Skip to content

chore(deps): bump the python-minor-patch group across 1 directory with 8 updates - #37

Merged
acroca merged 1 commit into
mainfrom
dependabot/uv/assistant/python-minor-patch-378d0ad48d
Oct 27, 2026
Merged

chore(deps): bump the python-minor-patch group across 1 directory with 8 updates#37
acroca merged 1 commit into
mainfrom
dependabot/uv/assistant/python-minor-patch-378d0ad48d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 8 updates in the /assistant directory:

Package From To
aiohttp 3.14.3 3.14.5
pydantic 2.13.5 2.14.1
pydantic-settings 2.15.0 2.16.1
trafilatura 2.2.0 2.3.1
watchfiles 1.2.0 1.3.0
pypdf 6.18.0 6.21.2
pypdfium2 5.13.0 5.14.0
ruff 0.16.7 0.17.2

Updates aiohttp from 3.14.3 to 3.14.5
Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

  • Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
  • Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

... (truncated)

Commits
  • b2212c7 Prepare release v2.14.1
  • 968fb2b Fix docs conversion table
  • 6adc8b3 Support named tuples in Sequence validation
  • 7637fbc Reject out-of-range int inputs for timedelta
  • dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
  • e2456d3 Support closed and extra_items via inheritance in TypedDict
  • 317655d Harden CI security
  • 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
  • 43681ab Bump samuelcolvin/check-python-version action to v5.1
  • d6bc53a Avoid unnecessary extra dict allocation in model validation
  • Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.1

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

  • Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
  • A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

v2.16.0

Highlights

Breaking changes and behavior changes

  • Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
  • python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
  • Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
  • validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
  • CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
  • JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
  • Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

  • Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
  • Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
  • AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
  • env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
  • CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

... (truncated)

Commits
  • 4e286e2 Prepare release 2.16.1 (#1087)
  • 993b59e Keep fixed-length tuple CLI positionals single-valued (#1069)
  • f651a7a Keep list of dicts CLI values as lists (#1049)
  • ecf7d90 Harden CI (#1044)
  • 8c259f4 Prepare release 2.16.0 (#1043)
  • 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
  • f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
  • cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
  • 081d39f Fix config file and CLI values being ignored when alias differs from validati...
  • c46ebc4 Expand home paths when checking TOML table headers (#1034)
  • Additional commits viewable in compare view

Updates trafilatura from 2.2.0 to 2.3.1

Release notes

Sourced from trafilatura's releases.

trafilatura-2.3.1

trafilatura-2.3.0

Major changes:

  • Downloads and decompression overhaul by @​adbar (#921)
  • Simplified document handling code and better correctness by @​adbar (#938)
  • Simpler and faster deduplication, scoped caches accepted by @​adbar (#919)

Fixes:

Maintenance:

Changelog

Sourced from trafilatura's changelog.

2.3.1

2.3.0

Major changes:

  • Downloads and decompression overhaul by @​adbar (#921)
  • Simplified document handling code and better correctness by @​adbar (#938)
  • Simpler and faster deduplication, scoped caches accepted by @​adbar (#919)
  • Dependencies updated, stricter linting and typing (ruff, mypy) by @​adbar (#907)

Fixes:

Maintenance:

Commits
  • e2f85c9 maintenance: prepare v2.3.1 (#957)
  • f26ba45 fix: prevent part of the duplicates in output and add tests (#955)
  • 7f54f67 fix: do not repeat the text after inline code (#951) (#952)
  • 2af336e fix: keep brackets inside inline code in link text unescaped (#954)
  • 3ee25c0 fix: do not duplicate image paragraphs in wild-text recovery (#946)
  • 6c1977a maintenance: prepare version 2.3.0 (#950)
  • 94b8235 docs: link URL discovery tools from extraction guidance (#944)
  • 9123b5a fix: add the record ID and fingerprint to the TXT/Markdown header (#947)
  • 96e19b9 maintenance: simplified document handling code and better correctness (#938)
  • f0522a5 fix: resolve protocol-relative canonical URLs in metadata (#942)
  • Additional commits viewable in compare view

Updates watchfiles from 1.2.0 to 1.3.0

Release notes

Sourced from watchfiles's releases.

v1.3.0 2026-09-21

What's Changed

New Contributors

Full Changelog: samuelcolvin/watchfiles@v1.2.0...v1.3.0

Commits

Updates pypdf from 6.18.0 to 6.21.2

Release notes

Sourced from pypdf's releases.

Version 6.21.2, 2026-10-21

What's new

Security (SEC)

Bug Fixes (BUG)

Robustness (ROB)

  • Multiple fixes

Full Changelog

Version 6.21.1, 2026-10-17

What's new

Security (SEC)

Full Changelog

Version 6.21.0, 2026-10-16

What's new

Security (SEC)

New Features (ENH)

Bug Fixes (BUG)

Full Changelog

Version 6.20.1, 2026-10-12

What's new

Security (SEC)

Bug Fixes (BUG)

  • Only read the color operator from a text field's default appearance (#4158) by @​yaourtv

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.21.2, 2026-10-21

Security (SEC)

  • Avoid repeated full file loads (#4240)
  • Limit size of standard xref table (#4239)

Bug Fixes (BUG)

  • Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)
  • Keep 8-bit DeviceRGB image mode (#4230)
  • Preserve all annotation quadrilaterals when merging pages (#4223)

Robustness (ROB)

  • Multiple fixes

Full Changelog

Version 6.21.1, 2026-10-17

Security (SEC)

  • Only open /DCTDecode image data with the Pillow JPEG plugin (#4222)

Full Changelog

Version 6.21.0, 2026-10-16

Security (SEC)

  • Improve performance and limit field work (#4219)
  • Limit stream parsing work (#4218)

New Features (ENH)

  • Allow custom fit modes for named destinations (#4181)

Bug Fixes (BUG)

  • Treat NUL as whitespace in ArrayObject (#4198)
  • Avoid overwriting unread objects in add_form_topname (#4190)
  • Read an indirect page box on a writer page (#4179)

Full Changelog

Version 6.20.1, 2026-10-12

Security (SEC)

  • Prevent cyclic tree handling (#4188)

Bug Fixes (BUG)

  • Only read the color operator from a text field's default appearance (#4158)

Full Changelog

Version 6.20.0, 2026-10-09

... (truncated)

Commits
  • 37d05f6 REL: 6.21.2
  • 68a0e50 SEC: Avoid repeated full file loads (#4240)
  • a3061e3 SEC: Limit size of standard xref table (#4239)
  • b7eb7b9 BUG: Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)
  • 885e743 ROB: Reject unsupported key lengths in the /Encrypt dictionary (#4226)
  • b68a335 TST: Enable type checking for PageRange tests (#4229)
  • 3f9c7f4 ROB: Reject negative bfrange source ranges in /ToUnicode CMaps (#4225)
  • 85c46ab ROB: Raise PdfReadError for malformed /ObjStm /N and /First headers (#4216)
  • a91817a BUG: Keep 8-bit DeviceRGB image mode (#4230)
  • b32df1d ROB: Validate the /Encrypt dictionary when opening an encrypted file (#4197)
  • Additional commits viewable in compare view

Updates pypdfium2 from 5.13.0 to 5.14.0

Release notes

Sourced from pypdfium2's releases.

5.14.0

Release 5.14.0

Summary

Runtime

  • PdfDocument.get_identifier(): Fix a blunder that caused one byte too much to be chopped off.
  • PdfDocument and PdfImage.load_jpeg(): With byte stream input, in the _buffer_reader callback, check that the number of bytes read into the buffer is no less than the buffer's size, otherwise indicate error. @Stjorn filed a security ticket that triggered this change; however we consider this more of a theoretical safety enhancement and not actually a vulnerability, since under valid cirucmstances we do not envisage a situation where readinto() would fall short on data. No exploit from the heavens. Updated documentation. (With older versions of pypdfium2, consider wrapping buffer input so that readinto() raises an exception if it could not consume enough data to fill the buffer.)
  • In PdfBitmap, unconditionally call FPDFBitmap_Destroy() when the bitmap is closed/finalized, i.e. including bitmaps created from a native, pdfium-external buffer (the default). The API does not affect external buffers, but assumably should still be called to release the FPDF_BITMAP shell itself.
  • On foreign bitmaps, PdfBitmap.close() now warns about being a potentially unsafe operation, since it frees the C-side buffer. Set .warn_on_close = False to silence the warning, if you have made sure your usage is safe.
  • In AutoCloseable, avoid assigning self to an instance attribute. This should result in improved GC behavior. Many thanks to James Barlow for pointing this out.
  • Added bindings to some new PDFium APIs, along with CLI integration:
    • PdfAttachment: .{get,set}_desc() to read/write attachment descriptions, and .get_subtype() to obtain the MIME type.
    • PdfBookmark.get_style() and PdfBookmarkStyle.

Builds

  • Build scripts & CI: Updated PDFium pin from 7913 to 8076.
    • Updated gn-dist from 2407.3 to 2540.0 (the 2501 build passed unused by pypdfium2).
  • Pyodide: Patch freetype load flags to avoid FT_Load_Glyph() somehow corrupting the heap. It seems that this addresses the previously encountered crashes/freezes; however, the exact cause remains elusive. Anyway, many thanks to Hood Chatham for this finding.
    • Dropped debug symbols. Enabled PyPI upload. Updated documentation.

Setup

  • Refactored ctypesgen integration. It is now cloned into pypdfium2's source tree and bundled in sdists. This avoids having an external git URL in pyproject setup dependencies that defeats the idea of a hermetic (self-contained) package index. ctypesgen's own setup and versioning code has been removed, owing to the project's special status as setup-only dependency with a head-to-head development model that allows for a constantly evolving API. See the updated pypdfium2-ctypesgen README.md for integration instructions. This also made Python 3.6 compatibility straightforward to restore after all, aligning to a common baseline with pypdfium2 and gn-dist.
  • Dropped module splitting (PYPDFIUM_MODULES={raw,helpers}) and the system-generate target, which had been introduced for pypdfium2's own conda packaging (see below). We recognize that module splitting may still be desirable in some downstream packaging contexts; however, the dynamic implementation had been standing in the way of a proper pyproject.toml migration, since the [project] table does not allow for name to be specified dynamically. This means we could not retain a first-party dynamic setting much longer without impairing the project's progress. Instead we suggest that you simply patch the project name / module include rules (possibly via some kind of automation) if module splitting is needed. This change does not affect the module layout in src/ which upholds the logical separation.
  • Lowered iOS min version from 26_0 to 17_0 thanks to an upstream contribution. (We have not released any iOS wheels yet, but it is handled in setup.)

Conda

Removed pypdfium2's own conda packaging (pypdfium2-team channel), following thorough consideration. Upstream pdfium-binaries (bblanchon channel) followed suit and removed conda packaging as well, since pypdfium2 was the only known dependent.

  • Key reasons include that it ended up covering far less platforms than we do with PyPI wheels, did not integrate with our own build strategies, and seemed fraught with workarounds. In part, this has been a result of outsourcing the pdfium dependency (which seemed about the only viable option prior to CEP 20), along with other limitations, like conda generally supporting less platforms, and tight storage limits at anaconda.org that leave maintainers with tradeoffs between release frequency and platform inclusion vs. sustainability. There is no fallback setup, either, which even seems to be an intentional limitation of conda's.
  • To add to that, builds in a custom channel are inaccessible to dependents within the main anaconda/conda-forge ecosystems themselves, and generally a pain to manage, which resulted in negligible demand compared to PyPI. In short, the problems are manifold and technical debt is not far off.
  • This means conda is effectively a third-party package environment similar to nixpkgs or Linux distribution packaging, unlike PyPI, which is a first-party package index where upstream authors publish directly. Conda build tools did not feel like being conceived for in-project packaging, either (the contrast to PyPA build backends is quite stark). Overall, there has been an unjustifably high complexity and amount of workarounds in relation to the low or nonexistent benefit.
  • To be clear, any builds of pypdfium2 in conda-forge or anaconda/main are unofficial (third-party). We generally do not recommend using third-party distributions of pypdfium2, and their varying maintainership is a potential concern as well. Anyway, we cannot support what we don't maintain.
  • Instead, we want to highlight that you can just install pypdfium2 from PyPI even in a conda env. There are no mandatory runtime dependencies, so the usual reasons against mixing in PyPI packages do not apply.
  • Maintainer's note: If upstream ever (drastically) improve integration with custom channels to allow for meaningful first-party publishing, the door remains ajar to redo pypdfium2's conda packaging the CEP 20 way.

Build info

This release was made with the following build strategies:

  • PBIN: [macosx_arm64, macosx_x86_64, win_amd64, win_arm64, win32, manylinux_x86_64, manylinux_i686, manylinux_aarch64, manylinux_armv7l, manylinux_ppc64le, manylinux_mips64le, manylinux_mipsle, android_arm64_v8a, android_armeabi_v7a]
  • SBLD: []
  • CIBW: [manylinux_riscv64, manylinux_loongarch64, manylinux_s390x, musllinux_x86_64, musllinux_aarch64, musllinux_armv7l, musllinux_i686, musllinux_ppc64le, musllinux_s390x, musllinux_riscv64, musllinux_loongarch64, pyodide_wasm32]

... (truncated)

Commits
  • 21f85e2 [autorelease main] update 5.14.0
  • 1a9a921 Code style: change some var == 0 checks to not var
  • 46be657 PdfImage.extract(): improve implementation's code style
  • b2d146c PdfDocument.get_identifier() fix: avoid chopping off a byte too much
  • e856c86 Add an errcheck to PdfAttachment.get_name()
  • 080d459 sbuild: fix macOS wheel tag (version)
  • 3859503 [autorelease main] update 5.14.0b1
  • 35304ab Prepare for a beta release
  • f9859d3 cli/toc: drop now-unnecessary pdfium version check
  • d7ab55e Fix weird changelog wording
  • Additional commits viewable in compare view

Updates ruff from 0.16.7 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 19, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/assistant/python-minor-patch-378d0ad48d branch from b7abdf8 to 02c8d1e Compare October 22, 2026 05:20
@dependabot
chore(deps): bump the python-minor-patch group across 1 directory wit…
f7e5333 
…h 8 updates

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pydantic-settings
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pypdf
  dependency-version: 6.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pypdfium2
  dependency-version: 5.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: trafilatura
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: watchfiles
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/assistant/python-minor-patch-378d0ad48d branch from 02c8d1e to f7e5333 Compare October 26, 2026 02:18
@acroca
acroca merged commit e65ea7f into main Oct 27, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@acroca