From efea260d8763fd8c2a008c458151fbdc6082b7d0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 11:17:21 +0000 Subject: [PATCH 01/10] Bump github/codeql-action from 4.37.2 to 4.37.3 (#13250) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.2 to 4.37.3.
Release notes

Sourced from github/codeql-action's releases.

v4.37.3

No user facing changes.

Changelog

Sourced from github/codeql-action's changelog.

4.37.3 - 22 Jul 2026

No user facing changes.

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=4.37.2&new-version=4.37.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7dea00c06e5..1a48f1b324d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -29,17 +29,17 @@ jobs: uses: actions/checkout@v7 - name: Initialize CodeQL - uses: github/codeql-action/init@v4.37.2 + uses: github/codeql-action/init@v4.37.3 with: languages: ${{ matrix.language }} config-file: ./.github/codeql.yml queries: +security-and-quality - name: Autobuild - uses: github/codeql-action/autobuild@v4.37.2 + uses: github/codeql-action/autobuild@v4.37.3 if: ${{ matrix.language == 'python' || matrix.language == 'javascript' }} - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4.37.2 + uses: github/codeql-action/analyze@v4.37.3 with: category: "/language:${{ matrix.language }}" From 20a25dc9c3ce9d75794eb79a13a7a653f606ab43 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 12:01:58 +0000 Subject: [PATCH 02/10] Bump pypa/cibuildwheel from 4.1.0 to 4.1.1 (#13251) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [pypa/cibuildwheel](https://github.com/pypa/cibuildwheel) from 4.1.0 to 4.1.1.
Release notes

Sourced from pypa/cibuildwheel's releases.

v4.1.1

  • ✨ Adds pyodide-build as a separate build-frontend, now the default frontend for Pyodide, with verbosity flags handling. Any other frontend is ignored with a warning on Pyodide. (#2609, #2945)
  • 🔐 Uses digests instead of tags for pinned container images, strengthening supply-chain security. The human-readable tags remain as comments in pinned_docker_images.cfg. (#2915)
  • 🐛 Fixes platform-specific test-runtime environment variables (e.g. CIBW_TEST_RUNTIME_ANDROID) not being honored (#2941)
  • 🐛 Fixes quoting of test-requires and audit-requires so PEP 508 specifiers containing spaces work (#2913)
  • 🐛 Makes archs parsing case-insensitive and platform-aware, so e.g. arm64 works on Windows (#2920)
  • 🐛 Uses an absolute path for the {project} placeholder in config-settings (#2934)
  • 🐛 Validates the pyodide-version option against the build identifier with a clear error (#2925)
  • 🐛 Fixes PyPy installs on macOS after PyPy switched its downloads from .tar.bz2 to .tar.gz (#2939)
  • 🐛 Makes a matching python3-config available in the build and test venvs on macOS (#2922)
  • 🛠 Updates dependencies and container pins (#2917, #2935, #2939)
  • 🛠 Updates Android tests to current Python versions and the new test repository URL (#2933)
  • 🛠 Drops the orjson dependency, no longer used by mypy 2+ (#2923)
  • 📚 Builds the docs with properdocs, a MkDocs fork (#2946)
  • 📚 Adds the missing cp314-pyodide_wasm32 entry to the build identifier table (#2947)
  • 📚 Removes outdated notes about the pip wheel build frontend and ClearLinux (#2926)
  • 💼 Adds a "CI: PyPy EoL" PR label to run PyPy EoL tests on PRs (#2930)
  • 💼 Updates CI action pins and pre-commit hooks (#2914, #2932, #2938, #2940, #2942, #2943)
Changelog

Sourced from pypa/cibuildwheel's changelog.

v4.1.1

24 July 2026

  • ✨ Adds pyodide-build as a separate build-frontend, now the default frontend for Pyodide, with verbosity flags handling. Any other frontend is ignored with a warning on Pyodide. (#2609, #2945)
  • 🔐 Uses digests instead of tags for pinned container images, strengthening supply-chain security. The human-readable tags remain as comments in pinned_docker_images.cfg. (#2915)
  • 🐛 Fixes platform-specific test-runtime environment variables (e.g. CIBW_TEST_RUNTIME_ANDROID) not being honored (#2941)
  • 🐛 Fixes quoting of test-requires and audit-requires so PEP 508 specifiers containing spaces work (#2913)
  • 🐛 Makes archs parsing case-insensitive and platform-aware, so e.g. arm64 works on Windows (#2920)
  • 🐛 Uses an absolute path for the {project} placeholder in config-settings (#2934)
  • 🐛 Validates the pyodide-version option against the build identifier with a clear error (#2925)
  • 🐛 Fixes PyPy installs on macOS after PyPy switched its downloads from .tar.bz2 to .tar.gz (#2939)
  • 🐛 Makes a matching python3-config available in the build and test venvs on macOS (#2922)
  • 🛠 Updates dependencies and container pins (#2917, #2935, #2939)
  • 🛠 Updates Android tests to current Python versions and the new test repository URL (#2933)
  • 🛠 Drops the orjson dependency, no longer used by mypy 2+ (#2923)
  • 📚 Builds the docs with properdocs, a MkDocs fork (#2946)
  • 📚 Adds the missing cp314-pyodide_wasm32 entry to the build identifier table (#2947)
  • 📚 Removes outdated notes about the pip wheel build frontend and ClearLinux (#2926)
  • 💼 Adds a "CI: PyPy EoL" PR label to run PyPy EoL tests on PRs (#2930)
  • 💼 Updates CI action pins and pre-commit hooks (#2914, #2932, #2938, #2940, #2942, #2943)
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pypa/cibuildwheel&package-manager=github_actions&previous-version=4.1.0&new-version=4.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci-cd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 1787938ce73..783902d1e77 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -723,7 +723,7 @@ jobs: run: | make cythonize - name: Build wheels - uses: pypa/cibuildwheel@v4.1.0 + uses: pypa/cibuildwheel@v4.1.1 with: # `build-frontend = "build[uv]"` (pyproject.toml) requires uv to be # available on the runner for Windows and macOS. Installing From 8baf9a2b7b052b7b41a4df07d802f7ca8ca8fe56 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 12:35:26 +0000 Subject: [PATCH 03/10] Bump virtualenv from 21.6.1 to 21.7.0 (#13256) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.6.1 to 21.7.0.
Release notes

Sourced from virtualenv's releases.

21.7.0

What's Changed

Full Changelog: https://github.com/pypa/virtualenv/compare/21.6.1...21.7.0

Changelog

Sourced from virtualenv's changelog.

Features - 21.7.0

  • Declare support for Python 3.15: CI now tests against the CPython 3.15 beta, including the free-threaded 3.15t build, and the Programming Language :: Python :: 3.15 classifier is advertised. (:issue:3192)

v21.6.1 (2026-07-10)

Commits
  • e6eb5b0 release 21.7.0
  • 6d7bf90 Add changelog fragment for Python 3.15 support
  • 482c7f9 👷 ci: test against Python 3.15 beta (#3192)
  • a190228 [pre-commit.ci] pre-commit autoupdate (#3191)
  • b54bc80 Replace prettier with mdformat and yamlfmt (#3190)
  • c5dff1d chore(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 (#3189)
  • cab4a0a chore(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 (#3188)
  • c53b5b1 [pre-commit.ci] pre-commit autoupdate (#3187)
  • 20b70f3 chore(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 (#3186)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=virtualenv&package-manager=pip&previous-version=21.6.1&new-version=21.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 3aab5418d78..9ad42d5f43c 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -333,7 +333,7 @@ uvloop==0.22.1 ; platform_system != "Windows" # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.6.1 +virtualenv==21.7.0 # via pre-commit wheel==0.47.0 # via pip-tools diff --git a/requirements/dev.txt b/requirements/dev.txt index 3fdb6a1b803..b86a5939815 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -323,7 +323,7 @@ uvloop==0.22.1 ; platform_system != "Windows" and implementation_name == "cpytho # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.6.1 +virtualenv==21.7.0 # via pre-commit wheel==0.47.0 # via pip-tools diff --git a/requirements/lint.txt b/requirements/lint.txt index 39b7bf5979f..c6a5cfcef66 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -166,7 +166,7 @@ uvloop==0.22.1 ; platform_system != "Windows" # via -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.6.1 +virtualenv==21.7.0 # via pre-commit yarl==1.24.5 # via aiohttp From 8cb2c63d0e05a1ae0508e25b88120e75b5c5b4ff Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 12:43:18 +0000 Subject: [PATCH 04/10] Bump platformdirs from 4.10.1 to 4.11.0 (#13258) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.10.1 to 4.11.0.
Release notes

Sourced from platformdirs's releases.

4.11.0

What's Changed

Full Changelog: https://github.com/tox-dev/platformdirs/compare/4.10.1...4.11.0

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.0 (2026-07-21)

  • Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

4.10.1 (2026-07-18)

  • Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

4.10.0 (2026-05-28)

  • Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491
  • Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490
  • Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

4.9.6 (2026-04-09)

  • Fix macOS XDG variables leaking across :func:~platformdirs.user_config_dir, :func:~platformdirs.user_data_dir, and :func:~platformdirs.user_state_dir when only some are set :pr:473 - by :user:Goddesen
  • Avoid duplicate site directories in Unix :meth:~platformdirs.PlatformDirs.iter_config_dirs and :meth:~platformdirs.PlatformDirs.iter_data_dirs when use_site_for_root is active :pr:469 - by :user:viccie30

4.9.4 (2026-03-05)

  • Respect XDG_CONFIG_HOME when reading the user-dirs configuration :pr:453 - by :user:bysiber
  • Create the directory in Android :func:~platformdirs.user_log_dir and :func:~platformdirs.user_runtime_dir when ensure_exists is set :pr:452 - by :user:bysiber

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=platformdirs&package-manager=pip&previous-version=4.10.1&new-version=4.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 9ad42d5f43c..7fda5b53619 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -167,7 +167,7 @@ pip-tools==7.6.0 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.10.1 +platformdirs==4.11.0 # via # python-discovery # virtualenv diff --git a/requirements/dev.txt b/requirements/dev.txt index b86a5939815..402a46b0d8a 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -164,7 +164,7 @@ pip-tools==7.6.0 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.10.1 +platformdirs==4.11.0 # via # python-discovery # virtualenv diff --git a/requirements/lint.txt b/requirements/lint.txt index c6a5cfcef66..2964a38642a 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -84,7 +84,7 @@ packaging==26.2 # via pytest pathspec==1.1.1 # via mypy -platformdirs==4.10.1 +platformdirs==4.11.0 # via # python-discovery # virtualenv From 22a1ad787c7392f8edf8388f7f8fcbf6117a705d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 12:45:47 +0000 Subject: [PATCH 05/10] Bump aiohttp from 3.14.2 to 3.14.3 (#13264) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [aiohttp](https://github.com/aio-libs/aiohttp) from 3.14.2 to 3.14.3.
Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

  • Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

    Related issues and pull requests on GitHub: :issue:13180.

  • Fixed error message construction in the C HTTP parser -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:13222.

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiohttp&package-manager=pip&previous-version=3.14.2&new-version=3.14.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 7fda5b53619..72a2a4cd981 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -347,5 +347,5 @@ zlib-ng==1.0.0 # -r requirements/test-common.in # The following packages are considered to be unsafe in a requirements file: -aiohttp==3.14.2 +aiohttp==3.14.3 # via pytest-aiohttp diff --git a/requirements/dev.txt b/requirements/dev.txt index 402a46b0d8a..8e820521603 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -337,5 +337,5 @@ zlib-ng==1.0.0 # -r requirements/test-common.in # The following packages are considered to be unsafe in a requirements file: -aiohttp==3.14.2 +aiohttp==3.14.3 # via pytest-aiohttp From 2cedfc6ec4310cd2bc4cfcbed786edcbd48cee1b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 12:51:23 +0000 Subject: [PATCH 06/10] Bump annotated-types from 0.7.0 to 0.8.0 (#13261) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [annotated-types](https://github.com/annotated-types/annotated-types) from 0.7.0 to 0.8.0.
Release notes

Sourced from annotated-types's releases.

v0.8.0

What's Changed

New Contributors

Full Changelog: https://github.com/annotated-types/annotated-types/compare/v0.7.0...v0.8.0

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=annotated-types&package-manager=pip&previous-version=0.7.0&new-version=0.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- requirements/test-common.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test.txt | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 72a2a4cd981..b28f756d040 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -24,7 +24,7 @@ aiosignal==1.4.0 # aiohttp alabaster==1.0.0 # via sphinx -annotated-types==0.7.0 +annotated-types==0.8.0 # via pydantic ast-serialize==0.6.0 # via mypy diff --git a/requirements/dev.txt b/requirements/dev.txt index 8e820521603..75407b1d25d 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -24,7 +24,7 @@ aiosignal==1.4.0 # aiohttp alabaster==1.0.0 # via sphinx -annotated-types==0.7.0 +annotated-types==0.8.0 # via pydantic ast-serialize==0.6.0 # via mypy diff --git a/requirements/lint.txt b/requirements/lint.txt index 2964a38642a..b03b385195b 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -12,7 +12,7 @@ aiohappyeyeballs==2.7.1 # via aiohttp aiosignal==1.4.0 # via aiohttp -annotated-types==0.7.0 +annotated-types==0.8.0 # via pydantic ast-serialize==0.6.0 # via mypy diff --git a/requirements/test-common.txt b/requirements/test-common.txt index 86007680ab1..99ce2ff4d9c 100644 --- a/requirements/test-common.txt +++ b/requirements/test-common.txt @@ -8,7 +8,7 @@ aiohappyeyeballs==2.7.1 # via aiohttp aiosignal==1.4.0 # via aiohttp -annotated-types==0.7.0 +annotated-types==0.8.0 # via pydantic ast-serialize==0.6.0 # via mypy diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index c5ee2b3460c..fdb6833afa8 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -16,7 +16,7 @@ aiosignal==1.4.0 # via # -r requirements/runtime-deps.in # aiohttp -annotated-types==0.7.0 +annotated-types==0.8.0 # via pydantic ast-serialize==0.6.0 # via mypy diff --git a/requirements/test.txt b/requirements/test.txt index f79d0fd0772..9ef85200dba 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -16,7 +16,7 @@ aiosignal==1.4.0 # via # -r requirements/runtime-deps.in # aiohttp -annotated-types==0.7.0 +annotated-types==0.8.0 # via pydantic ast-serialize==0.6.0 # via mypy From 8b61af67ed3ed6caaa430748440f4edfd6835cdc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 13:00:46 +0000 Subject: [PATCH 07/10] Bump cython from 3.2.8 to 3.2.9 (#13270) Bumps [cython](https://github.com/cython/cython) from 3.2.8 to 3.2.9.
Changelog

Sourced from cython's changelog.

3.2.9 (2026-07-24)

Bugs fixed

  • Indexing into freshly created lists with an out-of-bounds index could crash. (Github issue :issue:7793)

  • Function arguments with default values could end up uninitialised in closures, leading to crashes. Patch by Anthony Donlon. (Github issue :issue:7782)

  • bytearray.append(None) could crash. The optimised code was also lacking concurrency guards. (Github issue :issue:7796)

  • Some rare corner cases when concatenating text strings were resolved. (Github issue :issue:7799)

  • Assignments of builtin string types to typedefs of object could erroneously be rejected. (Github issue :issue:7789)

  • Subscripting type failed with a TypeError. (Github issue :issue:5563)

  • Manually disabling CYTHON_VECTORCALL in CPython could lead to invalid C code. Patch by Florent Gallaire. (Github issue :issue:7807)

  • Some internal Limited API version checks for Py3.12 were corrected. (Github issue :issue:7845)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cython&package-manager=pip&previous-version=3.2.8&new-version=3.2.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/cython.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index b28f756d040..9c55fd06da1 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -71,7 +71,7 @@ coverage==7.15.2 # pytest-cov cryptography==49.0.0 # via trustme -cython==3.2.8 +cython==3.2.9 # via -r requirements/cython.in distlib==0.4.3 # via virtualenv diff --git a/requirements/cython.txt b/requirements/cython.txt index bd8d1763725..0a464ba33df 100644 --- a/requirements/cython.txt +++ b/requirements/cython.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/cython.txt --resolver=backtracking --strip-extras requirements/cython.in # -cython==3.2.8 +cython==3.2.9 # via -r requirements/cython.in multidict==6.7.1 # via -r requirements/multidict.in From fa1bbaa65878bffe058906b468b0249c1e17f1d1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 13:09:16 +0000 Subject: [PATCH 08/10] Bump certifi from 2026.6.17 to 2026.7.22 (#13262) Bumps [certifi](https://github.com/certifi/python-certifi) from 2026.6.17 to 2026.7.22.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=certifi&package-manager=pip&previous-version=2026.6.17&new-version=2026.7.22)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/doc-spelling.txt | 2 +- requirements/doc.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 9c55fd06da1..028923872f5 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -51,7 +51,7 @@ brotli==1.2.0 ; platform_python_implementation == "CPython" and sys_platform != # via -r requirements/runtime-deps.in build==1.5.1 # via pip-tools -certifi==2026.6.17 +certifi==2026.7.22 # via requests cffi==2.1.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 75407b1d25d..021cecbe08e 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -51,7 +51,7 @@ brotli==1.2.0 ; platform_python_implementation == "CPython" and sys_platform != # via -r requirements/runtime-deps.in build==1.5.1 # via pip-tools -certifi==2026.6.17 +certifi==2026.7.22 # via requests cffi==2.1.0 # via diff --git a/requirements/doc-spelling.txt b/requirements/doc-spelling.txt index c0a09cf0639..7f4b2216dfc 100644 --- a/requirements/doc-spelling.txt +++ b/requirements/doc-spelling.txt @@ -10,7 +10,7 @@ alabaster==1.0.0 # via sphinx babel==2.18.0 # via sphinx -certifi==2026.6.17 +certifi==2026.7.22 # via requests charset-normalizer==3.4.9 # via requests diff --git a/requirements/doc.txt b/requirements/doc.txt index 1d9fe25abd0..8df5441b84c 100644 --- a/requirements/doc.txt +++ b/requirements/doc.txt @@ -10,7 +10,7 @@ alabaster==1.0.0 # via sphinx babel==2.18.0 # via sphinx -certifi==2026.6.17 +certifi==2026.7.22 # via requests charset-normalizer==3.4.9 # via requests From f6a3aa18c07048fb6a6858a959f006087d897a74 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 13:17:17 +0000 Subject: [PATCH 09/10] Bump pre-commit from 4.6.0 to 4.6.1 (#13267) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [pre-commit](https://github.com/pre-commit/pre-commit) from 4.6.0 to 4.6.1.
Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

Commits
  • 242ce8a v4.6.1
  • 766e550 Merge pull request #3727 from pre-commit/dedupe
  • 1558d06 Merge pull request #3726 from pre-commit/exists-faster
  • 8a1c47a avoid duplicate files in --all-files during conflict
  • 2e01c99 faster check of rev existing locally as a commit
  • 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
  • 1d811d9 Return an error for invalid --repo
  • 374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
  • 1e7994f set JULIA_DEPOT_PATH
  • b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
  • Additional commits viewable in compare view

Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 028923872f5..5d0a6d19bf5 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -175,7 +175,7 @@ pluggy==1.6.0 # via # pytest # pytest-cov -pre-commit==4.6.0 +pre-commit==4.6.1 # via -r requirements/lint.in propcache==0.5.2 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 021cecbe08e..72b8332efd7 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -172,7 +172,7 @@ pluggy==1.6.0 # via # pytest # pytest-cov -pre-commit==4.6.0 +pre-commit==4.6.1 # via -r requirements/lint.in propcache==0.5.2 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index b03b385195b..66680a48c1d 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -90,7 +90,7 @@ platformdirs==4.11.0 # virtualenv pluggy==1.6.0 # via pytest -pre-commit==4.6.0 +pre-commit==4.6.1 # via -r requirements/lint.in propcache==0.5.2 # via From 0ab1dd802abffcfdd702d397176742dde81a057f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 13:28:01 +0000 Subject: [PATCH 10/10] Bump python-discovery from 1.4.4 to 1.5.0 (#13269) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.4.4 to 1.5.0.
Release notes

Sourced from python-discovery's releases.

v1.5.0

What's Changed

Full Changelog: https://github.com/tox-dev/python-discovery/compare/1.4.4...1.5.0

Changelog

Sourced from python-discovery's changelog.

Packaging updates and notes for downstreams - 1.5.0

  • Declare support for Python 3.15 and run the test suite against it, currently in beta. (:issue:104)

v1.4.4 (2026-07-08)

Commits
  • 7889874 release 1.5.0
  • cb3ccb6 👷 ci: add Python 3.15 to the test matrix (#104)
  • 3dc250f [pre-commit.ci] pre-commit autoupdate (#103)
  • 6603012 📦 build: move dev extras to PEP 735 dependency groups (#102)
  • 8df9588 Replace prettier with mdformat and yamlfmt (#101)
  • de863fa build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 (#100)
  • 61ffbc0 build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 (#99)
  • 1ea2dcf [pre-commit.ci] pre-commit autoupdate (#98)
  • 8c8293a build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 (#97)
  • See full diff in compare view

Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 5d0a6d19bf5..3138dfc93b3 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -238,7 +238,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.4.4 +python-discovery==1.5.0 # via virtualenv python-on-whales==0.81.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 72b8332efd7..f2c759ec33f 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -233,7 +233,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.4.4 +python-discovery==1.5.0 # via virtualenv python-on-whales==0.81.0 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index 66680a48c1d..3c938421824 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -127,7 +127,7 @@ pytest-mock==3.15.1 # via -r requirements/lint.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.4.4 +python-discovery==1.5.0 # via virtualenv python-on-whales==0.81.0 # via -r requirements/lint.in