Skip to content

build(deps): bump the ci-python-tools group across 1 directory with 9 updates - #17

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-github/requirements/ci-python-tools-59d93b14c1
Open

build(deps): bump the ci-python-tools group across 1 directory with 9 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-github/requirements/ci-python-tools-59d93b14c1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2026

Copy link
Copy Markdown

Bumps the ci-python-tools group with 9 updates in the /.github/requirements directory:

Package From To
jsonschema 4.25.1 4.26.0
regex 2026.9.10 2026.9.29
rpds-py 2026.6.3 2026.9.1
filelock 3.32.5 4.1.0
identify 2.6.19 2.6.20
nodeenv 1.10.0 1.11.0
platformdirs 4.11.7 4.12.4
python-discovery 1.6.0 1.6.1
virtualenv 21.7.8 21.14.6

Updates jsonschema from 4.25.1 to 4.26.0

Release notes

Sourced from jsonschema's releases.

v4.26.0

What's Changed

New Contributors

Full Changelog: python-jsonschema/jsonschema@v4.25.1...v4.26.0

Changelog

Sourced from jsonschema's changelog.

v4.26.0

  • Decrease import time by delaying importing of urllib.request (#1416).
Commits
  • a727743 Add a changelog entry for 4.26.
  • 6d28c13 Update the lockfile.
  • 739499e Update pre-commit hooks.
  • cb2d779 Merge pull request #1443 from python-jsonschema/pre-commit-ci-update-config
  • e6bbbb7 [pre-commit.ci] pre-commit autoupdate
  • d56037a Merge pull request #1442 from python-jsonschema/dependabot/github_actions/ast...
  • e54ce13 Bump astral-sh/setup-uv from 7.1.4 to 7.1.6
  • 1f7c9fb Partially update docs requirements.
  • 241aec9 Merge pull request #1441 from python-jsonschema/pre-commit-ci-update-config
  • 2818efb Apache-2.0 -> nongpl
  • Additional commits viewable in compare view

Updates regex from 2026.9.10 to 2026.9.29

Changelog

Sourced from regex's changelog.

Version: 2026.9.29

Updated to Unicode 18.0.0.

Switched to using stdbool.h and stdint.h.

Version: 2026.9.19

Git issue 619: `Match.expand()` segfaults after `detach_string()` when the template references a group

Version: 2026.9.10

Fixed version.

Version: 2026.9.9

PR [#615](https://github.com/mrabarnett/mrab-regex/issues/615): Fix Python API error propagation in match helpers

PR #616: Preserve Python Exceptions in Input Decoding and String Detachment


PR #617: Prevent Invalid Pointer Use and Exception State Corruption in Byte String Joining


PR #618: Propagate Allocation and Internal Errors During Pattern Compilation and Scanner Execution

Version: 2026.9.3

New version of cibuildwheel no longer supports building for free-threaded Python 3.13.

Version: 2026.9.2

New version of cibuildwheel no longer needs nor supports cpython-freethreading option.

Version: 2026.9.1

Updated cibuildwheel.
Support Python 3.15.

Version: 2026.8.31

Fixed version.

Version: 2026.8.30

Git issue 611: Heap out-of-bounds write at compile time
Git issue 612: count_one() size underflow through the stale required-string cache
Git issue 613: (*SKIP) inside an atomic group, plus an equality-only scan stop
Git issue 614: build_GROUP() does not propagate the match direction

Version: 2026.8.12

... (truncated)

Commits
  • 0e8cb05 Updated to Unicode 18.0.0.
  • 85e568c Git issue 619: Match.expand() segfaults after detach_string() when the te...
  • See full diff in compare view

Updates rpds-py from 2026.6.3 to 2026.9.1

Commits
  • fc7a185 Release rpds-py version 2026.9.1
  • d19ef61 Merge pull request #311 from edgarrmondragon/pypy312
  • 47ac82f Bump PyO3 to 0.29.3 and start building PyPy 3.12 wheels
  • cf0900d Merge pull request #308 from crate-py/dependabot/github_actions/github/codeql...
  • 204fd02 Merge pull request #309 from crate-py/dependabot/github_actions/astral-sh/set...
  • 264fdef Merge pull request #310 from crate-py/pre-commit-ci-update-config
  • 5ddee5c [pre-commit.ci] pre-commit autoupdate
  • 9fe3318 Bump astral-sh/setup-uv from 10.1.0 to 10.2.0
  • 2302c70 Bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1
  • 93bbcbb Merge pull request #305 from crate-py/dependabot/github_actions/astral-sh/set...
  • Additional commits viewable in compare view

Updates filelock from 3.32.5 to 4.1.0

Release notes

Sourced from filelock's releases.

4.1.0

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@4.0.12...4.1.0

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.2.0 (2026-10-14)

  • import filelock is about twice as fast: lock types other than :class:~filelock.FileLock load on first use. :pr:831
  • Fix :class:~filelock.StrictSoftFileLock raising :class:~filelock.SoftFileLockProtocolError on Windows when a contender read a claim whose owner was still finishing its unlink. :pr:829

4.1.2 (2026-10-14)

  • Fix read-lock acquisition on SQLite versions older than 3.33.0 by using sqlite_master for the schema probe. :pr:770
  • Raise IsADirectoryError (or PermissionError on Windows) for a directory lock path regardless of its write permissions. :pr:822
  • Fix a forked child hanging at exit on PyPy when the parent forked while an :class:~filelock.AsyncReadWriteLock worker thread was between two operations. :pr:828
  • Hash all cache keys in the lock filename recipe so short path-like keys stay in the chosen directory. The example also accepts path-derived surrogate escapes and works before the cache directory exists. :pr:824

4.1.1 (2026-10-11)

  • Bound the shared-lock contention test by worker progress so slow CI machines can finish the workload. :pr:819
  • Avoid the macOS /dev/fd lookup implicated in a kernel panic by opening SQLite through a validated hard link. The database directory must be writable and support hard links; alias creation failure raises OSError. :pr:820
  • Ignore non-ASCII PID or start-time fields and out-of-range PIDs in ReadWriteLock hard-link directory names so forged owners cannot abort acquisition. :pr:821
  • Use Python 3.15 for development and automation. :pr:816

4.1.0 (2026-10-09)

  • Import :data:~filelock.OwnerMode, :data:~filelock.CompromiseReason and :data:~filelock.has_fcntl from filelock. :pr:790
  • :class:~filelock.AcquireReturnProxy is generic in the lock type, so with lock.acquire() as held: types held as the lock's own class. :pr:803
  • A :class:~filelock.Timeout from a soft lock names a holder on another host or in another PID namespace, which no contender ever reclaims. :pr:815
  • :attr:~filelock.SoftFileLock.is_lock_held_by_us and :attr:~filelock.MarkerSoftFileLock.is_lock_held_by_us return

... (truncated)

Commits
  • 6c0ecc2 Release 4.1.0
  • df06bbd 🐛 fix: close regressions since 4.0.12 (#815)
  • 0712045 🐛 fix(read-write): refuse a database moved mid-acquire (#808)
  • 73fefc1 📝 docs: point canonical and og:url at versioned pages (#813)
  • 181b36b 🧪 test(lease): give the age-out test a real-time margin (#814)
  • 2c19af4 🐛 fix(api): release thread holds, guard reentry (#810)
  • 367b111 🐛 fix(soft-rw): publish the head through gen/HEAD (#799)
  • 61582c5 🐛 fix(api): validate lock options up front (#803)
  • 20c4b5a 🐛 fix(descriptor): reject poll intervals above TIMEOUT_MAX (#802)
  • cf092c7 🧪 test: drop timing races from two runner-load flakes (#809)
  • Additional commits viewable in compare view

Updates identify from 2.6.19 to 2.6.20

Commits
  • aa34031 v2.6.20
  • 116099f Merge pull request #609 from Malix-Labs/feat/add-nushell
  • 971546c Merge pull request #610 from pre-commit/lock-file-tags
  • da45cb1 Add support for 'nu' extension and Nushell interpreters
  • a35b99b Merge pull request #608 from steovd/profile-sh
  • bd5cdb7 Merge pull request #601 from ngie-eign/issue-258
  • 66faf04 Merge pull request #597 from edgarrmondragon/patch-1
  • c75a0a2 Merge pull request #593 from NinjaMandalorian/main
  • ea6c9f9 Add support for 'luau' file extension
  • d28c571 Merge pull request #585 from Kvan7/patch-1
  • Additional commits viewable in compare view

Updates nodeenv from 1.10.0 to 1.11.0

Release notes

Sourced from nodeenv's releases.

1.11.0

What's Changed

New Features 🎉

Fixed bugs 🐛

Improvements 🛠

Documentation 📄

Other Changes

New Contributors

Full Changelog: ekalinin/nodeenv@1.10.0...1.11.0

Changelog

Sourced from nodeenv's changelog.

Version 1.11.0

  • Fixed zsh source bin/activate aborting on the direct-call guard [#398](https://github.com/ekalinin/nodeenv/issues/398) <https://github.com/ekalinin/nodeenv/issues/398>_
  • Added check for how activate is called [#384](https://github.com/ekalinin/nodeenv/issues/384) <https://github.com/ekalinin/nodeenv/pull/384>_
  • Addressed the tarfile.extractall deprecation on Python >= 3.12 by setting filter='data', which also prevents writing files via ".." or absolute paths [#380](https://github.com/ekalinin/nodeenv/issues/380) <https://github.com/ekalinin/nodeenv/pull/380>_
  • Added support for Solaris/illumos [#360](https://github.com/ekalinin/nodeenv/issues/360) <https://github.com/ekalinin/nodeenv/issues/360>_
  • Added predeactivate hooks for Windows
  • Added error handling and tests for the node installation [#336](https://github.com/ekalinin/nodeenv/issues/336) <https://github.com/ekalinin/nodeenv/issues/336>_
  • Removed the leftover debug print that leaked a dict to stdout on every version detection [#390](https://github.com/ekalinin/nodeenv/issues/390) <https://github.com/ekalinin/nodeenv/issues/390>_
  • Added --with-certifi to download packages with the certifi certificate bundle [#388](https://github.com/ekalinin/nodeenv/issues/388) <https://github.com/ekalinin/nodeenv/pull/388>_
  • --node accepts npm-style semver ranges [#393](https://github.com/ekalinin/nodeenv/issues/393) <https://github.com/ekalinin/nodeenv/pull/393>_
  • Added --prefer-system to use system-wide node.js when available and install one otherwise [#153](https://github.com/ekalinin/nodeenv/issues/153) <https://github.com/ekalinin/nodeenv/issues/153>_
  • Added --isolate-npm to keep npm cache, userconfig and init-module inside the environment [#154](https://github.com/ekalinin/nodeenv/issues/154) <https://github.com/ekalinin/nodeenv/issues/154>_
  • Added tests that run the activation scripts in sh, dash, bash, zsh and fish.
  • -p no longer reinstalls node when the requested version is already in the virtualenv [#159](https://github.com/ekalinin/nodeenv/issues/159) <https://github.com/ekalinin/nodeenv/issues/159>_
  • Repeated -p runs no longer duplicate the predeactivate hook [#159](https://github.com/ekalinin/nodeenv/issues/159) <https://github.com/ekalinin/nodeenv/issues/159>_
  • -p accepts an optional virtualenv directory and prefers the activated VIRTUAL_ENV over the virtualenv nodeenv itself is installed in [#156](https://github.com/ekalinin/nodeenv/issues/156) <https://github.com/ekalinin/nodeenv/issues/156>_
  • -r/--requirements may now be given more than once, and the new --local-requirements installs the packages of a file locally, into "node_modules" of the current directory, which is what freeze -l writes. Under npm < 1.0.0, which has no -g, a local file is still installed the old way [#206](https://github.com/ekalinin/nodeenv/issues/206) <https://github.com/ekalinin/nodeenv/issues/206>_
  • The "src" directory is now removed after installation by default, which halves the size of an environment. Added --no-clean-src to keep it: with --source that is what lets a repeated --force build reuse the downloaded source tree [#205](https://github.com/ekalinin/nodeenv/issues/205) <https://github.com/ekalinin/nodeenv/issues/205>_
  • Documented that --mirror takes a file:// URL, so a local directory can serve as the download source [#193](https://github.com/ekalinin/nodeenv/issues/193) <https://github.com/ekalinin/nodeenv/issues/193>_
  • The posix activate is now written on Windows too, into "Scripts", so git-bash and the other posix shells there can activate an environment [#226](https://github.com/ekalinin/nodeenv/issues/226) <https://github.com/ekalinin/nodeenv/issues/226>_
  • A download that reaches nothing at all, which a broken http_proxy or https_proxy usually causes, now reports the url and the proxy settings instead of a traceback

... (truncated)

Commits
  • e745358 Merge pull request #418 from ekalinin/chore/release-1.11.0
  • fd19956 chore(release): bump nodeenv version to 1.11.0
  • 1767015 Merge pull request #415 from ekalinin/fix/nodejs-exe-link
  • 55df3ce Merge pull request #417 from r3wretrhy/fix/zsh-activate-source-guard
  • bb15c5c fix: allow zsh to source bin/activate
  • 152cd3d fix(nodeenv): link nodejs.exe without mklink
  • d163302 Merge pull request #414 from ekalinin/fix/freeze-requirements
  • ef5ec35 fix(nodeenv): read npm's parseable listing in freeze
  • b1f0c54 Merge pull request #413 from ekalinin/fix/musl-vendor-detection
  • aadf307 fix(nodeenv): detect musl regardless of the host triplet vendor
  • Additional commits viewable in compare view

Updates platformdirs from 4.11.7 to 4.12.4

Release notes

Sourced from platformdirs's releases.

4.12.4

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.12.3...4.12.4

4.12.3

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.12.2...4.12.3

4.12.2

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.12.1...4.12.2

4.12.1

What's Changed

Full Changelog: tox-dev/platformdirs@4.12.0...4.12.1

4.12.0

What's Changed

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.13.3 (2026-10-16)

4.13.2 (2026-10-16)

  • Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. :pr:619

4.13.1 (2026-10-15)

  • Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. :pr:618
  • Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

4.13.0 (2026-10-10)

  • Detect Homebrew Python for the :class:~platformdirs.macos.MacOS site directories under :option:python:-S, which leaves :data:sys.base_prefix on the Cellar keg, and for the python-freethreading formula - by :user:sricharanreddycheruku. :pr:612
  • Use Python 3.15 for development and automation. :pr:613

4.12.4 (2026-10-07)

  • Keep site directories readable by other users when root calls :meth:~platformdirs.api.PlatformDirsABC.place_config_file or another place_*_file method with :attr:~platformdirs.api.PlatformDirsABC.use_site_for_root - by :user:darrenhuai. :pr:610
  • Make :func:~platformdirs.user_runtime_dir warn and fall back from an unreachable XDG_RUNTIME_DIR under :attr:~platformdirs.api.PlatformDirsABC.ensure_exists instead of raising. :pr:611

4.12.3 (2026-10-03)

  • Place files from place_config_file and place_data_file in the first site directory for root on Unix with

... (truncated)

Commits
  • 19338a4 Release 4.12.4
  • f2a4fa9 fix: fall back from unreachable runtime directory with ensure_exists (#611)
  • 16429e2 🐛 fix(api): keep root's site dir readable in place_*_file (#610)
  • b9735d3 ci: download coverage during tool setup (#609)
  • 344f249 [pre-commit.ci] pre-commit autoupdate (#608)
  • 960ff63 Release 4.12.3
  • 8047ad5 Place root config and data files in the first site directory (#607)
  • af2fc7f Release 4.12.2
  • bdafa67 ♻️ refactor(api): share use_site iteration (#606)
  • d5ff75c 🐛 fix(api): keep os.pathsep in site_applications_path (#604)
  • Additional commits viewable in compare view

Updates python-discovery from 1.6.0 to 1.6.1

Release notes

Sourced from python-discovery's releases.

v1.6.1

What's Changed

Full Changelog: tox-dev/python-discovery@1.6.0...1.6.1

Changelog

Sourced from python-discovery's changelog.

Bug fixes - 1.6.1

  • Skip empty PATH entries during interpreter discovery - by :user:gaborbernat. (:issue:129)

Improved documentation - 1.6.1

  • Document :attr:~python_discovery.PythonInfo.system_exe across the tutorial, the how-to guide and the explanation of how resolution reaches a base interpreter. The class diagram in the how-to guide had :attr:~python_discovery.PythonInfo.system_executable typed str rather than str | None - by :user:gaborbernat. (:issue:128)

v1.6.0 (2026-08-28)

Commits

Updates virtualenv from 21.7.8 to 21.14.6

Release notes

Sourced from virtualenv's releases.

21.14.6

What's Changed

Full Changelog: pypa/virtualenv@21.14.5...21.14.6

21.14.5

What's Changed

Full Changelog:

@dependabot
build(deps): bump the ci-python-tools group across 1 directory with 9…
b9ba562 
… updates

Bumps the ci-python-tools group with 9 updates in the /.github/requirements directory:

| Package | From | To |
| --- | --- | --- |
| [jsonschema](https://github.com/python-jsonschema/jsonschema) | `4.25.1` | `4.26.0` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.9.10` | `2026.9.29` |
| [rpds-py](https://github.com/crate-py/rpds) | `2026.6.3` | `2026.9.1` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.5` | `4.1.0` |
| [identify](https://github.com/pre-commit/identify) | `2.6.19` | `2.6.20` |
| [nodeenv](https://github.com/ekalinin/nodeenv) | `1.10.0` | `1.11.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.7` | `4.12.4` |
| [python-discovery](https://github.com/tox-dev/python-discovery) | `1.6.0` | `1.6.1` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.7.8` | `21.14.6` |



Updates `jsonschema` from 4.25.1 to 4.26.0
- [Release notes](https://github.com/python-jsonschema/jsonschema/releases)
- [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst)
- [Commits](python-jsonschema/jsonschema@v4.25.1...v4.26.0)

Updates `regex` from 2026.9.10 to 2026.9.29
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.9.10...2026.9.29)

Updates `rpds-py` from 2026.6.3 to 2026.9.1
- [Release notes](https://github.com/crate-py/rpds/releases)
- [Changelog](https://github.com/crate-py/rpds/blob/main/release.toml)
- [Commits](crate-py/rpds@v2026.6.3...v2026.9.1)

Updates `filelock` from 3.32.5 to 4.1.0
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.5...4.1.0)

Updates `identify` from 2.6.19 to 2.6.20
- [Commits](pre-commit/identify@v2.6.19...v2.6.20)

Updates `nodeenv` from 1.10.0 to 1.11.0
- [Release notes](https://github.com/ekalinin/nodeenv/releases)
- [Changelog](https://github.com/ekalinin/nodeenv/blob/master/CHANGES)
- [Commits](ekalinin/nodeenv@1.10.0...1.11.0)

Updates `platformdirs` from 4.11.7 to 4.12.4
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.7...4.12.4)

Updates `python-discovery` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/tox-dev/python-discovery/releases)
- [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst)
- [Commits](tox-dev/python-discovery@1.6.0...1.6.1)

Updates `virtualenv` from 21.7.8 to 21.14.6
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.7.8...21.14.6)

---
updated-dependencies:
- dependency-name: jsonschema
  dependency-version: 4.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-python-tools
- dependency-name: regex
  dependency-version: 2026.9.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-python-tools
- dependency-name: rpds-py
  dependency-version: 2026.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-python-tools
- dependency-name: filelock
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-python-tools
- dependency-name: identify
  dependency-version: 2.6.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-python-tools
- dependency-name: nodeenv
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-python-tools
- dependency-name: platformdirs
  dependency-version: 4.12.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-python-tools
- dependency-name: python-discovery
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-python-tools
- dependency-name: virtualenv
  dependency-version: 21.14.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-python-tools
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from joey-huckabee as a code owner October 16, 2026 23:25
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@joey-huckabee joey-huckabee Awaiting requested review from joey-huckabee joey-huckabee is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants