[dependabot]

Bumps the python group with 3 updates in the / directory: hiredis, numpy and pre-commit.

Updates hiredis from 3.4.2 to 3.5.0

Release notes

Sourced from hiredis's releases.

3.5.0

This release updates the bundled hiredis C library to v1.5.0, adds wheels for Python 3.15, and drops support for Python 3.8.

Breaking Changes

• Drop Python 3.8 support (#258)

  python_requires is now >=3.9, and no more cp38 wheels will be published. pip on Python 3.8 will keep resolving to hiredis 3.4.x.

🚀 New Features

• Bump hiredis to v1.5.0 (#257)

  redis/hiredis#1323

• Build wheels for Python 3.15 (#255)

  Wheels are now built with cibuildwheel 4.x and cover CPython 3.15 and free-threaded 3.15t.

🧰 Maintenance

• Add security policy (#245)
• Update dependencies and fix CI (#233)
• Fix benchmarking for hiredis-py (#232)
• Remove outdated spell check workflow (#259)

This release also includes the fixes that already shipped in 3.4.1 (hiredis v1.4.1, #243) and 3.4.2 (a push notification memory leak fix, #239).

Contributors

We'd like to thank all the contributors who worked on this release!

@​mmick78, @​MugundanMCW, @​shaanmajid, @​uglide and @​vladvildanov

Commits

• 797e826 Version 3.5.0
• 11357cf Remove outdated spell check workflow (#259)
• 6de39f7 Drop Python 3.8 support (#258)
• 7368fd1 Build wheels for Python 3.15 (#255)
• f7930bf Bump hiredis to v1.5.0 (#257)
• 9b16075 Release the list each push notification is sized from (#239)
• 3b36af9 Add security policy (#245)
• b0f22ba Bump hiredis to v1.4.1 (#243)
• ee55dd4 Update dependencies and fix CI (#233)
• b91eead Fix benchmarking for hiredis-py (#232)
• See full diff in compare view

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

• Many typing fixes and improvements,
• A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

• numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

• Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

• numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits

• a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
• 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
• 91acd87 REL: Prepare for the NumPy 2.5.4 release.
• 9cc555b Merge pull request #32956 from charris/backport-typing-1
• e04b972 TYP: dtype[void].names: allow setting with list (#32943)
• d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
• 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
• 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
• 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
• c7bcd2c TYP: place: widen mask (#32926)
• Additional commits viewable in compare view

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Commits

• 65bb884 v4.7.0
• 73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
• 860d07d don't leak GIT_* env into npm install for language: node
• 9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
• 9905e88 use contextlib.chdir
• 59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
• 2be1701 remove triple-nested withs for 3.14 coverage
• 4c8d22a py311+
• c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
• f49e251 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[hleroy]

SAFE TO MERGE

Checks: ci / tests ✅ · conventional-title ✅ · GitGuardian Security Checks ✅ · MERGEABLE / CLEAN
Release age: hiredis 3.5.0 → 2026-10-15 (9 days) · numpy 2.5.4 → 2026-10-10 (14 days) · pre-commit 4.7.0 → 2026-10-12 (12 days). All past the 7-day cooldown:, so none is fresh — no Step 2b required. None yanked on PyPI; each range contains exactly one release, so the notes below cover the whole range.

Package	Old → New	Type	Finding
hiredis	3.4.2 → 3.5.0	minor	Bundles hiredis C v1.5.0 (map-element overflow guard, configurable maxdepth still defaulting to 1024 ⇒ parsing behaviour unchanged; optional TLS peer-name verification, opt-in only). Drops Python 3.8 (python_requires now >=3.9), adds cp315/cp315t wheels. No Python-level API change, no Requires-Dist.
numpy	2.5.3 → 2.5.4	patch	Patch release: many typing fixes + an MSVC 19.51 build workaround. Behavioural items are all confined to linalg (svd/lstsq now raise on infinities instead of returning garbage, hang fix, cond non-finite consistency), StringDType NaN-sentinel hashing, and MaskedArray fill_value reset on dtype change (can now raise ComplexWarning).
pre-commit	4.6.2 → 4.7.0	minor	Single fix: language: node hooks during commit -a or inside a submodule (regression from 4.6.1). requires-python raised to >=3.11. Nothing else.

Impact on this codebase:

• numpy — grepped the whole tree for linalg, svd, lstsq, cond(, np.ma, MaskedArray, masked, StringDType, fill_value: zero hits anywhere, including tests. Every behavioural change in 2.5.4 is therefore unexercised. What the render path actually uses (radar/providers/meteofrance_render.py, bufr_decode.py) is unpackbits, frombuffer, interp, isnan/isfinite, where, pad, astype, exp, arange, floor, broadcast_to, degrees/arctan/sinh, stack, maximum, zeros_like/empty_like — none touched by this release.
• hiredis — not imported anywhere in Python (grep -rn hiredis --include=*.py → nothing); it is the response parser redis-py picks up implicitly. REDIS_URL = "redis://redis:6379/0" and REDIS_SSL = False, so the TLS peer-name change cannot apply; cached payloads are flat strings/JSON blobs, nowhere near the 1024 nesting limit. cp314 manylinux wheels published, so the "manylinux wheels only, no host build" note in pyproject.toml still holds.
• pre-commit — .pre-commit-config.yaml has no language: node hook (hooks are python, golang/gitleaks, and one language: system pytest), so the only fix in 4.7.0 is inert here.

Invariants:

• Python 3.14 only — requires-python == 3.14.*; the raised floors (hiredis >=3.9, pre-commit >=3.11, numpy >=3.12) are all satisfied, and cp314 manylinux wheels exist for both compiled packages.
• numpy / linear-Z reflectivity averaging — considered explicitly. No dtype, casting or NaN-semantics change in 2.5.4, and _smooth/_gaussian_blur/Lut.log_domain use none of the changed APIs. test_log_domain_blur_preserves_an_isolated_echo and test_rain_blur_stays_in_linear_space run against the real numpy in the dockerized suite, so green CI is genuine evidence here, not mocked away.
• redis / hiredis async client rebuilt on event-loop change — no connection-pool or decoding change in 3.5.0; radar/cache.py is untouched.
• pre-commit hooks / conventional-pre-commit type list — unaffected: this bumps the pre-commit tool, not a hook rev, and no hook behaviour changes.
• Dev-only for pre-commit; no runtime, migration, provider-abstraction or attribution surface touched.

Verdict rationale: Three patch/minor bumps, each a single release, all past cooldown and none yanked. Full notes read for every range; the only behavioural changes are in numpy APIs this project demonstrably never calls, a hiredis parser path whose behaviour upstream states is unchanged (and whose TLS addition is unreachable with a plain redis:// URL), and a pre-commit node-hook fix with no node hook in this repo. CI is green and genuinely exercises both compiled packages. Nothing left unresolved.

_{Automated weekly Dependabot triage.}

---

Generated by Claude Code