Skip to content

pip: bump the pip-updates group across 1 directory with 6 updates - #325

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-updates-b6f4e16f91
Open

pip: bump the pip-updates group across 1 directory with 6 updates#325
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-updates-b6f4e16f91

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on idna, multidict, propcache, yarl, ruff and coverage to permit the latest version.
Updates idna from 3.19 to 3.20

Release notes

Sourced from idna's releases.

v3.20

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.
Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.
Commits
  • d55e65e Release 3.20
  • 0c0824a Pre-release 3.20rc0
  • bd7c316 Note Python 3.15 support in the 3.20 changelog
  • b6cce85 Merge pull request #276 from kjd/unicode-18
  • 9a4bc59 Update to Unicode 18.0.0
  • dfab5a0 Merge branch 'python-3.15'
  • 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
  • cd17392 Merge pull request #274 from kjd/fix-decode-length-check
  • c5796d7 Skip the decode round-trip check for domains past encode's length limit
  • d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
  • Additional commits viewable in compare view

Updates multidict from 6.8.0 to 6.9.0

Release notes

Sourced from multidict's releases.

6.9.0

Bug fixes

  • Protected repr() of MultiDict, MultiDictProxy, and their views in the C extension with a critical section, avoiding data races on the free-threaded build of CPython -- by :user:asvetlov.

    Related issues and pull requests on GitHub: #1431.

  • Guarded repr() of MultiDictProxy in the C extension and of KeysView in both the C extension and the pure-Python implementation against infinite recursion on self-referential containers, matching the existing guard on MultiDict, ItemsView, and ValuesView -- by :user:asvetlov.

    Related issues and pull requests on GitHub: #1431.

  • Protected MultiDict.update(), .extend(), .merge(), .clear(), .copy(), and the MultiDict/CIMultiDict constructors in the C extension with a critical section, using the two-object form when a second multidict, multidict proxy, or plain dict instance is involved, avoiding data races and a segmentation fault on the free-threaded build of CPython. .clear() now also publishes the empty table before releasing any entry's references, so a concurrent caller can never observe a partially-cleared multidict even if releasing a value runs arbitrary Python code that suspends the held critical section -- by :user:asvetlov.

    Related issues and pull requests on GitHub: #1433.

  • Protected MultiDict.add(), __setitem__/__delitem__, get()/getone()/__getitem__, __contains__, getall(), setdefault(), pop()/popone()/popall()/popitem(), __eq__, iteration, and the &/|/-/^/in/ isdisjoint() operations on .keys() and .items() views in the C extension with a critical section, avoiding data races and use-after-free crashes on the free-threaded build of CPython -- by :user:asvetlov.

    Related issues and pull requests on GitHub: #1438.

  • Fixed a data race on the free-threaded build where MultiDictObject.used was written non-atomically while len() read it with a relaxed atomic load -- by :user:asvetlov.

... (truncated)

Changelog

Sourced from multidict's changelog.

6.9.0

(2026-09-18)

Bug fixes

  • Protected repr() of MultiDict, MultiDictProxy, and their views in the C extension with a critical section, avoiding data races on the free-threaded build of CPython -- by :user:asvetlov.

    Related issues and pull requests on GitHub: :issue:1431.

  • Guarded repr() of MultiDictProxy in the C extension and of KeysView in both the C extension and the pure-Python implementation against infinite recursion on self-referential containers, matching the existing guard on MultiDict, ItemsView, and ValuesView -- by :user:asvetlov.

    Related issues and pull requests on GitHub: :issue:1431.

  • Protected MultiDict.update(), .extend(), .merge(), .clear(), .copy(), and the MultiDict/CIMultiDict constructors in the C extension with a critical section, using the two-object form when a second multidict, multidict proxy, or plain dict instance is involved, avoiding data races and a segmentation fault on the free-threaded build of CPython. .clear() now also publishes the empty table before releasing any entry's references, so a concurrent caller can never observe a partially-cleared multidict even if releasing a value runs arbitrary Python code that suspends the held critical section -- by :user:asvetlov.

    Related issues and pull requests on GitHub: :issue:1433.

  • Protected MultiDict.add(), __setitem__/__delitem__, get()/getone()/__getitem__, __contains__, getall(), setdefault(), pop()/popone()/popall()/popitem(), __eq__, iteration, and the &/|/-/^/in/ isdisjoint() operations on .keys() and .items() views in the C extension with a critical section, avoiding data races and use-after-free crashes on the free-threaded build of CPython -- by :user:asvetlov.

    Related issues and pull requests on GitHub: :issue:1438.

... (truncated)

Commits

Updates propcache from 0.5.2 to 0.5.4

Release notes

Sourced from propcache's releases.

0.5.4

Packaging updates and notes for downstreams

  • Fixed the release wheels being compiled without optimization since version 0.5.0. The build backend set CFLAGS to add -ffile-prefix-map, which replaced the interpreter's own compiler flags instead of extending them, so -O3 and -DNDEBUG were dropped; the extra flags now go through CPPFLAGS, which is appended. Cached property reads are about 1.5x faster than in 0.5.3 -- by :user:bdraco.

    Related issues and pull requests on GitHub: #244, #302.

0.5.3

Bug fixes

  • Fixed a possible crash in the C implementation of cached_property and under_cached_property on free-threaded Python, where a cached value could be freed by another thread while it was being read; errors raised while looking up the cache are now propagated on all builds, and the computed value is no longer leaked if storing it fails -- by :user:bdraco.

    Related issues and pull requests on GitHub: #297.

Removals and backward incompatible breaking changes

  • Dropped support for free-threaded Python 3.13 -- by :user:Vizonex.

    Related issues and pull requests on GitHub: #223.

Improved documentation

  • Updated discussion links from the defunct Google Groups forum to GitHub Discussions -- by :user:gundalow.

    Related issues and pull requests on GitHub:

... (truncated)

Changelog

Sourced from propcache's changelog.

0.5.4

(2026-09-15)

Packaging updates and notes for downstreams

  • Fixed the release wheels being compiled without optimization since version 0.5.0. The build backend set CFLAGS to add -ffile-prefix-map, which replaced the interpreter's own compiler flags instead of extending them, so -O3 and -DNDEBUG were dropped; the extra flags now go through CPPFLAGS, which is appended. Cached property reads are about 1.5x faster than in 0.5.3 -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:244, :issue:302.

0.5.3

(2026-09-15)

Bug fixes

  • Fixed a possible crash in the C implementation of cached_property and under_cached_property on free-threaded Python, where a cached value could be freed by another thread while it was being read; errors raised while looking up the cache are now propagated on all builds, and the computed value is no longer leaked if storing it fails -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:297.

Removals and backward incompatible breaking changes

  • Dropped support for free-threaded Python 3.13 -- by :user:Vizonex.

    Related issues and pull requests on GitHub:

... (truncated)

Commits

Updates yarl from 1.24.5 to 1.25.1

Release notes

Sourced from yarl's releases.

1.25.1

[!IMPORTANT] The v1.25.0 release never published: its riscv64 wheel job hit the job timeout, so no packages reached PyPI and no GitHub release was created. No changes were lost; everything intended for v1.25.0 shipped in v1.25.1. Its changelog entries are reproduced below.

Contributor-facing changes

  • Stopped running the test suite inside the riscv64 wheel builds; every wheel for that architecture is built under emulation and the test run did not fit in the job timeout -- by :user:bdraco.

    Related issues and pull requests on GitHub: #1906.

v1.25.0

(2026-09-15)

Bug fixes

  • Made the C and pure Python quoting implementations reject % in safe or protected when requoting and a space in safe or protected for query strings, since the two implementations disagreed on those configurations -- by :user:bdraco.

    Related issues and pull requests on GitHub: #1869.

  • Made the pure Python quoter reject non-ASCII safe and protected characters when it is created, the same way the C extension does -- by :user:bdraco.

    Related issues and pull requests on GitHub: #1893.

  • Fixed :attr:URL.query <yarl.URL.query> returning empty fields and keeping invalid percent-encoded UTF-8 as is, a regression in 1.19.0. It matches :func:urllib.parse.parse_qsl again, and so do the methods built on it, :meth:~yarl.URL.update_query, :meth:~yarl.URL.without_query_params and :meth:~yarl.URL.human_repr, which also no longer double encode those escapes -- by :user:bdraco.

... (truncated)

Changelog

Sourced from yarl's changelog.

v1.25.1

(2026-09-15)

Contributor-facing changes

  • Stopped running the test suite inside the riscv64 wheel builds; every wheel for that architecture is built under emulation and the test run did not fit in the job timeout -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:1906.

v1.25.0

(2026-09-15)

Bug fixes

  • Made the C and pure Python quoting implementations reject % in safe or protected when requoting and a space in safe or protected for query strings, since the two implementations disagreed on those configurations -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:1869.

  • Made the pure Python quoter reject non-ASCII safe and protected characters when it is created, the same way the C extension does -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:1893.

  • Fixed :attr:URL.query <yarl.URL.query> returning empty fields and keeping invalid percent-encoded UTF-8 as is, a regression in 1.19.0. It matches :func:urllib.parse.parse_qsl again, and so do the methods built on it, :meth:~yarl.URL.update_query, :meth:~yarl.URL.without_query_params and :meth:~yarl.URL.human_repr, which also no longer double encode those escapes -- by :user:bdraco.

... (truncated)

Commits
  • 604eb6d Release 1.25.1 (#1907)
  • 467b48e Skip the in-build test run for riscv64 wheels (#1906)
  • 3dc4b26 Release 1.25.0 (#1905)
  • 7f07a89 Write escapes for ignored characters directly in the pure Python unquoter (#1...
  • a27544b Write escapes for ignored characters directly in the C unquoter (#1902)
  • 1868dae Reject non-ASCII ignore characters in the unquoters (#1903)
  • 4a243c1 Reject ignore characters the unquoters decode anyway (#1900)
  • e1c4d5d Remove unused constants from the quoting modules (#1901)
  • c239085 Add public query_to_pairs with max_fields and encoding (#1899)
  • ce45762 Speed up the pure Python unquoter for long and escape heavy strings (#1889)
  • Additional commits viewable in compare view

Updates ruff to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

0.16.7

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)

... (truncated)

Commits
  • 62914c4 Bump version to 0.16.8 (#28648)
  • c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
  • ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
  • 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
  • 50020fb [ty] Avoid storing constraint nodes twice (#28375)
  • 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
  • 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
  • d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
  • fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
  • 31131db [ty] Support type[A & B] (#27124)
  • Additional commits viewable in compare view

Updates coverage to 7.16.1

Release notes

Sourced from coverage's releases.

7.16.1

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
  • Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

Changelog

Sourced from coverage's changelog.

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

  • Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

.. _issue 1563: coveragepy/coveragepy#1563 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

  • The :meth:.Coverage.switch_context method now returns the previous context.

  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

  • Fixes to validation of options and configuration settings:

    • Negative precision settings now always cause useful error messages (pull 2261_).

    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't

... (truncated)

Commits
  • ccbb992 docs: prep for 7.16.1
  • 0697ccc chore: make upgrade
  • 12f3595 chore: bump docker/setup-qemu-action in the action-dependencies group (#2280)
  • 35b58d3 fix: CoverageData.update() can be called twice on an in-memory database. #2279
  • 92e1ce9 chore: bump the action-dependencies group with 4 updates (#2278)
  • bf07310 build: quote var expansion (actionlint SC2086)
  • 3c434f5 quality: use shellcheck-py to get shellcheck in GitHub CI
  • 632f397 build: use .txt instead of .pip, even though it's a stupid extension
  • ffc6a4a test: only run diff-cover on pull requests
  • 33553b3 fix: exclude the case line when an irrefutable case body is excluded (#2269)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
pip: bump the pip-updates group across 1 directory with 6 updates
4ac6035 
Updates the requirements on [idna](https://github.com/kjd/idna), [multidict](https://github.com/aio-libs/multidict), [propcache](https://github.com/aio-libs/propcache), [yarl](https://github.com/aio-libs/yarl), [ruff](https://github.com/astral-sh/ruff) and [coverage](https://github.com/coveragepy/coveragepy) to permit the latest version.

Updates `idna` from 3.19 to 3.20
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.19...v3.20)

Updates `multidict` from 6.8.0 to 6.9.0
- [Release notes](https://github.com/aio-libs/multidict/releases)
- [Changelog](https://github.com/aio-libs/multidict/blob/master/CHANGES.rst)
- [Commits](aio-libs/multidict@v6.8.0...v6.9.0)

Updates `propcache` from 0.5.2 to 0.5.4
- [Release notes](https://github.com/aio-libs/propcache/releases)
- [Changelog](https://github.com/aio-libs/propcache/blob/master/CHANGES.rst)
- [Commits](aio-libs/propcache@v0.5.2...v0.5.4)

Updates `yarl` from 1.24.5 to 1.25.1
- [Release notes](https://github.com/aio-libs/yarl/releases)
- [Changelog](https://github.com/aio-libs/yarl/blob/master/CHANGES.rst)
- [Commits](aio-libs/yarl@v1.24.5...v1.25.1)

Updates `ruff` to 0.16.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.7...0.16.8)

Updates `coverage` to 7.16.1
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.16.0...7.16.1)

---
updated-dependencies:
- dependency-name: idna
  dependency-version: '3.20'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-updates
- dependency-name: multidict
  dependency-version: 6.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-updates
- dependency-name: propcache
  dependency-version: 0.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-updates
- dependency-name: yarl
  dependency-version: 1.25.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-updates
- dependency-name: ruff
  dependency-version: 0.16.8
  dependency-type: direct:production
  dependency-group: pip-updates
- dependency-name: coverage
  dependency-version: 7.16.1
  dependency-type: direct:production
  dependency-group: pip-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added automation This issue or pull request was created by automation pip-update This pull request updates a pip package labels Sep 22, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 22, 2026 08:14
@dependabot dependabot Bot added automation This issue or pull request was created by automation pip-update This pull request updates a pip package labels Sep 22, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automation This issue or pull request was created by automation pip-update This pull request updates a pip package

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants