[dependabot]

Bumps the python-packaging group with 28 updates in the / directory:

Package	From	To
certifi	2026.6.17	2026.10.23
polars	1.42.1	2.0.0
pytz	2026.2	2026.6
temporalio	1.30.0	1.35.0
duckdb	1.5.4	1.5.6
statsmodels	0.14.6	0.15.0
coverage	7.15.2	7.16.2
hypothesis	6.152.7	6.168.5
pytest	9.1.1	9.2.0
black	26.5.1	26.10.1
commitizen	4.16.5	4.19.3
mypy	2.3.0	2.4.1
pre-commit	4.6.1	4.6.2
ruff	0.16.0	0.17.3
types-pyyaml	6.0.12.20260724	6.0.12.20261030
build	1.5.0	1.6.1
setuptools	83.0.0	84.2.1
twine	6.2.0	7.0.0
wheel	0.47.0	0.48.0
charset-normalizer	3.4.9	3.5.2
idna	3.18	3.20
nexus-rpc	1.4.0	1.5.0
packaging	26.2	26.3
polars-runtime-32	1.42.1	2.0.0
protobuf	7.35.1	7.36.2
pygments	2.20.0	2.21.0
types-protobuf	7.34.1.20260518	7.35.1.20260906
urllib3	2.7.0	2.8.0

Updates certifi from 2026.6.17 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• 662df63 Restore unaffected emSign roots (#439) (#440)
• 5cb238c Remove emsign (#437)
• 69494a7 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#436)
• 029c7b0 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#435)
• 9d0a8f1 Add support for Python 3.15 (#432)
• db472ab Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#431)
• f4bc676 2026.07.22 (#428)
• 4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427)
• 01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426)
• Additional commits viewable in compare view

Updates polars from 1.42.1 to 2.0.0

Release notes

Sourced from polars's releases.

Python Polars 2.0.0

💥 Breaking changes

• Run SQL window functions over grouped rows on the aggregated rows, and evaluate QUALIFY before the projection (#29746)
• Type exact SQL numeric literals as Decimal and truncate SQL %/DIV (#29536)
• Allow deterministic expression plugins to opt into CSE/CSPE (#29428)
• Read Parquet ENUM type as pl.String (#29331)
• More map operations (#29296)
• Deprecate cut/qcut (#29329)

🚀 Performance improvements

• Fix phases ending too soon due to join sampling (#29752)
• Group record batch fetches of remote IPC scans (#29750)
• Mark group-by node as memory intensive pipeline blocker (#29749)
• Don't inline slow OOC memory drift path (#29745)
• Only prefetch on unspill when there is memory headroom (#29701)
• Pushdown filters to scan_lance (#29538)
• Do not materialize equal ScalarColumns in Column::append/extend (#28989)
• Evaluate scalar windows in the streaming window node (#29698)
• Don't materialize scalar columns in DataFrame::estimated_size (#29711)
• Defer cached pread from prefetch to decode for Parquet (#29702)
• Decode IPC scans out of order when order is not observed (#29675)
• IPC metadata suffix fetch (#29692)
• Speed up null tracking in streaming group-by sum, min and max (#29691)
• Cache Iceberg manifest files across scans (#29623)
• Improve pushdown support for fallible Hive predicates (#29594)
• Streamline BytecodeParser method rewriting (#29632)
• Stream from_dicts records straight into column buffers (#29656)
• Read correlated SQL aggregates from the outer join when the subquery repeats it (#29685)
• Emit files unordered for remote IPC files when order not observed (#29678)
• Don't keep input order for order-insensitive windows in all engines (#29680)
• Fix parallelization in top-k reducer (#29684)
• Share one bloom filter between the build threads of a runtime filter (#29677)
• Add streaming (out-of-core) sort (#29657)
• Insert keys that start a run of equal keys into the hot group-by table right away (#29673)
• Prefetch key-row hash table lookups in blocks (#29663)
• Lower count-guarded sums to a sum that is null on empty input (#29668)
• Use single PUT for small cloud uploads (#29603)
• Don't cache plain scans in the streaming engine (#29654)
• Change single-key group-by hash table layout and add prefetching (#29661)
• Use the integer ranges of sampled parquet row groups in filter estimates (#29655)
• Raise HTTP rate-limiter read init default (#29584)
• Change join hash table layout and add prefetching (#29653)
• Add a fast-path for as_list with only a single input (#29592)
• Use one runtime filter builder per thread for a finished sample (#29646)
• Compute decimal addition, subtraction and multiplication in i64 when values fit (#29638)
• Spread decimal sums and means over lanes and check the sum's 38 digits once (#29637)
• Compute decimal addition, subtraction and multiplication without per-row validity (#29634)
• Skip or reuse UDF disassembly in BytecodeParser (#29625)

... (truncated)

Commits

• 22a147d perf: Fix phases ending too soon due to join sampling (#29752)
• e319cca Python Polars 2.0 (#29723)
• d1d6ba4 fix: Find SQL aggregates by their function name, and raise on nested aggregat...
• 5c6a473 perf: Group record batch fetches of remote IPC scans (#29750)
• c630040 perf: Mark group-by node as memory intensive pipeline blocker (#29749)
• e1fbe49 fix: Run SQL window functions over grouped rows on the aggregated rows, and e...
• 3de661d feat: Enable OOC by default with 80% of available RAM as threshold (#29741)
• 0159b45 refactor: Hold the category mapping in the categorical is_in lookup (#29747)
• 29995b3 perf: Don't inline slow OOC memory drift path (#29745)
• 8399cf6 fix: Match categories added after is_in prepares a string haystack (#29744)
• Additional commits viewable in compare view

Updates pytz from 2026.2 to 2026.6

Commits

• e3c6fe2 Bump version numbers to 2026.6/2026f
• 23e2e67 IANA 2026f
• e6f3078 Squashed 'tz/' changes from 039ef27cc5..d8acf4bc22
• 21be17f Add Python 3.14 to test suite
• fddd01c Bump version numbers to 2026.5 (2026e)
• d79605f Squashed 'tz/' changes from d633fe7ed3..db07415c7d
• 8f05ab3 IANA 2026e
• 1ac6e51 Bump version numbers to 2026.4 (2026d)
• 1672798 IANA 2026d
• 0b5995b Squashed 'tz/' changes from 71f28b9ab3..bac9223f4b
• Additional commits viewable in compare view

Updates temporalio from 1.30.0 to 1.35.0

Release notes

Sourced from temporalio's releases.

1.35.0

Notable Changes

Added

• Nexus links now convert to and from Link.Callback instead of raising NotImplementedError.

• Add an experimental Google Cloud Storage external payload storage driver with an optional async gcloud-aio-storage adapter.

• Add experimental notification service models in temporalio.nexus.notifications. The SDK does not currently use these models.

• Worker now warns when an activity method is registered from the class instead of from an instance (i.e. its first parameter is an unbound self).

• Add experimental versioning_override to workflow.start_child_workflow and workflow.execute_child_workflow to override inherited parent versioning, and common.OneTimeVersioningOverride to route an execution to a deployment version until its first completed workflow task. Child overrides require Temporal Server 1.32 or newer; invalid child overrides raise exceptions.InvalidVersioningOverrideError.

• Workers and clients can now read external storage reference payloads that were encoded with the configured payload codec and marked with __temporal_external_storage_reference metadata. This release does not write encoded references yet; a later release will, so upgrade all workers before then.

• WorkflowEnvironment.start_time_skipping_v2() starts a Temporal CLI dev server with per-workflow virtual-clock time skipping, the eventual replacement to the global-clock Java test server returned by start_time_skipping().

• TimeSkipper(client, config=TimeSkippingConfig(...)) from temporalio.testing wraps an existing Client with per-workflow time skipping for use outside the test environment.

• Core: Child workflow commands, including those submitted through the C bridge, support pinned, auto-upgrade, and one-time worker deployment versioning overrides on Temporal Server 1.32.0 or later. Child-start resolutions distinguish invalid versioning overrides and missing namespaces from other start failures.

• Expose connect_timeout on Client.connect and ConnectConfig to bound TCP connection attempts independently of RPC timeouts. The default remains unset.

• workflow.new_random() accepts an optional name that is mixed into the seed, so differently named generators, and workflow.random(), produce different sequences.

• Add startup timeout options to WorkflowEnvironment.start_local and WorkflowEnvironment.start_time_skipping to configure how long to wait for the server to become ready after spawning.

Stabilized

• Removed experimental labels from the core plugin APIs.

Changed

• Payload converters exposed by data converters and workflow/activity accessors retain transfer type conversion, so direct use behaves consistently with SDK serialization.

💥 Breaking Changes

• SchedulePolicy.catchup_window now defaults to None. An unspecified window will use the server configured default.

• Experimental: Nexus Workflow Updates now require wait_for_stage to be explicitly set to ACCEPTED.

• The Deep Agents, Google ADK, Google GenAI, LangGraph, LangSmith, and Strands Agents integrations have moved to independently versioned packages in temporalio/ai-integrations. The existing SDK extras install the corresponding standalone packages and public temporalio.contrib imports forward their APIs; new code should depend on the standalone packages and use their temporalio.<integration> imports directly.

• The OpenAI Agents integration has moved to the independently versioned temporalio-openai-agents package. The existing temporalio[openai-agents] extra now installs that package, and the old public temporalio.contrib.openai_agents imports remain available at runtime and retain their static type information. New code should depend on temporalio-openai-agents directly and import temporalio.openai_agents.

• temporalio.contrib.google_adk_agents: ADK-generated ids and retry jitter now draw from a workflow-private deterministic stream (a workflow.new_random() per run) instead of workflow.random(). A workflow started under 1.34.0 that generated ADK ids or jitter (for example one waiting on a HITL response) may not replay deterministically across this upgrade; drain such workflows or use worker versioning.

• Decorating an async def function with @update_method.validator or passing one as validator to workflow.set_update_handler/set_dynamic_update_handler now raises ValueError. Previously the validator was silently never run, so every update was accepted.

... (truncated)

Changelog

Sourced from temporalio's changelog.

[1.35.0] - 2026-10-28

Added

• Nexus links now convert to and from Link.Callback instead of raising NotImplementedError.

• Add an experimental Google Cloud Storage external payload storage driver with an optional async gcloud-aio-storage adapter.

• Add experimental notification service models in temporalio.nexus.notifications. The SDK does not currently use these models.

• Worker now warns when an activity method is registered from the class instead of from an instance (i.e. its first parameter is an unbound self).

• Add experimental versioning_override to workflow.start_child_workflow and workflow.execute_child_workflow to override inherited parent versioning, and common.OneTimeVersioningOverride to route an execution to a deployment version until its first completed workflow task. Child overrides require Temporal Server 1.32 or newer; invalid child overrides raise exceptions.InvalidVersioningOverrideError.

• Workers and clients can now read external storage reference payloads that were encoded with the configured payload codec and marked with __temporal_external_storage_reference metadata. This release does not write encoded references yet; a later release will, so upgrade all workers before then.

• WorkflowEnvironment.start_time_skipping_v2() starts a Temporal CLI dev server with per-workflow virtual-clock time skipping, the eventual replacement to the global-clock Java test server returned by start_time_skipping().

• TimeSkipper(client, config=TimeSkippingConfig(...)) from temporalio.testing wraps an existing Client with per-workflow time skipping for use outside the test environment.

• Core: Child workflow commands, including those submitted through the C bridge, support pinned, auto-upgrade, and one-time worker deployment versioning overrides on Temporal Server 1.32.0 or later. Child-start resolutions distinguish invalid versioning overrides and missing namespaces from other start failures.

• Expose connect_timeout on Client.connect and ConnectConfig to bound TCP connection attempts independently of RPC timeouts. The default remains unset.

• workflow.new_random() accepts an optional name that is mixed into the seed, so differently named generators, and workflow.random(), produce different sequences.

• Add startup timeout options to WorkflowEnvironment.start_local and WorkflowEnvironment.start_time_skipping to configure how long to wait for the server to become ready after spawning.

Stabilized

• Removed experimental labels from the core plugin APIs.

Changed

• Payload converters exposed by data converters and workflow/activity accessors retain transfer type conversion, so direct use behaves consistently with SDK serialization.

💥 Breaking Changes

• SchedulePolicy.catchup_window now defaults to None. An unspecified window will use the server configured default.

• Experimental: Nexus Workflow Updates now require wait_for_stage to be explicitly set to ACCEPTED.

• The Deep Agents, Google ADK, Google GenAI, LangGraph, LangSmith, and Strands Agents integrations have moved to independently versioned packages in temporalio/ai-integrations. The existing SDK extras install the corresponding standalone packages and public temporalio.contrib imports forward their APIs; new code should depend on the standalone packages and use their temporalio.<integration> imports directly.

• The OpenAI Agents integration has moved to the independently versioned temporalio-openai-agents package. The existing temporalio[openai-agents] extra now installs that package, and the old public temporalio.contrib.openai_agents imports remain available at runtime and retain their static type information. New code should depend on temporalio-openai-agents directly and import temporalio.openai_agents.

• temporalio.contrib.google_adk_agents: ADK-generated ids and retry jitter now draw from a workflow-private deterministic stream (a workflow.new_random() per run) instead of workflow.random(). A workflow started under 1.34.0 that generated ADK ids or jitter (for example one waiting on a HITL response) may not replay deterministically across this upgrade; drain such workflows or use worker versioning.

• Decorating an async def function with @update_method.validator or passing one as validator to workflow.set_update_handler/set_dynamic_update_handler now raises ValueError. Previously the validator was silently never run, so every update was accepted.

• temporalio.contrib.opentelemetry: removed TemporalIdGenerator.seed_span_id() and seed_trace_id().

... (truncated)

Commits

• b625314 Prepare release 1.35.0 (#2034)
• c34e6b7 Fix S3 storage key limits and permission guidance (#2002)
• 8b864e4 Add Google Cloud Storage support for external payloads (#1980)
• 9279de2 feat(endode-extstore-refs): external storage references are now decoded (#1946)
• d30ecbe Preserve Workflow Streams after workflow closure (#1994)
• ea7daa8 Keep ReplaySafeLoggerProvider working with opentelemetry-api 1.45 (#2030)
• b091206 Stamp the time-skipping config on update-with-start workflows (#2017)
• e73fa3d Don't hang Nexus worker shutdown when a handler failure can't be encoded (#2031)
• 9a9777e Remove timer race from external cancel test (#2027)
• 60e439c Return None for an unset next_retry_delay on a deserialized ApplicationError ...
• Additional commits viewable in compare view

Updates duckdb from 1.5.4 to 1.5.6

Release notes

Sourced from duckdb's releases.

v1.5.6 Bugfix Release

See DuckDB's changelog for all changes in DuckDB.

v1.5.5 Bugfix Release

See DuckDB's changelog for all changes in DuckDB.

What's Changed in DuckDB-Python

• Fix numpy deprecations by @​evertlammerts in duckdb/duckdb-python#505
• Fix alias of DuckDBPyRelation.query (closes #468) by @​evertlammerts in duckdb/duckdb-python#524

Commits

• 802a345 set submodule pin to v1.5.6 release hash
• f4f4ad2 [duckdb-labs bot] Bump DuckDB submodule (#631)
• 3d35637 Bump submodule
• 2929d48 [duckdb-labs bot] Bump DuckDB submodule (#625)
• e1b6247 Bump submodule
• f487d2d [duckdb-labs bot] Bump DuckDB submodule (#624)
• ede665a Bump submodule
• f0829a7 [duckdb-labs bot] Bump DuckDB submodule (#623)
• 7e1aaa2 Bump submodule
• b385dbf [duckdb-labs bot] Bump DuckDB submodule (#621)
• Additional commits viewable in compare view

Updates statsmodels from 0.14.6 to 0.15.0

Release notes

Sourced from statsmodels's releases.

Release 0.15.0

The statsmodels developers are happy to announce the release of 0.15.0. 358 issues were closed in this release and 655 pull requests were merged. Major new features include:

• Standardized on rng for controlling randomness across the package (SPEC 007), replacing seed/random_state
• Functions with variable-length tuple returns now return documented NamedTuple results instead
• A new abstracted formula engine that supports both patsy and formulaic as the backend
• Support for Polars DataFrames and Series as model input
• Switched the build backend from setuptools to meson-python
• New robust estimators: CovDetMCD, CovDetS, CovDetMM, and RLMDetSMM
• New tests: Diebold-Mariano, Pesaran-Timmermann, Jonckheere-Terpstra, Leybourne-McCabe, and a delete-k block jackknife estimator
• The Hamilton filter, local false discovery rate correction, and an L1-penalized GLM solver
• HurdleCountModel gained fit_regularized, and MICEData is now iterable

This release also raises the minimum supported versions of NumPy, SciPy, and pandas, and tightens input validation for many string-valued options across the package (invalid values that previously failed silently or with a confusing error now raise a clear ValueError). A handful of long-standing bugs in seldom-exercised code paths were also corrected as part of a systematic coverage audit this cycle, some of which change numerical output for affected models. See the release notes for the complete list of enhancements, breaking changes, and bug fixes.

Commits

• 278ff99 Merge pull request #10211 from bashtage/update-release-note
• ab3f3bc DOC: Final release note
• 9307ef1 Merge pull request #8712 from bdpedigo/nobs-style
• 463e5c5 Merge pull request #10210 from Panzerkampfwagen-del/mice-data-iterable
• cc734d8 Merge branch 'main' into mice-data-iterable
• 2912b84 Merge pull request #10209 from Panzerkampfwagen-del/var-df-model-docstring
• 279b9f4 ENH: make MICEData iterable, yielding successive imputed datasets
• ce7f2c0 DOC: clarify VARResults.df_model counts parameters per equation
• d1e1875 Merge pull request #10205 from bashtage/fix-hurdle-and-l1-cov
• bb385fb Merge pull request #10208 from bashtage/update-release-note
• Additional commits viewable in compare view

Updates coverage from 7.15.2 to 7.16.2

Release notes

Sourced from coverage's releases.

7.16.2

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

7.16.1

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
• Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.
• Fix: the Total row in the footer of the HTML report’s index page was recomputed in JavaScript with rounding that could disagree with the total the server rendered in the heading, including showing 100% when coverage was not complete. The footer now clamps values the way the rest of the report does, and when nothing is filtered out it is shown exactly as the server rendered it, so the two can’t disagree. That also keeps rows the report omits (--skip-covered drops fully covered files) in the total. Fixes issue 2256.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

7.16.0

Version 7.16.0 — 2026-08-28

• When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
• The Coverage.switch_context() method now returns the previous context.
• Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
• Fixes to validation of options and configuration settings:
  • Negative precision settings now always cause useful error messages (pull 2261).
  • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
  • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
  • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
• Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

7.15.4

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
• Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.

... (truncated)

Changelog

Sourced from coverage's changelog.

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168_.

• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289_.

• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923_.

.. _issue 1923: coveragepy/coveragepy#1923 .. _issue 2168: coveragepy/coveragepy#2168 .. _issue 2289: coveragepy/coveragepy#2289

.. _changes_7-16-1:

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

• Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

• Fix: the Total row in the footer of the HTML report's index page was recomputed in JavaScript with rounding that could disagree with the total the server rendered in the heading, including showing 100% when coverage was not complete. The footer now clamps values the way the rest of the report does, and when nothing is filtered out it is shown exactly as the server rendered it, so the two can't disagree. That also keeps rows the report omits (--skip-covered drops fully covered files) in the total. Fixes issue 2256_.

.. _issue 1563: coveragepy/coveragepy#1563 .. _issue 2256: coveragepy/coveragepy#2256 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Version 7.16.0 — 2026-08-28

... (truncated)

Commits

• 5643ae7 docs: prep for 7.16.2
• a3e969f fix: dynamic_context for @​staticmethod and @​classmethod tests (issue 1923) (#...
• 8ad7236 fix: stop counting the try/else line when a with statement raises (#2301)
• c6dab1f fix(debug): debug output doesn't mis-handle odd line separators #2296
• 08fbc32 style: Protocols should use ... for method bodies
• bc7b0e3 refactor: positional-only args are better than pragmas
• 52afd6b Document parallel tox coverage data files (#2284)
• f653aae fix: loop completion arcs on Python 3.14 (#2281)
• cc1ced4 test: PyPy still compiles comprehensions as functions
• 85a9088 chore: make upgrade
• Additional commits viewable in compare view

Updates hypothesis from 6.152.7 to 6.168.5

Release notes

Sourced from hypothesis's releases.

Hypothesis for Python - version 6.152.9

This release substantially improves our internal distribution for generating integers. This release has the most visible effect on "integers()", but may incidentally improve other strategies which draw integers internally.

Our integers distribution had two problems. First, it had jagged discontinuities at certain values where we switched sampling approaches. Second, it used a different distribution for bounded and unbounded ranges, which resulted in "st.integers()" and "st.integers(-264, 264)" producing very different distributions despite being semantically similar.

We now use a smooth distribution for both "st.integers()" and "st.integers(a, b)", which fixes both of these issues. This should substantially improve our testing power in certain cases.

The only way this release should be user-visible is that it finds more bugs! If this release is user-visible in other ways - for example, because it is slower, or produces a worse distribution in some cases - please open an issue.

The canonical version of these notes (with links) is on readthedocs.

Hypothesis for Python - version 6.152.8

This release drops support for end-of-life Django 4.2.

The canonical version of these notes (with links) is on readthedocs.

Commits

• ca2a4c6 Bump hypothesis version to 6.168.5 and update changelog
• c1c9957 Merge pull request #4894 from MarcoGorelli/django-from-field-return-type
• d862501 Bump hypothesis version to 6.168.4 and update changelog
• de4ec1c Merge pull request #4887 from HypothesisWorks/create-pull-request/patch
• 8a80889 add pypy312 support
• 9ee265d Update pinned dependencies
• f92f61c Fix the return type of django's from_field
• 44b82b2 Bump hypothesis version to 6.168.3 and update changelog
• aeaafb5 Merge pull request #4888 from gpacix/fix-quadratic-statistics
• f3f4a29 wording, remove hardcoded test
• Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

• #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

• #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

  Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

• #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

  • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
  • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

  pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

• #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

• #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

• #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

  They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

• #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

• #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

• #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
• #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
• #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

• #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits

• ae1d0ff Prepare release version 9.2.0
• 143ce31 pre-commit: exclude codespell on generated release announcements
• 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
• a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
• 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
• 41d12cd docs: clarify typing for yield fixtures
• b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
• 16f87a7 docs: improve getting-started.rst test execution description
• 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
• ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
• Additional commits viewable in compare view

Updates black from 26.5.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that us...

Description has been truncated