⬆ Bump the python-packages group with 9 updates - #2085

Merged
YuriiMotov merged 1 commit into
mainfrom
dependabot/uv/python-packages-aa52ce52cc
Sep 1, 2026
Merged

⬆ Bump the python-packages group with 9 updates#2085
YuriiMotov merged 1 commit into
mainfrom
dependabot/uv/python-packages-aa52ce52cc

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubSep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-packages group with 9 updates:

PackageFromTo
typer0.27.00.27.1
zensical0.0.510.0.57
fastapi0.140.00.141.1
ruff0.16.00.16.4
ty0.0.630.0.74
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0

Updates typer from 0.27.0 to 0.27.1

Release notes

Sourced from typer's releases.

0.27.1

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

Changelog

Sourced from typer's changelog.

0.27.1 (2026-08-03)

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

Commits
  • fe2aa0e 🔖 Release version 0.27.1 (#1919)
  • 680dc99 📝 Update release notes
  • ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
  • 32d80ef 📝 Update release notes
  • 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
  • ac329a0 📝 Update release notes
  • c37ae2f 📝 Add Library Skills documentation (#1906)
  • 0974a7e 📝 Update release notes
  • 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
  • 9051baa 📝 Update release notes
  • Additional commits viewable in compare view

Updates zensical from 0.0.51 to 0.0.57

Release notes

Sourced from zensical's releases.

0.0.57

Summary

This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.

Changelog

Bug fixes

  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)

Refactorings

  • b020159 zensical-serve – increase max header size to 8kb (#875)

0.0.56

Summary

This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.

Changelog

Bug fixes

  • 9973ac9 compat – regression reporting unresolved references (#866)

Refactorings

  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting

0.0.55

Summary

This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.

Changelog

Bug fixes

  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor

Refactorings

  • b53048e compat – revert code blocks to TOML 1.0 (#860)

0.0.54

Summary

... (truncated)

Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates fastapi from 0.140.0 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

0.141.0

Features

  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

Docs

0.140.12

Fixes

0.140.11

Fixes

  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

Internal

0.140.9

Fixes

  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Commits

Updates ty from 0.0.63 to 0.0.74

Release notes

Sourced from ty's releases.

0.0.74

Release Notes

Released on 2026-08-22.

Bug fixes

  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)

LSP server

  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)

Documentation

  • Update mypy/pyright comparison table (#4165)

Diagnostics

  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)

Core type checking

  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)

Performance

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.74

Released on 2026-08-22.

Bug fixes

  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)

LSP server

  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)

Documentation

  • Update mypy/pyright comparison table (#4165)

Diagnostics

  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)

Core type checking

  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)

Performance

... (truncated)

Commits

Updates prek from 0.4.11 to 0.4.14

Release notes

Sourced from prek's releases.

0.4.14

Release Notes

Released on 2026-08-17.

Enhancements

  • Support check-yaml unsafe mode (#2546)

Performance

  • Reuse allocations in common filters (#2548)

Bug fixes

  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)

Contributors

Install prek 0.4.14

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.4.14

FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum

... (truncated)

Changelog

Sourced from prek's changelog.

0.4.14

Released on 2026-08-17.

Enhancements

  • Support check-yaml unsafe mode (#2546)

Performance

  • Reuse allocations in common filters (#2548)

Bug fixes

  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)

Contributors

0.4.13

Released on 2026-08-10.

Highlights

Manage hook tools with mise

The new language: mise support lets hooks install tools using mise in an isolated environment:

repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false

Run commands in hook environments

The new prek exec subcommand can run an explicit command in a configured hook's prepared environment. For example, the hook above makes its managed binary available to this command:

... (truncated)

Commits

Updates zizmor from 1.28.0 to 1.29.0

Release notes

Sourced from zizmor's releases.

v1.29.0

New Features 🌈🔗

  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)

Changes ⚠️🔗

Removals 🌅🔗

  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)

  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)

  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

Changelog

Sourced from zizmor's changelog.

1.29.0

New Features 🌈

  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and #!yaml uses: ./foo/bar (#2248)

Changes ⚠️

  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly: [unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses, whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses (in addition to already checking other image references) (#2222)

Removals 🌅

  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛

  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)

  • Fixed a bug where the [github-app] audit would incorrectly flag some usages as needing a #!yaml repositories: key, despite requesting organization-level-only permissions (#2227)

  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

Commits

Updates pydantic-settings from 2.14.2 to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

Highlights

Behavior changes

  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.

New features

  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.

Bug fixes

  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).

Documentation

  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).

What's Changed

... (truncated)

Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix:...

    Description has been truncated

@dependabot
⬆ Bump the python-packages group with 9 updates
6e10724
Bumps the python-packages group with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [typer](https://github.com/fastapi/typer) | `0.27.0` | `0.27.1` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.140.0` | `0.141.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `typer` from 0.27.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.0...0.27.1)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `fastapi` from 0.140.0 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.140.0...0.141.1)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 1, 2026
@latest-changeslatest-changesBot added the internal Internal changes label Sep 1, 2026
@github-actions

github-actionsBot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

📝 Docs preview

Last commit 6e10724 at: https://f106b084.sqlmodel.pages.dev

@YuriiMotov
YuriiMotov merged commit a038aa3 into mainSep 1, 2026
31 checks passed
@YuriiMotov
YuriiMotov deleted the dependabot/uv/python-packages-aa52ce52cc branch September 1, 2026 22:39
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
⬆ Bump the python-packages group with 9 updates - #2085
Merged
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Sep 1, 2026
Merged
⬆ Bump the python-packages group with 9 updates#2085
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 9 updates:
PackageFromTo
typer0.27.00.27.1
zensical0.0.510.0.57
fastapi0.140.00.141.1
ruff0.16.00.16.4
ty0.0.630.0.74
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates typer from 0.27.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Changelog
Sourced from typer's changelog.
0.27.1 (2026-08-03)
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Commits
  • fe2aa0e 🔖 Release version 0.27.1 (#1919)
  • 680dc99 📝 Update release notes
  • ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
  • 32d80ef 📝 Update release notes
  • 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
  • ac329a0 📝 Update release notes
  • c37ae2f 📝 Add Library Skills documentation (#1906)
  • 0974a7e 📝 Update release notes
  • 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
  • 9051baa 📝 Update release notes
  • Additional commits viewable in compare view

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates fastapi from 0.140.0 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix:...

    Description has been truncated
@dependabot
⬆ Bump the python-packages group with 9 updates
6e10724
Bumps the python-packages group with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [typer](https://github.com/fastapi/typer) | `0.27.0` | `0.27.1` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.140.0` | `0.141.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `typer` from 0.27.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.0...0.27.1)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `fastapi` from 0.140.0 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.140.0...0.141.1)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit 6e10724 at: https://f106b084.sqlmodel.pages.dev
@YuriiMotov
YuriiMotov
merged commit a038aa3
into
mainSep 1, 2026

31 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-aa52ce52cc

branch
September 1, 2026 22:39
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
⬆ Bump the python-packages group with 9 updates - #2085
Merged
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Sep 1, 2026
Merged
⬆ Bump the python-packages group with 9 updates#2085
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 9 updates:
PackageFromTo
typer0.27.00.27.1
zensical0.0.510.0.57
fastapi0.140.00.141.1
ruff0.16.00.16.4
ty0.0.630.0.74
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates typer from 0.27.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Changelog
Sourced from typer's changelog.
0.27.1 (2026-08-03)
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Commits
  • fe2aa0e 🔖 Release version 0.27.1 (#1919)
  • 680dc99 📝 Update release notes
  • ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
  • 32d80ef 📝 Update release notes
  • 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
  • ac329a0 📝 Update release notes
  • c37ae2f 📝 Add Library Skills documentation (#1906)
  • 0974a7e 📝 Update release notes
  • 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
  • 9051baa 📝 Update release notes
  • Additional commits viewable in compare view

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates fastapi from 0.140.0 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix:...

    Description has been truncated
@dependabot
⬆ Bump the python-packages group with 9 updates
6e10724
Bumps the python-packages group with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [typer](https://github.com/fastapi/typer) | `0.27.0` | `0.27.1` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.140.0` | `0.141.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `typer` from 0.27.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.0...0.27.1)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `fastapi` from 0.140.0 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.140.0...0.141.1)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit 6e10724 at: https://f106b084.sqlmodel.pages.dev
@YuriiMotov
YuriiMotov
merged commit a038aa3
into
mainSep 1, 2026

31 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-aa52ce52cc

branch
September 1, 2026 22:39
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
⬆ Bump the python-packages group with 9 updates - #2085
Merged
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Sep 1, 2026
Merged
⬆ Bump the python-packages group with 9 updates#2085
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 9 updates:
PackageFromTo
typer0.27.00.27.1
zensical0.0.510.0.57
fastapi0.140.00.141.1
ruff0.16.00.16.4
ty0.0.630.0.74
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates typer from 0.27.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Changelog
Sourced from typer's changelog.
0.27.1 (2026-08-03)
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Commits
  • fe2aa0e 🔖 Release version 0.27.1 (#1919)
  • 680dc99 📝 Update release notes
  • ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
  • 32d80ef 📝 Update release notes
  • 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
  • ac329a0 📝 Update release notes
  • c37ae2f 📝 Add Library Skills documentation (#1906)
  • 0974a7e 📝 Update release notes
  • 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
  • 9051baa 📝 Update release notes
  • Additional commits viewable in compare view

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates fastapi from 0.140.0 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix:...

    Description has been truncated
@dependabot
⬆ Bump the python-packages group with 9 updates
6e10724
Bumps the python-packages group with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [typer](https://github.com/fastapi/typer) | `0.27.0` | `0.27.1` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.140.0` | `0.141.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `typer` from 0.27.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.0...0.27.1)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `fastapi` from 0.140.0 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.140.0...0.141.1)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit 6e10724 at: https://f106b084.sqlmodel.pages.dev
@YuriiMotov
YuriiMotov
merged commit a038aa3
into
mainSep 1, 2026

31 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-aa52ce52cc

branch
September 1, 2026 22:39
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
⬆ Bump the python-packages group with 9 updates - #2085
Merged
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Sep 1, 2026
Merged
⬆ Bump the python-packages group with 9 updates#2085
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 9 updates:
PackageFromTo
typer0.27.00.27.1
zensical0.0.510.0.57
fastapi0.140.00.141.1
ruff0.16.00.16.4
ty0.0.630.0.74
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates typer from 0.27.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Changelog
Sourced from typer's changelog.
0.27.1 (2026-08-03)
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Commits
  • fe2aa0e 🔖 Release version 0.27.1 (#1919)
  • 680dc99 📝 Update release notes
  • ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
  • 32d80ef 📝 Update release notes
  • 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
  • ac329a0 📝 Update release notes
  • c37ae2f 📝 Add Library Skills documentation (#1906)
  • 0974a7e 📝 Update release notes
  • 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
  • 9051baa 📝 Update release notes
  • Additional commits viewable in compare view

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates fastapi from 0.140.0 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix:...

    Description has been truncated
@dependabot
⬆ Bump the python-packages group with 9 updates
6e10724
Bumps the python-packages group with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [typer](https://github.com/fastapi/typer) | `0.27.0` | `0.27.1` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.140.0` | `0.141.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `typer` from 0.27.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.0...0.27.1)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `fastapi` from 0.140.0 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.140.0...0.141.1)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit 6e10724 at: https://f106b084.sqlmodel.pages.dev
@YuriiMotov
YuriiMotov
merged commit a038aa3
into
mainSep 1, 2026

31 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-aa52ce52cc

branch
September 1, 2026 22:39
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
⬆ Bump the python-packages group with 9 updates - #2085
Merged
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Sep 1, 2026
Merged
⬆ Bump the python-packages group with 9 updates#2085
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 9 updates:
PackageFromTo
typer0.27.00.27.1
zensical0.0.510.0.57
fastapi0.140.00.141.1
ruff0.16.00.16.4
ty0.0.630.0.74
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates typer from 0.27.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Changelog
Sourced from typer's changelog.
0.27.1 (2026-08-03)
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Commits
  • fe2aa0e 🔖 Release version 0.27.1 (#1919)
  • 680dc99 📝 Update release notes
  • ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
  • 32d80ef 📝 Update release notes
  • 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
  • ac329a0 📝 Update release notes
  • c37ae2f 📝 Add Library Skills documentation (#1906)
  • 0974a7e 📝 Update release notes
  • 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
  • 9051baa 📝 Update release notes
  • Additional commits viewable in compare view

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates fastapi from 0.140.0 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix:...

    Description has been truncated
@dependabot
⬆ Bump the python-packages group with 9 updates
6e10724
Bumps the python-packages group with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [typer](https://github.com/fastapi/typer) | `0.27.0` | `0.27.1` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.140.0` | `0.141.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `typer` from 0.27.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.0...0.27.1)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `fastapi` from 0.140.0 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.140.0...0.141.1)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit 6e10724 at: https://f106b084.sqlmodel.pages.dev
@YuriiMotov
YuriiMotov
merged commit a038aa3
into
mainSep 1, 2026

31 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-aa52ce52cc

branch
September 1, 2026 22:39
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
⬆ Bump the python-packages group with 9 updates - #2085
Merged
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Sep 1, 2026
Merged
⬆ Bump the python-packages group with 9 updates#2085
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 9 updates:
PackageFromTo
typer0.27.00.27.1
zensical0.0.510.0.57
fastapi0.140.00.141.1
ruff0.16.00.16.4
ty0.0.630.0.74
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates typer from 0.27.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Changelog
Sourced from typer's changelog.
0.27.1 (2026-08-03)
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Commits
  • fe2aa0e 🔖 Release version 0.27.1 (#1919)
  • 680dc99 📝 Update release notes
  • ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
  • 32d80ef 📝 Update release notes
  • 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
  • ac329a0 📝 Update release notes
  • c37ae2f 📝 Add Library Skills documentation (#1906)
  • 0974a7e 📝 Update release notes
  • 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
  • 9051baa 📝 Update release notes
  • Additional commits viewable in compare view

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates fastapi from 0.140.0 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix:...

    Description has been truncated
@dependabot
⬆ Bump the python-packages group with 9 updates
6e10724
Bumps the python-packages group with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [typer](https://github.com/fastapi/typer) | `0.27.0` | `0.27.1` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.140.0` | `0.141.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `typer` from 0.27.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.0...0.27.1)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `fastapi` from 0.140.0 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.140.0...0.141.1)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit 6e10724 at: https://f106b084.sqlmodel.pages.dev
@YuriiMotov
YuriiMotov
merged commit a038aa3
into
mainSep 1, 2026

31 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-aa52ce52cc

branch
September 1, 2026 22:39
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
⬆ Bump the python-packages group with 9 updates - #2085
Merged
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Sep 1, 2026
Merged
⬆ Bump the python-packages group with 9 updates#2085
YuriiMotov merged 1 commit into
mainfrom 
dependabot/uv/python-packages-aa52ce52cc
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 9 updates:
PackageFromTo
typer0.27.00.27.1
zensical0.0.510.0.57
fastapi0.140.00.141.1
ruff0.16.00.16.4
ty0.0.630.0.74
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates typer from 0.27.0 to 0.27.1
Release notes
Sourced from typer's releases.
0.27.1
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Changelog
Sourced from typer's changelog.
0.27.1 (2026-08-03)
Features
  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.
Docs
Internal
Commits
  • fe2aa0e 🔖 Release version 0.27.1 (#1919)
  • 680dc99 📝 Update release notes
  • ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
  • 32d80ef 📝 Update release notes
  • 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
  • ac329a0 📝 Update release notes
  • c37ae2f 📝 Add Library Skills documentation (#1906)
  • 0974a7e 📝 Update release notes
  • 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
  • 9051baa 📝 Update release notes
  • Additional commits viewable in compare view

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates fastapi from 0.140.0 to 0.141.1
Release notes
Sourced from fastapi's releases.
0.141.1
Fixes
  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.
Docs
0.141.0
Features
  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.
0.140.13
Fixes
Docs
0.140.12
Fixes
0.140.11
Fixes
  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.
0.140.10
Fixes
Internal
0.140.9
Fixes
  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.
... (truncated)
Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix:...

    Description has been truncated
@dependabot
⬆ Bump the python-packages group with 9 updates
6e10724
Bumps the python-packages group with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [typer](https://github.com/fastapi/typer) | `0.27.0` | `0.27.1` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.140.0` | `0.141.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `typer` from 0.27.0 to 0.27.1
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.0...0.27.1)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `fastapi` from 0.140.0 to 0.141.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.140.0...0.141.1)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: typer
dependency-version: 0.27.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: fastapi
dependency-version: 0.141.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit 6e10724 at: https://f106b084.sqlmodel.pages.dev
@YuriiMotov
YuriiMotov
merged commit a038aa3
into
mainSep 1, 2026

31 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-aa52ce52cc

branch
September 1, 2026 22:39
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov