Skip to content

build(deps): bump the pip group across 1 directory with 4 updates - #680

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-ae2b83d5ba
Closed

build(deps): bump the pip group across 1 directory with 4 updates#680
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-ae2b83d5ba

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on pydantic, ruff, mypy and flit-core to permit the latest version.
Updates pydantic to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

  • Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
  • Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

... (truncated)

Commits
  • b2212c7 Prepare release v2.14.1
  • 968fb2b Fix docs conversion table
  • 6adc8b3 Support named tuples in Sequence validation
  • 7637fbc Reject out-of-range int inputs for timedelta
  • dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
  • e2456d3 Support closed and extra_items via inheritance in TypedDict
  • 317655d Harden CI security
  • 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
  • 43681ab Bump samuelcolvin/check-python-version action to v5.1
  • d6bc53a Avoid unnecessary extra dict allocation in model validation
  • Additional commits viewable in compare view

Updates ruff to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15

... (truncated)

Commits
  • 4683270 Bump version to 0.17.1 (#29420)
  • 3514027 [ty] Update typing conformance suite pin (#29417)
  • 8294556 Update referenced PR security-review workflow (#29237)
  • d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
  • 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
  • 83a3afc Fix dedent with multiple leading comments (#29382)
  • b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
  • d01678e [ty] Clarify object attribute write-contract rationale (#29384)
  • 355b42a [ty] Avoid writable override contracts from object (#29373)
  • e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
  • Additional commits viewable in compare view

Updates mypy to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

  • You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
  • Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
  • Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

Updates flit-core to 4.1.0

Changelog

Sourced from flit-core's changelog.

Release history

Version 4.1

  • License expressions with named exceptions, the WITH syntax, are accepted (:ghpull:809).
  • flit init allows dotted module names, for a component of a namespace package (:ghissue:822).
  • Fix line endings in .cmd script wrappers on Windows (:ghpull:824).

Version 4.0.3

  • Fix built wheels being created with overly restrictive 0600 permissions instead of the normal, world-readable 0644 (:ghpull:806).

Version 4.0.2

  • Fix invalid metadata files with Import-Name (:ghissue:813).

Version 4.0.1

No changes, but a new tag to trigger an upload to PyPI now that twine will accept it.

Version 4.0

This version contains breaking changes, but most projects which are already using the [project] table for metadata shouldn't be affected, and can simply change the flit_core <4 constraint to <5.

  • The [tool.flit.metadata] table is no longer used for project metadata (:ghpull:771). Use the newer :ref:[project] table <pyproject_toml_project> instead (or if that is not possible, build with flit_core <4).
  • :ref:build_cmd and :ref:publish_cmd no longer include files in the sdist based on what is committed in git or Mercurial (:ghpull:772). These commands now build packages more like Flit does when called as a backend by e.g. python -m build. Specify :ref:sdist include & exclude patterns <pyproject_toml_sdist> instead (Flit can help to generate these), or pass the --use-vcs option to get the old behaviour back.
  • flit_core now requires Python 3.8 or above (:ghpull:738)
  • The --setup-py option to generate sdists containing a setup.py file is no longer available (:ghpull:776).
  • Making typing stubs packages with a -stubs suffix will now work (:ghpull:742).

... (truncated)

Commits
  • 75b1c90 Merge pull request #826 from pypa/prepare-4.1
  • b5ad0d7 Add release note about PR #824
  • 9fb48c1 Bump version: 4.0.2 → 4.1.0
  • a4ea331 Prepare release notes for 4.1
  • 337c499 Merge pull request #824 from r3wretrhy/fix-win-cmd-crlf
  • 04cfa08 Merge pull request #825 from hxperl/docs-dynamic-fields
  • 33be607 doc: list all four fields accepted in project.dynamic
  • d538cb4 install: keep explicit CRLF in Windows .cmd wrappers
  • 3c92604 Merge pull request #809 from yangfan-yf-yf/fix/spdx-with-exceptions
  • 33a7a39 Clarify SPDX WITH version requirement and error message
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 19, 2026
@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

:shipit: No regressions found.

@dependabot
build(deps): bump the pip group across 1 directory with 4 updates
2f8f9ab 
Updates the requirements on [pydantic](https://github.com/pydantic/pydantic), [ruff](https://github.com/astral-sh/ruff), [mypy](https://github.com/python/mypy) and [flit-core](https://github.com/pypa/flit) to permit the latest version.

Updates `pydantic` to 2.14.1
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.0...v2.14.1)

Updates `ruff` to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@v0.0.18...0.17.1)

Updates `mypy` to 2.4.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.1...v2.4.0)

Updates `flit-core` to 4.1.0
- [Changelog](https://github.com/pypa/flit/blob/main/doc/history.rst)
- [Commits](pypa/flit@4.0.2...4.1.0)

---
updated-dependencies:
- dependency-name: flit-core
  dependency-version: 4.1.0
  dependency-type: direct:development
  dependency-group: pip
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  dependency-group: pip
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/pip-ae2b83d5ba branch from db2263b to 2f8f9ab Compare October 26, 2026 06:38
@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/pip-ae2b83d5ba branch November 2, 2026 06:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code 🙈 no-regressions

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants