Skip to content

Deps: Bump the python-packages group with 4 updates - #21

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-packages-c4859479df
Open

Deps: Bump the python-packages group with 4 updates#21
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-packages-c4859479df

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-packages group with 4 updates: ruff, certifi, httpx2 and tomlkit.

Updates ruff from 0.17.0 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Commits
  • 4683270 Bump version to 0.17.1 (#29420)
  • 3514027 [ty] Update typing conformance suite pin (#29417)
  • 8294556 Update referenced PR security-review workflow (#29237)
  • d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
  • 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
  • 83a3afc Fix dedent with multiple leading comments (#29382)
  • b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
  • d01678e [ty] Clarify object attribute write-contract rationale (#29384)
  • 355b42a [ty] Avoid writable override contracts from object (#29373)
  • e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
  • Additional commits viewable in compare view

Updates certifi from 2026.7.22 to 2026.10.19

Commits

Updates httpx2 from 2.13.1 to 2.14.0

Release notes

Sourced from httpx2's releases.

v2.14.0

Highlights

🌐 CIDR ranges in NO_PROXY

NO_PROXY and mounts now match IP CIDR ranges like 192.168.0.0/16 and [fe80::]/10, so any address in the range bypasses the proxy (#1165). Bracketed IPv6 addresses like [::1]:8080 are accepted, and unparseable NO_PROXY entries are ignored instead of failing client creation (#1267).

🔐 FIPS-enforced Python support

httpx2 now imports on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError only when the server asks for an unavailable algorithm (#1130).

🔌 Sturdier connections and WebSocket shutdown

HTTP/2 reads no longer block when a server lowers SETTINGS_MAX_CONCURRENT_STREAMS mid-flight (#1217), and writing after a peer closes TLS without close_notify raises WriteError (#1263). Sync WebSocket sessions no longer hang on exit with a full event queue (#1123), and ASGI WebSocket reads after app shutdown no longer leak anyio exceptions (#1233).

httpx2

Added

  • Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did (#1165).
  • Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY (#1267).

Changed

  • Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33 (#1165).

Fixed

  • Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created (#1267).
  • Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm (#1130).
  • Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions (#1233).
  • Stop the sync WebSocket session from hanging on exit when its event queue is full (#1123).

httpcore2

Fixed

  • Keep CONNECT and absolute-form proxy targets when the request sets the target extension (#1262).
  • Stop blocking reads when an HTTP/2 server lowers SETTINGS_MAX_CONCURRENT_STREAMS while requests are in flight (#1217).
  • Raise WriteError instead of anyio.EndOfStream when writing after the peer closes a TLS connection without close_notify (#1263).

Full Changelog: pydantic/httpx2@v2.13.1...v2.14.0

Changelog

Sourced from httpx2's changelog.

2.14.0 (October 18th, 2026)

Added

  • Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did. (#1165)
  • Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY. (#1267)

Changed

  • Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33. (#1165)

Fixed

  • Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created. (#1267)
  • Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm. (#1130)
  • Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions. (#1233)
  • Stop the sync WebSocket session from hanging on exit when its event queue is full. (#1123)
Commits
  • 4fa853a Prepare version 2.14.0 (#1271)
  • dd7701a Support IP CIDR ranges in NO_PROXY (#1165)
  • cd50836 Accept bracketed IPv6 and skip unparseable entries in NO_PROXY (#1267)
  • 53c11c4 Interrupt blocked queue puts during sync WebSocket teardown (#1123)
  • d989385 Support FIPS-enforced Python builds without hashlib.md5 in DigestAuth (#1...
  • 76d02ee Handle reads during ASGI WebSocket shutdown (#1233)
  • See full diff in compare view

Updates tomlkit from 0.15.1 to 0.15.2

Release notes

Sourced from tomlkit's releases.

0.15.2

What's Changed

... (truncated)

Changelog

Sourced from tomlkit's changelog.

[0.15.2] - 2026-10-16

Changed

  • Write the ESC control character as \u001b instead of \e, which is only valid in TOML 1.1, so the output stays readable by TOML 1.0 parsers such as tomllib. (#641)
  • key_value() now raises UnexpectedCharError on anything other than whitespace or a comment after the pair, instead of silently discarding it (e.g. key_value("a = 1 b = 2")), matching parse(). (#594)
  • integer() given a string now validates it against the TOML integer grammar and keeps the original text, so grouping underscores (e.g. integer("1_000")) survive dumps(); strings that are not valid TOML integers (e.g. "010") now raise ValueError. (#336)
  • Add a fold argument to DateTime and Time, mirroring the stdlib, and carry fold through item(), arithmetic (including datetime subtraction) and unwrap(), so a folded local time no longer converts an hour off. (#619, #623, #626)
  • Declare the project metadata in the PEP 621 [project] table; building from source now requires poetry-core>=2.2.0. (#607, #609)

Fixed

  • Fix valid TOML being rejected when an out-of-order table reopens an implicit super-table with a dotted key: [a.b.c] then [a] with b.z = 1 extends the implicit a.b super-table rather than redefining it (stdlib tomllib accepts it), so it now parses and round-trips instead of raising Redefinition of an existing table. The concrete-table case ([a.b] then [a] b.z = 1) stays rejected. (#565)
  • Fix uppercase E exponent after a leading-zero mantissa (e.g. 0E2) being rejected as an invalid number while 0e2 parsed fine. (#586)
  • Fix non-lowercase special floats (e.g. Inf, NaN, -INF) being accepted; TOML only allows lowercase inf and nan, so they now raise ParseError. (#628)
  • Fix parse errors reporting the wrong line and column in documents with CRLF or mixed line endings. (#642)
  • Fix item() reordering the keys of an inline table (dict-valued keys were forced last) under the default sort_keys=False. (#546)
  • Fix unwrap() moving a key to the end after its value was replaced (e.g. doc["b"] = 9), while dumps() and keys() kept the original order. (#591)
  • Fix appending a key to a parsed inline table that uses ", " separators emitting a bare "," for the new entry, leaving the table inconsistently spaced (e.g. {x = 1, y = 2,z = 3}). (#595)
  • Fix an emptied array of tables being dropped from the output: it now renders as key = [], placed and keyed relative to the nearest table header so it parses back into the same table. (#567)
  • Fix a single-line array whose last element is a trailing comment (e.g. from add_line(value, comment=...)) rendering its closing ] on the comment line, producing unparseable output. (#580)
  • Fix del array[start:stop:step] with a negative or omitted bound removing the wrong elements from the rendered output. (#599)
  • Fix array slice assignment mutating the array before raising ValueError("slice assignment is not supported"). (#600)
  • Fix String.__add__ splicing the appended text into a basic string without escaping it, so appending a quote or backslash produced invalid TOML. (#612)
  • Fix a bare carriage return in a multiline string producing invalid TOML: it is now escaped as \r in a multiline basic string and rejected with InvalidStringError in a multiline literal string; CRLF line endings are left intact. (#539)
  • Fix a tz-aware datetime.time rendering with a UTC offset (e.g. 07:32:00+02:00), which TOML local times do not allow; it now renders as a local time. (#613)
  • Fix arithmetic on a signed float producing +-0.0 (e.g. -1.5 times 0), which does not parse. (#629)
  • Fix two Bool items never comparing equal to each other; they now compare by value. (#660)
Commits
  • a0b15eb chore: release 0.15.2 (#668)
  • 18e7f98 Compare Bool items by value (#660)
  • 19edc23 [pre-commit.ci] pre-commit autoupdate (#654)
  • 6b5f079 Render an emptied array of tables as an empty array (#567)
  • 229ee86 fix: don't reject an out-of-order super-table extended by a dotted key (#565)
  • 096148f escape or reject a bare carriage return in multiline strings (#539)
  • 5fe4329 test: add coverage for tomlkit._types wrapper operators (#570)
  • 2279e18 Enable intersphinx so stdlib references resolve (#624)
  • a963fe1 Preserve inline table key order in item() (#546) (#552)
  • 446d6fa Reject non-lowercase special float literals (#628)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Deps: Bump the python-packages group with 4 updates
ec4efc3 
Bumps the python-packages group with 4 updates: [ruff](https://github.com/astral-sh/ruff), [certifi](https://github.com/certifi/python-certifi), [httpx2](https://github.com/pydantic/httpx2) and [tomlkit](https://github.com/python-poetry/tomlkit).


Updates `ruff` from 0.17.0 to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.0...0.17.1)

Updates `certifi` from 2026.7.22 to 2026.10.19
- [Commits](certifi/python-certifi@2026.07.22...2026.10.19)

Updates `httpx2` from 2.13.1 to 2.14.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.13.1...v2.14.0)

Updates `tomlkit` from 0.15.1 to 0.15.2
- [Release notes](https://github.com/python-poetry/tomlkit/releases)
- [Changelog](https://github.com/python-poetry/tomlkit/blob/master/CHANGELOG.md)
- [Commits](python-poetry/tomlkit@0.15.1...0.15.2)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: certifi
  dependency-version: 2026.10.19
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: httpx2
  dependency-version: 2.14.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: tomlkit
  dependency-version: 0.15.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 22, 2026 04:12
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants