build(deps): bump the python-deps group with 5 updates by dependabot[bot] · Pull Request #66 · MEFORORG/MessageFoundry

dependabot · 2026-07-30T03:08:00Z

Bumps the python-deps group with 5 updates:

Package	From	To
annotated-types	`0.7.0`	`0.8.0`
fastapi	`0.139.2`	`0.140.0`
prometheus-client	`0.25.0`	`0.26.0`
ruff	`0.15.22`	`0.16.0`
zizmor	`1.5.2`	`1.28.0`

Updates annotated-types from 0.7.0 to 0.8.0

Release notes

Sourced from annotated-types's releases.

v0.8.0

What's Changed

Rename DocInfo to Doc by @zen-xu in annotated-types/annotated-types#80

Add support for Python 3.13 by @hugovk in annotated-types/annotated-types#83

Fix docstring of Timezone by @Viicos in annotated-types/annotated-types#84

Update license-files to be PEP-639 compliant (#85) by @shoeffner in annotated-types/annotated-types#86

fix: typo in README.md by @camiloaz in annotated-types/annotated-types#87

add CI for PyPy3.11 and fix test (issue 71) by @mattip in annotated-types/annotated-types#88

Fix string predicate names in doc by @leogermond in annotated-types/annotated-types#90

Add SPDX license expression by @wichert in annotated-types/annotated-types#92

Added Python 3.14 to the test matrix by @imtoopunkforyou in annotated-types/annotated-types#96

Add support for Python 3.14 and drop EOL 3.8-3.9 by @hugovk in annotated-types/annotated-types#97

Fix typo in Len docstring by @Dutcho in annotated-types/annotated-types#100

Prepare for 0.8.0 release by @adriangb in annotated-types/annotated-types#103

New Contributors

@zen-xu made their first contribution in annotated-types/annotated-types#80

@hugovk made their first contribution in annotated-types/annotated-types#83

@shoeffner made their first contribution in annotated-types/annotated-types#86

@camiloaz made their first contribution in annotated-types/annotated-types#87

@mattip made their first contribution in annotated-types/annotated-types#88

@leogermond made their first contribution in annotated-types/annotated-types#90

@wichert made their first contribution in annotated-types/annotated-types#92

@imtoopunkforyou made their first contribution in annotated-types/annotated-types#96

@Dutcho made their first contribution in annotated-types/annotated-types#100

Full Changelog: annotated-types/annotated-types@v0.7.0...v0.8.0

Commits

9eb9668 Prepare for 0.8.0 release (#103)
10b7764 Fix typo in Len docstring (#100)
955f757 Add support for Python 3.14 and drop EOL 3.8-3.9 (#97)
bd280fe Added Python 3.14 to the test matrix (#96)
a471bb7 Add SPDX license expression (#92)
eab91d9 Fix string predicate names in doc (#90)
03ad9c3 add CI for PyPy3.11 and fix test (issue 71) (#88)
5ae6043 fix: typo in README.md (#87)
b60ad7b Update license-files to be PEP-639 compliant (#85) (#86)
3fbeb6d Fix docstring of Timezone (#84)
Additional commits viewable in compare view

Updates fastapi from 0.139.2 to 0.140.0

Release notes

Sourced from fastapi's releases.

0.140.0

Refactors

⚡️ Reduce memory usage in dependencies. PR #16049 by @tiangolo.

Docs

📝 Fix links in docs. PR #15967 by @YuriiMotov.

📝 Add Library Skills documentation. PR #16041 by @tiangolo.

📝 Update docs to use uv projects by default. PR #16032 by @tiangolo.

📝 Restructure FastAPI People and related pages. PR #16015 by @tiangolo.

Internal

👷 Add CI memory benchmark. PR #16046 by @tiangolo.

👥 Update FastAPI People - Sponsors. PR #16027 by @tiangolo.

🔥 Remove now-obsolete scripts to generate data for FastAPI People. PR #16016 by @tiangolo.

Commits

255b912 🔖 Release version 0.140.0 (#16050)
892eacd 📝 Update release notes
0270829 ⚡️ Reduce memory usage in dependencies (#16049)
ae031be 📝 Update release notes
f3644b3 📝 Fix links in docs (#15967)
1e24ca0 📝 Update release notes
513c396 👷 Add CI memory benchmark (#16046)
a64dfbb 📝 Update release notes
4f15548 📝 Add Library Skills documentation (#16041)
704fbe1 📝 Update release notes
Additional commits viewable in compare view

Updates prometheus-client from 0.25.0 to 0.26.0

Release notes

Sourced from prometheus-client's releases.

v0.26.0

What's Changed

Expose measured duration on Timer context manager by @vokracko in prometheus/client_python#1166

Use specific exception for duplicate timeseries by @kajinamit in prometheus/client_python#1074

Make clear() a no-op for label-less metrics (fixes #707) by @ompathakbaap in prometheus/client_python#1184

Use object instead of Any for labels() parameters by @gregoiredx in prometheus/client_python#1186

Add TLS version parameters for start_wsgi_server by @vyzigold in prometheus/client_python#1178

Validate Enum arguments before registering the collector by @sean-kim05 in prometheus/client_python#1189

Do not emit a leading zero in floatToGoString exponents >= 10 by @sean-kim05 in prometheus/client_python#1190

fix: make test suite pass on Windows and Python 3.12+ by @MelvinjoseC in prometheus/client_python#1185

Parse the native histogram sum as a float by @sean-kim05 in prometheus/client_python#1192

Remove nameless collectors from the registry on unregister by @sean-kim05 in prometheus/client_python#1191

Fix operator precedence allowing exemplars on any metric type by @sean-kim05 in prometheus/client_python#1188

New Contributors

@vokracko made their first contribution in prometheus/client_python#1166

@ompathakbaap made their first contribution in prometheus/client_python#1183

@gregoiredx made their first contribution in prometheus/client_python#1186

@vyzigold made their first contribution in prometheus/client_python#1178

@sean-kim05 made their first contribution in prometheus/client_python#1189

@MelvinjoseC made their first contribution in prometheus/client_python#1185

Full Changelog: prometheus/client_python@v0.25.0...v0.26.0

Commits

9b6b971 Release v0.26.0
fb072c2 Fix operator precedence allowing exemplars on any metric type (#1188)
6e22fb5 Remove nameless collectors from the registry on unregister (#1191)
5b09479 Parse the native histogram sum as a float (#1192)
769b415 fix: make test suite pass on Windows and Python 3.12+ (#1185)
d0b497f Update common Prometheus files (#1195)
75603d7 Update common Prometheus files (#1194)
fb2351f Do not emit a leading zero in floatToGoString exponents >= 10 (#1190)
a39a697 Validate Enum arguments before registering the collector (#1189)
a96f6f4 Add TLS version parameters for start_wsgi_server (#1178)
Additional commits viewable in compare view

Updates ruff from 0.15.22 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes
Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.
Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:
import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os
Fixes are now shown in check and format --check output:
❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted
This example also shows off the Markdown formatting.
format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:
❯ ruff format --check --output-format github .
::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted
See the CLI help or documentation for the full list of supported formats.
The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes
Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.
Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:
import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os
Fixes are now shown in check and format --check output:
❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted
This example also shows off the Markdown formatting.
format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

a2635fd Bump 0.16.0 (#27136)
3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
17ef711 Stabilize --add-ignore (#27125)
ef912bb Add newly stabilized rules to defaults (#27055)
b30f040 Stabilize new default rules (#27035)
bcd70c5 Exclude Markdown files from format-dev runs (#27052)
87e51e2 Fix format --check spans for syntax errors (#27045)
afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
Additional commits viewable in compare view

Updates zizmor from 1.5.2 to 1.28.0

Release notes

Sourced from zizmor's releases.

v1.28.0

Security 🔒🔗

v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

Many thanks to @shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)

sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛🔗

Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#2201)

Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

v1.27.0

New Features 🌈🔗

zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#2153) Enhancements 🌱🔗

zizmor's handling of paths is now more consistent, particularly when run on Windows (#2163)

zizmor now emits a helpful warning when being run in implicit offline mode (#2180)

Bug Fixes 🐛🔗

Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#2157)

Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#2177)

Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#2185)

v1.26.1

This is a small corrective release for 1.26.0.

v1.26.0

New Features 🌈🔗

New audit: typosquat-uses detects uses: clauses that reference likely typoed actions (#1985)

Many thanks to @andrew for proposing and implementing this improvement!

... (truncated)

Changelog

Sourced from zizmor's changelog.

1.28.0

Security 🔒

v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See [GHSA-f42p-wjw5-97qh] for full information.

Many thanks to @shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱

The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

The [dependabot-cooldown] audit is now aware of GitHub's new three-day default cooldown (#2193)

sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛

Fixed a bug where the [template-injection] audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

Fixed a bug where the [github-env] audit would incorrectly flag some printf calls as exploitable (#2201)

Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

1.27.0

New Features 🌈

zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#2153)

Enhancements 🌱

zizmor's handling of paths is now more consistent, particularly when run on Windows (#2163)

zizmor now emits a helpful warning when being run in implicit offline mode (#2180)

Bug Fixes 🐛

Fixed a bug where the [secrets-outside-env] audit would not honor

... (truncated)

Commits

4381cc6 Prep zizmor 1.28.0 (#2214)
724d0e8 Remove a redundant debug log (#2213)
5a01aad [BOT] update JSON schemas from SchemaStore (#2208)
6138a6d Add sbt to known Dependabot ecosystems (#2211)
23878aa chore(deps): bump the cargo group with 4 updates (#2206)
5e839db chore(deps): bump the github-actions group with 3 updates (#2207)
297975a dependabot-cooldown: honor GitHub's new default (#2193)
b648e57 Improve error message on remote ambiguous input refs (#2205)
d06c823 Dedupe a function in the GitHub APIs (#2204)
82f5bf6 github-env: don't flag all-literal printf arguments (#2201)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-deps group with 5 updates: | Package | From | To | | --- | --- | --- | | [annotated-types](https://github.com/annotated-types/annotated-types) | `0.7.0` | `0.8.0` | | [fastapi](https://github.com/fastapi/fastapi) | `0.139.2` | `0.140.0` | | [prometheus-client](https://github.com/prometheus/client_python) | `0.25.0` | `0.26.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.22` | `0.16.0` | | [zizmor](https://github.com/zizmorcore/zizmor) | `1.5.2` | `1.28.0` | Updates `annotated-types` from 0.7.0 to 0.8.0 - [Release notes](https://github.com/annotated-types/annotated-types/releases) - [Commits](annotated-types/annotated-types@v0.7.0...v0.8.0) Updates `fastapi` from 0.139.2 to 0.140.0 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.139.2...0.140.0) Updates `prometheus-client` from 0.25.0 to 0.26.0 - [Release notes](https://github.com/prometheus/client_python/releases) - [Commits](prometheus/client_python@v0.25.0...v0.26.0) Updates `ruff` from 0.15.22 to 0.16.0 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.22...0.16.0) Updates `zizmor` from 1.5.2 to 1.28.0 - [Release notes](https://github.com/zizmorcore/zizmor/releases) - [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md) - [Commits](zizmorcore/zizmor@v1.5.2...v1.28.0) --- updated-dependencies: - dependency-name: annotated-types dependency-version: 0.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-deps - dependency-name: fastapi dependency-version: 0.140.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-deps - dependency-name: prometheus-client dependency-version: 0.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-deps - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-deps - dependency-name: zizmor dependency-version: 1.28.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-deps ... Signed-off-by: dependabot[bot] <support@github.com>

PR #80 appended eight Steps-view items to docs/BACKLOG.md without the status banner every numbered item must carry, so tests/test_backlog_status_check.py::test_the_real_backlog_satisfies_the_invariant began failing on main itself (8 errors, first at line 6905). Because GitHub tests each PR merged into main, every open PR inherited the failure: #81, #74, #71, #66 and #60 were all blocked, three of them with auto-merge armed and unable to fire. Adds exactly one leading banner per item. Seven use the open/prioritized form; #239 uses the partial form, because its measurement ran and is recorded on PR #81 while the re-runnable scripts/quality/lens_coverage.py is still unmerged -- the number is not yet reproducible from main. The banners are deliberately minimal and do not re-litigate any item's verdict. #234 in particular is left explicitly unsettled rather than entrenched: it was filed as "revisit, not a bug" after the owner asked for a fix, and that framing is still open. Verified: scripts/docs/backlog_status_check.py exits 0 (237 items) and tests/test_backlog_status_check.py is 15 passed, was 14 passed 1 failed. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 30, 2026

dependabot Bot requested a review from wshallwshall as a code owner July 30, 2026 03:08

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 30, 2026

chore(deps): resync exported lock files (DEP-1)

7d591e4

wshallwshall mentioned this pull request Jul 30, 2026

docs(backlog): items 232-239 declared no status, turning main red #82

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the python-deps group with 5 updates - #66

build(deps): bump the python-deps group with 5 updates#66
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/python-deps-eb7932d1b9

dependabot Bot commented on behalf of github Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 30, 2026

v0.8.0

What's Changed

New Contributors

0.140.0

Refactors

Docs

Internal

v0.26.0

What's Changed

New Contributors

0.16.0

Release Notes

Breaking changes

0.16.0

Breaking changes

v1.28.0

Security 🔒🔗

Enhancements 🌱🔗

Bug Fixes 🐛🔗

v1.27.0

New Features 🌈🔗

Bug Fixes 🐛🔗

v1.26.1

v1.26.0

New Features 🌈🔗

1.28.0

Security 🔒

Enhancements 🌱

Bug Fixes 🐛

1.27.0

New Features 🌈

Enhancements 🌱

Bug Fixes 🐛

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants