Skip to content

MAINT: Bump the python-deps group across 1 directory with 6 updates - #323

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/requirements/python-deps-26c8722c29
Closed

MAINT: Bump the python-deps group across 1 directory with 6 updates#323
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/requirements/python-deps-26c8722c29

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the python-deps group with 6 updates in the /requirements directory:

Package From To
gitpython 3.1.57 3.1.61
ruff 0.16.1 0.16.5
hypothesis 6.164.0 6.167.1
mypy 2.3.0 2.3.1
pyrefly 1.1.1 1.2.0
delvewheel 1.13.0 1.13.1

Updates gitpython from 3.1.57 to 3.1.61

Release notes

Sourced from gitpython's releases.

3.1.61

Fix accidental removal of exploitable regex in Actor by bringing it back, and deprecating it.

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.60...3.1.61

3.1.60 Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.59...3.1.60

3.1.59 - Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.58...3.1.59

3.1.58 - Security and Fixes

What's Changed

New Contributors

... (truncated)

Commits
  • 5346d1b prepare next release
  • d81336b Merge pull request #2221 from gitpython-developers/re-add-regex
  • bc63b02 fix: restore Actor.name_email_regex (#2220)
  • a9fb008 Merge pull request #2219 from Vogtinator/main
  • db1a2cf fix: wait for git daemon to listen before connecting
  • 3481da9 Merge pull request #2218 from gitpython-developers/fix-repo-open
  • 56636c3 prepare new release
  • c7cf4d1 fix: prefer .git during repository discovery
  • d160fb4 Merge pull request #2217 from gitpython-developers/fix-advisory
  • 09f2cf3 fix: require opt-in for no-index diffs
  • Additional commits viewable in compare view

Updates ruff from 0.16.1 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

0.16.4

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

... (truncated)

Commits

Updates hypothesis from 6.164.0 to 6.167.1

Commits
  • a8dcd74 Bump hypothesis version to 6.167.1 and update changelog
  • c862b6f Merge pull request #4874 from Zac-HD/claude/cu-many-reject-span-discard-yhaidc
  • df39994 Merge pull request #4873 from HypothesisWorks/create-pull-request/patch
  • afe5b0b Bump hypothesis version to 6.167.0 and update changelog
  • 06bfa69 Merge pull request #4870 from Zac-HD/claude/status-reason-ideas-dum8wm
  • 1d0e155 Add return annotation to satisfy mypy's disallow_incomplete_defs
  • a0a7dfc Report the failing assume() when .map() gives up
  • d010799 Rename _filter_gave_ups test helper to _get_filter_gave_ups
  • ef98ff9 Fix the type of Bundle transformations
  • 8e36c8f Require passing data to SampledFromStrategy._transform
  • Additional commits viewable in compare view

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

Updates pyrefly from 1.1.1 to 1.2.0

Release notes

Sourced from pyrefly's releases.

Pyrefly v1.2.0

Release date: July 31, 2026

Pyrefly v1.2.0 bundles 901 commits from 59 contributors.

✨ New & Improved

Type Checking

  • Attrs classes are now fully supported with comprehensive field synthesis, validation, and special-method generation. Pyrefly recognizes @attr.s, @define, @frozen, and their variants, handling field specifiers (attr.ib(), field()), converters, validators, defaults, and private-field aliasing. Converters are typed from their real input type rather than Any, including the @<field>.converter decorator, attrs.converters.pipe, attrs.converters.default_if_none, and generic converters like copy.deepcopy. See the new attrs documentation for details.
  • functools.partial is now type-checked instead of treated as opaque. Bound arguments are validated at construction and Pyrefly synthesizes a precise residual signature for the remaining parameters, so errors surface at both the partial(...) call and the later invocation. Generic functions, overloads, constructors, bound methods, and **Unpack[TypedDict] parameters are supported, and results expose .func, .args, and .keywords. Precise residual callable assignment is enabled by the strict and all presets or explicitly with strict-partial-subtyping.
  • Functions decorated with functools.singledispatch now type-check calls using the signature of the function you decorated, and registered implementations are checked against that function's first parameter. Generic singledispatch functions infer from call arguments instead of reporting Unknown.
  • Pyrefly can now warn when a function declared to return a concrete type returns Any, with separate diagnostics for explicit and inferred cases. Off by default, and migrated automatically from mypy's warn_return_any.
  • Pattern matching is substantially more precise: positional class patterns resolve attribute names from __match_args__ at solve time, sequence element captures read from the narrowed subject so sibling constraints refine them, and isinstance on a facet filters the parent union to matching members. Fully covered class and sequence patterns now subtract their union member from later cases.
  • Unpacking a variadic tuple with a fixed prefix and suffix no longer smears those elements into the starred capture, so a, *rest, b = t where t: tuple[int, *tuple[bool, ...], str] types rest as list[bool].
  • TypedDict classes now synthesize __required_keys__ and __optional_keys__, so protocols requiring them (like those in langgraph) satisfy structural checks. .get() and .pop() with literal defaults preserve the field type.
  • Overload handling improved throughout: constrained TypeVar arguments expand during resolution, rejected overloads no longer leak argument errors into diagnostics, and exact callback-forwarding signatures resolve overloaded callbacks against forwarded arguments for helpers like asyncio.to_thread.
  • Enum .value on an enum type now infers as the union of member literal values instead of widening to the mixed-in data type.
  • Lambda parameters are contextually typed more thoroughly. Types are stored directly rather than resolved through inference variables, and *args/**kwargs resolve from callable hints to tuple[...] and dict[str, ...] inside the body while preserving element types in the signature.
  • All properties are now treated as data descriptors, and reflected binary-operation dunders are tried first for proper subclasses, fixing a class of incorrect attribute and operator results.
  • Cyclic type aliases reachable from an annotation are now detected instead of hanging, and class finality is taken into account when deciding whether a condition is redundant.
  • Continued basedpyright parity work: class instance truthiness is recognized, code under if TYPE_CHECKING is handled consistently, typing_extensions.sentinel is supported with relaxed naming restrictions, and super(cls, cls) is accepted.
  • copy.replace is now type-checked like dataclass replacement, and isinstance(x, type) preserves type arguments when narrowing unions.
  • Narrowing a receiver typed as Self to a subclass now preserves Self, eliminating false return errors in methods that return the narrowed receiver.

Library Support

  • Pydantic constructor synthesis now honors populate_by_name and built-in alias_generator functions, ignores Field(init=False) to match runtime, and treats frozen as a readonly field reason.
  • Django ForeignKey targets now resolve attribute expressions and string references such as "app_label.Model", preserving the generated relation and <field>_id types.
  • Bare factory-boy factory calls now return the model type via FactoryMetaClass.
  • PEP 561 partial stub packages are now supported in imports. Pyrefly reads the partial marker from py.typed and merges the stubs with the runtime package, deferring to the runtime package for omitted modules while preserving .pyi-before-.py precedence for provided ones.
  • A configured typeshed-path now supplies stdlib stubs as well as third-party stubs, enabling complete custom-typeshed testing and overrides.

Language Server

  • Hover now resolves keyword arguments, renders callable protocols as their __call__ signature, preserves overload docstrings at call sites, shows enum fields, wraps nested callable and Concatenate[...] signatures for readability, and covers and/or operators, augmented assignments, and union methods.
  • Auto-import completions respect python.analysis.autoImportCompletions, rank deprecated stdlib typing aliases below their modern equivalents, avoid duplicates for already-imported modules, and preserve import aliases correctly.
  • Rename now works on aliased imports and across files for keyword arguments, and renaming a Protocol class targets the class rather than __init__.
  • Go-to-definition now navigates directly to symbols in non-Python files such as .thrift, including nested attribute and enum access and intermediate components of multi-dotted imports.
  • Inlay hints debounce server-side (default 150ms), preventing width jitter while typing. NewType values now use their callable constructor signature instead of producing an invalid type[N] annotation.
  • Notebook support improved: hover and type lookups work past the first cell, and inlay hints, document symbols, references, and diagnostic grouping work in cells following markdown cells.
  • Document symbols fall back to flat SymbolInformation for clients such as Helix, semantic tokens cover with ... as and except ... as bindings, and cross-file diagnostics refresh on save in strict-spec clients such as Zed.
  • #region/#endregion markers create folding regions, and selection ranges now follow AST nesting from expression to statement to scope to document.
  • Baselined errors now appear as hints instead of errors, making it easier to distinguish new issues from known technical debt. Baselining also now applies correctly to unused-ignore diagnostics.
  • Match captures receive consistent semantic highlighting and preserve their declaration identity for go-to-definition.
  • lspArguments defaults to ["lsp"] when empty, preventing startup failures in dev containers and remote environments.
  • The VSCode extension adds an "Infer Types for Current File" command to the command palette.

... (truncated)

Commits
  • 1933169 cut 1.2.0
  • df11f5d Enforce call-boundary consumption in production
  • e67bc8e Transfer quantified handles to call boundaries
  • 6ba516f Move deferred call state into its boundary
  • 8888e70 Scope call contexts to a lexical boundary
  • f8c9e7c LSP: default lspArguments to ["lsp"] when empty
  • 3f0c228 Remove dead .hgignore
  • 335510d improve Sandbox: link shortening #1063 (#4327)
  • 41094b9 Keep lambda hint decomposition transactional
  • 3193b6a fix behavior of init=False for pydantic.BaseModel (#4352)
  • Additional commits viewable in compare view

Updates delvewheel from 1.13.0 to 1.13.1

Changelog

Sourced from delvewheel's changelog.

1.13.1 (28 August 2026)

  • Improve GitHub Actions security.
  • Ignore invalid PATH entries instead of raising OSError.
  • Fix ValueError when a vendored DLL has a timestamp outside what's supported by the ZIP format.
  • Fix FileNotFoundError on a case-sensitive file system when the wheel extraction directory has a capital letter or when an extension module resides in a package with a capital letter.
  • Fix .py patch when __future__ import is split across multiple lines.
  • Fix argument validation for replace-needed when -change specifies the old DLL name more than once but with different case. Previously, the last -change argument overrode the previous value. Now, an exception is raised.
  • Fix error when repairing a non-x64 wheel with an unrecognized platform tag.
  • Allow surrounding whitespace and empty components within the values specified with --include, --exclude, --no-mangle, --add-path, and --namespace-pkg.
  • Fail fast when --with-mangle is incorrectly specified without --ignore-existing. Previously, the wheel was extracted before an exception was raised. Now, the exception is raised at the beginning during argument validation.
  • Speed up test suite by disabling ZIP compression when testing and by extracting a wheel directly instead of using pip. This halves the runtime for each GitHub Actions CI run.
  • When repairing multiple wheels with a single command, prevent the internal state from repairing one wheel from polluting the state for repairing subsequent wheels. Previously, DLLs excluded based on the targeted Python version for the first wheel were also excluded when repairing subsequent wheels, regardless of the targeted Python versions for the subsequent wheels.
  • Improve performance by reducing redundant calls when searching for DLL dependencies or parsing DLL files.
  • Reduce memory usage by reading files in chunks.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
MAINT: Bump the python-deps group across 1 directory with 6 updates
ac75348 
Bumps the python-deps group with 6 updates in the /requirements directory:

| Package | From | To |
| --- | --- | --- |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.57` | `3.1.61` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.1` | `0.16.5` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.164.0` | `6.167.1` |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |
| [pyrefly](https://github.com/facebook/pyrefly) | `1.1.1` | `1.2.0` |
| [delvewheel](https://github.com/adang1345/delvewheel) | `1.13.0` | `1.13.1` |



Updates `gitpython` from 3.1.57 to 3.1.61
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.57...3.1.61)

Updates `ruff` from 0.16.1 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.1...0.16.5)

Updates `hypothesis` from 6.164.0 to 6.167.1
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.164.0...v6.167.1)

Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)

Updates `pyrefly` from 1.1.1 to 1.2.0
- [Release notes](https://github.com/facebook/pyrefly/releases)
- [Commits](facebook/pyrefly@1.1.1...1.2.0)

Updates `delvewheel` from 1.13.0 to 1.13.1
- [Changelog](https://github.com/adang1345/delvewheel/blob/master/CHANGELOG.md)
- [Commits](https://github.com/adang1345/delvewheel/commits)

---
updated-dependencies:
- dependency-name: gitpython
  dependency-version: 3.1.61
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: hypothesis
  dependency-version: 6.167.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: mypy
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: pyrefly
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: delvewheel
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 23, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 23, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/requirements/python-deps-26c8722c29 branch September 23, 2026 10:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

03 - Maintenance

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants