[dependabot]

Bumps the python-dependencies group with 6 updates in the / directory:

Package	From	To
filelock	4.0.9	4.2.1
google-genai	2.28.0	2.31.0
pydantic	2.13.5	2.14.1
pydantic-settings	2.15.0	2.16.0
typer	0.27.2	0.27.3
ruff	0.16.10	0.17.1

Updates filelock from 4.0.9 to 4.2.1

Release notes

Sourced from filelock's releases.

4.2.1

• On a singleton wrapper, close> and close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. #832
• ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an AsyncFileLock call joins its queue no longer blocks every later call on that lock. #833
• Fix ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database in a directory other accounts cannot write, such as one under %LOCALAPPDATA%. The lock removes link directories through a checked descriptor rather than by name, reads a link directory's name only when the locking account owns it, and leaves alone a directory with other content renamed onto a link directory's name. A database whose schema takes more than a few kilobytes to load raises ValueError instead of running past the acquire timeout. #834
• Fix five bugs in opening the lock file. UnixFileLock no longer truncates a file it did not create, such as one renamed to the lock path, and no longer applies mode to it. An on_acquired hook that writes holder metadata now truncates the file itself. A lease (Linux) or an oplock (Windows) on the lock file or a soft lock's marker no longer holds acquire() past its timeout or blocking=False, and an oplock no longer holds release(); ReadWriteLock on Windows waits for its timeout and raises Timeout. On Windows, a mode without group and other bits, such as 0o600, now creates the lock file with an owner-only permission list; the ReadWriteLock database gets the same. The soft locks' writability check no longer follows a symlink swapped in at the lock path. On a filesystem without flock, a contender from another account now waits on a marker it cannot write instead of raising PermissionError. #835
• Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing a live holder's marker in three cases: the holder and the contender run in Linux time namespaces with different boottime offsets; only one of them can read the boot id; a process other than the owner rewrote the marker. Soft markers no longer carry group or other write bits. A process name containing a carriage return or another line separator no longer makes the stale check raise ValueError. When /proc/self/ns/time exists but cannot be read, the stale check no longer compares start times and keeps the marker. #836
• The async read-write locks record their hold under a task owner, so synchronous code on the executor thread that took the hold can no longer re-enter or release it. AsyncSoftReadWriteLock gives back one level on release, so synchronous readers of a shared singleton keep theirs. SoftReadWriteLock tracks read levels per thread: release() from a thread that holds none raises RuntimeError. After its heartbeat recorded a lost hold, it refuses new acquires until that hold is released. #838
• StrictSoftFileLock creates <path>.filelock and its claims directory with the lock's mode and sets the sticky bit (a directory flag that lets only a file's owner remove it) on both. On the next acquisition it narrows a directory it owns that an earlier release created wider; it leaves a directory of another account as it is, so remove such leftovers by hand. It reaches claims through a descriptor opened without following symlinks; on Windows it holds both directories open and refuses a junction (a directory that points at another directory). Under a sticky parent such as /tmp it refuses a coordination directory of another account, as SoftReadWriteLock does for <path>.rw. One read grace now covers a whole claim scan, a failed claim cleanup no longer leaves the sentinel descriptor open, and a non-regular node at a sentinel private-record name raises SoftFileLockProtocolError. On Windows, contenders read claims without blocking their owner's unlink. #839

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.2.4 (2026-10-19)

---

• Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. :pr:863

---

4.2.3 (2026-10-19)

---

• Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. :pr:860
• Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error.

---

4.2.2 (2026-10-18)

---

• Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now leaves the lock's hold count unchanged. :pr:856

---

4.2.1 (2026-10-17)

---

• On a singleton wrapper, :meth:AsyncReadWriteLock.close() <filelock.AsyncReadWriteLock.close> and :meth:AsyncSoftReadWriteLock.close() <filelock.AsyncSoftReadWriteLock.close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. :pr:832
• :class:~filelock.ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. :class:~filelock.AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an :class:~filelock.AsyncFileLock call joins its queue no longer blocks every later call on that lock. :pr:833
• Fix :class:~filelock.ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database

... (truncated)

Commits

• 60331bb Release 4.2.1
• 834bf13 🧪 test(soft): skip Unix pin test on Windows
• 9d15e38 fix(soft-rw): isolate subclass singleton registries (#855)
• e1e825b 🐛 fix(open): keep lock files intact, honor deadlines and mode (#835)
• 5e3f2ec 🐛 fix(read-write): keep SQLite off shared names, bound schema (#834)
• bfa066d 🐛 fix(strict): keep claim directories private to the lock (#839)
• 977d2c3 🐛 fix(soft): wait on an empty marker instead of evicting (#846)
• 740ff66 🐛 fix(soft): break stale markers without emptying the lock path (#843)
• 86c6d5f 🐛 fix(async): honor cancellation and per-thread gates (#844)
• eeceaa8 🐛 fix(soft): keep live holders when owner identity differs (#836)
• Additional commits viewable in compare view

Updates google-genai from 2.28.0 to 2.31.0

Release notes

Sourced from google-genai's releases.

v2.31.0

2.31.0 (2026-10-14)

Features

• interactions: Add gemini-4-argon to Model enum (8554b07)

Bug Fixes

• Clear continuation state and preserve prompt feedback when continuation hop returns no candidates (a0d809c)
• Fix the function declaration parser for union types. Fixes #3060 (be32e9e)
• Fix the grounding metadata merging for automatic continuation in generate content and generate content stream (f1499bb)
• Make continuation streams retry dropped hops, stop on prompt_feedback, and keep real errors in generate_content (339a929)
• Match the mTLS endpoint to each transport's SSL context, including plain aiohttp (f8a4693)

v2.30.1

2.30.1 (2026-10-13)

Bug Fixes

• Concatenate output_text across multi-step model responses in a turn (180c345)

v2.30.0

2.30.0 (2026-10-13)

Features

• Accumulate streaming continuation usage metadata and expose initial_prompt_token_count (b27f3cd)
• Add continuation_token to the Interactions interaction.status_update event. (02db4c5)
• Add a CONTINUATION_REQUIRED Interaction status (bf9d6d7)
• Add billable token counts fields (6a6501c)
• Add startOffset/endOffset to Transcription and interimTranscriptTimestampEnabled to RealtimeInputConfig (c644a94)
• Add usage in InteractionStatusUpdate events (56c3a1a)
• Allow automatic resumption of continuation token for in generate content and generate content stream. Default behavior for this feature is disabled (83e43ea)
• cli: Update Speakeasy generator to v2.948.0, bump CLI to v0.4.2, and apply CLI overlay fixes (cdcd3dd)
• Enable automatic continuation token resumption for chats module. (9ebf714)

Bug Fixes

• Clear intermediate CONTINUATION finish_reason in streaming continuation (8a641d8)
• Do not record incomplete continuation stream turns in curated chat history (b382e01)
• gemini-api-cli: Remove unsupported 2.5 and 1.6 models from Interactions model options and CLI examples (fe5fb10)
• genai: Deduplicate Flash and Omni descriptions in ModelOption (33efaad)
• interactions: Restore super().model_construct in Interaction model validator (ccd5dd3)
• python: Discard stale checkpoint token on non-resumable finish reason (f44e8ee)

... (truncated)

Changelog

Sourced from google-genai's changelog.

2.31.0 (2026-10-14)

Features

• interactions: Add gemini-4-argon to Model enum (8554b07)

Bug Fixes

• Clear continuation state and preserve prompt feedback when continuation hop returns no candidates (a0d809c)
• Fix the function declaration parser for union types. Fixes #3060 (be32e9e)
• Fix the grounding metadata merging for automatic continuation in generate content and generate content stream (f1499bb)
• Make continuation streams retry dropped hops, stop on prompt_feedback, and keep real errors in generate_content (339a929)
• Match the mTLS endpoint to each transport's SSL context, including plain aiohttp (f8a4693)

2.30.1 (2026-10-13)

Bug Fixes

• Concatenate output_text across multi-step model responses in a turn (180c345)

2.30.0 (2026-10-13)

Features

• Accumulate streaming continuation usage metadata and expose initial_prompt_token_count (b27f3cd)
• Add continuation_token to the Interactions interaction.status_update event. (02db4c5)
• Add a CONTINUATION_REQUIRED Interaction status (bf9d6d7)
• Add billable token counts fields (6a6501c)
• Add startOffset/endOffset to Transcription and interimTranscriptTimestampEnabled to RealtimeInputConfig (c644a94)
• Add usage in InteractionStatusUpdate events (56c3a1a)
• Allow automatic resumption of continuation token for in generate content and generate content stream. Default behavior for this feature is disabled (83e43ea)
• cli: Update Speakeasy generator to v2.948.0, bump CLI to v0.4.2, and apply CLI overlay fixes (cdcd3dd)
• Enable automatic continuation token resumption for chats module. (9ebf714)

Bug Fixes

• Clear intermediate CONTINUATION finish_reason in streaming continuation (8a641d8)
• Do not record incomplete continuation stream turns in curated chat history (b382e01)
• gemini-api-cli: Remove unsupported 2.5 and 1.6 models from Interactions model options and CLI examples (fe5fb10)
• genai: Deduplicate Flash and Omni descriptions in ModelOption (33efaad)
• interactions: Restore super().model_construct in Interaction model validator (ccd5dd3)
• python: Discard stale checkpoint token on non-resumable finish reason (f44e8ee)
• Raise default HTTP timeouts so long-running requests aren't killed client-side (b006b4b)
• Resume streaming generation from the latest checkpoint continuation token on mid-stream errors or cutoffs (90bb32b)
• Update EnvironmentConfig.env schema to map keys to EnvVar or string. (3108d8c)

... (truncated)

Commits

• 6bbead9 chore(main): release 2.31.0 (#3123)
• be32e9e fix: fix the function declaration parser for union types. Fixes #3060
• efbe9d7 chore: internal change
• 339a929 fix: make continuation streams retry dropped hops, stop on prompt_feedback, a...
• 829ec55 test: retry transient errors for longer in the nightly integration tests
• 1dbf070 test: switch the shared integration tests to gemini-3.8-flash
• f1499bb fix: fix the grounding metadata merging for automatic continuation in generat...
• 8554b07 feat(interactions): add gemini-4-argon to Model enum
• a0d809c fix: clear continuation state and preserve prompt feedback when continuation ...
• f8a4693 fix: Match the mTLS endpoint to each transport's SSL context, including plain...
• Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.0

Release notes

Sourced from pydantic-settings's releases.

v2.16.0

Highlights

Breaking changes and behavior changes

• Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
• python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
• Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
• validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
• CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
• JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
• Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

• Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
• Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
• AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
• env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
• CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

• CliApp.serialize output now round-trips through CliApp.run for enums, tuples, dates and Decimals (#988), explicit None values (#981), empty containers (#1008), CliVariadicArg values (#976) and populated CliUnknownArgs fields, which previously raised IndexError (#992).
• Empty JSON arrays (--items []) now give an empty list instead of [''] (#994).
• Tuples, frozenset, MutableSequence and other collection subtypes are now treated as repeatable/variadic options (#972), and so are named collection type aliases such as TypeAliasType('Addrs', list[IPvAnyAddress]) (#1032).
• cli_exit_on_error=False is now honored in CliSubCommand parsers, which raise SettingsError instead of exiting (#977).
• CliSubCommand aliases keep their case with case_sensitive=False (#989).
• Each CliUnknownArgs field now receives only its own subcommand's leftover args (#1004).
• CliApp.format_help no longer crashes when cli_prefix is set in model_config (#945).

Type aliases and parsing

• Named union type aliases (TypeAliasType('V', list[int] | str)) now decode like their inline equivalents in env and dotenv sources, including under Optional, Annotated and custom validation aliases (#1006, #1030, #1041).
• Resolving a named Annotated type alias no longer mutates shared FieldInfo metadata, which made validators run twice on subclasses or after model_rebuild() (#979).
• A bare single-segment AliasPath('SOME_KEY') no longer tries to JSON-decode plain string values (#980).
• collections.abc.Set/MutableSet/typing.AbstractSet fields now JSON-decode env values (#973).
• A bare typing.Dict field with env_nested_delimiter no longer raises IndexError, which was a regression in 2.13.0 (#1009).
• Case-insensitive matching now works for nested pydantic dataclasses (#1010).

Dotenv, secrets and config files

• With extra='allow', a non-lowercase env_prefix is now stripped from dotenv extras (#959, #968).
• secrets_case_sensitive=True is now honored on Windows (#1001).
• An empty JSON config file is treated as an empty mapping instead of crashing (#947), matching YAML and TOML.
• TOML table headers: ~ paths are now expanded when checking that the file exists (#1034), and an explicit toml_table_header=() now overrides the model config to read the file root (#1027).

Cloud sources

• Azure Key Vault and GCP Secret Manager now honor env_parse_none_str (#1019, #1040).
• Azure Key Vault: dash_to_underscore=True now works for nested model fields (#1025).
• NestedSecretsSettingsSource now validates its specific constructor arguments (#975).

... (truncated)

Commits

• 8c259f4 Prepare release 2.16.0 (#1043)
• 4bc667a Keep case of non-option CLI args when case_sensitive=False (#1036)
• f75a805 Simplify alias resolution branch and test alias with AliasChoices/AliasPath (...
• cfdc558 Honor env_parse_none_str for GCP Secret Manager (#1040)
• 081d39f Fix config file and CLI values being ignored when alias differs from validati...
• c46ebc4 Expand home paths when checking TOML table headers (#1034)
• 6ea85e6 Decode optional Annotated named union aliases (#1041)
• ca9d7c4 Fix JSON decoding for optional named union aliases (#1030)
• b6ddda2 Fix CLI parsing for named collection type aliases (#1032)
• bedb60e Honor explicit empty TOML table header overrides (#1027)
• Additional commits viewable in compare view

Updates typer from 0.27.2 to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

• 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

• ⬆ Bump pyjwt from 2.13.0 to 2.15.0. PR #1969 by @​dependabot[bot].
• ⬆ Bump urllib3 from 2.7.0 to 2.8.0. PR #1968 by @​dependabot[bot].
• ⬆ Bump pymdown-extensions from 11.0 to 11.0.1. PR #1924 by @​dependabot[bot].
• ⬆ Bump the python-packages group across 1 directory with 7 updates. PR #1966 by @​dependabot[bot].
• ⬆ Bump cryptography from 48.0.1 to 50.0.2. PR #1920 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #1967 by @​pr-submit[bot].
• ⬆ Bump the github-actions group with 3 updates. PR #1965 by @​dependabot[bot].
• ⬆ Bump anyio from 4.12.0 to 4.14.2. PR #1959 by @​dependabot[bot].
• ✅ Fix flaky app_dir and launch tutorial tests under xdist. PR #1951 by @​YuriiMotov.
• ⬆ Bump the python-packages group across 1 directory with 8 updates. PR #1948 by @​dependabot[bot].
• ⬆ Bump annotated-doc from 0.0.4 to 0.0.5. PR #1949 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #1950 by @​pr-submit[bot].
• ⬆ Bump the github-actions group with 4 updates. PR #1947 by @​dependabot[bot].

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

• 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

• ⬆ Bump pyjwt from 2.13.0 to 2.15.0. PR #1969 by @​dependabot[bot].
• ⬆ Bump urllib3 from 2.7.0 to 2.8.0. PR #1968 by @​dependabot[bot].
• ⬆ Bump pymdown-extensions from 11.0 to 11.0.1. PR #1924 by @​dependabot[bot].
• ⬆ Bump the python-packages group across 1 directory with 7 updates. PR #1966 by @​dependabot[bot].
• ⬆ Bump cryptography from 48.0.1 to 50.0.2. PR #1920 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #1967 by @​pr-submit[bot].
• ⬆ Bump the github-actions group with 3 updates. PR #1965 by @​dependabot[bot].
• ⬆ Bump anyio from 4.12.0 to 4.14.2. PR #1959 by @​dependabot[bot].
• ✅ Fix flaky app_dir and launch tutorial tests under xdist. PR #1951 by @​YuriiMotov.
• ⬆ Bump the python-packages group across 1 directory with 8 updates. PR #1948 by @​dependabot[bot].
• ⬆ Bump annotated-doc from 0.0.4 to 0.0.5. PR #1949 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #1950 by @​pr-submit[bot].
• ⬆ Bump the github-actions group with 4 updates. PR #1947 by @​dependabot[bot].

Commits

• b15210b 🔖 Release version 0.27.3 (#1973)
• 8bfe6d1 📝 Update release notes
• a74010f 🐛 Escape terminal control characters in error messages (#1972)
• 11b083b 📝 Update release notes
• 910a474 ⬆ Bump pyjwt from 2.13.0 to 2.15.0 (#1969)
• 33b1eec 📝 Update release notes
• 62f1d4a ⬆ Bump urllib3 from 2.7.0 to 2.8.0 (#1968)
• ffc8b9a 📝 Update release notes
• 1b7ceee ⬆ Bump pymdown-extensions from 11.0 to 11.0.1 (#1924)
• 40c39c1 📝 Update release notes
• Additional commits viewable in compare view

Updates ruff from 0.16.10 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions...

  Description has been truncated