Skip to content

Deps: Bump the python-packages group across 1 directory with 30 updates - #19

Merged
olav-gb merged 1 commit into
mainfrom
dependabot/pip/python-packages-05d68060d2
Oct 16, 2026
Merged

Deps: Bump the python-packages group across 1 directory with 30 updates#19
olav-gb merged 1 commit into
mainfrom
dependabot/pip/python-packages-05d68060d2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-packages group with 30 updates in the / directory:

Package From To
black 26.5.1 26.10.1
autohooks 26.2.0 26.9.0
coverage 7.14.1 7.16.2
ruff 0.15.14 0.17.0
pypsrp 0.9.0 0.9.1
anyio 4.13.0 4.15.1
certifi 2026.5.20 2026.7.22
cffi 2.0.0 2.1.1
charset-normalizer 3.4.7 3.5.2
click 8.4.1 8.5.0
cryptography 48.0.0 50.0.2
gssapi 1.8.2 1.12.0
h2 4.3.0 4.4.1
hpack 4.1.0 4.2.0
idna 3.16 3.20
krb5 0.9.0 0.10.0
lxml 6.1.1 6.1.3
packaging 26.2 26.3
platformdirs 4.10.0 4.12.4
pontos 25.8.1 26.9.2
pycparser 3.0 3.11
pygments 2.20.0 2.21.0
pyspnego 0.12.1 0.12.4
semver 3.0.4 3.1.0
shtab 1.8.0 1.12.1
sspilib 0.5.0 0.6.0
tomli 2.4.1 2.5.0
tomlkit 0.15.0 0.15.1
typing-extensions 4.15.0 4.16.0
urllib3 2.7.0 2.8.0

Updates black from 26.5.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

  • Add --cache-dir to configure the cache directory from the command line (#5433)
  • Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

  • Add --cache-dir to configure the cache directory from the command line (#5433)

... (truncated)

Commits
  • 258e7db Prepare release 26.10.1 (#5511)
  • ac1f715 Action: validate required-version better (#5510)
  • fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
  • 4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
  • 6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
  • c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
  • 8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
  • c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
  • eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
  • 939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
  • Additional commits viewable in compare view

Updates autohooks from 26.2.0 to 26.9.0

Release notes

Sourced from autohooks's releases.

autohooks 26.9.0

26.9.0 - 2026-09-17

Changed

  • Set Python 3.10 as minimum version f447d23

Bug Fixes

  • Handle git typechange (T) status instead of raising ValueError (#817) 368d00d
  • Increase version requirement in README dfae606
  • Reformat with new 'black' version 7e87061

Dependencies

  • Bump the dependencies group with 4 updates febe8ae
  • Bump the dependencies group across 1 directory with 10 updates 9555bf2
  • Bump the dependencies group with 7 updates 792e4f3
  • Bump the dependencies group with 6 updates b56334b
  • Bump the dependencies group with 7 updates 2af9378
  • Bump the dependencies group with 2 updates 859d747
  • Bump the dependencies group with 5 updates 73e51b4
  • Bump the dependencies group with 6 updates f66a977
  • Bump the dependencies group with 6 updates c65406e
  • Bump the dependencies group with 5 updates 65b3add
  • Bump the dependencies group with 5 updates a820a6e
  • Bump actions/checkout from 6 to 7 in the dependencies group 153c1d9
  • Bump the dependencies group with 4 updates fcf4f0e
  • Bump the dependencies group across 1 directory with 6 updates 7d89d43
  • Bump the dependencies group with 9 updates d6e2f5d
  • Bump the dependencies group with 8 updates 3bcfa00
  • Bump the dependencies group with 7 updates fb93d9a
  • Bump pontos from 26.4.1 to 26.4.3 in the dependencies group 03bed8d
  • Bump the dependencies group with 8 updates 9119808
  • Bump the dependencies group across 1 directory with 2 updates fd3370e
  • Bump the dependencies group across 1 directory with 21 updates 8a5fe95
  • Bump black from 25.11.0 to 26.3.1 7f7876f
  • Bump pygments from 2.19.2 to 2.20.0 393651a
  • Bump requests from 2.32.5 to 2.33.0 0ec0d3b
  • Bump the dependencies group across 1 directory with 4 updates 7bd5a19
Commits
  • 4fa4f99 Automatic release to 26.9.0
  • 368d00d Fix: Handle git typechange (T) status instead of raising ValueError (#817)
  • febe8ae Deps: Bump the dependencies group with 4 updates
  • 9555bf2 Deps: Bump the dependencies group across 1 directory with 10 updates
  • 792e4f3 Deps: Bump the dependencies group with 7 updates
  • b56334b Deps: Bump the dependencies group with 6 updates
  • 2af9378 Deps: Bump the dependencies group with 7 updates
  • 7b9a6bc CI: Run auto-merge action for all kind of PR changes
  • 859d747 Deps: Bump the dependencies group with 2 updates
  • 4574b72 Address all linter errors and warnings
  • Additional commits viewable in compare view

Updates coverage from 7.14.1 to 7.16.2

Release notes

Sourced from coverage's releases.

7.16.2

Version 7.16.2 — 2026-09-27

  • Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
  • Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
  • Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

7.16.1

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
  • Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

7.16.0

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
  • The Coverage.switch_context() method now returns the previous context.
  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
  • Fixes to validation of options and configuration settings:
    • Negative precision settings now always cause useful error messages (pull 2261).
    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

7.15.4

Version 7.15.4 — 2026-08-06

  • Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
  • Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
  • Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

  • Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
  • A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.

... (truncated)

Changelog

Sourced from coverage's changelog.

Version 7.16.2 — 2026-09-27

  • Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168_.

  • Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289_.

  • Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923_.

.. _issue 1923: coveragepy/coveragepy#1923 .. _issue 2168: coveragepy/coveragepy#2168 .. _issue 2289: coveragepy/coveragepy#2289

.. _changes_7-16-1:

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

  • Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

  • Fix: the Total row in the footer of the HTML report's index page was recomputed in JavaScript with rounding that could disagree with the total the server rendered in the heading, including showing 100% when coverage was not complete. The footer now clamps values the way the rest of the report does, and when nothing is filtered out it is shown exactly as the server rendered it, so the two can't disagree. That also keeps rows the report omits (--skip-covered drops fully covered files) in the total. Fixes issue 2256_.

.. _issue 1563: coveragepy/coveragepy#1563 .. _issue 2256: coveragepy/coveragepy#2256 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Version 7.16.0 — 2026-08-28

... (truncated)

Commits

Updates ruff from 0.15.14 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

    The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

  • Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

    The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

  • Remove support for ruff-lsp (#28750)

    Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits
  • 5b27c1c Bump version to 0.17.0 (#29259)
  • 8f362bf Integrate vendored Unicode names into Ruff
  • 88a50d6 Revert upstream Unicode loose matching
  • 276832a Revert upstream Unicode alias normalization
  • 26911ca Vendor unicode_names2 from upstream
  • 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
  • bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
  • 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
  • dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
  • ef23c9c Update default and latest Python versions for 3.15 (#28792)
  • Additional commits viewable in compare view

Updates pypsrp from 0.9.0 to 0.9.1

Release notes

Sourced from pypsrp's releases.

v0.9.1

0.9.1 - 2026-03-16

  • Fix recursion issue when generating requests HTTP adapter on each new connection

What's Changed

New Contributors

Full Changelog: jborean93/pypsrp@v0.9.0...v0.9.1

Changelog

Sourced from pypsrp's changelog.

0.9.1 - 2026-03-16

  • Fix recursion issue when generating requests HTTP adapter on each new connection
Commits

Updates anyio from 4.13.0 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

  • Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

  • Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

    • follow_symlinks on exists() (Python 3.12+)
    • follow_symlinks on is_dir() (Python 3.13+)
    • follow_symlinks on is_file() (Python 3.13+)
    • follow_symlinks on owner() (Python 3.13+)
    • follow_symlinks on group() (Python 3.13+)
    • newline on read_text() (Python 3.13+)

    (#1286, #1293; PR by @​jaideeppyne)

  • Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

  • Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

  • Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

  • Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

  • Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

  • Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

  • Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

  • Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

  • Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

  • Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

  • Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

  • Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

  • Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

  • Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

  • Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

  • Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

  • Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

  • Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits
  • ffcd154 Bumped up the version
  • 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
  • 9283662 Bumped up the version
  • d137692 Improved the instructions for AI agents
  • 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
  • 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
  • b825c3b Fixed pyproject.toml changes not triggering the test suite
  • 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
  • b05fe6d Fixed wrong type in move_on_after (#1297)
  • 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
  • Additional commits viewable in compare view

Updates certifi from 2026.5.20 to 2026.7.22

Commits

Updates cffi from 2.0.0 to 2.1.1

Release notes

Sourced from cffi's releases.

v2.1.1

What's Changed

  • Minimize internal Python API usage for interpreter and thread state sampling where possible. Avoids breaking ABI change in Python >= 3.15.0b4 (python-cffi/cffi#269).

Full Changelog: python-cffi/cffi@v2.1.0...v2.1.1

v2.1.0

  • Added support for Python 3.15 and support for C extensions generated by CFFI to target the new abi3t free-threaded ABI.
  • Dropped support for Python 3.9.
  • Added cffi-gen-src CLI to generate CFFI C extension source for alternate build backend support.
  • Fixed crashes inside __delitem__.
  • Fixed "string too big" error under MSVC.
  • Fixed mingw builds.
  • Added support for arm64 iOS wheels.
Commits
  • fd33e77 New release 2.1.1
  • 56a7876 Use PyGILState_Ensure to avoid accessing CPython internals (#269) (#270)
  • d9f6f70 New release 2.1.0
  • 02a7b0e Misc pre-2.1 release/packaging cleanup (#253)
  • 1362e5d Move cffi-gen-src release note to 2.1.0 notes
  • a797055 Make error message when embedding version test fails more friendly
  • f1f40a8 Update changelog
  • dc62c93 Delete missed cp39 Windows builds
  • a341180 Update version numbers to prepare for v2.1 release
  • 9f04d85 Mark test using inet_ntoa as thread-unsafe
  • Additional commits viewable in compare view

Updates charset-normalizer from 3.4.7 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

  • Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

  • Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
  • Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Version 3.5.1

@dependabot
Deps: Bump the python-packages group across 1 directory with 30 updates
4b3dd8e 
Bumps the python-packages group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [black](https://github.com/psf/black) | `26.5.1` | `26.10.1` |
| [autohooks](https://github.com/greenbone/autohooks) | `26.2.0` | `26.9.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.1` | `7.16.2` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.14` | `0.17.0` |
| [pypsrp](https://github.com/jborean93/pypsrp) | `0.9.0` | `0.9.1` |
| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.15.1` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.5.20` | `2026.7.22` |
| [cffi](https://github.com/python-cffi/cffi) | `2.0.0` | `2.1.1` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.7` | `3.5.2` |
| [click](https://github.com/pallets/click) | `8.4.1` | `8.5.0` |
| [cryptography](https://github.com/pyca/cryptography) | `48.0.0` | `50.0.2` |
| [gssapi](https://github.com/pythongssapi/python-gssapi) | `1.8.2` | `1.12.0` |
| [h2](https://github.com/python-hyper/h2) | `4.3.0` | `4.4.1` |
| [hpack](https://github.com/python-hyper/hpack) | `4.1.0` | `4.2.0` |
| [idna](https://github.com/kjd/idna) | `3.16` | `3.20` |
| [krb5](https://github.com/jborean93/pykrb5) | `0.9.0` | `0.10.0` |
| [lxml](https://github.com/lxml/lxml) | `6.1.1` | `6.1.3` |
| [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.10.0` | `4.12.4` |
| [pontos](https://github.com/greenbone/pontos) | `25.8.1` | `26.9.2` |
| [pycparser](https://github.com/eliben/pycparser) | `3.0` | `3.11` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |
| [pyspnego](https://github.com/jborean93/pyspnego) | `0.12.1` | `0.12.4` |
| [semver](https://github.com/python-semver/python-semver) | `3.0.4` | `3.1.0` |
| [shtab](https://github.com/tqdm/shtab) | `1.8.0` | `1.12.1` |
| [sspilib](https://github.com/jborean93/sspilib) | `0.5.0` | `0.6.0` |
| [tomli](https://github.com/hukkin/tomli) | `2.4.1` | `2.5.0` |
| [tomlkit](https://github.com/python-poetry/tomlkit) | `0.15.0` | `0.15.1` |
| [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.7.0` | `2.8.0` |



Updates `black` from 26.5.1 to 26.10.1
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@26.5.1...26.10.1)

Updates `autohooks` from 26.2.0 to 26.9.0
- [Release notes](https://github.com/greenbone/autohooks/releases)
- [Commits](greenbone/autohooks@v26.2.0...v26.9.0)

Updates `coverage` from 7.14.1 to 7.16.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.1...7.16.2)

Updates `ruff` from 0.15.14 to 0.17.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.14...0.17.0)

Updates `pypsrp` from 0.9.0 to 0.9.1
- [Release notes](https://github.com/jborean93/pypsrp/releases)
- [Changelog](https://github.com/jborean93/pypsrp/blob/master/CHANGELOG.md)
- [Commits](jborean93/pypsrp@v0.9.0...v0.9.1)

Updates `anyio` from 4.13.0 to 4.15.1
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.13.0...4.15.1)

Updates `certifi` from 2026.5.20 to 2026.7.22
- [Commits](certifi/python-certifi@2026.05.20...2026.07.22)

Updates `cffi` from 2.0.0 to 2.1.1
- [Release notes](https://github.com/python-cffi/cffi/releases)
- [Commits](python-cffi/cffi@v2.0.0...v2.1.1)

Updates `charset-normalizer` from 3.4.7 to 3.5.2
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.7...3.5.2)

Updates `click` from 8.4.1 to 8.5.0
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.4.1...8.5.0)

Updates `cryptography` from 48.0.0 to 50.0.2
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@48.0.0...50.0.2)

Updates `gssapi` from 1.8.2 to 1.12.0
- [Release notes](https://github.com/pythongssapi/python-gssapi/releases)
- [Commits](pythongssapi/python-gssapi@v1.8.2...v1.12.0)

Updates `h2` from 4.3.0 to 4.4.1
- [Changelog](https://github.com/python-hyper/h2/blob/master/CHANGELOG.rst)
- [Commits](python-hyper/h2@v4.3.0...v4.4.1)

Updates `hpack` from 4.1.0 to 4.2.0
- [Changelog](https://github.com/python-hyper/hpack/blob/master/CHANGELOG.rst)
- [Commits](python-hyper/hpack@v4.1.0...v4.2.0)

Updates `idna` from 3.16 to 3.20
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.16...v3.20)

Updates `krb5` from 0.9.0 to 0.10.0
- [Release notes](https://github.com/jborean93/pykrb5/releases)
- [Changelog](https://github.com/jborean93/pykrb5/blob/main/CHANGELOG.md)
- [Commits](jborean93/pykrb5@v0.9.0...v0.10.0)

Updates `lxml` from 6.1.1 to 6.1.3
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.1.1...lxml-6.1.3)

Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.2...26.3)

Updates `platformdirs` from 4.10.0 to 4.12.4
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.10.0...4.12.4)

Updates `pontos` from 25.8.1 to 26.9.2
- [Release notes](https://github.com/greenbone/pontos/releases)
- [Commits](greenbone/pontos@v25.8.1...v26.9.2)

Updates `pycparser` from 3.0 to 3.11
- [Release notes](https://github.com/eliben/pycparser/releases)
- [Commits](eliben/pycparser@release_v3.00...release_v3.11)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

Updates `pyspnego` from 0.12.1 to 0.12.4
- [Release notes](https://github.com/jborean93/pyspnego/releases)
- [Changelog](https://github.com/jborean93/pyspnego/blob/main/CHANGELOG.md)
- [Commits](jborean93/pyspnego@v0.12.1...v0.12.4)

Updates `semver` from 3.0.4 to 3.1.0
- [Release notes](https://github.com/python-semver/python-semver/releases)
- [Changelog](https://github.com/python-semver/python-semver/blob/master/CHANGELOG.rst)
- [Commits](python-semver/python-semver@3.0.4...3.1.0)

Updates `shtab` from 1.8.0 to 1.12.1
- [Release notes](https://github.com/tqdm/shtab/releases)
- [Commits](tqdm/shtab@v1.8.0...v1.12.1)

Updates `sspilib` from 0.5.0 to 0.6.0
- [Release notes](https://github.com/jborean93/sspilib/releases)
- [Changelog](https://github.com/jborean93/sspilib/blob/main/CHANGELOG.md)
- [Commits](jborean93/sspilib@v0.5.0...v0.6.0)

Updates `tomli` from 2.4.1 to 2.5.0
- [Changelog](https://github.com/hukkin/tomli/blob/master/CHANGELOG.md)
- [Commits](hukkin/tomli@2.4.1...2.5.0)

Updates `tomlkit` from 0.15.0 to 0.15.1
- [Release notes](https://github.com/python-poetry/tomlkit/releases)
- [Changelog](https://github.com/python-poetry/tomlkit/blob/master/CHANGELOG.md)
- [Commits](python-poetry/tomlkit@0.15.0...0.15.1)

Updates `typing-extensions` from 4.15.0 to 4.16.0
- [Release notes](https://github.com/python/typing_extensions/releases)
- [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md)
- [Commits](python/typing_extensions@4.15.0...4.16.0)

Updates `urllib3` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.7.0...2.8.0)

---
updated-dependencies:
- dependency-name: black
  dependency-version: 26.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: autohooks
  dependency-version: 26.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: coverage
  dependency-version: 7.16.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: pypsrp
  dependency-version: 0.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: anyio
  dependency-version: 4.15.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: cffi
  dependency-version: 2.1.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: charset-normalizer
  dependency-version: 3.5.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: python-packages
- dependency-name: gssapi
  dependency-version: 1.12.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: h2
  dependency-version: 4.4.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: hpack
  dependency-version: 4.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: idna
  dependency-version: '3.20'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: krb5
  dependency-version: 0.10.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: lxml
  dependency-version: 6.1.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: platformdirs
  dependency-version: 4.12.4
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: pontos
  dependency-version: 26.9.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: python-packages
- dependency-name: pycparser
  dependency-version: '3.11'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: pyspnego
  dependency-version: 0.12.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: semver
  dependency-version: 3.1.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: shtab
  dependency-version: 1.12.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: sspilib
  dependency-version: 0.6.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: tomli
  dependency-version: 2.5.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: tomlkit
  dependency-version: 0.15.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: typing-extensions
  dependency-version: 4.16.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 15, 2026 04:18
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 15, 2026
@olav-gb

olav-gb commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

In E2E testing

@olav-gb
olav-gb merged commit ce55022 into main Oct 16, 2026
3 of 13 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/python-packages-05d68060d2 branch October 16, 2026 14:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@olav-gb olav-gb olav-gb approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@olav-gb