Skip to content

deps: Bump the python-minor-and-patch group across 1 directory with 7 updates - #35

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-b24ceffd02
Closed

deps: Bump the python-minor-and-patch group across 1 directory with 7 updates#35
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-b24ceffd02

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 7 updates in the / directory:

Package From To
boto3 1.43.56 1.43.62
filelock 3.32.0 3.32.2
pymdown-extensions 11.0 11.0.1
mutmut 3.6.0 3.7.0
ruff 0.16.0 0.16.1
ty 0.0.63 0.0.65
hypothesis 6.161.6 6.165.0

Updates boto3 from 1.43.56 to 1.43.62

Commits
  • f3e9c52 Merge branch 'release-1.43.62'
  • 47765b7 Bumping version to 1.43.62
  • 2f4f5fb Add changelog entries from botocore
  • 8cd8552 Merge branch 'release-1.43.61'
  • 53d9670 Merge branch 'release-1.43.61' into develop
  • 74101e1 Bumping version to 1.43.61
  • 7faedb5 Add changelog entries from botocore
  • 785f6ff Merge branch 'release-1.43.60'
  • 550ff07 Merge branch 'release-1.43.60' into develop
  • 68f5316 Bumping version to 1.43.60
  • Additional commits viewable in compare view

Updates filelock from 3.32.0 to 3.32.2

Release notes

Sourced from filelock's releases.

3.32.2

What's Changed

Full Changelog: tox-dev/filelock@3.32.1...3.32.2

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.2 (2026-07-29)

  • A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

3.32.1 (2026-07-26)

  • Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

3.32.0 (2026-07-21)

  • SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685
  • Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683
  • The source distribution ships the capability probes the tests import, and reading one no longer needs coverage installed, so the suite runs from an unpacked sdist instead of failing on a missing coverage_pragmas. :pr:685

3.31.2 (2026-07-21)

  • filelock imports again on runtimes whose errno omits ENOTSUP, such as GraalPy, where importing the package raised ImportError. It probes the code instead, preferring ENOTSUP, falling back to EOPNOTSUPP where that name is absent, and dropping to ENOSYS/EXDEV where neither exists. Platforms defining ENOTSUP keep their behavior. :pr:681

3.31.1 (2026-07-20)

  • A SoftFileLease acquired on one thread keeps its claim when another thread fails to acquire the same lease object, so its heartbeat carries on refreshing the marker instead of being torn down and letting a peer take the live claim. :pr:680

... (truncated)

Commits
  • 9a6cc43 Release 3.32.2
  • 56879c7 🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy (#695)
  • ecf5be0 hand back the claim when a heartbeat thread fails to start (#691)
  • ee70d2e 🧪 test(soft-rw): deflake writer phase-2 peer-marker test (#694)
  • 1eb14dd Fix test failures on NetBSD (#689) (#693)
  • d81e859 build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#692)
  • 6fbc905 [pre-commit.ci] pre-commit autoupdate (#690)
  • 34d1c38 build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#688)
  • bf13ec7 Release 3.32.1
  • 887f114 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#687)
  • Additional commits viewable in compare view

Updates pymdown-extensions from 11.0 to 11.0.1

Release notes

Sourced from pymdown-extensions's releases.

11.0.1

  • FIX: BetterEm: Fix regex pattern inefficiencies.
  • FIX: Tilde: Fix regex pattern inefficiencies.
  • FIX: Caret: Fix regex pattern inefficiencies.
  • FIX: MagicLink: Fix regex pattern inefficiencies.
Commits

Updates mutmut from 3.6.0 to 3.7.0

Changelog

Sourced from mutmut's changelog.

3.7.0


* Fix the trampoline dropping a generator's return value, so ``yield from`` on a mutated generator no longer yields ``None`` instead of its result

    

  • 

    Fix async generators, so that aclose()/athrow() are handled by the except/finally blocks of the mutated function instead of being swallowed by the trampoline
    

    • 

  • 

    Fix max_stack_depth when a test changes the working directory (for example via a tmpdir fixture)
    

    • 

  • 

    Fix type_check_command reporting type errors in copied files that have no mutants
    

    • 

  • 

    Per-function source hashing for incremental cache invalidation — only re-test mutants in functions that changed
    

    • 

  • 

    Cross-call dependency tracking — invalidate mutants in callers when a called function changes
    

    • 

  • 

    Use git to detect non-Python dependency file changes; falls back to a curated file list when git is unavailable
    

    • 

  • 

    Add cache_invalidation_exclude config to suppress noisy files from change detection
    

    • 

  • 

    Add use_git_change_detection config (default true) to opt out of git-based detection
    

    • 

  • 

    Add uv.lock, poetry.lock, Pipfile.lock, and pdm.lock to the list of files copied by default
    

    • 

  • 

    Invalidate cached results automatically when result-affecting config fields change
    

    • 

  • 

    Make mutmut browse, show and apply much faster and use far less memory, by storing where each mutant is in the mutated file instead of parsing the whole file to find it

Commits

Updates ruff from 0.16.0 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Commits
  • 80790b3 Bump 0.16.1 (#27330)
  • 63830f3 [ty] Borrow from constraint set storage less often (#27328)
  • f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
  • 0d80497 Lint TOML files in the LSP (#26862)
  • d91586b Update prek dependencies (#27293)
  • 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
  • b20daf7 [ty] refactor: add helper function to send partial results (#27249)
  • 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
  • 7c3e2db [ty] Fix enum class container assignability (#27318)
  • d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
  • Additional commits viewable in compare view

Updates ty from 0.0.63 to 0.0.65

Release notes

Sourced from ty's releases.

0.0.65

Release Notes

Released on 2026-07-29.

LSP server

  • Support comprehension walruses in IDE features (#26476)

Library support

  • Pydantic: Allow mutation of private attributes on frozen models (#27257)
  • Pydantic: Synthesize __replace__ for models (#27220)

Diagnostics

  • Correct ParamSpec forwarded-argument diagnostic locations (#27263)
  • Recover forwarded callable object and constructor sources (#27264)
  • Recover forwarded functools.partial diagnostic sources (#27265)

Core type checking

  • Fix gradual class assignability with generic receivers (#27223)
  • Lazily materialize protocol attributes (#27267)
  • Narrow tagged unions through all type kinds (#27226)
  • Prefer static constrained TypeVar solutions (#27057)
  • Preserve frozen-dataclass setter delegation (#27217)
  • Preserve inference when filtering constructor overloads (#27254)
  • Reject frozen-dataclass field deletion through subclasses (#27001)
  • Stabilize recursive type-constraint ordering (#27176)
  • Support materialized class type expressions (#27258)

Performance

  • Avoid quadratic inference for large literal unions (#27178)
  • Cache protocol receiver binding (#27301)

Contributors

Install ty 0.0.65

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.65/ty-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.65

Released on 2026-07-29.

LSP server

  • Support comprehension walruses in IDE features (#26476)

Library support

  • Pydantic: Allow mutation of private attributes on frozen models (#27257)
  • Pydantic: Synthesize __replace__ for models (#27220)

Diagnostics

  • Correct ParamSpec forwarded-argument diagnostic locations (#27263)
  • Recover forwarded callable object and constructor sources (#27264)
  • Recover forwarded functools.partial diagnostic sources (#27265)

Core type checking

  • Fix gradual class assignability with generic receivers (#27223)
  • Lazily materialize protocol attributes (#27267)
  • Narrow tagged unions through all type kinds (#27226)
  • Prefer static constrained TypeVar solutions (#27057)
  • Preserve frozen-dataclass setter delegation (#27217)
  • Preserve inference when filtering constructor overloads (#27254)
  • Reject frozen-dataclass field deletion through subclasses (#27001)
  • Stabilize recursive type-constraint ordering (#27176)
  • Support materialized class type expressions (#27258)

Performance

  • Avoid quadratic inference for large literal unions (#27178)
  • Cache protocol receiver binding (#27301)

Contributors

0.0.64

Released on 2026-07-27.

Bug fixes

  • Fix identity narrowing for NewTypes (#26439)

... (truncated)

Commits

Updates hypothesis from 6.161.6 to 6.165.0

Commits
  • a11e4b4 Bump hypothesis version to 6.165.0 and update changelog
  • 2e08ef3 Merge pull request #4831 from Zac-HD/claude/codec-non-round-tripping-chars-hh...
  • 72bfab7 Merge pull request #4838 from Zac-HD/website-fixtures-article
  • 6f1a14c Only enforce 100% combined coverage when the python tests actually ran
  • 9153fd1 Warn rather than raise for non-round-tripping characters
  • 1815cab Write pytest consistently, and fix code block rendering
  • cbcd1cc Update the pytest-fixtures article for the function-scoped health check
  • ce7ef4a Merge pull request #4840 from Zac-HD/website-preview-pr-lookup
  • 8a4c803 Fix PR lookup in the website preview workflow
  • f94aae1 Merge pull request #4836 from Zac-HD/claude/pr-build-live-preview-15crof
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 3, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-b24ceffd02 branch 2 times, most recently from a75cc7f to 115032e Compare August 4, 2026 15:03
@dependabot
deps: Bump the python-minor-and-patch group across 1 directory with 7…
80efd64 
… updates

Bumps the python-minor-and-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.56` | `1.43.62` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.0` | `3.32.2` |
| [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) | `11.0` | `11.0.1` |
| [mutmut](https://github.com/boxed/mutmut) | `3.6.0` | `3.7.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.1` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.65` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.161.6` | `6.165.0` |



Updates `boto3` from 1.43.56 to 1.43.62
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.56...1.43.62)

Updates `filelock` from 3.32.0 to 3.32.2
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.0...3.32.2)

Updates `pymdown-extensions` from 11.0 to 11.0.1
- [Release notes](https://github.com/facelessuser/pymdown-extensions/releases)
- [Commits](facelessuser/pymdown-extensions@11.0...11.0.1)

Updates `mutmut` from 3.6.0 to 3.7.0
- [Changelog](https://github.com/boxed/mutmut/blob/main/HISTORY.rst)
- [Commits](boxed/mutmut@3.6.0...3.7.0)

Updates `ruff` from 0.16.0 to 0.16.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.1)

Updates `ty` from 0.0.63 to 0.0.65
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.65)

Updates `hypothesis` from 6.161.6 to 6.165.0
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.161.6...v6.165.0)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.61
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: filelock
  dependency-version: 3.32.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: hypothesis
  dependency-version: 6.164.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: mutmut
  dependency-version: 3.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pymdown-extensions
  dependency-version: 11.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.16.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: ty
  dependency-version: 0.0.65
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-b24ceffd02 branch from 115032e to 80efd64 Compare August 5, 2026 13:51
rustyconover added a commit that referenced this pull request Aug 5, 2026
@rustyconover @claude
deps: bring every dependency current, and cap ty below the hang
e2ae9d8 
`uv lock --upgrade` across the tree, landing a superset of the two open
Dependabot PRs (#34 pyarrow, #35 the python-minor-and-patch group) and 38
package moves in total. Nothing remains outdated afterwards.

The one worth naming is pyarrow 24.0.0 -> 25.0.0. vgi-python moved to 25
in its own dependency pass, so the two repos were resolving different
majors of the single library the whole protocol sits on -- this package's
tests were exercising an Arrow surface no vgi-python user runs. Suite
passes unchanged at 4042.

No security content: this repo has zero open Dependabot alerts, and the
advisories that drove vgi-python's pass were already satisfied here
(cryptography 50.0.0, aiohttp 3.14.3).

ty is capped at <0.0.64 rather than upgraded. At 0.0.66 `ty check` stopped
terminating on the sibling vgi-python tree -- ten minutes locally, and in
CI it hung until the step was cancelled, which `continue-on-error` does
not rescue, so a check that gates nothing turned the whole Lint job red.
vgi-python dropped the tool outright; here it is merely pinned, because
the cap is what stops the next routine `uv lock --upgrade` from silently
walking back into it. Lift once upstream terminates again.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@rustyconover

rustyconover commented Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Superseded by e2ae9d8, which ran uv lock --upgrade across the whole tree and landed a superset of this PR (38 package moves, including pyarrow 24.0.0 → 25.0.0). Suite passes unchanged at 4042. Closing rather than merging to avoid a lockfile conflict with that commit.

@dependabot @github

dependabot Bot commented on behalf of github Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/uv/python-minor-and-patch-b24ceffd02 branch August 5, 2026 13:55
rustyconover added a commit that referenced this pull request Aug 5, 2026
@rustyconover @claude
release: 0.40.1 — every dependency current, pyarrow aligned with vgi-…
c8bb1d1 
…python

No shipped code changes; this is the version marker for e2ae9d8, which ran
`uv lock --upgrade` across the tree and landed a superset of Dependabot
#34 and #35 -- 38 package moves, nothing outdated left afterwards.

The one that mattered is pyarrow 24.0.0 -> 25.0.0. vgi-python had already
moved to 25, so this package's tests were exercising a different major of
the library the whole protocol sits on than any vgi-python user runs. Both
repos now resolve the same Arrow.

No security content: zero open Dependabot alerts here, and the advisories
behind vgi-python's pass were already satisfied (cryptography 50.0.0,
aiohttp 3.14.3).

ty is capped at <0.0.64 rather than upgraded. At 0.0.66 `ty check` stopped
terminating -- ten minutes locally, and in CI it hung until the step was
cancelled, which `continue-on-error` does not rescue, so a check that
gates nothing turned the Lint job red. The cap is what stops the next
routine `uv lock --upgrade` from walking back into it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rustyconover