Skip to content

Bump the python-dependencies group with 8 updates - #377

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/python-dependencies-6b017ed4af
Open

Bump the python-dependencies group with 8 updates#377
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/python-dependencies-6b017ed4af

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 8 updates:

Package From To
idna 3.18 3.19
filelock 3.32.2 3.32.4
ruff 0.16.1 0.16.5
responses 0.26.2 0.26.3
syrupy 5.5.3 6.0.0
mypy 2.3.0 2.3.1
tox 4.58.0 4.61.1
build 1.5.0 1.6.0

Updates idna from 3.18 to 3.19

Release notes

Sourced from idna's releases.

v3.19

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.19 (2026-08-18)

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits
  • 03a9a11 Release 3.19
  • 2d2a7ef Pre-release 3.19rc0
  • 5cce130 Merge pull request #268 from kjd/fix-std3-regex-alert
  • 3914b75 Split the STD3 disallowed-character range so uppercase is explicit
  • ce9fd98 Merge pull request #267 from kjd/housekeeping
  • 809240c Fail CI when the license copyright year is behind the current year
  • d9e16c5 Consolidate test fixtures, prune stale gitignore entries, and fix doc typos
  • ef30fee Remove dead code and pare back superfluous comments
  • b907913 Tighten the version support and Unicode notes in the README
  • 6204cbe Ignore local build artifacts and stop packaging stray tooling config
  • Additional commits viewable in compare view

Updates filelock from 3.32.2 to 3.32.4

Release notes

Sourced from filelock's releases.

3.32.4

What's Changed

Full Changelog: tox-dev/filelock@3.32.3...3.32.4

3.32.3

What's Changed

Full Changelog: tox-dev/filelock@3.32.2...3.32.3

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.5 (2026-08-31)

  • SoftFileLease.token and AsyncSoftFileLease.token now read None after a failed acquisition, so a contender turned away by a live holder no longer reports a token for a claim it never published. :pr:721
  • Document that mode has no setter: unlike poll_interval, timeout, blocking and lifetime, it is fixed at construction and lock.mode = ... raises AttributeError. :pr:716

3.32.4 (2026-08-23)

  • StrictSoftFileLock always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:705
  • WindowsFileLock waits out a transient STATUS_ACCESS_DENIED from NtCreateFile for up to half a second before raising PermissionError, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:705
  • Every lock class now escapes the hostname it publishes, so a host whose socket.gethostname() carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held SoftReadWriteLock read slot to a peer and could not take a write slot or a StrictSoftFileLock at all. :pr:709

3.32.3 (2026-08-13)

  • The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

3.32.2 (2026-07-29)

  • A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

3.32.1 (2026-07-26)

  • Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

... (truncated)

Commits
  • cb493d6 Release 3.32.4
  • fe07a11 escape the hostname every marker publishes (#709)
  • 232732f 🔧 chore: batch dependency updates weekly on Tuesday (#713)
  • 2966eb5 🧪 test(fork): fork once the event loop has closed (#714)
  • 61511eb build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#712)
  • f12a52f build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#711)
  • 54c7b6c [pre-commit.ci] pre-commit autoupdate (#710)
  • 49f8035 🧪 test: cover a reclaimed private record for real (#706)
  • bb16d39 🧪 test: deflake six scheduled-run failures (#704)
  • 13b82a6 🐛 fix: retry transient denials on open and claim read (#705)
  • Additional commits viewable in compare view

Updates ruff from 0.16.1 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

0.16.4

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

... (truncated)

Commits

Updates responses from 0.26.2 to 0.26.3

Release notes

Sourced from responses's releases.

0.26.3

  • Added a keep_headers argument to _recorder.record and Recorder.dump_to_file to preserve named headers (for example Date) that are otherwise stripped as verbose defaults, so a signed response can be recorded and later verified. Matching is case-insensitive. See #763
  • Fixed the element type exposed by CallList so static type checkers infer Call values when iterating, indexing, or filtering recorded calls. See #722
  • Fixed query_string_matcher (and the query matching auto-applied to a registered URL's own query string) discarding blank-valued query params (b=), which caused requests with an extra or missing blank param to match incorrectly. See #804
  • Fixed fragment_identifier_matcher treating opaque fragments (those without =, e.g. /users/5) as always equal, so a required fragment matched a different one or none at all. See #806
Changelog

Sourced from responses's changelog.

0.26.3

  • Added a keep_headers argument to _recorder.record and Recorder.dump_to_file to preserve named headers (for example Date) that are otherwise stripped as verbose defaults, so a signed response can be recorded and later verified. Matching is case-insensitive. See #763
  • Fixed the element type exposed by CallList so static type checkers infer Call values when iterating, indexing, or filtering recorded calls. See #722
  • Fixed query_string_matcher (and the query matching auto-applied to a registered URL's own query string) discarding blank-valued query params (b=), which caused requests with an extra or missing blank param to match incorrectly. See #804
  • Fixed fragment_identifier_matcher treating opaque fragments (those without =, e.g. /users/5) as always equal, so a required fragment matched a different one or none at all. See #806
Commits
  • cb13954 release: 0.26.3
  • f30df24 Merge pull request #809 from golikovichev/fix/763-recorder-keep-headers
  • 5c074b9 Add keep_headers to the recorder to preserve named default headers
  • 2827d43 fix: type CallList as a sequence of calls (#807)
  • 2af69cb fix: compare opaque fragment identifiers verbatim (#806)
  • da2c5d1 fix: keep blank-valued query params significant in query_string_matcher (#804)
  • 983a497 Merge branch 'release/0.26.2'
  • See full diff in compare view

Updates syrupy from 5.5.3 to 6.0.0

Release notes

Sourced from syrupy's releases.

v6.0.0

Syrupy 6.0.0

(2026-08-22)

Syrupy 6 focuses on better built-in serialization, clearer snapshot workflows, and large-suite performance. Please review the breaking changes before upgrading.

Most suites should not need significant snapshot updates on upgrade — the main exception is dataclass usage (see below). Syrupy v6 does not change the required Python version or other package dependencies. Support for Python 3.10 will instead be dropped in the next Syrupy major version (v7).

Full Changelog: syrupy-project/syrupy@v5.5.3...v6.0.0

Breaking Changes

Built-in dataclass serialization (removed DataclassPlugin)

stdlib dataclasses are now serialized natively by the Amber serializer. The separate DataclassPlugin has been removed.

  • If you used DataclassPlugin: remove imports and plugin wiring. Behavior should match what the plugin produced; no snapshot rewrite should be needed for the dataclass shape itself.
  • If you did not use the plugin: dataclass snapshots may change from a repr-style string to structured Amber form (field-by-field). Re-run with --snapshot-update where those assertions fail.

Example of what to remove:

# Before (v5)
from syrupy.extensions.amber.dataclasses_plugin import DataclassPlugin
class MySerializer(AmberDataSerializer):
serializer_plugins = [DataclassPlugin, ...]

# After (v6) — dataclasses work with the default Amber extension
assert MyDataclass(...) == snapshot

Attrs and Pydantic models are unchanged and still need their serializer plugins. See the serializer plugins example.

(#1220, closes #1048)

JSON datetime.date snapshots

The JSON extension now serializes datetime.date as YYYY-MM-DD instead of a repr string. Existing JSON snapshots that contain dates will need an update.

(#1216, closes #1058)

path_value nested path replacement in default (literal) mode

path_value(..., regex=False) now correctly replaces values at nested paths such as user.token. Previously, the default-mode lookup missed escaped path keys, so nested values were left unchanged (and could leak into committed snapshots).

... (truncated)

Changelog

Sourced from syrupy's changelog.

v6.0.0 (2026-08-22)

What's Changed

... (truncated)

Commits
  • 621af75 chore(release): 6.0.0 [skip ci]
  • 3a9f691 fix: single file snapshot no longer buffers in memory (#1223)
  • ab13f8d chore: sponsorship (#1224)
  • 98f989c feat: add --snapshot-declaration-order for respecting declaration order (#1222)
  • b549b4b feat: built-in support for Dataclasses (#1220)
  • d34933f chore: use the benchmarks git branch (#1221)
  • f6eda02 chore(ci): permissions for gh-pages
  • a5ce049 chore(deps): update actions/configure-pages action to v6 (#1219)
  • c0cb162 chore: update github pages
  • 4d59bde chore: update docs for v6 release (#1218)
  • Additional commits viewable in compare view

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

Updates tox from 4.58.0 to 4.61.1

Release notes

Sourced from tox's releases.

v4.61.1

What's Changed

Full Changelog: tox-dev/tox@4.61.0...4.61.1

v4.61.0

What's Changed

Full Changelog: tox-dev/tox@4.60.1...4.61.0

v4.60.1

What's Changed

New Contributors

Full Changelog: tox-dev/tox@4.60.0...4.60.1

v4.60.0

What's Changed

... (truncated)

Changelog

Sourced from tox's changelog.

Bug fixes - 4.61.1

  • Publish a JSON Schema that compiles under SchemaStore's validator again, so editors pick up the configuration keys added since 4.56 - by :user:gaborbernat. (:issue:4051)

Contributor-facing changes - 4.61.1

  • Check tox's JSON Schema with SchemaStore's own validator on every pull request that changes it, and again before the release sync opens a pull request there - by :user:gaborbernat. (:issue:4051)

v4.61.0 (2026-08-28)

Features - 4.61.0

  • A labeled factor group can now declare a default for {factor:label} to fall back on when no factor of that group is active in the environment name. Setting TOX_FACTOR_<label> resolves that label to a given value for a single run - by :user:gaborbernat. (:issue:4045)
  • A factor range now takes a label when you nest it under one, as in factors = [{ py_version = { prefix = "3.", start = 12, stop = 14 } }], which makes {factor:py_version} available for ranges - by :user:gaborbernat. (:issue:4046)

Bug fixes - 4.61.0

  • Values passed via --override/-x or TOX_OVERRIDE now resolve substitutions such as {posargs}, {env:VAR} and {env_name}, instead of reaching the environment as literal text - by :user:gaborbernat. (:issue:4047)

Improved documentation - 4.61.0

  • Point the virtualenv discovery link in the explanation documentation at its current location. (:issue:4042)

Contributor-facing changes - 4.61.0

  • Replace the deprecated load_module call in the documentation configuration, which Python 3.15 removes - by :user:gaborbernat. (:issue:4043)

v4.60.1 (2026-08-25)

Bug fixes - 4.60.1

... (truncated)

Commits
  • c8c010a release 4.61.1
  • cd8c1fa 🐛 fix(schema): declare prefix in the labeled factor group's not clause (#4051)
  • aa8f46c release 4.61.0
  • 8ef0326 ✨ feat(toml): declare factor group defaults and per-run overrides (#4050)
  • e489adb 🐛 fix(config): substitute inside override values (#4048)
  • c1af929 ✨ feat(toml): allow labeling a range factor group (#4049)
  • 930190c Replace deprecated load_module in docs conf (#4043)
  • 2a4a215 docs: fix dead virtualenv discovery link in explanation.rst (#4042)
  • e91ca3b release 4.60.1
  • 59e984f Report an empty TOML command value as a handled error (#4041)
  • Additional commits viewable in compare view

Updates build from 1.5.0 to 1.6.0

Release notes

Sourced from build's releases.

1.6.0

What's Changed

@dependabot
Bump the python-dependencies group with 8 updates
66b6879 
Bumps the python-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [idna](https://github.com/kjd/idna) | `3.18` | `3.19` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.2` | `3.32.4` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.1` | `0.16.5` |
| [responses](https://github.com/getsentry/responses) | `0.26.2` | `0.26.3` |
| [syrupy](https://github.com/syrupy-project/syrupy) | `5.5.3` | `6.0.0` |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [tox](https://github.com/tox-dev/tox) | `4.58.0` | `4.61.1` |
| [build](https://github.com/pypa/build) | `1.5.0` | `1.6.0` |


Updates `idna` from 3.18 to 3.19
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.19)

Updates `filelock` from 3.32.2 to 3.32.4
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.2...3.32.4)

Updates `ruff` from 0.16.1 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.1...0.16.5)

Updates `responses` from 0.26.2 to 0.26.3
- [Release notes](https://github.com/getsentry/responses/releases)
- [Changelog](https://github.com/getsentry/responses/blob/master/CHANGES)
- [Commits](getsentry/responses@0.26.2...0.26.3)

Updates `syrupy` from 5.5.3 to 6.0.0
- [Release notes](https://github.com/syrupy-project/syrupy/releases)
- [Changelog](https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md)
- [Commits](syrupy-project/syrupy@v5.5.3...v6.0.0)

Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)

Updates `tox` from 4.58.0 to 4.61.1
- [Release notes](https://github.com/tox-dev/tox/releases)
- [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst)
- [Commits](tox-dev/tox@4.58.0...4.61.1)

Updates `build` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.5.0...1.6.0)

---
updated-dependencies:
- dependency-name: idna
  dependency-version: '3.19'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: filelock
  dependency-version: 3.32.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: responses
  dependency-version: 0.26.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: syrupy
  dependency-version: 6.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: mypy
  dependency-version: 2.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: tox
  dependency-version: 4.61.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: build
  dependency-version: 1.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants