chore(deps): Bump the python-dependencies group with 18 updates

[dependabot]

Bumps the python-dependencies group with 18 updates:

Package	From	To
uvicorn	0.52.4	0.53.0
sqlalchemy	2.0.52	2.0.53
pypdf	6.18.0	6.18.1
pyjwt	2.13.0	2.14.0
filelock	3.32.5	3.32.6
anthropic	1.4.0	1.6.0
psycopg2-binary	2.9.12	2.9.13
ruff	0.16.6	0.16.7
ast-serialize	0.11.0	0.11.2
boto3	1.43.89	1.43.94
botocore	1.43.89	1.43.94
coverage	7.16.0	7.16.1
greenlet	3.5.5	3.5.6
httpcore2	2.12.0	2.13.0
httpx2	2.12.0	2.13.0
jiter	0.16.0	0.17.0
pydantic-core	2.46.5	2.49.0
wrapt	2.4.0	2.4.1

Updates uvicorn from 0.52.4 to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

Commits

• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• 098b206 Remove timing race from SIGHUP supervisor test (#3127)
• 968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
• 7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
• fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
• fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.52 to 2.0.53

Release notes

Sourced from sqlalchemy's releases.

2.0.53

Released: September 14, 2026

orm

• [orm] [bug] Fixed issue where an expression passed to _orm.with_expression() that embedded a _sql.select(), such as a correlated _sql.exists(), would fail to populate the attribute correctly on the second and subsequent executions of an otherwise identical statement, when the _orm.query_expression() attribute was loaded by a relationship loader that emits a second query, i.e. _orm.selectinload(), _orm.lazyload() or _orm.immediateload().

  References: #13560

• [orm] [bug] Fixed memory issue where mapped classes, along with their Table and _orm.Mapper objects, would not be garbage collected after the _orm.registry in which they were mapped had been disposed and dereferenced. The issue would occur for mappings that made use of _orm.relationship() together with constructs such as an Index established against an ORM-annotated expression.

  References: #13566

• [orm] [bug] Fixed issue where pickling an ORM object that had an instance level lazy loader established, such as when the _orm.raiseload() option is used, would emit a spurious warning regarding the loader containing additional criteria, if the object had itself been unpickled from a previous serialization. This would occur for objects that cross more than one serialization boundary, such as when using multiprocessing.

  References: #13574

• [orm] [bug] Fixed issue where calling _orm.aliased() against an existing _orm.aliased() construct, without passing an explicit selectable, would disregard the selectable of the existing construct and produce an alias of the mapped table instead, if that selectable were anything other than a table or a plain subquery, leading to incorrect results and/or non-working queries.

  This includes _orm.aliased() against a _orm.with_polymorphic() construct, which would previously produce an alias of the base mapped class only, discarding the polymorphic selectable and additional mappers. The new construct now retains these, so that criteria against subclass attributes and the innerjoin and selectable parameters of _orm.with_polymorphic() take effect, and subclass columns are loaded up front. The SQL rendered for these constructs now includes the

... (truncated)

Commits

• See full diff in compare view

Updates pypdf from 6.18.0 to 6.18.1

Release notes

Sourced from pypdf's releases.

Version 6.18.1, 2026-09-11

What's new

Security (SEC)

• Further restrict FlateDecode recovery (#4073) by @​stefan6419846
• Limit entry count for TrueType and Type1 font /Widths (#4072) by @​stefan6419846
• Limit allowed length of tokens in parse_bfchar (#4071) by @​stefan6419846

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#4062) by @​r-kamei
• Repeat the letter for /S /A and /S /a page labels past Z (#4065) by @​youdie006
• Use font color for FreeText default appearance (#4051) by @​Yuki9814

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#4050, #4059) by @​MeggyCal and @​stefan6419846

Documentation (DOC)

• Use combined matrix in visitor examples (#4066) by @​r-kamei

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.18.1, 2026-09-11

Security (SEC)

• Further restrict FlateDecode recovery (#4073)
• Limit entry count for TrueType and Type1 font /Widths (#4072)
• Limit allowed length of tokens in parse_bfchar (#4071)

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#4062)
• Repeat the letter for /S /A and /S /a page labels past Z (#4065)
• Use font color for FreeText default appearance (#4051)

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#4050, #4059)

Documentation (DOC)

• Use combined matrix in visitor examples (#4066)

Full Changelog

Commits

• caf8cde REL: 6.18.1
• d9d38cf SEC: Further restrict FlateDecode recovery (#4073)
• 0fb26eb SEC: Limit entry count for TrueType and Type1 font /Widths (#4072)
• 319d0b8 SEC: Limit allowed length of tokens in parse_bfchar (#4071)
• 735d284 BUG: Use current text matrix for visitor_text (#4062)
• 808a318 DOC: Use combined matrix in visitor examples (#4066)
• c38feda BUG: Repeat the letter for /S /A and /S /a page labels past Z (#4065)
• 3f7bc19 ROB: Do not crash when the XFA entry is not a well-formed array (#4064)
• d80ccfc ROB: Fix compatibility for fonttools < 4.57.0 (#4050)
• 7bb71dd ROB: Do not crash when the font encoding differences are not an array (#4058)
• Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt's releases.

PyJWT 2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security

- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.
Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
Fixed



Raise the documented PyJWTError subclass instead of leaking a

TypeError when the exp, nbf, or iat claim decodes to a

non-numeric, non-string value such as a list, dict, or null.

Commits

• c6fe464 release: prepare v2.14.0
• f541302 style: apply Ruff formatting
• 801cd12 fix: reject public JWK container HMAC keys
• af8181c fix: reject empty HMAC keys from JWKs
• ba4853a Throttle repeated PyJWKClient refreshes
• 2798504 fix: reject DER public keys as HMAC secrets
• 8b4e233 fix: reject loader-accepted PEM variants
• 1f8180a fix: format JWS tests
• cff1ac5 Fix redirect handler return annotation
• 0a795b8 Reject redirects in PyJWKClient fetches
• Additional commits viewable in compare view

Updates filelock from 3.32.5 to 3.32.6

Release notes

Sourced from filelock's releases.

3.32.6

What's Changed

• 🐛 fix(lease): reject a duration no marker can carry by @​lprnmns in tox-dev/filelock#723
• 🐛 fix(soft-rw): reject non-finite timing options by @​lprnmns in tox-dev/filelock#724
• fix: preserve exception notes when copying and pickling by @​jackwalkerlabs in tox-dev/filelock#729
• test(soft-rw): reuse existing test module by @​gaborbernat in tox-dev/filelock#730
• fix: respect ACL write access when the owner write bit is absent by @​jackwalkerlabs in tox-dev/filelock#728
• Fix SoftReadWriteLock state lock timeout by @​Sohel2309 in tox-dev/filelock#726

New Contributors

• @​jackwalkerlabs made their first contribution in tox-dev/filelock#729
• @​Sohel2309 made their first contribution in tox-dev/filelock#726

Full Changelog: tox-dev/filelock@3.32.5...3.32.6

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.0.0 (2026-09-17)

---

• The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state, .write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:~filelock.StrictSoftFileLock, so a runtime without os.link raises :class:~filelock.SoftFileLockProtocolError on acquire. Constructing a singleton again with a different on_compromise, or with poll_interval at or above stale_threshold, now raises :class:ValueError. :pr:735
• :class:~filelock.SoftReadWriteLock exposes :attr:~filelock.SoftReadWriteLock.generation as a fencing token for the protected resource and reports a lost hold through on_compromise and :attr:~filelock.SoftReadWriteLock.compromise. :pr:735
• :class:~filelock.SoftReadWriteLock no longer deadlocks when a holder dies on another host mid-transition, and release() no longer waits on a mutex a dead host left behind (:pr:725, :pr:735). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an mtime read against another host's. :pr:735

---

3.32.7 (2026-09-16)

---

• Validate final-symlink refusal by error number so the test works across libc implementations. :pr:737
• Document that :meth:~filelock.BaseFileLock.acquire reads blocking=None as the lock's blocking attribute and raises :class:~filelock.Timeout after one attempt when blocking=False. :pr:733

---

3.32.6 (2026-09-08)

---

• SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
• Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724
• Honor acquisition timeouts and blocking=False during SoftReadWriteLock state-mutex contention, including failed writer cleanup. Cross-host recovery of an abandoned .state marker remains unsupported. :pr:726
• Allow acquiring existing lock files that grant write access through group permissions or an ACL even when their owner-write mode bit is unset. :pr:728
• Preserve exception notes and custom attributes when copying or pickling Timeout and SoftFileLockProtocolError. :pr:729

---

... (truncated)

Commits

• 4efd93e Release 3.32.6
• 7b7b7a8 Fix SoftReadWriteLock state lock timeout (#726)
• f2f7b86 fix: respect ACL write access when the owner write bit is absent (#728)
• e947a69 test(soft-rw): reuse existing test module (#730)
• da3ae2b fix: preserve exception notes when copying and pickling (#729)
• ae9cb5b 🐛 fix(soft-rw): reject non-finite timing options (#724)
• d00f9bb [pre-commit.ci] pre-commit autoupdate (#727)
• 82f66d7 🐛 fix(lease): reject a duration no marker can carry (#723)
• 1d9e9e7 [pre-commit.ci] pre-commit autoupdate (#722)
• See full diff in compare view

Updates anthropic from 1.4.0 to 1.6.0

Release notes

Sourced from anthropic's releases.

v1.6.0

1.6.0 (2026-09-15)

Full Changelog: v1.5.0...v1.6.0

Features

• api: add auto mode tool permissions for Managed Agents (909d92f)
• api: add compaction parameter and signed compaction blocks (beta) (8689179)
• api: add enum types for workspace data-residency geo fields (3dc6dbf)
• api: add thinking_mismatch_allowed entries to input_transformations (beta) (14d1792)
• api: add url_sources to the web fetch tool (4ba7115)
• api: add workspace_id parameter to user profiles methods (1c359b2)
• client: support async credential token providers (95e93f7)

Bug Fixes

• api: mark usage iteration model as nullable (520d000)
• api: use one input transformation type for message and delta event (ae86d7d)
• client: honor Retry-After values above 60 seconds (2d03ba2)
• client: ignore invalid Retry-After values and validate maxRetries (909d92f)
• client: retry connection errors in the async client and stop blocking in the coroutine retry loop (909d92f)
• client: use the default backoff when Retry-After is out of range (3d15f04)

Chores

• deps: bump aiohttp, pygments and pytest in the dev lockfile (005ad11)
• deps: require anyio 4.1 or later (79b4175)
• docs: clarify that session_thread_id on tool use events is informational (2ac7b60)
• docs: correct the compaction beta's parameter descriptions (5048c9a)
• internal: sort the imports in beta_message.py (0a92f91)
• tests: define the model tests' type alias at module level (98c3a7a)
• tests: stop the mock server without failing a passing test run (d28aea7)

Documentation

• api: clarify usage.iterations entry typing under server-side fallback (bb06629)
• stop documenting unions with their first variant's description (7a94250)
• use markdown formatting in most docstrings (25f344f)

v1.5.0

1.5.0 (2026-09-10)

Full Changelog: v1.4.0...v1.5.0

Features

... (truncated)

Changelog

Sourced from anthropic's changelog.

1.6.0 (2026-09-15)

Full Changelog: v1.5.0...v1.6.0

Features

• api: add auto mode tool permissions for Managed Agents (909d92f)
• api: add compaction parameter and signed compaction blocks (beta) (8689179)
• api: add enum types for workspace data-residency geo fields (3dc6dbf)
• api: add thinking_mismatch_allowed entries to input_transformations (beta) (14d1792)
• api: add url_sources to the web fetch tool (4ba7115)
• api: add workspace_id parameter to user profiles methods (1c359b2)
• client: support async credential token providers (95e93f7)

Bug Fixes

• api: mark usage iteration model as nullable (520d000)
• api: use one input transformation type for message and delta event (ae86d7d)
• client: honor Retry-After values above 60 seconds (2d03ba2)
• client: ignore invalid Retry-After values and validate maxRetries (909d92f)
• client: retry connection errors in the async client and stop blocking in the coroutine retry loop (909d92f)
• client: use the default backoff when Retry-After is out of range (3d15f04)

Chores

• deps: bump aiohttp, pygments and pytest in the dev lockfile (005ad11)
• deps: require anyio 4.1 or later (79b4175)
• docs: clarify that session_thread_id on tool use events is informational (2ac7b60)
• docs: correct the compaction beta's parameter descriptions (5048c9a)
• internal: sort the imports in beta_message.py (0a92f91)
• tests: define the model tests' type alias at module level (98c3a7a)
• tests: stop the mock server without failing a passing test run (d28aea7)

Documentation

• api: clarify usage.iterations entry typing under server-side fallback (bb06629)
• stop documenting unions with their first variant's description (7a94250)
• use markdown formatting in most docstrings (25f344f)

1.5.0 (2026-09-10)

Full Changelog: v1.4.0...v1.5.0

Features

• api: add auto mode tool permissions for Managed Agents (62aa21b)
• api: add content_too_large web_fetch tool error code (4b5dec6)

... (truncated)

Commits

• 7e5ca5c Merge pull request #1937 from anthropics/release-please--branches--main--chan...
• b93968b release: 1.6.0
• 5048c9a chore(docs): correct the compaction beta's parameter descriptions
• 98c3a7a chore(tests): define the model tests' type alias at module level
• 8689179 feat(api): add compaction parameter and signed compaction blocks (beta)
• ae86d7d fix(api): use one input transformation type for message and delta event
• 0a92f91 chore(internal): sort the imports in beta_message.py
• 4ba7115 feat(api): add url_sources to the web fetch tool
• d28aea7 chore(tests): stop the mock server without failing a passing test run
• 14d1792 feat(api): add thinking_mismatch_allowed entries to input_transformations (beta)
• Additional commits viewable in compare view

Updates psycopg2-binary from 2.9.12 to 2.9.13

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
• Fix parsing of malformed bytea input.
• Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
• Add a pyproject.toml file to declare a PEP 517 build backend (:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
• Drop support for Python 3.9.

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.14.
• Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
• Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
• Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.13.
• Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
• Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8

... (truncated)

Commits

• f650e7a chore: bump to release 2.9.13
• 368c8a1 chore!: drop support for Python 3.9
• 9b39e65 chore: drop scaleway build support
• 2ca7041 fix: fix handling of PostgreSQL 18 exceptions
• 5385c02 Build CPython 3.15 wheels
• 1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
• 433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
• 8fb80bc fix: fix parsing of malformed int64 input in arrays
• f98014a fix: fix parsing of malformed bytea input
• 822b79c chore: bump dependencies in binary package
• Additional commits viewable in compare view

Updates ruff from 0.16.6 to 0.16.7

Release notes

Sourced from ruff's releases.

0.16.7

Release Notes

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.7

Released on 2026-09-10.

Preview features

• [ruff] Add rule for default values on method receivers (RUF077) (#26700)
• [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

• Alternate nested quotes inside format spec interpolations (#28259)
• [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
• [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
• [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

• Correct D211 and D203 rule conflict diagnostic (#28444)
• Recognize slice and frozendict generics (#28477)
• Stop defining __cached__ for Python 3.15 (#28476)
• [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

• Reuse parser name lookups when interning (#28399)
• Speed up inherited configuration resolution (#28299)

Documentation

• Fix line-length path in --config example (#28392)
• Remove the "Who’s Using Ruff?" list (#28455)

Other changes

• Embed archive checksums in the shell installer (#28281)

Contributors

• @​The-Compiler
• @​mdiniz97
• @​zsol
• @​gorewilliams
• @​RafaelJohn9
• @​qatcod
• @​zanieb
• @​MichaReiser
• @​ntBre
• @​charliermarsh
• @​nightt5879

... (truncated)

Commits

• b5dba86 Bump version to 0.16.7 (#28496)
• 5992d05 Install rustfmt before linting releases (#28495)
• 1713a1f ensure prepare release changes pass prek (#28488)
• 18cdbb4 use scoped token for release workflow (#28484)
• c3813a5 add a workflow for preparing releases (#28486)
• 00948c0 Remove the "Who’s Using Ruff?" list (#28455)
• 86a2eba [pyupgrade] Stop recommending removed typing.no_type_check_decorator (`UP...
• 609e184 Stop defining __cached__ for Python 3.15 (#28476)
• 859ff2f [ty] Track symlinked directory status in listings (#28482)
• 77f6538 Use paid GitHub-hosted runners for Linux (#28478)
• Additional commits viewable in compare view

Updates ast-serialize from 0.11.0 to 0.11.2

Commits

• f508fe5 Bump version to 0.11.2
• 8642c86 Fix edge case in Literal type handling (#92)
• 3039f8b Serialize flag for lazy imports (#91)
• e667a2b Bump version to 0.11.1
• 30e8c5f Simple-minded universal newline normalization (#90)
• See full diff in compare view

Updates boto3 from 1.43.89 to 1.43.94

Commits

• ec50e6e Merge branch 'release-1.43.94'
• e18db43 Bumping version to 1.43.94
• a500f54 Add changelog entries from botocore
• 655751c Merge branch 'release-1.43.93'
• 373c958 Merge branch 'release-1.43.93' into develop
• e522bfd Bumping version to 1.43.93
• 9c7d4c3 Add changelog entries from botocore
• 4477cdc Merge branch 'release-1.43.92'
• a465bee Merge branch 'release-1.43.92' into develop
• 5d8a8ab Bumping version to 1.43.92
• Additional commits viewable in compare view

Updates botocore from 1.43.89 to 1.43.94

Commits

• 7b8c332 Merge branch 'release-1.43.94'
• c4231df Bumping version to 1.43.94
• ac6bd2c Update endpoints model
• c17abeb Update to latest models
• 45d6074 Merge branch 'release-1.43.93'
• aeb03fc Merge branch 'release-1.43.93' into develop
• 6022491 Bumping version to 1.43.93
• 37d756e Update endpoints model
• e06d9fb Update to latest models
• 262e5e6 Preserve sub-second precision when serializing unixTimestamp parameters (#3796)
• Additional commits viewable in compare view

Updates coverage from 7.16.0 to 7.16.1

Release notes

Sourced from coverage's releases.

7.16.1

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
• Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

Changelog

Sourced from coverage's changelog.

Version 7.16.1 — 2026-09-13

• Fix: when the body...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.