Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 20 updates - #107

Merged
JonZeolla merged 3 commits into
mainfrom
dependabot/uv/production-dependencies-db03929e92
Sep 21, 2026
Merged

chore(deps): bump the production-dependencies group across 1 directory with 20 updates#107
JonZeolla merged 3 commits into
mainfrom
dependabot/uv/production-dependencies-db03929e92

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 20 updates in the / directory:

Package From To
annotated-types 0.7.0 0.8.0
ast-serialize 0.6.0 0.11.2
certifi 2026.6.17 2026.7.22
charset-normalizer 3.4.7 3.5.1
filelock 3.29.5 3.32.7
idna 3.18 3.20
librt 0.12.0 0.15.0
mypy 2.1.0 2.3.1
packaging 26.2 26.3
platformdirs 4.10.0 4.11.10
pydantic 2.13.4 2.13.5
pydantic-core 2.46.4 2.46.5
pygments 2.20.0 2.21.0
python-discovery 1.4.3 1.6.1
python-slugify 8.0.4 9.0.0
typing-inspection 0.4.2 0.4.4
tzdata 2026.2 2026.4
urllib3 2.7.0 2.8.0
virtualenv 21.5.1 21.7.14
wrapt 2.2.2 2.4.1

Updates annotated-types from 0.7.0 to 0.8.0

Release notes

Sourced from annotated-types's releases.

v0.8.0

What's Changed

New Contributors

Full Changelog: annotated-types/annotated-types@v0.7.0...v0.8.0

Commits

Updates ast-serialize from 0.6.0 to 0.11.2

Commits

Updates certifi from 2026.6.17 to 2026.7.22

Commits

Updates charset-normalizer from 3.4.7 to 3.5.1

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.1

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

  • Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

Version 3.4.8

3.4.8 (2026-07-06)

Fixed

... (truncated)

Changelog

Sourced from charset-normalizer's changelog.

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

3.4.9 (2026-07-07)

Fixed

  • Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

3.4.8 (2026-07-06)

Fixed

  • Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
  • Unnecessary json import at runtime (#753)
  • Inverse capitalization not seen by noise detector (#731)

... (truncated)

Commits
  • e239bdc Merge pull request #795 from jawah/release-3.5.1
  • 648ad77 docs: update faq
  • fab2749 docs: write changelog for 3.5.1
  • 7d32774 chore: bump version to 3.5.1
  • 9a69f60 docs: update data/info
  • 5dcc6dd perf: charinfo cache access optimization in cython
  • ea3b447 fix: do not validate-decode large payload when md says it's noise
  • a05917f chore: allow setuptools 84 builds (#794)
  • 3325d87 Merge pull request #792 from jawah/update-cibuildwheel-action
  • 77203b1 chore: reformat noxfile.py
  • Additional commits viewable in compare view

Updates filelock from 3.29.5 to 3.32.7

Release notes

Sourced from filelock's releases.

3.32.7

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.6...3.32.7

3.32.6

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.5...3.32.6

3.32.5

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.4...3.32.5

3.32.4

What's Changed

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.0.1 (2026-09-19)

  • poll_interval is now validated at construction, on the setter, and on acquire(): a negative, non-finite, or non-numeric value raises :class:ValueError/:class:TypeError immediately instead of failing inside time.sleep. :pr:739

4.0.0 (2026-09-17)

  • The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state, .write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:~filelock.StrictSoftFileLock, so a runtime without os.link raises :class:~filelock.SoftFileLockProtocolError on acquire. Constructing a singleton again with a different on_compromise, or with poll_interval at or above stale_threshold, now raises :class:ValueError. :pr:735
  • :class:~filelock.SoftReadWriteLock exposes :attr:~filelock.SoftReadWriteLock.generation as a fencing token for the protected resource and reports a lost hold through on_compromise and :attr:~filelock.SoftReadWriteLock.compromise. :pr:735
  • :class:~filelock.SoftReadWriteLock no longer deadlocks when a holder dies on another host mid-transition, and release() no longer waits on a mutex a dead host left behind (:pr:725, :pr:735). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an mtime read against another host's. :pr:735

3.32.7 (2026-09-16)

  • Validate final-symlink refusal by error number so the test works across libc implementations. :pr:737
  • Document that :meth:~filelock.BaseFileLock.acquire reads blocking=None as the lock's blocking attribute and raises :class:~filelock.Timeout after one attempt when blocking=False. :pr:733

3.32.6 (2026-09-08)

  • SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
  • Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724

... (truncated)

Commits
  • 20929f7 Release 3.32.7
  • 35f07c4 [pre-commit.ci] pre-commit autoupdate (#736)
  • e860d39 📝 docs: say acquire() falls back to the lock's blocking attribute (#733)
  • c530efe Fix final symlink test on musl (#737)
  • 4efd93e Release 3.32.6
  • 7b7b7a8 Fix SoftReadWriteLock state lock timeout (#726)
  • f2f7b86 fix: respect ACL write access when the owner write bit is absent (#728)
  • e947a69 test(soft-rw): reuse existing test module (#730)
  • da3ae2b fix: preserve exception notes when copying and pickling (#729)
  • ae9cb5b 🐛 fix(soft-rw): reject non-finite timing options (#724)
  • Additional commits viewable in compare view

Updates idna from 3.18 to 3.20

Release notes

Sourced from idna's releases.

v3.20

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.

v3.19

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.

3.19 (2026-08-18)

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits
  • d55e65e Release 3.20
  • 0c0824a Pre-release 3.20rc0
  • bd7c316 Note Python 3.15 support in the 3.20 changelog
  • b6cce85 Merge pull request #276 from kjd/unicode-18
  • 9a4bc59 Update to Unicode 18.0.0
  • dfab5a0 Merge branch 'python-3.15'
  • 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
  • cd17392 Merge pull request #274 from kjd/fix-decode-length-check
  • c5796d7 Skip the decode round-trip check for domains past encode's length limit
  • d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
  • Additional commits viewable in compare view

Updates librt from 0.12.0 to 0.15.0

Commits

Updates mypy from 2.1.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits
  • d642c44 Bump version to 2.3.1
  • a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
  • 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
  • 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
  • 6dfa06d Fix crash when unpacking return value from overload (#21830)
  • a385746 Bump version to 2.3.1+dev
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

    

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() &lt;packaging.specifiers.SpecifierSet.to_range&gt;,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
    • 

  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
    • 

  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
    • 

  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
    • 

  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
    • 

  • Add :meth:SpecifierSet.is_subset() &lt;packaging.specifiers.SpecifierSet.is_subset&gt;, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
    • 



Behavior adaptations:


    

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
    • 

  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
    • 



Fixes for versions and specifiers:


    

  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
    • 

  • Raise InvalidVersion for non-string pre-release letters passed to
    
Version.from_parts. (:pull:1241)
    • 

  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
    • 

  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
    • 



Fixes for requirements and markers:


    

  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    
foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates platformdirs from 4.10.0 to 4.11.10

Release notes

Sourced from platformdirs's releases.

4.11.10

What's Changed

Full Changelog: tox-dev/platformdirs@4.11.9...4.11.10

4.11.9

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.11.8...4.11.9

4.11.8

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.11.7...4.11.8

4.11.7

Full Changelog: tox-dev/platformdirs@4.11.6...4.11.7

4.11.6

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.11 (2026-09-19)

  • Reject appname, appauthor and version values that leave the platform base directory (a .. segment, a leading separator, a drive or a UNC share) with ValueError, so ensure_exists cannot create directories outside it - by :user:Pitchfork-and-Torch. :pr:552

4.11....

Description has been truncated

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
fde4350 
…y with 20 updates

Bumps the production-dependencies group with 20 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [annotated-types](https://github.com/annotated-types/annotated-types) | `0.7.0` | `0.8.0` |
| [ast-serialize](https://github.com/mypyc/ast_serialize) | `0.6.0` | `0.11.2` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.6.17` | `2026.7.22` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.7` | `3.5.1` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.29.5` | `3.32.7` |
| [idna](https://github.com/kjd/idna) | `3.18` | `3.20` |
| [librt](https://github.com/mypyc/librt) | `0.12.0` | `0.15.0` |
| [mypy](https://github.com/python/mypy) | `2.1.0` | `2.3.1` |
| [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.10.0` | `4.11.10` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.4` | `2.46.5` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |
| [python-discovery](https://github.com/tox-dev/python-discovery) | `1.4.3` | `1.6.1` |
| [python-slugify](https://github.com/un33k/python-slugify) | `8.0.4` | `9.0.0` |
| [typing-inspection](https://github.com/pydantic/typing-inspection) | `0.4.2` | `0.4.4` |
| [tzdata](https://github.com/python/tzdata) | `2026.2` | `2026.4` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.7.0` | `2.8.0` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.5.1` | `21.7.14` |
| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `2.2.2` | `2.4.1` |



Updates `annotated-types` from 0.7.0 to 0.8.0
- [Release notes](https://github.com/annotated-types/annotated-types/releases)
- [Commits](annotated-types/annotated-types@v0.7.0...v0.8.0)

Updates `ast-serialize` from 0.6.0 to 0.11.2
- [Commits](mypyc/ast_serialize@v0.6.0...v0.11.2)

Updates `certifi` from 2026.6.17 to 2026.7.22
- [Commits](certifi/python-certifi@2026.06.17...2026.07.22)

Updates `charset-normalizer` from 3.4.7 to 3.5.1
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.7...3.5.1)

Updates `filelock` from 3.29.5 to 3.32.7
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.29.5...3.32.7)

Updates `idna` from 3.18 to 3.20
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.20)

Updates `librt` from 0.12.0 to 0.15.0
- [Commits](mypyc/librt@v0.12.0...v0.15.0)

Updates `mypy` from 2.1.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.1.0...v2.3.1)

Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.2...26.3)

Updates `platformdirs` from 4.10.0 to 4.11.10
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.10.0...4.11.10)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `pydantic-core` from 2.46.4 to 2.46.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@core-v2.46.4...core-v2.46.5)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

Updates `python-discovery` from 1.4.3 to 1.6.1
- [Release notes](https://github.com/tox-dev/python-discovery/releases)
- [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst)
- [Commits](tox-dev/python-discovery@1.4.3...1.6.1)

Updates `python-slugify` from 8.0.4 to 9.0.0
- [Release notes](https://github.com/un33k/python-slugify/releases)
- [Changelog](https://github.com/un33k/python-slugify/blob/master/CHANGELOG.md)
- [Commits](un33k/python-slugify@v8.0.4...v9.0.0)

Updates `typing-inspection` from 0.4.2 to 0.4.4
- [Release notes](https://github.com/pydantic/typing-inspection/releases)
- [Changelog](https://github.com/pydantic/typing-inspection/blob/main/HISTORY.md)
- [Commits](pydantic/typing-inspection@v0.4.2...v0.4.4)

Updates `tzdata` from 2026.2 to 2026.4
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.2...2026.4)

Updates `urllib3` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.7.0...2.8.0)

Updates `virtualenv` from 21.5.1 to 21.7.14
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.5.1...21.7.14)

Updates `wrapt` from 2.2.2 to 2.4.1
- [Release notes](https://github.com/GrahamDumpleton/wrapt/releases)
- [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst)
- [Commits](GrahamDumpleton/wrapt@2.2.2...2.4.1)

---
updated-dependencies:
- dependency-name: annotated-types
  dependency-version: 0.8.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ast-serialize
  dependency-version: 0.11.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: charset-normalizer
  dependency-version: 3.5.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: filelock
  dependency-version: 3.32.7
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: idna
  dependency-version: '3.20'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: librt
  dependency-version: 0.15.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mypy
  dependency-version: 2.3.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: platformdirs
  dependency-version: 4.11.10
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: pydantic-core
  dependency-version: 2.46.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: python-discovery
  dependency-version: 1.6.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: python-slugify
  dependency-version: 9.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: typing-inspection
  dependency-version: 0.4.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: tzdata
  dependency-version: '2026.4'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: virtualenv
  dependency-version: 21.7.14
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: wrapt
  dependency-version: 2.4.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: jonzeolla. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from JonZeolla as a code owner September 21, 2026 08:12
ai-coding-guardrails[bot]
ai-coding-guardrails Bot reviewed Sep 21, 2026
View reviewed changes

@ai-coding-guardrails ai-coding-guardrails Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work! 😎

I didn't find anything of concern

Risk: 🟢 Low

Think our bots are missing some context? Add custom requirements or guardrails in our management console

@ai-coding-guardrails ai-coding-guardrails Bot added the zenable/risk:low Zenable assessed this PR as LOW risk. label Sep 21, 2026
JonZeolla and others added 2 commits September 21, 2026 07:15
@JonZeolla @claude
ci(windows): drop removed --quiet flag from Docker install script
3aabc5d 
get.docker.com no longer accepts --quiet, which broke the WSL Docker setup
in the Windows smoke test. Redirect stdout instead.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@JonZeolla @claude
docs(dockerhub): fix dead OIDC connection link
5a7ed53 
Docker moved the create-manage page; link to the OIDC connections
landing page instead.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@JonZeolla
JonZeolla merged commit fdd72a6 into main Sep 21, 2026
7 checks passed
@JonZeolla
JonZeolla deleted the dependabot/uv/production-dependencies-db03929e92 branch September 21, 2026 12:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ai-coding-guardrails ai-coding-guardrails[bot] ai-coding-guardrails[bot] left review comments
@JonZeolla JonZeolla Awaiting requested review from JonZeolla JonZeolla is a code owner

Assignees

@JonZeolla JonZeolla

Labels

zenable/risk:low Zenable assessed this PR as LOW risk.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JonZeolla