Skip to content

chore(deps): bump the all-dependencies group with 3 updates - #902

Merged
gijzelaerr merged 1 commit into
masterfrom
dependabot/uv/all-dependencies-b3dd3eb22e
Sep 23, 2026
Merged

chore(deps): bump the all-dependencies group with 3 updates#902
gijzelaerr merged 1 commit into
masterfrom
dependabot/uv/all-dependencies-b3dd3eb22e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 3 updates: ruff, tox and uv.

Updates ruff from 0.16.7 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Commits
  • 62914c4 Bump version to 0.16.8 (#28648)
  • c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
  • ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
  • 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
  • 50020fb [ty] Avoid storing constraint nodes twice (#28375)
  • 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
  • 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
  • d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
  • fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
  • 31131db [ty] Support type[A & B] (#27124)
  • Additional commits viewable in compare view

Updates tox from 4.61.4 to 4.61.5

Release notes

Sourced from tox's releases.

v4.61.5

What's Changed

New Contributors

Full Changelog: tox-dev/tox@4.61.4...4.61.5

Changelog

Sourced from tox's changelog.

Bug fixes - 4.61.5

  • An empty set_env list in TOML no longer fails to load; like an empty table, it clears inherited variables - by :user:yuefdev. (:issue:4065)
  • A TOML factor range now rejects true or false as start or stop instead of reading them as 1 and 0 - by :user:yuefdev. (:issue:4066)
  • Preserve an explicitly empty {factor:label:} fallback instead of using the declared factor group default. (:issue:4072)

Improved documentation - 4.61.5

  • Loader.build documented a future parameter it no longer takes and left factory undocumented, so the plugin API reference listed a parameter that does not exist - by :user:hxperl. (:issue:4070)

Contributor-facing changes - 4.61.5

  • Restore COVERAGE_PROCESS_START in the test environments; a mangled key had left it unset since the move to tox.toml - by :user:yuefdev. (:issue:4067)

v4.61.4 (2026-09-09)

Commits

Updates uv from 0.12.13 to 0.12.16

Release notes

Sourced from uv's releases.

0.12.16

Release Notes

Released on 2026-09-17.

Python

  • Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#21741)

Enhancements

  • Verify downloaded wheels and source distributions against hashes supplied by package indexes (#21562)
  • Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#21467)
  • Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#21766)
  • Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#21779)

Preview features

  • Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#21163)
  • Honor configured and command-line index settings, including credentials, in uv upgrade (#21776)
  • Allow uv check to run in projects that are not managed by uv and outside workspaces (#21777)
  • Respect --python and UV_PYTHON when selecting the Python version for uv check (#21744)

Bug fixes

  • Redact Azure shared access signatures from displayed and logged URLs (#21755)
  • Check archive sizes from pylock.toml before reusing cached distributions (#21609)
  • Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#20631)
  • Use the bundled uv_build backend only when its version matches active version pins (#21742)
  • Handle malformed index URLs without panicking when credentials are configured (#21784)
  • Report a configuration error instead of panicking for proxy URLs without a host (#21781)
  • Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#21783)

Install uv 0.12.16

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.ps1 | iex"

Download uv 0.12.16

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.16

Released on 2026-09-17.

Python

  • Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#21741)

Enhancements

  • Verify downloaded wheels and source distributions against hashes supplied by package indexes (#21562)
  • Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#21467)
  • Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#21766)
  • Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#21779)

Preview features

  • Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#21163)
  • Honor configured and command-line index settings, including credentials, in uv upgrade (#21776)
  • Allow uv check to run in projects that are not managed by uv and outside workspaces (#21777)
  • Respect --python and UV_PYTHON when selecting the Python version for uv check (#21744)

Bug fixes

  • Redact Azure shared access signatures from displayed and logged URLs (#21755)
  • Check archive sizes from pylock.toml before reusing cached distributions (#21609)
  • Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#20631)
  • Use the bundled uv_build backend only when its version matches active version pins (#21742)
  • Handle malformed index URLs without panicking when credentials are configured (#21784)
  • Report a configuration error instead of panicking for proxy URLs without a host (#21781)
  • Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#21783)

0.12.15

Released on 2026-09-15.

Performance

  • Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (#21675)

Bug fixes

  • Fix regressions in 0.12.14 when installing to symlinked destinations or using uv pip install --target . (#21699)

0.12.14

Released on 2026-09-15.

Enhancements

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the all-dependencies group with 3 updates
2e97be7 
Bumps the all-dependencies group with 3 updates: [ruff](https://github.com/astral-sh/ruff), [tox](https://github.com/tox-dev/tox) and [uv](https://github.com/astral-sh/uv).


Updates `ruff` from 0.16.7 to 0.16.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.7...0.16.8)

Updates `tox` from 4.61.4 to 4.61.5
- [Release notes](https://github.com/tox-dev/tox/releases)
- [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst)
- [Commits](tox-dev/tox@4.61.4...4.61.5)

Updates `uv` from 0.12.13 to 0.12.16
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.13...0.12.16)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: tox
  dependency-version: 4.61.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: uv
  dependency-version: 0.12.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 21, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) September 21, 2026 16:06
@gijzelaerr
gijzelaerr disabled auto-merge September 23, 2026 10:53
@gijzelaerr
gijzelaerr merged commit 135493a into master Sep 23, 2026
18 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/all-dependencies-b3dd3eb22e branch September 23, 2026 10:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gijzelaerr gijzelaerr gijzelaerr approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gijzelaerr