Skip to content

build(deps-dev): bump the dev-tools group across 1 directory with 7 updates - #141

Merged
miciav merged 1 commit into
mainfrom
dependabot/uv/dev-tools-580404609f
Sep 11, 2026
Merged

build(deps-dev): bump the dev-tools group across 1 directory with 7 updates#141
miciav merged 1 commit into
mainfrom
dependabot/uv/dev-tools-580404609f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-tools group with 7 updates in the / directory:

Package From To
pytest-cov 7.0.0 7.1.0
vulture 2.14 2.16
pytest 9.0.2 9.1.1
pre-commit 4.5.1 4.6.2
deptry 0.24.0 0.25.1
bandit 1.9.2 1.9.4
semgrep 1.154.0 1.176.1

Updates pytest-cov from 7.0.0 to 7.1.0

Changelog

Sourced from pytest-cov's changelog.

7.1.0 (2026-03-21)

  • Fixed total coverage computation to always be consistent, regardless of reporting settings. Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on reporting options. See [#641](https://github.com/pytest-dev/pytest-cov/issues/641) <https://github.com/pytest-dev/pytest-cov/issues/641>_.

  • Improve handling of ResourceWarning from sqlite3.

    The plugin adds warning filter for sqlite3 ResourceWarning unclosed database (since 6.2.0). It checks if there is already existing plugin for this message by comparing filter regular expression. When filter is specified on command line the message is escaped and does not match an expected message. A check for an escaped regular expression is added to handle this case.

    With this fix one can suppress ResourceWarning from sqlite3 from command line::

    pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...

  • Various improvements to documentation. Contributed by Art Pelling in [#718](https://github.com/pytest-dev/pytest-cov/issues/718) <https://github.com/pytest-dev/pytest-cov/pull/718>_ and "vivodi" in [#738](https://github.com/pytest-dev/pytest-cov/issues/738) <https://github.com/pytest-dev/pytest-cov/pull/738>. Also closed [#736](https://github.com/pytest-dev/pytest-cov/issues/736) <https://github.com/pytest-dev/pytest-cov/issues/736>.

  • Fixed some assertions in tests. Contributed by in Markéta Machová in [#722](https://github.com/pytest-dev/pytest-cov/issues/722) <https://github.com/pytest-dev/pytest-cov/pull/722>_.

  • Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

Commits
  • 66c8a52 Bump version: 7.0.0 → 7.1.0
  • f707662 Make the examples use pypy 3.11.
  • 6049a78 Make context test use the old ctracer (seems the new sysmon tracer behaves di...
  • 8ebf20b Update changelog.
  • 861d30e Remove the backup context manager - shouldn't be needed since coverage 5.0, ...
  • fd4c956 Pass the precision on the nulled total (seems that there's some caching goion...
  • 78c9c4e Only run the 3.9 on older deps.
  • 4849a92 Punctuation.
  • 197c35e Update changelog and hopefully I don't forget to publish release again :))
  • 14dc1c9 Update examples to use 3.11 and make the adhoc layout example look a bit more...
  • Additional commits viewable in compare view

Updates vulture from 2.14 to 2.16

Release notes

Sourced from vulture's releases.

v2.16

2.16 (2026-03-25)

  • Fix false positives for dead code after while loops (#412, #413, Jendrik Seipp).
  • Use ty instead of pytype for testing type annotations (Jendrik Seipp).

v2.15

2.15 (2026-03-04)

  • Handle while True loops without break statements (kreathon).
  • Add whitelist for ssl.SSLContext (tunnelsociety, #392).
  • Add more ruff rules (even-even).
  • Drop support for Python 3.8 (Jendrik Seipp, #398).
  • Add support for Python 3.14 (even-even).
Changelog

Sourced from vulture's changelog.

2.16 (2026-03-25)

  • Fix false positives for dead code after while loops (#412, #413, Jendrik Seipp).
  • Use ty instead of pytype for testing type annotations (Jendrik Seipp).

2.15 (2026-03-04)

  • Handle while True loops without break statements (kreathon).
  • Add whitelist for ssl.SSLContext (tunnelsociety, #392).
  • Add more ruff rules (even-even).
  • Drop support for Python 3.8 (Jendrik Seipp, #398).
  • Add support for Python 3.14 (even-even).
Commits
  • b0f67ba Update version number to 2.16 for release.
  • 41d6224 Update changelog.
  • 0462a5a Don't falsely report code after while loops as dead (fixes #412 and fixes #413).
  • 1eb212f Use ty instead of pytype for testing type annotations.
  • 6a4001f Update version number to 2.15 for release.
  • ef9e6de Fix release script.
  • 0649029 Add release date.
  • 01b9ff5 Add more ruff rules and fix warnings (#406)
  • 3d99061 Add tests for Python 3.14 (#404)
  • b11b7d4 Drop support for Python 3.8 (#399)
  • Additional commits viewable in compare view

Updates pytest from 9.0.2 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

  • #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
  • #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
  • #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
  • #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

  • #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

    If this is undesirable, move the fixture definition to a conftest.py file if possible.

    Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

  • #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

    See 10819 and 14011.

  • #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

    See dynamic-fixture-request-during-teardown for details.

  • #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

    These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

    See parametrize-iterators for details and suggestions.

  • #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

    See config-inicfg for more details.

  • #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits
  • cf470ec Prepare release version 9.1.1
  • e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
  • 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
  • 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
  • b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
  • 9a567e0 [automated] Update plugin list (#14617) (#14618)
  • ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
  • 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
  • 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
  • 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
  • Additional commits viewable in compare view

Updates pre-commit from 4.5.1 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

pre-commit v4.6.1

Fixes

pre-commit v4.6.0

Features

  • pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

4.6.1 - 2026-07-21

Fixes

4.6.0 - 2026-04-21

Features

  • pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.

Fixes

Commits
  • 9767b6c v4.6.2
  • 42ee3ff Merge pull request #3743 from pre-commit/npm-build-scripts-11-x
  • 3056619 fix language: node for hooks with build scripts and npm 11.x
  • 242ce8a v4.6.1
  • 766e550 Merge pull request #3727 from pre-commit/dedupe
  • 1558d06 Merge pull request #3726 from pre-commit/exists-faster
  • 8a1c47a avoid duplicate files in --all-files during conflict
  • 2e01c99 faster check of rev existing locally as a commit
  • 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
  • 1d811d9 Return an error for invalid --repo
  • Additional commits viewable in compare view

Updates deptry from 0.24.0 to 0.25.1

Release notes

Sourced from deptry's releases.

0.25.1

What's Changed

Release 0.25.0 was yanked in PyPI because of a failure during the release. 0.25.1 is identical, but includes a fix in the release process.

Full Changelog: osprey-oss/deptry@0.25.0...0.25.1

0.25.0

What's Changed

Repository moved to Osprey OSS

deptry has moved from fpgmaas/deptry to osprey-oss/deptry under the new Osprey OSS organisation. This ensures the project is not tied to a single account and makes it easier to manage contributors and access as the project grows.

Features

  • Support inline # deptry: ignore comments to suppress violations (#1473)
  • Support non-dev dependency groups with --non-dev-dependency-groups (#1440)
  • Use tomli on Python < 3.15 for TOML 1.1 support (#1446)
  • Add --optional-dependencies-dev-groups and deprecate --pep621-dev-dependency-groups (#1391)

Bug Fixes

  • Ensure that --config does not suppress output (#1390)

Full Changelog

osprey-oss/deptry@0.24.0...0.25.0

Changelog

Sourced from deptry's changelog.

0.25.1 - 2025-03-18

Release 0.25.0 was yanked in PyPI because of a failure during the release. 0.25.1 is identical, but includes a fix in the release process.

0.25.0 - 2025-03-18

Repository moved to Osprey OSS

deptry has moved from fpgmaas/deptry to osprey-oss/deptry under the new Osprey OSS organisation. This ensures the project is not tied to a single account and makes it easier to manage contributors and access as the project grows.

Features

  • Support inline # deptry: ignore comments to suppress violations (#1473)
  • Support non-dev dependency groups with --non-dev-dependency-groups (#1440)
  • Use tomli on Python < 3.15 for TOML 1.1 support (#1446)
  • Add --optional-dependencies-dev-groups and deprecate --pep621-dev-dependency-groups (#1391)

Bug Fixes

  • Ensure that --config does not suppress output (#1390)

Full Changelog

osprey-oss/deptry@0.24.0...0.25.0

Commits
  • 0c39226 Remove pinned maturin version for building windows wheels in release (#1516)
  • 501a929 chore(packaging): use PEP 639 license format (#1514)
  • 2d89cf4 Releasenotes for release 0.25.0 (#1510)
  • ef64f93 Replace all references of fpgmaas/deptry with osprey-oss/deptry (#1513)
  • fdec8c5 Add trusted publishing (#1512)
  • 2e27ae2 chore(deps): update uv-version to v0.10.10 (#1503)
  • 9d1f7d1 chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.15.6 (#1502)
  • 2a5a0a6 chore(deps): update dependency mkdocs-material to v9.7.5 (#1501)
  • 487f682 chore(deps): update dependency pnpm to v10.32.1 (#1506)
  • 608ba46 fix(deps): update ruff rust to v0.15.6 (#1504)
  • Additional commits viewable in compare view

Updates bandit from 1.9.2 to 1.9.4

Release notes

Sourced from bandit's releases.

1.9.4

What's Changed

New Contributors

Full Changelog: PyCQA/bandit@1.9.3...1.9.4

1.9.3

What's Changed

New Contributors

Full Changelog: PyCQA/bandit@1.9.2...1.9.3

Commits
  • 92ae8b8 Fix B106 reporting wrong line number on multiline function calls (#1360)
  • c8c8a55 Lower version guard in check_ast_node to Python 3.12 (#1355)
  • 8f2f928 Fix B615 false positive when revision is set via variable (#1358)
  • e27493f Include filename in nosec 'no failed test' warning (#1363)
  • b69b336 Fix B613 crash when reading from stdin (#1361)
  • e418b79 Bump docker/build-push-action from 6.18.0 to 6.19.2 (#1357)
  • ff646fd Bump docker/login-action from 3.6.0 to 3.7.0 (#1353)
  • c0def6c chore: fixed some typos in comments (#1351)
  • 765f00d Limit B614 to torch.load deserializers (#1348)
  • 06fbbab Bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#1347)
  • Additional commits viewable in compare view

Updates semgrep from 1.154.0 to 1.176.1

Release notes

Sourced from semgrep's releases.

Release v1.176.0

1.176.0 - 2026-09-01

### Changed

  • Homebrew installs of Semgrep are no longer supported on Intel Macs. (ENGINE-2951)

Release v1.175.0

1.175.0 - 2026-08-26

### Changed

  • Semgrep is now built with OCaml 5.4 instead of OCaml 5.3. End users should notice no change. (ocaml-5.4)

### Known Issues

  • Homebrew users on macOS Intel systems will experience errors when trying to install or update their Semgrep binary installation.
    • There is no impact on users on other platforms (i.e. ARM64) or using other distribution channels.
    • This is caused by the removal of macOS Intel bottles by Homebrew.
    • Semgrep thus no longer supports Homebrew for installing Semgrep on macOS Intel systems

Release v1.174.0

1.174.0 - 2026-08-20

### Added

  • Diff scans now report which dependency source files were added or modified relative to the merge base. (changed-dependency-sources)

### Changed

  • Partial scans (--x-partial-scan-rule-id) now resolve dependencies only for subprojects whose ecosystem is evaluated by the rules being run. Subprojects in any other ecosystem are skipped and reported to semgrep-app as skipped subprojects. (SC-3830)

Release v1.173.0

1.173.0 - 2026-08-12

### Added

  • semgrep-core -version now reports the git commit that the binary was built from. (core-version-git-sha)
  • Pro: Added a no_disk_cache memory policy (--x-mem-policy no_disk_cache) to trade higher memory usage for not caching intermediary scan data structures on disk. (no-disk-cache-memory-policy)

### Changed

  • File targeting now submits path-filtering work to worker domains in batches removing multithreaded synchronization overhead for very large repos. (ENGINE-2854)
  • Parallel rule parsing for large rulesets now shards rules into files sized by bytes rather than by worker count, stabilizing memory allocations at parse-time

... (truncated)

Changelog

Sourced from semgrep's changelog.

Changelog

1.176.0 - 2026-09-01

### Changed

  • Homebrew installs of Semgrep are no longer supported on Intel Macs. (ENGINE-2951)

1.175.1 - 2026-09-03

### Fixed

  • Fixed scans run with --trace that would fail with Stdlib.Effect.Unhandled(Eio__core__Cancel.Get_context) when a secret would fail to validate (CODE-9906)

1.175.0 - 2026-08-26

### Changed

  • Semgrep is now built with OCaml 5.4 instead of OCaml 5.3. End users should notice no change. (ocaml-5.4)

1.174.0 - 2026-08-20

### Added

  • Diff scans now report which dependency source files were added or modified relative to the merge base. (changed-dependency-sources)

### Changed

  • Partial scans (--x-partial-scan-rule-id) now resolve dependencies only for subprojects whose ecosystem is evaluated by the rules being run. Subprojects in any other ecosystem are skipped and reported to semgrep-app as skipped subprojects. (SC-3830)

1.173.0 - 2026-08-12

### Added

  • semgrep-core -version now reports the git commit that the binary was built from. (core-version-git-sha)
  • Pro: Added a no_disk_cache memory policy (--x-mem-policy no_disk_cache) to trade higher memory usage for not caching intermediary scan data structures on disk. (no-disk-cache-memory-policy)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the dev-tools group across 1 directory with 7 u…
c5470de 
…pdates

Bumps the dev-tools group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pytest-cov](https://github.com/pytest-dev/pytest-cov) | `7.0.0` | `7.1.0` |
| [vulture](https://github.com/jendrikseipp/vulture) | `2.14` | `2.16` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.2` | `9.1.1` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.5.1` | `4.6.2` |
| [deptry](https://github.com/osprey-oss/deptry) | `0.24.0` | `0.25.1` |
| [bandit](https://github.com/PyCQA/bandit) | `1.9.2` | `1.9.4` |
| [semgrep](https://github.com/semgrep/semgrep) | `1.154.0` | `1.176.1` |



Updates `pytest-cov` from 7.0.0 to 7.1.0
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v7.0.0...v7.1.0)

Updates `vulture` from 2.14 to 2.16
- [Release notes](https://github.com/jendrikseipp/vulture/releases)
- [Changelog](https://github.com/jendrikseipp/vulture/blob/main/CHANGELOG.md)
- [Commits](jendrikseipp/vulture@v2.14...v2.16)

Updates `pytest` from 9.0.2 to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.2...9.1.1)

Updates `pre-commit` from 4.5.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.5.1...v4.6.2)

Updates `deptry` from 0.24.0 to 0.25.1
- [Release notes](https://github.com/osprey-oss/deptry/releases)
- [Changelog](https://github.com/osprey-oss/deptry/blob/main/CHANGELOG.md)
- [Commits](osprey-oss/deptry@0.24.0...0.25.1)

Updates `bandit` from 1.9.2 to 1.9.4
- [Release notes](https://github.com/PyCQA/bandit/releases)
- [Commits](PyCQA/bandit@1.9.2...1.9.4)

Updates `semgrep` from 1.154.0 to 1.176.1
- [Release notes](https://github.com/semgrep/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/semgrep/semgrep/commits)

---
updated-dependencies:
- dependency-name: pytest-cov
  dependency-version: 7.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tools
- dependency-name: vulture
  dependency-version: '2.16'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tools
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tools
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tools
- dependency-name: deptry
  dependency-version: 0.25.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tools
- dependency-name: bandit
  dependency-version: 1.9.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-tools
- dependency-name: semgrep
  dependency-version: 1.176.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tools
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 11, 2026
@miciav
miciav merged commit bbb2d4b into main Sep 11, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/dev-tools-580404609f branch September 11, 2026 16:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@miciav