chore(deps): bump the package-updates group with 8 updates

[dependabot]

Updates the requirements on environs[django], feedparser, markdown, granian, coverage, peek-python, pyrefly and ruff to permit the latest version.
Updates environs[django] to 15.1.0

Changelog

Sourced from environs[django]'s changelog.

15.1.0 (2026-07-31)

Features:

• Add a specific exception, EnvNotSetError, for missing environment variables (#480). Thanks paduszyk for the suggestion and w3lld1 for the PR.

15.0.1 (2026-04-06)

Bug fixes:

• Exported environment variables take precedence over .env files (regression from 15.0.0) (#464). Thanks DougEdey-Slice for reporting.

15.0.0 (2026-03-31)

Features:

• Env.read_env no longer mutates os.environ (#393). Values from .env files are loaded into the Env instance only. This comes with two breaking changes:
  • Env.read_env is now an instance method rather than a @staticmethod. Env.read_env() -> env.read_env()
  • The verbose parameter of read_env is been removed.

Other changes:

• Drop support for marshmallow 3, which is EOL. marshmallow>=4.0.0 is supported.
• Minor typing improvements (#463).

14.6.0 (2026-02-19)

Bug fixes:

• Fix variable expansion with other characters (#359). Thanks flymanzhao for reporting and veeceey for the PR.

Other changes:

• Update lowest supported marshmallow version to 3.26.2 (#448). Thanks whyscream for the PR.

14.5.0 (2025-11-02)

Features:

• Add strip_whitespace param to FileAwareEnv (#431). Thanks eandersons for the suggestion and PR.

Other changes:

• Drop support for Python 3.9, which is EOL.

... (truncated)

Commits

• 886812c Bump version and update changelog
• 9180535 feat: distinguish missing environment variables (#481)
• fd0a8e4 [pre-commit.ci] pre-commit autoupdate (#479)
• 97f9b70 Respect uv.lock in tox envs (#476)
• 3cdeaa3 [pre-commit.ci] pre-commit autoupdate (#475)
• 0acd977 Bump uv from 0.11.6 to 0.11.15 (#474)
• 5e5ec7d [pre-commit.ci] pre-commit autoupdate (#472)
• b5e2229 Bump pytest from 9.0.2 to 9.0.3 (#471)
• 6428609 Migrate to renovate; add zimzor (#469)
• 80d9aeb Bump uv from 0.11.2 to 0.11.6 (#467)
• Additional commits viewable in compare view

Updates feedparser from 6.0.13 to 6.0.14

Release notes

Sourced from feedparser's releases.

v6.0.14

Changed

• Upgrade to feedparser-sgmllib 2.0.0. (#585)

Changelog

Sourced from feedparser's changelog.

6.0.14 - 2026-07-30

• Upgrade to feedparser-sgmllib 2.0.0. (#585)

Commits

• 14425f6 Hotfix v6.0.14 (#586)
• 64757d0 Update project metadata
• 67ad0ed Upgrade to feedparser-sgmllib 2.x
• See full diff in compare view

Updates markdown from 3.10.2 to 3.10.3

Release notes

Sourced from markdown's releases.

Release 3.10.3

Fixed

• Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
• Add AI Policy to Contributing Guide.
• Officially document all included extensions as being in maintenance mode.
• Link the Extension API documentation to the API Reference (#1612).

Changelog

Sourced from markdown's changelog.

[3.10.3] - 2026-07-30

Fixed

• Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
• Add AI Policy to Contributing Guide.
• Officially document all included extensions as being in maintenance mode.
• Link the Extension API documentation to the API Reference (#1612).

Commits

• bb50627 Bump version to 3.10.3
• 8453df0 Update Extension API documentation
• 93ac448 Document that all extensions are in maintenance mode
• d38fd4a Create AI Policy
• ddead47 Prevent mixed =/- chars in Setext-style headings
• See full diff in compare view

Updates granian from 2.7.9 to 2.8.0

Release notes

Sourced from granian's releases.

Granian 2.8.0

What's Changed

New features

• Add header atom to access log format (#829 by @​nitrag)

Changes

• BREAKING prioritize request's scope over OS env when building WSGI environ dict (#879 by @​Barsoomx)
  • This means conflicting keys won't override WSGI request data anymore
• BREAKING TCP handshake errors are now logged under debug severity
• Add Python 3.15 support
• Drop free-threaded Python 3.13 support
• Bump PyO3 to 0.29 (#820 by @​tobiasge)
• Bump dependencies

Enhancements

• BREAKING Refactor socket sharing on Linux
  • Granian on Linux now requires kernel >= 5.14 and net.ipv4.tcp_migrate_req sysctl option enabled when using multiple workers and respawn features
• BREAKING Implement (non-configurable) backpressure over streamed/iterable responses in ASGI and WSGI protocols
  • This trades a bit of throughput (mostly unnoticeable) for lower memory usage
• Refactor workers main loop and shutdown process

Fixes

• Fix several bugs on shutdown process (thanks @​Malkiz223)
• Fix a shared socket bug on free-threaded Python causing crashes on workers respawn

Commits

• 4599fa4 Allow logger creation on disabled access log
• c032072 Change TCP handshake error log severity to debug (close #720)
• a3bc23c Add header to access log atoms (#829)
• 7b6e62f Fix shared socket fd lifetime on MT server (close #859)
• 9027314 Update benchmarks
• fabce47 Fix lost condvar wakeup on mt worker shutdown (#901)
• e37cc6b Backport unified WorkerSignal class, refactor worker main loop (#899)
• a94d75b Add backpressure on ASGI and WSGI streaming responses (#898)
• 053fdf6 Prefer request scope over OS env when building WSGI environ (#879)
• 09e1a8a Refactor socket sharing on Linux (#897)
• Additional commits viewable in compare view

Updates coverage from 7.15.2 to 7.15.3

Release notes

Sourced from coverage's releases.

7.15.3

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.
• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️  PyPI page: coverage 7.15.3. :arrow_right:  To install: python3 -m pip install coverage==7.15.3

Changelog

Sourced from coverage's changelog.

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>. Closes issue 2200.

• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios <pull 2239_>_.

• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: coveragepy/coveragepy#2200 .. _pull 2234: coveragepy/coveragepy#2234 .. _pull 2239: coveragepy/coveragepy#2239 .. _pull 2240: coveragepy/coveragepy#2240

.. _changes_7-15-2:

Commits

• b7470d9 docs: sample HTML for 7.15.3
• 27e6e80 docs: prep for 7.15.3
• 396dbbb build: include NOTICE in wheels (#2232)
• 54dde05 chore: bump the action-dependencies group with 7 updates (#2248)
• c83a0e0 perf: skip AST parsing without soft keywords (#2240)
• a57f981 refactor: fix some uncovered lines
• 0252c34 refactor: move numbits aggregate to numbits
• 1c4184c docs: maintainer workflow
• e8a1c87 perf: speed up SQLite numbits aggregation (#2239)
• 18c2a59 test: conditional use of Hypothesis
• Additional commits viewable in compare view

Updates peek-python from 26.1.4 to 26.1.5

Changelog

Sourced from peek-python's changelog.

version 26.1.5 2026-07-31

• ANSI colors are defined slightly different, to be exactly compatible with xlwings Lite.

Commits

• See full diff in compare view

Updates pyrefly from 1.1.1 to 1.2.0

Release notes

Sourced from pyrefly's releases.

Pyrefly v1.2.0

Release date: July 31, 2026

Pyrefly v1.2.0 bundles 901 commits from 59 contributors.

---

✨ New & Improved

Type Checking

• Attrs classes are now fully supported with comprehensive field synthesis, validation, and special-method generation. Pyrefly recognizes @attr.s, @define, @frozen, and their variants, handling field specifiers (attr.ib(), field()), converters, validators, defaults, and private-field aliasing. Converters are typed from their real input type rather than Any, including the @<field>.converter decorator, attrs.converters.pipe, attrs.converters.default_if_none, and generic converters like copy.deepcopy. See the new attrs documentation for details.
• functools.partial is now type-checked instead of treated as opaque. Bound arguments are validated at construction and Pyrefly synthesizes a precise residual signature for the remaining parameters, so errors surface at both the partial(...) call and the later invocation. Generic functions, overloads, constructors, bound methods, and **Unpack[TypedDict] parameters are supported, and results expose .func, .args, and .keywords. Precise residual callable assignment is enabled by the strict and all presets or explicitly with strict-partial-subtyping.
• Functions decorated with functools.singledispatch now type-check calls using the signature of the function you decorated, and registered implementations are checked against that function's first parameter. Generic singledispatch functions infer from call arguments instead of reporting Unknown.
• Pyrefly can now warn when a function declared to return a concrete type returns Any, with separate diagnostics for explicit and inferred cases. Off by default, and migrated automatically from mypy's warn_return_any.
• Pattern matching is substantially more precise: positional class patterns resolve attribute names from __match_args__ at solve time, sequence element captures read from the narrowed subject so sibling constraints refine them, and isinstance on a facet filters the parent union to matching members. Fully covered class and sequence patterns now subtract their union member from later cases.
• Unpacking a variadic tuple with a fixed prefix and suffix no longer smears those elements into the starred capture, so a, *rest, b = t where t: tuple[int, *tuple[bool, ...], str] types rest as list[bool].
• TypedDict classes now synthesize __required_keys__ and __optional_keys__, so protocols requiring them (like those in langgraph) satisfy structural checks. .get() and .pop() with literal defaults preserve the field type.
• Overload handling improved throughout: constrained TypeVar arguments expand during resolution, rejected overloads no longer leak argument errors into diagnostics, and exact callback-forwarding signatures resolve overloaded callbacks against forwarded arguments for helpers like asyncio.to_thread.
• Enum .value on an enum type now infers as the union of member literal values instead of widening to the mixed-in data type.
• Lambda parameters are contextually typed more thoroughly. Types are stored directly rather than resolved through inference variables, and *args/**kwargs resolve from callable hints to tuple[...] and dict[str, ...] inside the body while preserving element types in the signature.
• All properties are now treated as data descriptors, and reflected binary-operation dunders are tried first for proper subclasses, fixing a class of incorrect attribute and operator results.
• Cyclic type aliases reachable from an annotation are now detected instead of hanging, and class finality is taken into account when deciding whether a condition is redundant.
• Continued basedpyright parity work: class instance truthiness is recognized, code under if TYPE_CHECKING is handled consistently, typing_extensions.sentinel is supported with relaxed naming restrictions, and super(cls, cls) is accepted.
• copy.replace is now type-checked like dataclass replacement, and isinstance(x, type) preserves type arguments when narrowing unions.
• Narrowing a receiver typed as Self to a subclass now preserves Self, eliminating false return errors in methods that return the narrowed receiver.

Library Support

• Pydantic constructor synthesis now honors populate_by_name and built-in alias_generator functions, ignores Field(init=False) to match runtime, and treats frozen as a readonly field reason.
• Django ForeignKey targets now resolve attribute expressions and string references such as "app_label.Model", preserving the generated relation and <field>_id types.
• Bare factory-boy factory calls now return the model type via FactoryMetaClass.
• PEP 561 partial stub packages are now supported in imports. Pyrefly reads the partial marker from py.typed and merges the stubs with the runtime package, deferring to the runtime package for omitted modules while preserving .pyi-before-.py precedence for provided ones.
• A configured typeshed-path now supplies stdlib stubs as well as third-party stubs, enabling complete custom-typeshed testing and overrides.

Language Server

• Hover now resolves keyword arguments, renders callable protocols as their __call__ signature, preserves overload docstrings at call sites, shows enum fields, wraps nested callable and Concatenate[...] signatures for readability, and covers and/or operators, augmented assignments, and union methods.
• Auto-import completions respect python.analysis.autoImportCompletions, rank deprecated stdlib typing aliases below their modern equivalents, avoid duplicates for already-imported modules, and preserve import aliases correctly.
• Rename now works on aliased imports and across files for keyword arguments, and renaming a Protocol class targets the class rather than __init__.
• Go-to-definition now navigates directly to symbols in non-Python files such as .thrift, including nested attribute and enum access and intermediate components of multi-dotted imports.
• Inlay hints debounce server-side (default 150ms), preventing width jitter while typing. NewType values now use their callable constructor signature instead of producing an invalid type[N] annotation.
• Notebook support improved: hover and type lookups work past the first cell, and inlay hints, document symbols, references, and diagnostic grouping work in cells following markdown cells.
• Document symbols fall back to flat SymbolInformation for clients such as Helix, semantic tokens cover with ... as and except ... as bindings, and cross-file diagnostics refresh on save in strict-spec clients such as Zed.
• #region/#endregion markers create folding regions, and selection ranges now follow AST nesting from expression to statement to scope to document.
• Baselined errors now appear as hints instead of errors, making it easier to distinguish new issues from known technical debt. Baselining also now applies correctly to unused-ignore diagnostics.
• Match captures receive consistent semantic highlighting and preserve their declaration identity for go-to-definition.
• lspArguments defaults to ["lsp"] when empty, preventing startup failures in dev containers and remote environments.
• The VSCode extension adds an "Infer Types for Current File" command to the command palette.

... (truncated)

Commits

• 1933169 cut 1.2.0
• df11f5d Enforce call-boundary consumption in production
• e67bc8e Transfer quantified handles to call boundaries
• 6ba516f Move deferred call state into its boundary
• 8888e70 Scope call contexts to a lexical boundary
• f8c9e7c LSP: default lspArguments to ["lsp"] when empty
• 3f0c228 Remove dead .hgignore
• 335510d improve Sandbox: link shortening #1063 (#4327)
• 41094b9 Keep lambda hint decomposition transactional
• 3193b6a fix behavior of init=False for pydantic.BaseModel (#4352)
• Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878
• @​MichaReiser

... (truncated)

Commits

• 80790b3 Bump 0.16.1 (#27330)
• 63830f3 [ty] Borrow from constraint set storage less often (#27328)
• f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
• 0d80497 Lint TOML files in the LSP (#26862)
• d91586b Update prek dependencies (#27293)
• 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
• b20daf7 [ty] refactor: add helper function to send partial results (#27249)
• 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
• 7c3e2db [ty] Fix enum class container assignability (#27318)
• d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions