Skip to content

Bump the pip-minor-and-patch group across 2 directories with 9 updates - #869

Merged
lotte-amsterdam merged 1 commit into
mainfrom
dependabot/pip/jwtproxy/pip-minor-and-patch-cbc69d52da
Oct 20, 2026
Merged

Bump the pip-minor-and-patch group across 2 directories with 9 updates#869
lotte-amsterdam merged 1 commit into
mainfrom
dependabot/pip/jwtproxy/pip-minor-and-patch-cbc69d52da

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip-minor-and-patch group with 7 updates in the /jwtproxy directory:

Package From To
azure-monitor-opentelemetry 1.8.10 1.8.11
multidict 7.0.0 7.1.0
pycparser 3.0 3.11
black 26.5.1 26.10.1
devtools 0.12.2 0.13.0
executing 2.2.1 2.3.0
ruff 0.16.10 0.17.0

Bumps the pip-minor-and-patch group with 2 updates in the /tools directory: aiohttp and amsterdam-schema-tools.

Updates azure-monitor-opentelemetry from 1.8.10 to 1.8.11

Release notes

Sourced from azure-monitor-opentelemetry's releases.

azure-monitor-opentelemetry_1.8.11

1.8.11 (2026-10-07)

Other Changes

  • Corrected the package metadata to require Python 3.10 or later, matching the existing support policy (#49200)
Commits

Updates multidict from 7.0.0 to 7.1.0

Release notes

Sourced from multidict's releases.

7.1.0 is a correctness and housekeeping release. It changes what keys() yields, fixes a long list of crashes and inconsistencies that Python code run in the middle of an operation could trigger, stores the common all-str multidicts in half the space, and deprecates multidict.upstr.

Behaviour changes. keys() and iteration over a multidict yield each key once, as spelled in its first item, so len(d.keys()) counts distinct keys; items(), values() and len(d) still see every item. A str subclass's own lower() is no longer called to compute the case-insensitive identity of a CIMultiDict key.

Robustness. Finalizers, __eq__(), __repr__(), lower() and argument iterators that read or mutate the multidict in the middle of __init__(), update(), merge(), del d[key], popall(), popitem(), to_dict() or repr() no longer crash the C extension, lose or duplicate pairs, or make the two backends disagree. Two data races against lock-free readers on the free-threaded build are gone too.

Memory. A MultiDict whose keys are all exact str, and a CIMultiDict whose keys are all exact istr, are stored in a compact table without a separate identity and hash per entry, which cuts their size by about 45%.

Bug fixes

  • Fixed building the C extension on platforms where char is unsigned, such as ARM, PowerPC, s390x and RISC-V, and with GCC 9, which flags CPython's own headers from 3.12 on; both failed on a sign conversion warning since -Wconversion took effect. GCC 9 builds the extension without -Wconversion -- by @​asvetlov.

    Related issues and pull requests on GitHub: #1759, #1760.

  • Fixed getversion() returning only the low 32 bits of the version on Windows and on 32-bit platforms, where two different versions could compare equal, and fixed a race in the pure-Python implementation on GIL builds that could give two multidicts mutated at the same time from different threads the same version -- by @​asvetlov.

    Related issues and pull requests on GitHub: #1607, #1610.

... (truncated)

Changelog

Sourced from multidict's changelog.

7.1.0

(2026-10-08)

7.1.0 is a correctness and housekeeping release. It changes what :meth:~multidict.MultiDict.keys yields, fixes a long list of crashes and inconsistencies that Python code run in the middle of an operation could trigger, stores the common all-:class:str multidicts in half the space, and deprecates multidict.upstr.

Behaviour changes. :meth:~multidict.MultiDict.keys and iteration over a multidict yield each key once, as spelled in its first item, so len(d.keys()) counts distinct keys; :meth:~multidict.MultiDict.items, :meth:~multidict.MultiDict.values and len(d) still see every item. A :class:str subclass's own lower() is no longer called to compute the case-insensitive identity of a :class:~multidict.CIMultiDict key.

Robustness. Finalizers, __eq__(), __repr__(), lower() and argument iterators that read or mutate the multidict in the middle of __init__(), update(), merge(), del d[key], :meth:~multidict.MultiDict.popall, :meth:~multidict.MultiDict.popitem, :meth:~multidict.MultiDict.to_dict or :func:repr no longer crash the C extension, lose or duplicate pairs, or make the two backends disagree. Two data races against lock-free readers on the free-threaded build are gone too.

Memory. A :class:~multidict.MultiDict whose keys are all exact :class:str, and a :class:~multidict.CIMultiDict whose keys are all exact :class:~multidict.istr, are stored in a compact table without a separate identity and hash per entry, which cuts their size by about 45%.

Bug fixes

  • Fixed building the C extension on platforms where char is unsigned, such as ARM, PowerPC, s390x and RISC-V, and with GCC 9, which flags CPython's own headers from 3.12 on; both failed on a sign conversion warning since -Wconversion took effect. GCC 9 builds the extension without -Wconversion -- by :user:asvetlov.

    Related issues and pull requests on GitHub: :issue:1759, :issue:1760.

  • Fixed :func:~multidict.getversion returning only the low 32 bits of the version on Windows and on 32-bit platforms, where two different versions could compare equal, and fixed a race in the pure-Python implementation on GIL builds that could give two multidicts mutated at the same time from different threads the same version

... (truncated)

Commits
  • 709f260 Trim the test run of the emulated wheel jobs (#1762)
  • dbc3aba Build(deps): Bump pypa/cibuildwheel from 4.2.1 to 4.3.0 (#1761)
  • ef68371 Build without -Wconversion on GCC 9 (#1760)
  • e812c4f Fix the C extension build where char is unsigned (#1759)
  • f9459a1 Release 7.1.0 (#1758)
  • 45552bd Fold the hash chain walk into _md_update() (#1757)
  • 84c5412 Move to_dict() into to_dict.h and mark only later duplicates (#1756)
  • cfd8ea2 Reserve room for update() and merge() only when keys are added (#1755)
  • fb828e3 Prefix header-local helpers with an underscore (#1753)
  • 3c3fc84 Move istr_canonical() into istr_object.h (#1754)
  • Additional commits viewable in compare view

Updates pycparser from 3.0 to 3.11

Release notes

Sourced from pycparser's releases.

release_v3.11

Enhanced C11 support

Full Changelog: eliben/pycparser@release_v3.01...release_v3.11

release_v3.01

What's Changed

Full Changelog: eliben/pycparser@release_v3.00...release_v3.01

Commits
  • ccb3439 Prepare for release 3.11
  • 1d31981 Fix concatenation escapes
  • dbcd5fd Add missing fake types
  • 8bc38aa Fix dropped specifiers in lists
  • 17da57c Fix generation of _Alignas and _Atomic
  • 61f979c Add C11's fake headers and some tests
  • dfbe88b Fix unicode escapes
  • 74588ec Unify string literal parsing
  • 7adecd5 Fix implementation of _Static_assert
  • b7f48c8 C generation for _Generic
  • Additional commits viewable in compare view

Updates black from 26.5.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

  • Add --cache-dir to configure the cache directory from the command line (#5433)
  • Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

  • Add --cache-dir to configure the cache directory from the command line (#5433)

... (truncated)

Commits
  • 258e7db Prepare release 26.10.1 (#5511)
  • ac1f715 Action: validate required-version better (#5510)
  • fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
  • 4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
  • 6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
  • c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
  • 8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
  • c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
  • eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
  • 939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
  • Additional commits viewable in compare view

Updates devtools from 0.12.2 to 0.13.0

Release notes

Sourced from devtools's releases.

v0.13.0 (2026-10-11)

What's Changed

New Contributors

Full Changelog: samuelcolvin/python-devtools@v0.12.2...v0.13.0

Commits

Updates executing from 2.2.1 to 2.3.0

Commits

Updates ruff from 0.16.10 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

    The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

  • Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

    The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

  • Remove support for ruff-lsp (#28750)

    Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits
  • 5b27c1c Bump version to 0.17.0 (#29259)
  • 8f362bf Integrate vendored Unicode names into Ruff
  • 88a50d6 Revert upstream Unicode loose matching
  • 276832a Revert upstream Unicode alias normalization
  • 26911ca Vendor unicode_names2 from upstream
  • 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
  • bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
  • 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
  • dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
  • ef23c9c Update default and latest Python versions for 3.15 (#28792)
  • Additional commits viewable in compare view

Updates aiohttp from 3.14.3 to 3.14.5
Updates amsterdam-schema-tools from 9.14.1 to 9.14.2

Changelog

Sourced from amsterdam-schema-tools's changelog.

2026-10-06 (9.14.2)

  • Fix export scope access checks so tables and fields are filtered correctly when multiple scopes are used.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the pip-minor-and-patch group across 2 directories with 9 updates
6bb22ab 
---
updated-dependencies:
- dependency-name: azure-monitor-opentelemetry
  dependency-version: 1.8.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-and-patch
- dependency-name: multidict
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: pycparser
  dependency-version: '3.11'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: black
  dependency-version: 26.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: devtools
  dependency-version: 0.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: executing
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-and-patch
- dependency-name: amsterdam-schema-tools
  dependency-version: 9.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 14, 2026
@lotte-amsterdam
lotte-amsterdam merged commit f81bb28 into main Oct 20, 2026
4 checks passed
@lotte-amsterdam
lotte-amsterdam deleted the dependabot/pip/jwtproxy/pip-minor-and-patch-cbc69d52da branch October 20, 2026 07:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lotte-amsterdam lotte-amsterdam lotte-amsterdam approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lotte-amsterdam