.18.0
beautifulsoup4	4.14.2	4.15.0
cffi	2.0.0	2.1.1
charset-normalizer	3.4.4	3.5.1
coverage	7.12.0	7.16.0
cryptography	50.0.0	50.0.1
cuda-pathfinder	1.5.5	1.8.0
distlib	0.4.0	0.4.3
docutils	0.21.2	0.22.4
filelock	3.20.3	3.32.5
fonttools	4.63.0	4.64.0
google-auth	2.56.3	2.57.0
hf-xet	1.5.2	1.6.0
identify	2.6.15	2.6.19
idna	3.15	3.19
jiter	0.12.0	0.16.0
jsonschema	4.23.0	4.26.0
kiwisolver	1.5.0	1.5.1
multidict	6.7.0	6.7.1
nodeenv	1.9.1	1.10.0
nvidia-nvjitlink	13.0.88	13.3.33
platformdirs	4.5.0	4.11.5
propcache	0.4.1	0.5.2
pydantic	2.12.5	2.13.5
python-dotenv	1.2.2	1.2.3
requests	2.33.0	2.34.2
snowballstemmer	3.0.1	3.1.1
soupsieve	2.8.4	2.9.2
tiktoken	0.12.0	0.14.0
tokenizers	0.22.2	0.23.1
typer	0.27.1	0.27.2
typing-extensions	4.15.0	4.16.0
typing-inspection	0.4.2	0.4.4
tzdata	2026.2	2026.3
yarl	1.22.0	1.24.5

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). {pr}3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
• {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
• The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits

• 8b19813 Release version 8.5.0
• 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
• 131c86a Add FAQ entry about UnicodeEncodeError on Windows
• e1fd594 Add support of pathlib.Path to edit (#3781)
• a1d8785 Add support of pathlib.Path to edit
• 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
• a6256bf Forwards all user's parameters set in PAGER
• 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
• 9835b0f Resolve the pager command once, in _pager_contextmanager
• f36d58b Refactor pager stream handling (#3767)
• Additional commits viewable in compare view

Updates huggingface-hub from 1.27.0 to 1.29.0

Release notes

Sourced from huggingface-hub's releases.

[v1.29.0] Fix Xet downloads rate limits, bucket visibility updates, and security fixes

⚡ Xet downloads no longer make one API call per file

Since v1.19.0, downloading a repository with hf_xet eagerly requested a xet read token for every single file, because each download group was built without cached connection info. On repos with many files this quickly added up — a 77k-file repo made ~1,500 Hub API calls per minute — and eventually hit the rate limiter, leaving snapshot_download appearing stalled for minutes before failing with a 429 Too Many Requests. This release restores the Python-side connection info cache so the endpoint and token are reused across download groups, skipping the eager per-file token request entirely. Large downloads are both faster and far less likely to be rate-limited.

• [Xet] Cache connection info to avoid one token request per file by @​hanouticelina in #4732

🪣 Change bucket visibility after creation

Bucket visibility used to be a create-time-only setting: once a bucket existed, there was no way to flip it between private and public. You can now update it with the new HfApi.update_bucket_settings() method (also exported as update_bucket_settings) or from the CLI with hf buckets settings, which takes either --private or --public.

>>> from huggingface_hub import update_bucket_settings
Make a bucket private
>>> update_bucket_settings("username/my-bucket", private=True)
Make it public again
>>> update_bucket_settings("username/my-bucket", private=False)

# Make a bucket private
>>> hf buckets settings username/my-bucket --private
✓ Bucket settings updated
  bucket_id: username/my-bucket
  private: True
Make it public again
>>> hf buckets settings username/my-bucket --public

📚 Documentation: Buckets guide

• [Buckets] Add support for updating bucket visibility by @​hanouticelina in #4715

🔒 Security fixes

Two security-relevant fixes land in this release. First, the path-traversal guard introduced earlier for CVE-2026-15717 is now extended to hf buckets sync / sync_bucket(): when downloading from a bucket, server-supplied file keys were joined straight onto the local destination without validation, so a malicious or compromised bucket could return anchored or traversing keys (/etc/cron.d/evil, ../../../../etc/passwd, Windows drive-absolute or UNC paths) that escape the chosen directory and write arbitrary files. Remote paths are now validated the same way as in the original fix. Second, load_state_dict_from_file could fall back to pickle deserialization for a shard named exactly .safetensors: Path.suffix returns an empty string for extension-only filenames, so a file that passed sharded-checkpoint validation (which uses str.endswith) was still routed to torch.load(weights_only=False). A shared _is_safetensors() helper now guarantees both code paths use the same matching semantics, so an index-declared "safetensors" checkpoint can never be loaded with pickle.

• [Buckets] Validate remote paths in bucket sync to prevent path traversal by @​hanouticelina in #4731
• Fix extension-confusion fallback to pickle in load_state_dict_from_file (add _is_safetensors) by @​moon-bot-app[bot] in #4737

🤖 Inference

• [Inference Providers] Send LoRA weights for fal-ai text-to-video by @​moon-bot-app[bot] in #4706
• Hint at stream=True when a non-streaming inference call fails with 504 by @​moon-bot-app[bot] in #4744

🖥️ CLI

... (truncated)

Commits

• 4237d95 Release: v1.29.0
• dd44abc Release: v1.29.0.rc1
• 38d29a8 [Release] Refresh OpenCode model cache before validating RELEASE_NOTES_MODEL ...
• b1bf950 Release: v1.29.0.rc0
• 2e62777 [CI] Auto-close community PRs without a maintainer-scoped issue (#4695)
• c5eb13c [CLI] Installer: point at shadowed newer Python on macOS (#4758)
• 585c075 [Buckets] Validate remote paths in bucket sync to prevent path traversal (#4731)
• 4dcfe7e [CLI] Fix argument help rendering with click 8.5 (#4759)
• 2c60641 [Xet] Cache connection info to avoid one token request per file (#4732)
• c6be77f Hint at stream=True when a non-streaming inference call fails with 504 (#4744)
• Additional commits viewable in compare view

Updates litellm from 1.97.0 to 1.99.0

Release notes

Sourced from litellm's releases.

v1.99.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.99.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.99.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.99.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• chore(typing): drop 1.3k basedpyright errors across 30 Any hotspot files by @​mateo-berri in BerriAI/litellm#37073
• fix(proxy): register WebSocket passthrough for OpenAI prefixes by @​LHMQ878 in BerriAI/litellm#36151
• fix(bedrock): report uploaded size in the FileObject returned by managed batch uploads by @​devin-ai-integration[bot] in BerriAI/litellm#36392
• fix(batches): support AWS Bedrock batch cancellation via StopModelInvocationJob by @​ArjunPakhan in BerriAI/litellm#34087
• feat: Async Rust OCR Bridge and MCP OAuth UI Restore by @​ArjunPakhan in BerriAI/litellm#31453
• fix(batches): don't crash logging when a completed batch has no output file by @​MUSE-CODE-SPACE in BerriAI/litellm#34067
• fix(UI): add default model pin to complexity router UI by @​tin-berri in BerriAI/litellm#36615
• feat(ui): add Lite mixed-provider auto-router preset by @​tin-berri in BerriAI/litellm#37068
• feat(ui): link key info header to its user, creator, team, and organization by @​ryan-crabbe-berri in BerriAI/litellm#37187
• fix(guardrails): scan text on /guardrails/apply_guardrail for Azure Content Safety by @​yucheng-berri in BerriAI/litellm#36894
• feat(bedrock): forward LiteLLM identity and metadata into Bedrock requestMetadata by @​yassin-berriai in BerriAI/litellm#36861
• fix(azure): rename max_tokens to max_completion_tokens for gpt-5-chat deployments by @​yassin-berriai in BerriAI/litellm#36857
• fix(bedrock): preserve cache token usage when invocationMetrics replace the usage block by @​brian5021 in BerriAI/litellm#36878
• fix(proxy): registry caches stop per-request tag and end-user Postgres reads in auth by @​ryan-crabbe-berri in BerriAI/litellm#36801
• test(e2e): replay a real tool-search assistant turn back to Bedrock Invoke by @​yassin-berriai in BerriAI/litellm#36856

... (truncated)

Commits

• fa647f7 Merge pull request #39048 from BerriAI/litellm_/docker-build-failure-9f6247
• 5892e30 fix(docker): pin apk python to 3.13 in migrations image
• 91f1a57 fix(docker): bump wolfi-base for glibc 2.44 and pin apk python to 3.13
• d0c8667 Merge pull request #38862 from BerriAI/litellm_/litellm-e2e-rc-1-99-0-11cfd8
• da1d292 test(e2e): measure the select popup after it settles instead of mid-flight
• a2aecfe fix(e2e): only the negative fallback assertion needs every replica to agree
• ab1da05 test(e2e): de-flake the cost-header cache read and the router fallback control
• 1411852 Merge pull request #38855 from BerriAI/litellm_/backport-38251-rc-1-99-0
• f0ee067 fix(anthropic): translate tool_result document blocks in the /v1/messages bridge
• 4b281e7 Merge pull request #38854 from BerriAI/litellm_backport_model_test_dialog_str...
• Additional commits viewable in compare view

Updates google-genai from 2.18.1 to 2.21.0

Release notes

Sourced from google-genai's releases.

v2.21.0

2.21.0 (2026-08-31)

Features

• Add destination parameter to client.files.download to support streaming downloads to disk or file-like objects (fcf9e3f)
• Add support for the audio/webm MIME type. (67ec3d7)
• Add translation_config SDK support for GEAP. (ff153a7)
• Add Video Understanding support to the Interactions API (2cc99a9)

Bug Fixes

• Expose ProcessingCallStep and ProcessingResultStep in Interactions SDK (df0ab55)

v2.20.0

2.20.0 (2026-08-25)

Features

• Add AudioTranscriptionConfigMode (4a80954)
• Add environment files support and scotty file download helper (3074263)
• Add TYPE_JPEG2000 to VideoContent.MimeType enum (ef39c40)

v2.19.0

2.19.0 (2026-08-19)

Features

• Add mode enum (VERBATIM, SMART) to AudioTranscriptionConfig and TranscriptionConfig. (e8cd7d0)
• Add enable_data_retention to ToolParallelAiSearch, Add step_count to ReinforcementTuningHyperParameters, Add BidiGenerateContentSetup (656da78)
• Add IDLE state to live connection status enum and mark REQUIRES_ACTION as deprecated. (599d89f)
• Add video resolution and extension task parameters (c3bdb88)

Changelog

Sourced from google-genai's changelog.

2.21.0 (2026-08-31)

Features

• Add destination parameter to client.files.download to support streaming downloads to disk or file-like objects (fcf9e3f)
• Add support for the audio/webm MIME type. (67ec3d7)
• Add translation_config SDK support for GEAP. (ff153a7)
• Add Video Understanding support to the Interactions API (2cc99a9)

Bug Fixes

• Expose ProcessingCallStep and ProcessingResultStep in Interactions SDK (df0ab55)

2.20.0 (2026-08-25)

Features

• Add AudioTranscriptionConfigMode (4a80954)
• Add environment files support and scotty file download helper (3074263)
• Add TYPE_JPEG2000 to VideoContent.MimeType enum (ef39c40)

2.19.0 (2026-08-19)

Features

• Add mode enum (VERBATIM, SMART) to AudioTranscriptionConfig and TranscriptionConfig. (e8cd7d0)
• Add enable_data_retention to ToolParallelAiSearch, Add step_count to ReinforcementTuningHyperParameters, Add BidiGenerateContentSetup (656da78)
• Add IDLE state to live connection status enum and mark REQUIRES_ACTION as deprecated. (599d89f)
• Add video resolution and extension task parameters (c3bdb88)

Commits

• ca2b081 chore(main): release 2.21.0 (#2918)
• 67ec3d7 feat: Add support for the audio/webm MIME type.
• ab41ae3 chore: internal
• ff153a7 feat: Add translation_config SDK support for GEAP.
• df0ab55 fix: expose ProcessingCallStep and ProcessingResultStep in Interactions SDK
• fcf9e3f feat: Add destination parameter to client.files.download to support streaming...
• 2cc99a9 feat: add Video Understanding support to the Interactions API
• 9570065 chore: Add java api reference examples.
• 66518c9 chore(main): release 2.20.0 (#2884)
• 4a80954 feat: Add AudioTranscriptionConfigMode
• Additional commits viewable in compare view

Updates sphinx-autodoc-typehints from 3.13.2 to 3.13.4

Release notes

Sourced from sphinx-autodoc-typehints's releases.

3.13.4

What's Changed

• 🐛 fix(parser): stop shadowing intersphinx roles in the type role by @​gaborbernat in tox-dev/sphinx-autodoc-typehints#761
• 🐛 fix(resolver): bind only what a guarded statement defines by @​gaborbernat in tox-dev/sphinx-autodoc-typehints#760
• 🧪 test(docstring): pin what a nested handler restores by @​gaborbernat in tox-dev/sphinx-autodoc-typehints#759

Full Changelog: tox-dev/sphinx-autodoc-typehints@3.13.3...3.13.4

3.13.3

What's Changed

• 🔧 chore: batch dependency updates weekly on Tuesday by @​gaborbernat in tox-dev/sphinx-autodoc-typehints#755
• 🐛 fix(parser): stop shadowing intersphinx roles in the rtype probe by @​gaborbernat in tox-dev/sphinx-autodoc-typehints#756
• 🐛 fix(resolver): accept guarded code the interpreter rejects by @​gaborbernat in tox-dev/sphinx-autodoc-typehints#757
• 🐛 fix(docstring): survive a re-entrant docstring handler by @​gaborbernat in tox-dev/sphinx-autodoc-typehints#758

Full Changelog: tox-dev/sphinx-autodoc-typehints@3.13.2...3.13.3

Commits

• 7853f2e 🧪 test(docstring): pin what a nested handler restores (#759)
• a708030 🐛 fix(resolver): bind only what a guarded statement defines (#760)
• f6ca3fd 🐛 fix(parser): stop shadowing intersphinx roles in the type role (#761)
• 02dd58f 🐛 fix(docstring): survive a re-entrant docstring handler (#758)
• 3f6d334 🐛 fix(resolver): accept guarded code the interpreter rejects (#757)
• d98ed0b 🐛 fix(parser): stop shadowing intersphinx roles in the rtype probe (#756)
• c4b99d0 🔧 chore: batch dependency updates weekly on Tuesday (#755)
• ce9abe3 build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#754)
• a032f12 build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#752)
• 3528bac [pre-commit.ci] pre-commit autoupdate (#749)
• Additional commits viewable in compare view

Updates ruff from 0.16.3 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

... (truncated)

Commits

• 9e4938c Bump 0.16.5 (#28110)
• aad0e90 Allow rules without codes (#28049)
• 5fdab73 Update preview default rules and categories (#27877)
• 29c8e5b Document rule acceptance guidelines (#27910)
• 50a4d7f Document the new category selectors (#27906)
• ada8795 Introduce category selectors (#27666)
• d894723 [ty] Infer lambda parameters through callable type aliases (#28109)
• 2685fde [ty] Narrow functional enum members in == and match (#28103)
• efcffd2 [ty] Intersection simplifications with subtype-related generic specialization...
• eb78048 [ty] Bump ecosystem-analyzer for HTML escaping (#28104)
• Additional commits viewable in compare view

Updates aiohappyeyeballs from 2.6.1 to 2.7.1

Release notes

Sourced from aiohappyeyeballs's releases.

v2.7.1 (2026-07-01)

Performance Improvements

• Use defaultdict to help with performance (#239, e10f335)

Refactoring

• Collapse collect-then-remove pattern in utils helpers (#227, 0dd3fd1)

• Merge identical except blocks in _connect_sock cleanup (#229, b7c186e)

• Simplify _interleave_addrinfos family grouping (#226, fdf6548)

---

Detailed Changes: v2.7.0...v2.7.1

v2.7.0 (2026-05-20)

Features

• Add Python 3.14 support (#224, 10e7d43)

---

Detailed Changes: v2.6.2...v2.7.0

v2.6.2 (2026-05-20)

Bug Fixes

• Clear error on empty addr_infos in start_connection (#222, 55dd76a)

Refactoring

• Optimize obtaining event-loop down to 1 line (#185, 02a7029)

Testing

• Stop verify_no_lingering_tasks from leaking an event loop (#221, ce43beb)

---

Detailed Changes: v2.6.1...v2.6.2

Changelog

Sourced from aiohappyeyeballs's changelog.

v2.7.1 (2026-07-01)

Performance improvements

• Use defaultdict to help with performance (e10f335)

Refactoring

• Simplify _interleave_addrinfos family grouping (fdf6548)
• Collapse collect-then-remove pattern in utils helpers (0dd3fd1)
• Merge identical except blocks in _connect_sock cleanup (b7c186e)

v2.7.0 (2026-05-20)

Features

• Add python 3.14 support (10e7d43)

v2.6.2 (2026-05-20)

Bug fixes

• Clear error on empty addr_infos in start_connection (55dd76a)

Testing

• Stop verify_no_lingering_tasks from leaking an event loop (ce43beb)

Refactoring

• Optimize obtaining event-loop down to 1 line (02a7029)

Commits

• 4dfc926 2.7.1
• e10f335 perf: use defaultdict to help with performance (#239)
• 338277b chore: stop tracking .DS_Store files (#251)
• 1697869 ci: add codspeed benchmark suite for addrinfo reordering hot paths (#250)
• d40a848 chore(deps-dev): bump starlette from 1.0.1 to 1.3.1 (#242)
• 51d4266 chore(deps-dev): bump cryptography from 46.0.7 to 48.0.1 (#243)
• 2df44b3 chore(pre-commit.ci): pre-commit autoupdate (#241)
• 3e3cb61 chore(deps-dev): bump pytest from 9.0.3 to 9.1.1 (#244)
• 922dcd7 chore(deps-ci): bump the github-actions group with 4 updates (#245)
• 70461c5 ci: drop .github/FUNDING.yml to inherit org-wide config (#247)
• Additional commits viewable in compare view

Updates annotated-types from 0.7.0 to 0.8.0

Release notes

Sourced from annotated-types's releases.

v0.8.0

What's Changed

• Rename DocInfo to Doc by @​zen-xu in annotated-types/annotated-types#80
• Add support for Python 3.13 by @​hugovk in annotated-types/annotated-types#83
• Fix docstring of Timezone by @​Viicos in annotated-types/annotated-types#84
• Update license-files to be PEP-639 compliant (#85) by @​shoeffner in annotated-types/annotated-types#86
• fix: typo in README.md by @​camiloaz in annotated-types/annotated-types#87
• add CI for PyPy3.11 and fix test (issue 71) by @​mattip in annotated-types/annotated-types#88
• Fix string predicate names in doc by @​leogermond in annotated-types/annotated-types#90
• Add SPDX license expression by @​wichert in annotated-types/annotated-types#92
• Added Python 3.14 to the test matrix by @​imtoopunkforyou in annotated-types/annotated-types#96
• Add support for Python 3.14 and drop EOL 3.8-3.9 by @​hugovk in annotated-types/annotated-types#97
• Fix typo in Len docstring by @​Dutcho in