⬆ Bump the python-packages group across 1 directory with 8 updates - #1948

Merged
YuriiMotov merged 3 commits into
masterfrom
dependabot/uv/python-packages-8c2cf8eff0
Sep 2, 2026
Merged

⬆ Bump the python-packages group across 1 directory with 8 updates#1948
YuriiMotov merged 3 commits into
masterfrom
dependabot/uv/python-packages-8c2cf8eff0

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubSep 1, 2026•
edited by YuriiMotov
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-packages group with 8 updates in the / directory:

PackageFromTo
mypy2.3.02.3.1
ty0.0.630.0.74
ruff0.16.00.16.4
zensical0.0.510.0.57
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName=TypedDict("HasName", {"name": str})
HasOnlyName=TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie=TypedDict("Movie", {"name": str, "year": int})
movie: Movie= {"name": "Nimona", "year": 2023}
has_name: HasName=movie# OK: HasName is open (default)has_only_name: HasOnlyName=movie# Error: HasOnlyName is closed and Movie has extra "year" key</tr></table>

... (truncated)

Commits

Updates ty from 0.0.63 to 0.0.74

Release notes

Sourced from ty's releases.

0.0.74

Release Notes

Released on 2026-08-22.

Bug fixes

  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)

LSP server

  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)

Documentation

  • Update mypy/pyright comparison table (#4165)

Diagnostics

  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)

Core type checking

  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)

Performance

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.74

Released on 2026-08-22.

Bug fixes

  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)

LSP server

  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)

Documentation

  • Update mypy/pyright comparison table (#4165)

Diagnostics

  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)

Core type checking

  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)

Performance

... (truncated)

Commits

Updates ruff from 0.16.0 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Commits

Updates zensical from 0.0.51 to 0.0.57

Release notes

Sourced from zensical's releases.

0.0.57

Summary

This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.

Changelog

Bug fixes

  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)

Refactorings

  • b020159 zensical-serve – increase max header size to 8kb (#875)

0.0.56

Summary

This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.

Changelog

Bug fixes

  • 9973ac9 compat – regression reporting unresolved references (#866)

Refactorings

  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting

0.0.55

Summary

This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.

Changelog

Bug fixes

  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor

Refactorings

  • b53048e compat – revert code blocks to TOML 1.0 (#860)

0.0.54

Summary

... (truncated)

Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates prek from 0.4.11 to 0.4.14

Release notes

Sourced from prek's releases.

0.4.14

Release Notes

Released on 2026-08-17.

Enhancements

  • Support check-yaml unsafe mode (#2546)

Performance

  • Reuse allocations in common filters (#2548)

Bug fixes

  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)

Contributors

Install prek 0.4.14

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.4.14

FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum

... (truncated)

Changelog

Sourced from prek's changelog.

0.4.14

Released on 2026-08-17.

Enhancements

  • Support check-yaml unsafe mode (#2546)

Performance

  • Reuse allocations in common filters (#2548)

Bug fixes

  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)

Contributors

0.4.13

Released on 2026-08-10.

Highlights

Manage hook tools with mise

The new language: mise support lets hooks install tools using mise in an isolated environment:

repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false

Run commands in hook environments

The new prek exec subcommand can run an explicit command in a configured hook's prepared environment. For example, the hook above makes its managed binary available to this command:

... (truncated)

Commits

Updates zizmor from 1.28.0 to 1.29.0

Release notes

Sourced from zizmor's releases.

v1.29.0

New Features 🌈🔗

  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)

Changes ⚠️🔗

Removals 🌅🔗

  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)

  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)

  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

Changelog

Sourced from zizmor's changelog.

1.29.0

New Features 🌈

  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)

  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)

  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and #!yaml uses: ./foo/bar (#2248)

Changes ⚠️

  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly: [unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses, whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses (in addition to already checking other image references) (#2222)

Removals 🌅

  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)

Bug Fixes 🐛

  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)

  • Fixed a bug where the [github-app] audit would incorrectly flag some usages as needing a #!yaml repositories: key, despite requesting organization-level-only permissions (#2227)

  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)

Commits

Updates pydantic-settings from 2.14.2 to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

Highlights

Behavior changes

  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.

New features

  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.

Bug fixes

  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).

Documentation

  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).

What's Changed

... (truncated)

Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
  • 798dcea Bump the python-packages group with 4 updates (#924)
  • a190041 Bump the github-actions group with 4 updates (#925)
  • 5d93332 Bump the python-packages group with 4 updates (#921)
  • d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
  • 2256a4e Bump the python-packages group with 3 updates (#915)
  • Additional commits viewable in compare view

Updates pygithub from 2.9.1 to 2.10.0

Release notes

Sourced from pygithub's releases.

2.10.0

Notable changes

Drop Python 3.9 support due to End-of-Life

Python 3.9 reached its end-of-life October 31, 2025. Support has been removed with this release.

New Features

Improvements

Bug Fixes

@dependabotdependabotBot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 1, 2026
@latest-changeslatest-changesBot added the internal Internal changes label Sep 1, 2026
@github-actions

github-actionsBot commented Sep 1, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

📝 Docs preview

Last commit f904338 at: https://cc24cc34.typertiangolo.pages.dev

@dependabot
⬆ Bump the python-packages group across 1 directory with 8 updates
cb8672b
Bumps the python-packages group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: mypy
dependency-version: 2.3.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot changed the title ⬆ Bump the python-packages group with 8 updates⬆ Bump the python-packages group across 1 directory with 8 updatesSep 2, 2026
@dependabot
dependabotBotforce-pushed the dependabot/uv/python-packages-8c2cf8eff0 branch from 6b46e1b to cb8672bCompareSeptember 2, 2026 13:59
@YuriiMotov
YuriiMotovforce-pushed the dependabot/uv/python-packages-8c2cf8eff0 branch from 9c6db40 to f904338CompareSeptember 2, 2026 14:28
@YuriiMotov
YuriiMotov merged commit a3f4a55 into masterSep 2, 2026
28 checks passed
@YuriiMotov
YuriiMotov deleted the dependabot/uv/python-packages-8c2cf8eff0 branch September 2, 2026 14:41
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
⬆ Bump the python-packages group across 1 directory with 8 updates - #1948
Merged
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Sep 2, 2026
Merged
⬆ Bump the python-packages group across 1 directory with 8 updates#1948
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026•

edited by YuriiMotov

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 8 updates in the / directory:
PackageFromTo
mypy2.3.02.3.1
ty0.0.630.0.74
ruff0.16.00.16.4
zensical0.0.510.0.57
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates mypy from 2.3.0 to 2.3.1
Changelog
Sourced from mypy's changelog.
Mypy 2.3.1
  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)
Acknowledgements
Thanks to all mypy contributors who contributed to this release:
  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale
I'd also like to thank my employer, Dropbox, for supporting mypy development.
Mypy 2.2
We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new features, performance
improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.
Support for Closed TypedDicts (PEP 728)
Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra
keys beyond those explicitly defined. This allows the type checker to determine that certain
operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.
You can use the closed keyword argument with TypedDict:
HasName=TypedDict("HasName", {"name": str})
HasOnlyName=TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie=TypedDict("Movie", {"name": str, "year": int})
movie: Movie= {"name": "Nimona", "year": 2023}
has_name: HasName=movie# OK: HasName is open (default)has_only_name: HasOnlyName=movie# Error: HasOnlyName is closed and Movie has extra "year" key</tr></table>
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
  • 798dcea Bump the python-packages group with 4 updates (#924)
  • a190041 Bump the github-actions group with 4 updates (#925)
  • 5d93332 Bump the python-packages group with 4 updates (#921)
  • d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
  • 2256a4e Bump the python-packages group with 3 updates (#915)
  • Additional commits viewable in compare view

Updates pygithub from 2.9.1 to 2.10.0
Release notes
Sourced from pygithub's releases.
2.10.0
Notable changes
Drop Python 3.9 support due to End-of-Life
Python 3.9 reached its end-of-life October 31, 2025. Support has been removed with this release.
New Features
Improvements
Bug Fixes
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit f904338 at: https://cc24cc34.typertiangolo.pages.dev
@dependabot
⬆ Bump the python-packages group across 1 directory with 8 updates
cb8672b
Bumps the python-packages group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: mypy
dependency-version: 2.3.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
changed the title
⬆ Bump the python-packages group with 8 updates⬆ Bump the python-packages group across 1 directory with 8 updatesSep 2, 2026
@dependabot
dependabotBotforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
6b46e1b to
cb8672bCompareSeptember 2, 2026 13:59
@YuriiMotov
YuriiMotovforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
9c6db40 to
f904338CompareSeptember 2, 2026 14:28
@YuriiMotov
YuriiMotov
merged commit a3f4a55
into
masterSep 2, 2026

28 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-8c2cf8eff0

branch
September 2, 2026 14:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
⬆ Bump the python-packages group across 1 directory with 8 updates - #1948
Merged
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Sep 2, 2026
Merged
⬆ Bump the python-packages group across 1 directory with 8 updates#1948
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026•

edited by YuriiMotov

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 8 updates in the / directory:
PackageFromTo
mypy2.3.02.3.1
ty0.0.630.0.74
ruff0.16.00.16.4
zensical0.0.510.0.57
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates mypy from 2.3.0 to 2.3.1
Changelog
Sourced from mypy's changelog.
Mypy 2.3.1
  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)
Acknowledgements
Thanks to all mypy contributors who contributed to this release:
  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale
I'd also like to thank my employer, Dropbox, for supporting mypy development.
Mypy 2.2
We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new features, performance
improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.
Support for Closed TypedDicts (PEP 728)
Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra
keys beyond those explicitly defined. This allows the type checker to determine that certain
operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.
You can use the closed keyword argument with TypedDict:
HasName=TypedDict("HasName", {"name": str})
HasOnlyName=TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie=TypedDict("Movie", {"name": str, "year": int})
movie: Movie= {"name": "Nimona", "year": 2023}
has_name: HasName=movie# OK: HasName is open (default)has_only_name: HasOnlyName=movie# Error: HasOnlyName is closed and Movie has extra "year" key</tr></table>
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
  • 798dcea Bump the python-packages group with 4 updates (#924)
  • a190041 Bump the github-actions group with 4 updates (#925)
  • 5d93332 Bump the python-packages group with 4 updates (#921)
  • d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
  • 2256a4e Bump the python-packages group with 3 updates (#915)
  • Additional commits viewable in compare view

Updates pygithub from 2.9.1 to 2.10.0
Release notes
Sourced from pygithub's releases.
2.10.0
Notable changes
Drop Python 3.9 support due to End-of-Life
Python 3.9 reached its end-of-life October 31, 2025. Support has been removed with this release.
New Features
Improvements
Bug Fixes
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit f904338 at: https://cc24cc34.typertiangolo.pages.dev
@dependabot
⬆ Bump the python-packages group across 1 directory with 8 updates
cb8672b
Bumps the python-packages group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: mypy
dependency-version: 2.3.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
changed the title
⬆ Bump the python-packages group with 8 updates⬆ Bump the python-packages group across 1 directory with 8 updatesSep 2, 2026
@dependabot
dependabotBotforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
6b46e1b to
cb8672bCompareSeptember 2, 2026 13:59
@YuriiMotov
YuriiMotovforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
9c6db40 to
f904338CompareSeptember 2, 2026 14:28
@YuriiMotov
YuriiMotov
merged commit a3f4a55
into
masterSep 2, 2026

28 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-8c2cf8eff0

branch
September 2, 2026 14:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
⬆ Bump the python-packages group across 1 directory with 8 updates - #1948
Merged
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Sep 2, 2026
Merged
⬆ Bump the python-packages group across 1 directory with 8 updates#1948
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026•

edited by YuriiMotov

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 8 updates in the / directory:
PackageFromTo
mypy2.3.02.3.1
ty0.0.630.0.74
ruff0.16.00.16.4
zensical0.0.510.0.57
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates mypy from 2.3.0 to 2.3.1
Changelog
Sourced from mypy's changelog.
Mypy 2.3.1
  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)
Acknowledgements
Thanks to all mypy contributors who contributed to this release:
  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale
I'd also like to thank my employer, Dropbox, for supporting mypy development.
Mypy 2.2
We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new features, performance
improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.
Support for Closed TypedDicts (PEP 728)
Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra
keys beyond those explicitly defined. This allows the type checker to determine that certain
operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.
You can use the closed keyword argument with TypedDict:
HasName=TypedDict("HasName", {"name": str})
HasOnlyName=TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie=TypedDict("Movie", {"name": str, "year": int})
movie: Movie= {"name": "Nimona", "year": 2023}
has_name: HasName=movie# OK: HasName is open (default)has_only_name: HasOnlyName=movie# Error: HasOnlyName is closed and Movie has extra "year" key</tr></table>
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
  • 798dcea Bump the python-packages group with 4 updates (#924)
  • a190041 Bump the github-actions group with 4 updates (#925)
  • 5d93332 Bump the python-packages group with 4 updates (#921)
  • d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
  • 2256a4e Bump the python-packages group with 3 updates (#915)
  • Additional commits viewable in compare view

Updates pygithub from 2.9.1 to 2.10.0
Release notes
Sourced from pygithub's releases.
2.10.0
Notable changes
Drop Python 3.9 support due to End-of-Life
Python 3.9 reached its end-of-life October 31, 2025. Support has been removed with this release.
New Features
Improvements
Bug Fixes
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit f904338 at: https://cc24cc34.typertiangolo.pages.dev
@dependabot
⬆ Bump the python-packages group across 1 directory with 8 updates
cb8672b
Bumps the python-packages group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: mypy
dependency-version: 2.3.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
changed the title
⬆ Bump the python-packages group with 8 updates⬆ Bump the python-packages group across 1 directory with 8 updatesSep 2, 2026
@dependabot
dependabotBotforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
6b46e1b to
cb8672bCompareSeptember 2, 2026 13:59
@YuriiMotov
YuriiMotovforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
9c6db40 to
f904338CompareSeptember 2, 2026 14:28
@YuriiMotov
YuriiMotov
merged commit a3f4a55
into
masterSep 2, 2026

28 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-8c2cf8eff0

branch
September 2, 2026 14:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
⬆ Bump the python-packages group across 1 directory with 8 updates - #1948
Merged
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Sep 2, 2026
Merged
⬆ Bump the python-packages group across 1 directory with 8 updates#1948
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026•

edited by YuriiMotov

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 8 updates in the / directory:
PackageFromTo
mypy2.3.02.3.1
ty0.0.630.0.74
ruff0.16.00.16.4
zensical0.0.510.0.57
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates mypy from 2.3.0 to 2.3.1
Changelog
Sourced from mypy's changelog.
Mypy 2.3.1
  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)
Acknowledgements
Thanks to all mypy contributors who contributed to this release:
  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale
I'd also like to thank my employer, Dropbox, for supporting mypy development.
Mypy 2.2
We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new features, performance
improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.
Support for Closed TypedDicts (PEP 728)
Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra
keys beyond those explicitly defined. This allows the type checker to determine that certain
operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.
You can use the closed keyword argument with TypedDict:
HasName=TypedDict("HasName", {"name": str})
HasOnlyName=TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie=TypedDict("Movie", {"name": str, "year": int})
movie: Movie= {"name": "Nimona", "year": 2023}
has_name: HasName=movie# OK: HasName is open (default)has_only_name: HasOnlyName=movie# Error: HasOnlyName is closed and Movie has extra "year" key</tr></table>
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
  • 798dcea Bump the python-packages group with 4 updates (#924)
  • a190041 Bump the github-actions group with 4 updates (#925)
  • 5d93332 Bump the python-packages group with 4 updates (#921)
  • d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
  • 2256a4e Bump the python-packages group with 3 updates (#915)
  • Additional commits viewable in compare view

Updates pygithub from 2.9.1 to 2.10.0
Release notes
Sourced from pygithub's releases.
2.10.0
Notable changes
Drop Python 3.9 support due to End-of-Life
Python 3.9 reached its end-of-life October 31, 2025. Support has been removed with this release.
New Features
Improvements
Bug Fixes
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit f904338 at: https://cc24cc34.typertiangolo.pages.dev
@dependabot
⬆ Bump the python-packages group across 1 directory with 8 updates
cb8672b
Bumps the python-packages group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: mypy
dependency-version: 2.3.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
changed the title
⬆ Bump the python-packages group with 8 updates⬆ Bump the python-packages group across 1 directory with 8 updatesSep 2, 2026
@dependabot
dependabotBotforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
6b46e1b to
cb8672bCompareSeptember 2, 2026 13:59
@YuriiMotov
YuriiMotovforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
9c6db40 to
f904338CompareSeptember 2, 2026 14:28
@YuriiMotov
YuriiMotov
merged commit a3f4a55
into
masterSep 2, 2026

28 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-8c2cf8eff0

branch
September 2, 2026 14:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
⬆ Bump the python-packages group across 1 directory with 8 updates - #1948
Merged
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Sep 2, 2026
Merged
⬆ Bump the python-packages group across 1 directory with 8 updates#1948
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026•

edited by YuriiMotov

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 8 updates in the / directory:
PackageFromTo
mypy2.3.02.3.1
ty0.0.630.0.74
ruff0.16.00.16.4
zensical0.0.510.0.57
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates mypy from 2.3.0 to 2.3.1
Changelog
Sourced from mypy's changelog.
Mypy 2.3.1
  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)
Acknowledgements
Thanks to all mypy contributors who contributed to this release:
  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale
I'd also like to thank my employer, Dropbox, for supporting mypy development.
Mypy 2.2
We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new features, performance
improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.
Support for Closed TypedDicts (PEP 728)
Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra
keys beyond those explicitly defined. This allows the type checker to determine that certain
operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.
You can use the closed keyword argument with TypedDict:
HasName=TypedDict("HasName", {"name": str})
HasOnlyName=TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie=TypedDict("Movie", {"name": str, "year": int})
movie: Movie= {"name": "Nimona", "year": 2023}
has_name: HasName=movie# OK: HasName is open (default)has_only_name: HasOnlyName=movie# Error: HasOnlyName is closed and Movie has extra "year" key</tr></table>
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
  • 798dcea Bump the python-packages group with 4 updates (#924)
  • a190041 Bump the github-actions group with 4 updates (#925)
  • 5d93332 Bump the python-packages group with 4 updates (#921)
  • d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
  • 2256a4e Bump the python-packages group with 3 updates (#915)
  • Additional commits viewable in compare view

Updates pygithub from 2.9.1 to 2.10.0
Release notes
Sourced from pygithub's releases.
2.10.0
Notable changes
Drop Python 3.9 support due to End-of-Life
Python 3.9 reached its end-of-life October 31, 2025. Support has been removed with this release.
New Features
Improvements
Bug Fixes
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit f904338 at: https://cc24cc34.typertiangolo.pages.dev
@dependabot
⬆ Bump the python-packages group across 1 directory with 8 updates
cb8672b
Bumps the python-packages group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: mypy
dependency-version: 2.3.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
changed the title
⬆ Bump the python-packages group with 8 updates⬆ Bump the python-packages group across 1 directory with 8 updatesSep 2, 2026
@dependabot
dependabotBotforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
6b46e1b to
cb8672bCompareSeptember 2, 2026 13:59
@YuriiMotov
YuriiMotovforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
9c6db40 to
f904338CompareSeptember 2, 2026 14:28
@YuriiMotov
YuriiMotov
merged commit a3f4a55
into
masterSep 2, 2026

28 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-8c2cf8eff0

branch
September 2, 2026 14:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
⬆ Bump the python-packages group across 1 directory with 8 updates - #1948
Merged
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Sep 2, 2026
Merged
⬆ Bump the python-packages group across 1 directory with 8 updates#1948
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026•

edited by YuriiMotov

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 8 updates in the / directory:
PackageFromTo
mypy2.3.02.3.1
ty0.0.630.0.74
ruff0.16.00.16.4
zensical0.0.510.0.57
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates mypy from 2.3.0 to 2.3.1
Changelog
Sourced from mypy's changelog.
Mypy 2.3.1
  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)
Acknowledgements
Thanks to all mypy contributors who contributed to this release:
  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale
I'd also like to thank my employer, Dropbox, for supporting mypy development.
Mypy 2.2
We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new features, performance
improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.
Support for Closed TypedDicts (PEP 728)
Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra
keys beyond those explicitly defined. This allows the type checker to determine that certain
operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.
You can use the closed keyword argument with TypedDict:
HasName=TypedDict("HasName", {"name": str})
HasOnlyName=TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie=TypedDict("Movie", {"name": str, "year": int})
movie: Movie= {"name": "Nimona", "year": 2023}
has_name: HasName=movie# OK: HasName is open (default)has_only_name: HasOnlyName=movie# Error: HasOnlyName is closed and Movie has extra "year" key</tr></table>
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
  • 798dcea Bump the python-packages group with 4 updates (#924)
  • a190041 Bump the github-actions group with 4 updates (#925)
  • 5d93332 Bump the python-packages group with 4 updates (#921)
  • d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
  • 2256a4e Bump the python-packages group with 3 updates (#915)
  • Additional commits viewable in compare view

Updates pygithub from 2.9.1 to 2.10.0
Release notes
Sourced from pygithub's releases.
2.10.0
Notable changes
Drop Python 3.9 support due to End-of-Life
Python 3.9 reached its end-of-life October 31, 2025. Support has been removed with this release.
New Features
Improvements
Bug Fixes
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit f904338 at: https://cc24cc34.typertiangolo.pages.dev
@dependabot
⬆ Bump the python-packages group across 1 directory with 8 updates
cb8672b
Bumps the python-packages group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: mypy
dependency-version: 2.3.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
changed the title
⬆ Bump the python-packages group with 8 updates⬆ Bump the python-packages group across 1 directory with 8 updatesSep 2, 2026
@dependabot
dependabotBotforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
6b46e1b to
cb8672bCompareSeptember 2, 2026 13:59
@YuriiMotov
YuriiMotovforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
9c6db40 to
f904338CompareSeptember 2, 2026 14:28
@YuriiMotov
YuriiMotov
merged commit a3f4a55
into
masterSep 2, 2026

28 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-8c2cf8eff0

branch
September 2, 2026 14:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
⬆ Bump the python-packages group across 1 directory with 8 updates - #1948
Merged
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Sep 2, 2026
Merged
⬆ Bump the python-packages group across 1 directory with 8 updates#1948
YuriiMotov merged 3 commits into
masterfrom 
dependabot/uv/python-packages-8c2cf8eff0
Conversation
@dependabot
@dependabotdependabotBot
commented
on behalf of githubSep 1, 2026•

edited by YuriiMotov

Loading

Copy link


Copy Markdown

Contributor
Bumps the python-packages group with 8 updates in the / directory:
PackageFromTo
mypy2.3.02.3.1
ty0.0.630.0.74
ruff0.16.00.16.4
zensical0.0.510.0.57
prek0.4.110.4.14
zizmor1.28.01.29.0
pydantic-settings2.14.22.15.0
pygithub2.9.12.10.0
Updates mypy from 2.3.0 to 2.3.1
Changelog
Sourced from mypy's changelog.
Mypy 2.3.1
  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)
Acknowledgements
Thanks to all mypy contributors who contributed to this release:
  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale
I'd also like to thank my employer, Dropbox, for supporting mypy development.
Mypy 2.2
We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new features, performance
improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.
Support for Closed TypedDicts (PEP 728)
Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra
keys beyond those explicitly defined. This allows the type checker to determine that certain
operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.
You can use the closed keyword argument with TypedDict:
HasName=TypedDict("HasName", {"name": str})
HasOnlyName=TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie=TypedDict("Movie", {"name": str, "year": int})
movie: Movie= {"name": "Nimona", "year": 2023}
has_name: HasName=movie# OK: HasName is open (default)has_only_name: HasOnlyName=movie# Error: HasOnlyName is closed and Movie has extra "year" key</tr></table>
... (truncated)
Commits

Updates ty from 0.0.63 to 0.0.74
Release notes
Sourced from ty's releases.
0.0.74
Release Notes
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Changelog
Sourced from ty's changelog.
0.0.74
Released on 2026-08-22.
Bug fixes
  • Avoid duplicate bindings in multi-target assignments (#27938)
  • Avoid panic on unpacked kwargs in string annotations (#27963)
  • Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
  • Handle assignment expressions in string annotations (#27921)
  • Handle dynamic classes in string annotations (#27883)
  • Preserve string annotation context in lambda defaults and TypedDict types (#27914)
  • Skip invalid subscript arguments in string annotations (#27917)
  • Skip invalid subscript operands in string annotations (#27882)
LSP server
  • Add untrustedWorkspace option to the LSP (#27828)
  • Add executable discovery to the server command (#27806)
  • Handle file-valued workspace folders from Zed (#27836)
  • Skip scripts with an invalid PEP 723 configuration (#27505)
  • Support pull diagnostics for notebook cells (#27778)
Documentation
  • Update mypy/pyright comparison table (#4165)
Diagnostics
  • Add an opt-in unsound-assignment rule for variables (#27874)
  • Fix variadic signature display (#27869)
  • Highlight declarations in invalid-assignment diagnostics (#27872)
  • Improve LiteralString suggestions in string annotations (#27931)
  • Use invalid-type-form for non-generic class annotations (#27889)
Core type checking
  • Add bounded constraint solution projections (#27949)
  • Fix invariant gradual tuple materialization ranges (#27946)
  • Guard recursive constructor bindings by receiver (#27958)
  • Preserve all alternatives in bounded intersections (#27898)
  • Preserve keyword safety for unpacked callables (#27517)
  • Preserve source protocol members and classify finite aliases (#27772)
  • Preserve type-variable order when reloading constraints (#27904)
  • Propagate narrowing through statically known branches (#27752)
  • Recognize ABC metaclass methods on protocols (#27897)
  • Support __slots__ (#27730)
Performance
... (truncated)
Commits

Updates ruff from 0.16.0 to 0.16.4
Release notes
Sourced from ruff's releases.
0.16.4
Release Notes
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Changelog
Sourced from ruff's changelog.
0.16.4
Released on 2026-08-20.
Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)
Documentation
  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)
Other changes
  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)
Contributors
... (truncated)
Commits

Updates zensical from 0.0.51 to 0.0.57
Release notes
Sourced from zensical's releases.
0.0.57
Summary
This version improves compatibility with markdown-exec by supporting pymdownx blocks, raises the maximum HTTP header value size to 8 KiB for proxy-generated cookies, and updates the UI dependency stack and bundled icons. UI performance and palette tooltip behavior were also improved, especially on large pages and in Safari.
Changelog
Bug fixes
  • 325758f ui – update ui to v0.0.26
  • 7372e5b compat – support pymdownx blocks in markdown exec (#871)
Refactorings
  • b020159 zensical-serve – increase max header size to 8kb (#875)
0.0.56
Summary
This version fixes a regression introduced in 0.0.55, making Zensical report false positives for the deprecated unresolved_references setting. Additionally, checking of autorefs is moved to the invalid_links setting. Please disable unresolved_references - it is not supported anymore, and will be replaced by the reference parser that we're currently testing in Zensical Studio.
Changelog
Bug fixes
  • 9973ac9 compat – regression reporting unresolved references (#866)
Refactorings
  • e6c56ce zensical, compat – report invalid autorefs under invalid_links validation setting
0.0.55
Summary
This version fixes two false positives in the reference extractor and reverts Zensical's bootstrapped zensical.toml to TOML 1.0, since most editor tooling does not yet support TOML 1.1. Zensical understands both, TOML 1.0 and TOML 1.1, so this change does not affect the functionality of Zensical itself.
Changelog
Bug fixes
  • 91d9d50 compat – ignore surrounding whitespace in inline link targets (#861)
  • 6774d61 compat – invalid code span detection in reference extractor
Refactorings
  • b53048e compat – revert code blocks to TOML 1.0 (#860)
0.0.54
Summary
... (truncated)
Commits
  • f18bb99 chore: release v0.0.57
  • 325758f fix: update ui to v0.0.26
  • b020159 refactor: increase max header size to 8kb (#875)
  • 7372e5b fix: support pymdownx blocks in markdown exec (#871)
  • ab17429 chore: release v0.0.56
  • e6c56ce refactor: report invalid autorefs under invalid_links validation setting
  • 9973ac9 fix: regression reporting unresolved references (#866)
  • b60354c chore: release v0.0.55
  • b53048e refactor: revert code blocks to TOML 1.0 (#860)
  • 7fe9b24 Merge pull request #862 from zensical/fix/reference-extractor
  • Additional commits viewable in compare view

Updates prek from 0.4.11 to 0.4.14
Release notes
Sourced from prek's releases.
0.4.14
Release Notes
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
Install prek 0.4.14
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.4.14
FilePlatformChecksum
prek-aarch64-apple-darwin.tar.gzApple Silicon macOSchecksum
prek-x86_64-apple-darwin.tar.gzIntel macOSchecksum
prek-aarch64-pc-windows-msvc.zipARM64 Windowschecksum
... (truncated)
Changelog
Sourced from prek's changelog.
0.4.14
Released on 2026-08-17.
Enhancements
  • Support check-yaml unsafe mode (#2546)
Performance
  • Reuse allocations in common filters (#2548)
Bug fixes
  • Accept non-finite floats in check-yaml (#2545)
  • Allow comment-heavy YAML in check-yaml (#2554)
  • Sanitize captured terminal output before replay (#2552)
Contributors
0.4.13
Released on 2026-08-10.
Highlights
Manage hook tools with mise
The new language: mise support lets hooks install tools using
mise in an isolated environment:
repos:
- repo: localhooks:
- id: golangci-lintname: golangci-lintlanguage: miseadditional_dependencies: ["aqua:golangci/golangci-lint@2"]entry: golangci-lint run --fast-only ./...pass_filenames: false
Run commands in hook environments
The new prek exec subcommand can run an explicit command in a configured
hook's prepared environment. For example, the hook above makes its managed
binary available to this command:
... (truncated)
Commits

Updates zizmor from 1.28.0 to 1.29.0
Release notes
Sourced from zizmor's releases.
v1.29.0
New Features 🌈🔗
  • zizmor now has experimental support for auditing pre-commit inputs, meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: insecure-url-scheme detects usages of insecure (i.e. plaintext) protocols when making network requests. The initial version of this audit is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local actions, e.g. uses: $/foo/bar instead of a manual checkout and uses: ./foo/bar (#2248)
Changes ⚠️🔗
Removals 🌅🔗
  • --collect=workflows-only and --collect=actions-only have been fully removed. Use --collect=workflows and --collect=actions for the replacement behavior (#2242)
Bug Fixes 🐛🔗
  • Fixed a bug where zizmor would reject a valid workflow definition for containing a literal jobs..outputs. value for being a non-string (#2220)
  • Fixed a bug where the github-app audit would incorrectly flag some usages as needing a repositories: key, despite requesting organization-level-only permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in unintuitive ways. When auditing from a Git repository, zizmor now uses the repository root to discover configuration consistently (#2234)
Changelog
Sourced from zizmor's changelog.
1.29.0
New Features 🌈
  • zizmor now has experimental support for auditing pre-commit inputs,
meaning both pre-commit configuration and hook definitions (#2209)
  • New audit: [insecure-url-scheme] detects usages of insecure (i.e. plaintext)
protocols when making network requests. The initial version of this audit
is limited to pre-commit inputs only (#2228)
  • zizmor now supports GitHub's "self-repository" reference syntax for local
actions, e.g. #!yaml uses: $/foo/bar instead of a manual checkout and
#!yaml uses: ./foo/bar (#2248)
Changes ⚠️
  • The [unpinned-uses] and [unpinned-images] audits have been separated more cleanly:
[unpinned-uses] is now principally responsible for Git-style #!yaml uses: clauses,
whereas [unpinned-images] is now responsible for docker://-style #!yaml uses: clauses
(in addition to already checking other image references) (#2222)
Removals 🌅
  • --collect=workflows-only and --collect=actions-only have been fully removed.
Use --collect=workflows and --collect=actions for the replacement behavior
(#2242)
Bug Fixes 🐛
  • Fixed a bug where zizmor would reject a valid workflow definition for
containing a literal jobs.<job>.outputs.<name> value for being a non-string (#2220)
  • Fixed a bug where the [github-app] audit would incorrectly flag some usages
as needing a #!yaml repositories: key, despite requesting organization-level-only
permissions (#2227)
  • Fixed a class of bugs where zizmor would discover the user's configuration in
unintuitive ways. When auditing from a Git repository, zizmor now uses the repository
root to discover configuration consistently (#2234)
Commits

Updates pydantic-settings from 2.14.2 to 2.15.0
Release notes
Sourced from pydantic-settings's releases.
v2.15.0
Highlights
Behavior changes
  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.
New features
  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.
Bug fixes
  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).
Documentation
  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).
What's Changed
... (truncated)
Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
  • 798dcea Bump the python-packages group with 4 updates (#924)
  • a190041 Bump the github-actions group with 4 updates (#925)
  • 5d93332 Bump the python-packages group with 4 updates (#921)
  • d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
  • 2256a4e Bump the python-packages group with 3 updates (#915)
  • Additional commits viewable in compare view

Updates pygithub from 2.9.1 to 2.10.0
Release notes
Sourced from pygithub's releases.
2.10.0
Notable changes
Drop Python 3.9 support due to End-of-Life
Python 3.9 reached its end-of-life October 31, 2025. Support has been removed with this release.
New Features
Improvements
Bug Fixes
@dependabotdependabotBot
added

dependencies
Pull requests that update a dependency file
python:uv
Pull requests that update python:uv code
labels
Sep 1, 2026
@latest-changeslatest-changesBot
added
the 
internal
Internal changes
label
Sep 1, 2026
@github-actions
github-actionsBot
commented
Sep 1, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
📝 Docs preview
Last commit f904338 at: https://cc24cc34.typertiangolo.pages.dev
@dependabot
⬆ Bump the python-packages group across 1 directory with 8 updates
cb8672b
Bumps the python-packages group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [ty](https://github.com/astral-sh/ty) | `0.0.63` | `0.0.74` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.16.4` |
| [zensical](https://github.com/zensical/zensical) | `0.0.51` | `0.0.57` |
| [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.14` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.28.0` | `1.29.0` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pygithub](https://github.com/pygithub/pygithub) | `2.9.1` | `2.10.0` |
Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)
Updates `ty` from 0.0.63 to 0.0.74
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.63...0.0.74)
Updates `ruff` from 0.16.0 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.4)
Updates `zensical` from 0.0.51 to 0.0.57
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.51...v0.0.57)
Updates `prek` from 0.4.11 to 0.4.14
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.11...v0.4.14)
Updates `zizmor` from 1.28.0 to 1.29.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.28.0...v1.29.0)
Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)
Updates `pygithub` from 2.9.1 to 2.10.0
- [Release notes](https://github.com/pygithub/pygithub/releases)
- [Changelog](https://github.com/PyGithub/PyGithub/blob/main/doc/changes.rst)
- [Commits](PyGithub/PyGithub@v2.9.1...v2.10.0)
---
updated-dependencies:
- dependency-name: mypy
dependency-version: 2.3.1
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: prek
dependency-version: 0.4.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: pydantic-settings
dependency-version: 2.15.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: pygithub
dependency-version: 2.10.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
- dependency-name: ruff
dependency-version: 0.16.4
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: ty
dependency-version: 0.0.74
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zensical
dependency-version: 0.0.57
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: python-packages
- dependency-name: zizmor
dependency-version: 1.29.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: python-packages
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot
changed the title
⬆ Bump the python-packages group with 8 updates⬆ Bump the python-packages group across 1 directory with 8 updatesSep 2, 2026
@dependabot
dependabotBotforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
6b46e1b to
cb8672bCompareSeptember 2, 2026 13:59
@YuriiMotov
YuriiMotovforce-pushed
the
dependabot/uv/python-packages-8c2cf8eff0
branch
from
9c6db40 to
f904338CompareSeptember 2, 2026 14:28
@YuriiMotov
YuriiMotov
merged commit a3f4a55
into
masterSep 2, 2026

28 checks passed

@YuriiMotov
YuriiMotov
deleted the

dependabot/uv/python-packages-8c2cf8eff0

branch
September 2, 2026 14:41
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels

dependenciesPull requests that update a dependency fileinternalInternal changespython:uvPull requests that update python:uv code

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@tiangolo@YuriiMotov