Skip to content

deps(deps): bump the python-minor-patch group across 1 directory with 13 updates - #100

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-patch-0134f9e317
Open

deps(deps): bump the python-minor-patch group across 1 directory with 13 updates#100
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-patch-0134f9e317

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 13 updates in the / directory:

Package From To
packaging 26.2 26.3
anyio 4.14.1 4.14.2
charset-normalizer 3.4.8 3.4.9
dulwich 1.2.9 1.2.12
fastjsonschema 2.21.2 2.22.1
filelock 3.29.5 3.32.2
fsspec 2026.6.0 2026.7.0
jaraco-functools 4.5.0 4.6.0
platformdirs 4.10.0 4.11.0
pypdf 6.14.2 6.15.0
ruff 0.15.20 0.16.2
tomlkit 0.15.0 0.15.1
torch 2.12.1 2.13.0

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

    

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
    • 

  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
    • 

  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
    • 

  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
    • 

  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
    • 

  • Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
    • 



Behavior adaptations:


    

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
    • 

  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
    • 



Fixes for versions and specifiers:


    

  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
    • 

  • Raise InvalidVersion for non-string pre-release letters passed to
    
Version.from_parts. (:pull:1241)
    • 

  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
    • 

  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
    • 



Fixes for requirements and markers:


    

  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    
foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates anyio from 4.14.1 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates charset-normalizer from 3.4.8 to 3.4.9

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

  • Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.
Changelog

Sourced from charset-normalizer's changelog.

3.4.9 (2026-07-07)

Fixed

  • Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.
Commits
  • cc68407 Merge pull request #772 from jawah/fix-regression-fallback-path
  • 152b923 chore: release 3.4.9
  • 2bc2607 fix: unicodedecodeerror in fallback path
  • be252d7 chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#767)
  • 71c7bdd chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#768)
  • aeea391 chore(deps): bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#758)
  • See full diff in compare view

Updates dulwich from 1.2.9 to 1.2.12

Release notes

Sourced from dulwich's releases.

dulwich-1.2.12

  • SECURITY: Refuse to write a checkout entry whose leading path resolves through a symlink. `build_index_from_tree` (used by `reset_index` and thus by `clone`/`checkout`) materialized a tree in sorted order without checking leading components, so a tree pairing a symlink `link` with a descendant `link/foo` wrote `foo` through the link to an arbitrary absolute path. The same `verify_leading_dirs` guard already used by porcelain and stash is now applied here. (Jelmer Vernooij, reported by Hugh Lewis)

  • Fix `Bundle.store_objects()` silently dropping every OFS_DELTA/REF_DELTA object in the bundle's pack instead of resolving it, leaving the target object store missing most objects with no error raised. Delta resolution now goes through `PackInflater`, matching how packs are ingested elsewhere in the object store code. (theVinchi, #2312)

dulwich-1.2.11

Security and hardening

  • Apply core.protectHFS and core.protectNTFS together when selecting the checkout path-element validator. Previously only the NTFS validator ran when protectNTFS was on (the default), so on macOS an HFS+ spelling of .git using ignorable code points could pass validation and poison .git on checkout.
  • Canonicalize file modes in git archive tarballs, so a crafted tree entry can no longer carry setuid/setgid/sticky bits into an extracted file.
  • Collapse embedded whitespace in reflog messages, so a crafted multi-line commit message can no longer forge additional reflog entries with attacker-chosen SHAs.
  • Verify that a .bitmap index matches the pack it is loaded for, so a stale or swapped-in bitmap can't produce a wrong reachable-object set during fetch negotiation.
  • Parse commit-message trailers in linear time, fixing a cubic blowup where a crafted commit message could tie up CPU for minutes to hours.

Features and fixes

  • Honour core.worktree, so the working tree can live outside the parent of the control directory.
  • Porcelain functions now take an env argument, and read GIT_PROTOCOL, GIT_SSH_COMMAND/GIT_SSH when called as a library rather than only from the CLI (fixes a regression since 1.2.1 where porcelain.clone() silently ignored the SSH variables).
  • porcelain.archive() gained a remote argument.
  • Recurse into subtrees when merging trees, so non-overlapping changes under a shared directory merge cleanly.
  • Clear core.bare when setting up a submodule's working tree.

Security and hardening fixes in this release were contributed by Kartik Kenchi (@​netliomax25-code).

dulwich-1.2.10

  • Fix regression in 1.2.9 where loose objects whose content inflates to more than 8192 bytes failed to parse with `zlib.error: object header exceeds maximum size`. (Jelmer Vernooij, #2292)
Changelog

Sourced from dulwich's changelog.

1.2.12 2026-07-19

  • Fix Bundle.store_objects() silently dropping every OFS_DELTA/REF_DELTA object in the bundle's pack instead of resolving it, leaving the target object store missing most objects with no error raised. Delta resolution now goes through PackInflater, matching how packs are ingested elsewhere in the object store code. (theVinchi, #2312)

  • SECURITY: Refuse to write a checkout entry whose leading path resolves through a symlink. build_index_from_tree (used by reset_index and thus by clone/checkout) materialized a tree in sorted order without checking leading components, so a tree pairing a symlink link with a descendant link/foo wrote foo through the link to an arbitrary absolute path. The same verify_leading_dirs guard already used by porcelain and stash is now applied here. (Jelmer Vernooij, reported by Hugh Lewis)

1.2.11 2026-07-16

  • Let porcelain functions that consult the environment take an env argument overriding os.environ. As a side effect tag_create now honours GIT_COMMITTER_NAME/GIT_COMMITTER_EMAIL for the tagger line and merge/revert honour GIT_AUTHOR_NAME/GIT_AUTHOR_EMAIL, matching git. (Jelmer Vernooij)

  • Honour the core.worktree configuration option, so the working tree can live somewhere other than the parent of the control directory. Relative paths are resolved against the control directory, and core.bare and core.worktree are now rejected as incompatible. (Jelmer Vernooij, #1785)

  • Clear core.bare when setting up a submodule's working tree. submodule_update cloned the submodule bare and then set core.worktree on it, leaving a configuration git considers invalid. (Jelmer Vernooij)

  • Read GIT_PROTOCOL in porcelain rather than only in the command line interface, so clone and pull honour it when called as a library. An explicit protocol_version argument still wins. (Jelmer Vernooij)

  • Add a remote argument to porcelain.archive(), so an archive can be retrieved from a remote repository without dropping down to dulwich.client. (Jelmer Vernooij)

  • Read GIT_SSH_COMMAND/GIT_SSH in porcelain rather than only in the command line interface, so clone, fetch, ls_remote, pull and push honour them again when called as a library. Since 1.2.1 only the CLI resolved these, so porcelain.clone() silently ignored them. An explicit ssh_command argument still wins, and push and pull gained an env argument. (Jelmer Vernooij, #2209)

... (truncated)

Commits
  • c9240bc Release 1.2.12
  • fabed56 Fix Bundle.store_objects() silently dropping delta objects (#2314)
  • d845b3c validate object ids in receive-pack ref commands (#2309)
  • e6d123e catch ValueError from ref line unpack instead of checking field count
  • 551d0ef Preserve dulwich.porcelain.get_user_identity (#2313)
  • 4cc3d60 Fix Bundle.store_objects() silently dropping delta objects
  • dbf7f15 Preserve dulwich.porcelain.get_user_identity
  • e84043a client: Half-close write side after sending a fetch request (#2311)
  • 6dacf2f client: Half-close write side after sending a fetch request
  • e633cdc Refuse to write checkout entries through leading symlinks (#2308)
  • Additional commits viewable in compare view

Updates fastjsonschema from 2.21.2 to 2.22.1

Changelog

Sourced from fastjsonschema's changelog.

=== 2.22.1 (2026-07-27)

  • Fixed min Python version

=== 2.22.0 (2026-07-25)

  • Fixed IPv4 validation (rejecting leading zeros)
  • Fixed empty items and patternProperties
  • Fixed protection from deeply nested schemas potentially causing denial of service
  • Fixed comparing values for enum and const validations
  • Fixed resolving plain-name ref fragments
  • Fixed not throwing when unknown format is used
  • Fixed compilation of not, if/then/else, items, additionalItems, propertyNames and schema dependencies when a subschema generates no validation code
  • Added option to get all the errors (set fast_fail to False)
  • Added basic type hints
  • Added support of duration and uuid formats from draft-2019
Commits
  • 8a7cde9 v2.22.1
  • e1cf85b Merge pull request #213 from casperdcl/fix-pyver
  • 87960c8 fix min python version
  • a2fb34c v2.22.0
  • 1fa8834 Merge pull request #209 from henryiii/fix-not-variable-leak
  • 606503d Merge branch 'master' into fix-not-variable-leak
  • 9c385ea Merge pull request #207 from chuenchen309/fix/ipv4-format-reject-leading-zeros
  • 2a8955c Merge pull request #206 from gaoflow/fix-empty-body-codegen
  • 10e952b fix: don't leak variables from not blocks into the outer scope
  • 5513da7 Reject IPv4 octets with leading zeros in the ipv4 format check
  • Additional commits viewable in compare view

Updates filelock from 3.29.5 to 3.32.2

Release notes

Sourced from filelock's releases.

3.32.2

What's Changed

Full Changelog: tox-dev/filelock@3.32.1...3.32.2

3.32.0

What's Changed

Full Changelog: tox-dev/filelock@3.31.2...3.32.0

3.31.2

What's Changed

Full Changelog: tox-dev/filelock@3.31.1...3.31.2

3.31.1

What's Changed

Full Changelog: tox-dev/filelock@3.31.0...3.31.1

3.31.0

What's Changed

Full Changelog: tox-dev/filelock@3.30.3...3.31.0

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.2 (2026-07-29)

  • A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

3.32.1 (2026-07-26)

  • Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

3.32.0 (2026-07-21)

  • SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685
  • Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683
  • The source distribution ships the capability probes the tests import, and reading one no longer needs coverage installed, so the suite runs from an unpacked sdist instead of failing on a missing coverage_pragmas. :pr:685

3.31.2 (2026-07-21)

  • filelock imports again on runtimes whose errno omits ENOTSUP, such as GraalPy, where importing the package raised ImportError. It probes the code instead, preferring ENOTSUP, falling back to EOPNOTSUPP where that name is absent, and dropping to ENOSYS/EXDEV where neither exists. Platforms defining ENOTSUP keep their behavior. :pr:681

3.31.1 (2026-07-20)

  • A SoftFileLease acquired on one thread keeps its claim when another thread fails to acquire the same lease object, so its heartbeat carries on refreshing the marker instead of being torn down and letting a peer take the live claim. :pr:680

... (truncated)

Commits
  • 9a6cc43 Release 3.32.2
  • 56879c7 🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy (#695)
  • ecf5be0 hand back the claim when a heartbeat thread fails to start (#691)
  • ee70d2e 🧪 test(soft-rw): deflake writer phase-2 peer-marker test (#694)
  • 1eb14dd Fix test failures on NetBSD (#689) (#693)
  • d81e859 build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0 (#692)
  • 6fbc905 [pre-commit.ci] pre-commit autoupdate (#690)
  • 34d1c38 build(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#688)
  • bf13ec7 Release 3.32.1
  • 887f114 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#687)
  • Additional commits viewable in compare view

Updates fsspec from 2026.6.0 to 2026.7.0

Commits

Updates jaraco-functools from 4.5.0 to 4.6.0

Changelog

Sourced from jaraco-functools's changelog.

v4.6.0

Features

  • Add signed wrapper to render a value with an explicit sign.
Commits
  • f7f4f3b Finalize
  • 1b61507 Merge pull request #38 from jaraco/feature/signed
  • ec615a5 Add news fragment.
  • 0169374 Add signed, a wrapper to render a value's formatter with an explicit sign
  • See full diff in compare view

Updates platformdirs from 4.10.0 to 4.11.0

Release notes

Sourced from platformdirs's releases.

4.11.0

What's Changed

Full Changelog: tox-dev/platformdirs@4.10.1...4.11.0

4.10.1

What's Changed

Full Changelog: tox-dev/platformdirs@4.10.0...4.10.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.2 (2026-08-10)

  • Stop :meth:~platformdirs.PlatformDirs.iter_cache_dirs, :meth:~platformdirs.PlatformDirs.iter_state_dirs, :meth:~platformdirs.PlatformDirs.iter_log_dirs and :meth:~platformdirs.PlatformDirs.iter_runtime_dirs yielding the same directory twice on Unix when use_site_for_root is active - :pr:469 fixed this for the config and data iterators only. On macOS, :meth:~platformdirs.PlatformDirs.iter_cache_dirs now yields the Homebrew and /Library/Caches entries separately rather than one os.pathsep-joined string when multipath is set. :pr:520

4.11.1 (2026-08-07)

  • Fix :func:~platformdirs.user_desktop_dir on Windows builds without ctypes. CSIDL_DESKTOPDIRECTORY appeared only in the ctypes lookup table, so the registry and environment variable resolvers raised ValueError for it. :pr:519

4.11.0 (2026-07-21)

  • Declare support for Python 3.15 and run the test suite against it, currently in beta. :pr:512

4.10.1 (2026-07-18)

  • Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

4.10.0 (2026-05-28)

  • Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491
  • Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490
  • Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

... (truncated)

Commits
  • 2140495 Release 4.11.0
  • a562df9 👷 ci: run the test suite against Python 3.15 (#512)
  • 7c764c4 [pre-commit.ci] pre-commit autoupdate (#511)
  • 2e74013 Release 4.10.1
  • 3076722 📝 docs(changelog): rebuild against release history (#510)
  • 42751ce 🚀 ci(release): towncrier changelog + publish on tag push (#509)
  • d2e5756 fix(windows): stop leaking ctypes pointer types on repeated calls (#507)
  • 4f52c4f build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 in the all group (#506)
  • f68e56f build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 in the all group (#504)
  • 806560b build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 in the all group (#502)
  • Additional commits viewable in compare view

Updates pypdf from 6.14.2 to 6.15.0

Release notes

Sourced from pypdf's releases.

Version 6.15.0, 2026-08-06

What's new

Security (SEC)

Deprecations (DEP)

New Features (ENH)

  • Add ActualText tag when we produce RTL appearance stream (#3901) by @​PJBrs
  • Allow keeping original PDF header in non-incremental clone mode (#3918) by @​pctablet505
  • AppearanceStream: Add support for RTL appearance streams with Arabic characters (#3831) by @​PJBrs
  • Add actions base class (#3552) by @​j-t-1

Bug Fixes (BUG)

Documentation (DOC)

Maintenance (MAINT)

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.15.0, 2026-08-06

Security (SEC)

  • Improve performance of read_until_whitespace (#3947)
  • Limit CID width range and width count when loading fonts (#3946)
  • Limit token length for ToUnicode entries (#3944)

Deprecations (DEP)

  • Deprecate previously missed inline_images setter as well (#3897)

New Features (ENH)

  • Add ActualText tag when we produce RTL appearance stream (#3901)
  • Allow keeping original PDF header in non-incremental clone mode (#3918)
  • AppearanceStream: Add support for RTL appearance streams with Arabic characters (#3831)
  • Add actions base class (#3552)

Bug Fixes (BUG)

  • Expand low-bit samples for images without a filter (#3938)
  • Decode low-bit DeviceRGB images as RGB instead of palette (#3929)
  • Correctly handle IndirectObject in FlateDecode.decode DecodeParms (#3937)

Documentation (DOC)

  • Image and attachment filenames are unsanitized (#3942)

Maintenance (MAINT)

  • Update charset mappings (#3935)

Full Changelog

Commits
  • 7f226a2 REL: 6.15.0
  • 4959848 SEC: Improve performance of read_until_whitespace (#3947)
  • 51cb6ac SEC: Limit CID width range and width count when loading fonts (#3946)
  • afba808 SEC: Limit token length for ToUnicode entries (#3944)
  • aa2f37d DOC: Image and attachment filenames are unsanitized (#3942)
  • 760ba28 DOC: Further clarify security policy
  • 55bd85c BUG: Expand low-bit samples for images without a filter (#3938)
  • 4807cb4 ROB: Tolerate malformed /FontBBox when building font descriptors (#3895)
  • ce9320b DEV: Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#3941)
  • 8b6f6fd ENH: Add ActualText tag when we produce RTL appearance stream (#3901)
  • Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.16.2

Release notes

Sourced from ruff's releases.

0.16.2

Release Notes

Released on 2026-08-06.

Bug fixes

  • [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

  • Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

Install ruff 0.16.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astra...
Description has been truncated

@dependabot
deps(deps): bump the python-minor-patch group across 1 directory with…
80f8b84 
… 13 updates

Bumps the python-minor-patch group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.1` | `4.14.2` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.8` | `3.4.9` |
| [dulwich](https://github.com/dulwich/dulwich) | `1.2.9` | `1.2.12` |
| [fastjsonschema](https://github.com/horejsek/python-fastjsonschema) | `2.21.2` | `2.22.1` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.29.5` | `3.32.2` |
| [fsspec](https://github.com/fsspec/filesystem_spec) | `2026.6.0` | `2026.7.0` |
| [jaraco-functools](https://github.com/jaraco/jaraco.functools) | `4.5.0` | `4.6.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.10.0` | `4.11.0` |
| [pypdf](https://github.com/py-pdf/pypdf) | `6.14.2` | `6.15.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.16.2` |
| [tomlkit](https://github.com/python-poetry/tomlkit) | `0.15.0` | `0.15.1` |
| [torch](https://github.com/pytorch/pytorch) | `2.12.1` | `2.13.0` |



Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.2...26.3)

Updates `anyio` from 4.14.1 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.1...4.14.2)

Updates `charset-normalizer` from 3.4.8 to 3.4.9
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.8...3.4.9)

Updates `dulwich` from 1.2.9 to 1.2.12
- [Release notes](https://github.com/dulwich/dulwich/releases)
- [Changelog](https://github.com/jelmer/dulwich/blob/main/NEWS)
- [Commits](jelmer/dulwich@dulwich-1.2.9...dulwich-1.2.12)

Updates `fastjsonschema` from 2.21.2 to 2.22.1
- [Changelog](https://github.com/horejsek/python-fastjsonschema/blob/master/CHANGELOG.txt)
- [Commits](horejsek/python-fastjsonschema@v2.21.2...v2.22.1)

Updates `filelock` from 3.29.5 to 3.32.2
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.29.5...3.32.2)

Updates `fsspec` from 2026.6.0 to 2026.7.0
- [Commits](fsspec/filesystem_spec@2026.6.0...2026.7.0)

Updates `jaraco-functools` from 4.5.0 to 4.6.0
- [Release notes](https://github.com/jaraco/jaraco.functools/releases)
- [Changelog](https://github.com/jaraco/jaraco.functools/blob/main/NEWS.rst)
- [Commits](jaraco/jaraco.functools@v4.5.0...v4.6.0)

Updates `platformdirs` from 4.10.0 to 4.11.0
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.10.0...4.11.0)

Updates `pypdf` from 6.14.2 to 6.15.0
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.14.2...6.15.0)

Updates `ruff` from 0.15.20 to 0.16.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.16.2)

Updates `tomlkit` from 0.15.0 to 0.15.1
- [Release notes](https://github.com/python-poetry/tomlkit/releases)
- [Changelog](https://github.com/python-poetry/tomlkit/blob/master/CHANGELOG.md)
- [Commits](python-poetry/tomlkit@0.15.0...0.15.1)

Updates `torch` from 2.12.1 to 2.13.0
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](pytorch/pytorch@v2.12.1...v2.13.0)

---
updated-dependencies:
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: anyio
  dependency-version: 4.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: charset-normalizer
  dependency-version: 3.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: dulwich
  dependency-version: 1.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: fastjsonschema
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: filelock
  dependency-version: 3.32.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: fsspec
  dependency-version: 2026.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: jaraco-functools
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: platformdirs
  dependency-version: 4.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pypdf
  dependency-version: 6.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: tomlkit
  dependency-version: 0.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: torch
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 10, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants