Skip to content

chore(deps): bump the python-dependencies group with 6 updates - #4337

Merged
d-v-b merged 2 commits into
mainfrom
dependabot/uv/python-dependencies-7be7cc2e98
Sep 11, 2026
Merged

chore(deps): bump the python-dependencies group with 6 updates#4337
d-v-b merged 2 commits into
mainfrom
dependabot/uv/python-dependencies-7be7cc2e98

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 6 updates:

Package From To
typer 0.27.1 0.27.2
coverage 7.15.4 7.16.0
hypothesis 6.165.10 6.167.1
uv 0.12.6 0.12.9
mkdocstrings-python 2.0.7 2.0.8
ruff 0.16.4 0.16.5

Updates typer from 0.27.1 to 0.27.2

Release notes

Sourced from typer's releases.

0.27.2

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

Changelog

Sourced from typer's changelog.

0.27.2 (2026-08-28)

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

Commits

Updates coverage from 7.15.4 to 7.16.0

Release notes

Sourced from coverage's releases.

7.16.0

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
  • The Coverage.switch_context() method now returns the previous context.
  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
  • Fixes to validation of options and configuration settings:
    • Negative precision settings now always cause useful error messages (pull 2261).
    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

Changelog

Sourced from coverage's changelog.

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

  • The :meth:.Coverage.switch_context method now returns the previous context.

  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

  • Fixes to validation of options and configuration settings:

    • Negative precision settings now always cause useful error messages (pull 2261_).

    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with "Can't combine statement coverage data with branch data". Each named concurrency library is now properly considered (pull 2270_).

  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265_).

.. _pull 2261: coveragepy/coveragepy#2261 .. _pull 2262: coveragepy/coveragepy#2262 .. _pull 2263: coveragepy/coveragepy#2263 .. _pull 2265: coveragepy/coveragepy#2265 .. _issue 2266: coveragepy/coveragepy#2266 .. _pull 2268: coveragepy/coveragepy#2268

... (truncated)

Commits
  • 3e9fc16 docs: prep for 7.16.0
  • 38be8d1 build: control check-manifest explicitly
  • 8eb1266 docs(build): no longer commit sample_html
  • 1a8b3fa docs: remove sample_html
  • aeaa79b docs: linklint is now sphinx-linklint
  • d5eaf3f test: a branchless way to re-add extensions
  • 57e52fd docs: adjust CHANGES for #2270
  • b9d304d fix: check for multiprocessing in a --concurrency list (#2270)
  • a6ef928 chore: make upgrade
  • 070461f chore: bump the action-dependencies group with 4 updates (#2271)
  • Additional commits viewable in compare view

Updates hypothesis from 6.165.10 to 6.167.1

Commits
  • a8dcd74 Bump hypothesis version to 6.167.1 and update changelog
  • c862b6f Merge pull request #4874 from Zac-HD/claude/cu-many-reject-span-discard-yhaidc
  • df39994 Merge pull request #4873 from HypothesisWorks/create-pull-request/patch
  • afe5b0b Bump hypothesis version to 6.167.0 and update changelog
  • 06bfa69 Merge pull request #4870 from Zac-HD/claude/status-reason-ideas-dum8wm
  • 1d0e155 Add return annotation to satisfy mypy's disallow_incomplete_defs
  • a0a7dfc Report the failing assume() when .map() gives up
  • d010799 Rename _filter_gave_ups test helper to _get_filter_gave_ups
  • ef98ff9 Fix the type of Bundle transformations
  • 8e36c8f Require passing data to SampledFromStrategy._transform
  • Additional commits viewable in compare view

Updates uv from 0.12.6 to 0.12.9

Release notes

Sourced from uv's releases.

0.12.9

Release Notes

Released on 2026-09-01.

Python

Enhancements

  • Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
  • Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

  • Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

  • Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
  • Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
  • Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
  • Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
  • Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

Install uv 0.12.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 | iex"

Download uv 0.12.9

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.9

Released on 2026-09-01.

Python

Enhancements

  • Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
  • Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

  • Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

  • Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
  • Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
  • Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
  • Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
  • Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

0.12.8

Released on 2026-08-31.

Enhancements

  • Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

  • Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
  • Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
  • Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

  • Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
  • Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
  • Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
  • Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

  • Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
  • Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)

... (truncated)

Commits

Updates mkdocstrings-python from 2.0.7 to 2.0.8

Release notes

Sourced from mkdocstrings-python's releases.

2.0.8

2.0.8 - 2026-08-31

Compare with 2.0.7

Performance Improvements

  • Make template existence test (for locale templates) faster (c0424f2 by Timothée Mazzucotelli).
Changelog

Sourced from mkdocstrings-python's changelog.

2.0.8 - 2026-08-31

Compare with 2.0.7

Performance Improvements

  • Make template existence test (for locale templates) faster (c0424f2 by Timothée Mazzucotelli).
Commits
  • 8125b0d chore: Prepare release 2.0.8
  • 5054240 chore: Be a bit more minijinja compatible
  • c0424f2 perf: Make template existence test (for locale templates) faster
  • See full diff in compare view

Updates ruff from 0.16.4 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-dependencies group with 6 updates
c5b467f 
Bumps the python-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [typer](https://github.com/fastapi/typer) | `0.27.1` | `0.27.2` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.4` | `7.16.0` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.165.10` | `6.167.1` |
| [uv](https://github.com/astral-sh/uv) | `0.12.6` | `0.12.9` |
| [mkdocstrings-python](https://github.com/mkdocstrings/python) | `2.0.7` | `2.0.8` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.4` | `0.16.5` |


Updates `typer` from 0.27.1 to 0.27.2
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.1...0.27.2)

Updates `coverage` from 7.15.4 to 7.16.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.4...7.16.0)

Updates `hypothesis` from 6.165.10 to 6.167.1
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.165.10...v6.167.1)

Updates `uv` from 0.12.6 to 0.12.9
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.6...0.12.9)

Updates `mkdocstrings-python` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/mkdocstrings/python/releases)
- [Changelog](https://github.com/mkdocstrings/python/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/python@2.0.7...2.0.8)

Updates `ruff` from 0.16.4 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.4...0.16.5)

---
updated-dependencies:
- dependency-name: typer
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: coverage
  dependency-version: 7.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: hypothesis
  dependency-version: 6.167.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: uv
  dependency-version: 0.12.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: mkdocstrings-python
  dependency-version: 2.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 10, 2026
@d-v-b
d-v-b enabled auto-merge (squash) September 11, 2026 18:12
@d-v-b
d-v-b merged commit a44a102 into main Sep 11, 2026
35 checks passed
@d-v-b
d-v-b deleted the dependabot/uv/python-dependencies-7be7cc2e98 branch September 11, 2026 18:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@d-v-b d-v-b d-v-b approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@d-v-b