Bump the "infrastructure" group with 4 updates across multiple ecosystems by dependabot[bot] · Pull Request #54 · mdeweerd/meterstoha

dependabot · 2026-07-14T10:55:58Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Updates the requirements on urllib3, colorama, selenium, pyvirtualdisplay and requests to permit the latest version.
Updates urllib3 to 2.7.0

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @Cycloctane)

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @kimkou2024)

See GHSA-mf9v-mfxr-j63j for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @christos-spearbit)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)

Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)

Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)

Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)

Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)

Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)

Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)

Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)

Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)

Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)

Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)

Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

9a950b9 Release 2.7.0
5ec0de4 Merge commit from fork
2bdcc44 Merge commit from fork
f45b0df Fix a misleading example for ProxyManager (#4970)
577193c Switch to nightly PyPy3.11 in CI for now (#4984)
e90af45 Avoid infinite loop in HTTPResponse.read_chunked when amt=0 (#4974)
67ed74f Bump dev dependencies (#4972)
3abd481 Upgrade mypy to version 1.20.2 (#4978)
2b8725d Drop support for EOL PyPy3.10 (#4979)
2944b2a Upgrade setup-chrome and setup-firefox to fix warnings (#4973)
Additional commits viewable in compare view

Updates colorama to 0.4.6

Changelog

Sourced from colorama's changelog.

0.4.6 Current release

tartley/colorama#139 Add alternative to 'init()', called 'just_fix_windows_console'. This fixes many longstanding problems with 'init', such as working incorrectly on modern Windows terminals, and wonkiness when init gets called multiple times. The intention is that it just makes all Windows terminals treat ANSI the same way as other terminals do. Many thanks the njsmith for fixing our messes.

tartley/colorama#352 Support Windows 10's ANSI/VT console. This didn't exist when Colorama was created, and avoiding us causing havok there is long overdue. Thanks to segeviner for the initial approach, and to njsmith for getting it merged.

tartley/colorama#338 Internal overhaul of package metadata declaration, which abolishes our use of the now heavily discouraged setuptools (and hence setup.py, setup.cfg and MANIFEST.in), in favor of hatchling (and hence pyproject.toml), generously contributed by ofek (author of hatchling). This includes dropping support Python3.5 and 3.6, which are EOL, and were already dropped from setuptools, so this should not affect our users.

tartley/colorama#353 Attention to detail award to LqdBcnAtWork for a spelling fix in demo06 0.4.5

Catch a racy ValueError that could occur on exit.

Create README-hacking.md, for Colorama contributors.

Tweak some README unicode characters that don't render correctly on PyPI.

Fix some tests that were failing on some operating systems.

Add support for Python 3.9.

Add support for PyPy3.

Add support for pickling with the dill module. 0.4.4

Re-org of README, to put the most insteresting parts near the top.

Added Linux makefile targets and Windows powershell scripts to automate bootstrapping a development environment, and automate the process of testing wheels before they are uploaded to PyPI.

Use stdlib unittest.mock where available

Travis CI now also builds on arm64

Demo06 demonstrates existing cursor positioning feature

Fix OSC regex & handling to prevent hang or crash

Document enterprise support by Tidelift 0.4.3

Fix release 0.4.2 which was uploaded with missing files. 0.4.2 BROKEN DO NOT USE

#228: Drop support for EOL Python 3.4, and add 3.7 and 3.8. Thanks to hugovk.

Several additions and fixes to documentation and metadata.

Added Tidelift subscription information. 0.4.1

Fix issue #196: prevent exponential number of calls when calling 'init' multiple times. Reported by bbayles and fixed by Delgan. 0.4.0

Fix issue #142: reset LIGHT_EX colors with RESET_ALL. Reported by Delgan

... (truncated)

Commits

3de9f01 bump version 0.4.6
a45949b Format the CHANGELOG bullet list, no content change
f55f72e comment need for a fix after recent MP broke it
cb83041 fix test-release after recent MPs broke it
832f14c README tweaks
54b89c3 Bump version to 0.4.6rc1
7991d34 'make bootstrap' uses system python3, not pinned v3.8
0ae5ef2 CHANGELOG updates for upcoming 0.4.6 release
52f4cfd Tweak ordering of release checklist
ab64cfa Merge pull request #353 from LqdBcnAtWork/patch-1
Additional commits viewable in compare view

Updates selenium to 4.46.0

Release notes

Sourced from selenium's releases.

Selenium 4.46.0

Detailed Changelogs by Component

Java | Python | DotNet | Ruby | JavaScript

What's Changed

[build] Upgrade rules_rs to 0.0.90 and build Rust against @llvm on macOS by @AutomatedTester in SeleniumHQ/selenium#17683

[dotnet] Thread safe product info determination by @nvborisenko in SeleniumHQ/selenium#17684

[release] Skip release if package is already published by @diemol in SeleniumHQ/selenium#17686

[docs] add design decision record process and template by @titusfortner in SeleniumHQ/selenium#17665

[rust] Support pbzx-compressed macOS .pkg payloads by @AutomatedTester in SeleniumHQ/selenium#17691

[java] Mark all current BiDi related classes beta by @pujagani in SeleniumHQ/selenium#17690

[build] Upgrade rules_rs to 0.0.92 by @AutomatedTester in SeleniumHQ/selenium#17688

[ci] Ignore changes in docs/decisions directory for pull requests by @diemol in SeleniumHQ/selenium#17693

[build] Upgrade @llvm to 0.8.9 by @AutomatedTester in SeleniumHQ/selenium#17703

[rust] Use PKG again for Firefox macOS downloads by @AutomatedTester in SeleniumHQ/selenium#17702

[rb] trim whitespace around NO_PROXY entries by @aguspe in SeleniumHQ/selenium#17565

Treat prefix literally in UrlTemplate.match(url, prefix) by @vasiliy-mikhailov in SeleniumHQ/selenium#17713

[java] show browser version and available CDP versions by @asolntsev in SeleniumHQ/selenium#17708

Make Either.stream() and iterator() empty for a left value by @vasiliy-mikhailov in SeleniumHQ/selenium#17714

[java] Handle system proxy setting for arguments passed to selenium manager by @bhecquet in SeleniumHQ/selenium#17402

[js] Add binding-neutral BiDi schema with cddl2ts-gated fidelity by @titusfortner in SeleniumHQ/selenium#17700

[build] add copyright headers to rbs, pyi, ts, mjs, and erb files by @titusfortner in SeleniumHQ/selenium#17720

[rb] add ClientConfig for HTTP client customization by @titusfortner in SeleniumHQ/selenium#17699

[rb] Add copyright header for client_config.rbs by @nvborisenko in SeleniumHQ/selenium#17722

[dotnet] [bidi] Split event stream backed subscription and enumeration by @nvborisenko in SeleniumHQ/selenium#17705

[dotnet] [test] Moves Urls knowledge to testing web server by @nvborisenko in SeleniumHQ/selenium#17724

[java] fix comparator of Docker versions by @asolntsev in SeleniumHQ/selenium#17723

[dotnet] [test] Driver is protected through fixtures by @nvborisenko in SeleniumHQ/selenium#17726

[dotnet] [test] Clean driver fixture from expected page titles by @nvborisenko in SeleniumHQ/selenium#17727

[py] Route Safari, STP and WebView2 to their handlers by @v-dermichev in SeleniumHQ/selenium#17728

[grid] Fix classpath packaging Redis-backed for SessionQueue by @VietND96 in SeleniumHQ/selenium#17706

[rust][selenium-manager]: do not ignore browser path when version is specified by @Delta456 in SeleniumHQ/selenium#17659

[json] Allow constructor args to be used when coercing from json by @shs96c in SeleniumHQ/selenium#17733

[py] Fix example WebDriverWait import in docstring by @cgoldberg in SeleniumHQ/selenium#17735

[dotnet] [test] Eliminate stub driver for testing events in Support package by @nvborisenko in SeleniumHQ/selenium#17736

[java] Fix JSON parser EOF sentinel collision with U+FFFF by @shs96c in SeleniumHQ/selenium#17737

[java] Reject unescaped control characters in JSON strings by @shs96c in SeleniumHQ/selenium#17740

[rust] Support multiple names for Firefox binary in Linux (#17695) by @bonigarcia in SeleniumHQ/selenium#17732

build: update Node.js toolchain version to 24.18.0 by @diemol in SeleniumHQ/selenium#17742

[java] Tighten JSON number lexer to match RFC 8259 by @shs96c in SeleniumHQ/selenium#17739

[java] Enforce commas between JSON elements; accept trailing commas by @shs96c in SeleniumHQ/selenium#17738

[java] Deprecate methods to avoid internal BiDi connection surfacing on driver by @pujagani in SeleniumHQ/selenium#17751

[js] Update cddl to 0.21.0 to fix quoted reserved-word parsing in BiDi codegen by @titusfortner in SeleniumHQ/selenium#17752

[rb] generate the BiDi protocol layer from the shared binding-neutral schema by @titusfortner in SeleniumHQ/selenium#17731

[docs] ADR implementation updates - track by PR number, clarify PR body vs ADR, tracking status by issue by @titusfortner in SeleniumHQ/selenium#17697

... (truncated)

Commits

df5a634 [build] Prepare for release of selenium-4.46.0 (#17763)
a6a14b4 bumping ts rules (#17760)
726666b [rust] Prevent path traversal in tar and pkg extraction (#17668). Reported by...
8b85e9a [build] Resolve Chrome milestone from Chrome-for-Testing channel version (#17...
9f6ccde [java][bidi] Track events subscriptions using subscription ids (#17759)
4177888 [java] Move BiDi creation to RemoteWebDriver. Add enable BiDi to SafariOption...
185e626 [build] fix python linting in format.sh script
15ee583 [build] document .local customization and add PR review guidance (#17756)
ee4057c Add guidance for testing conventions in each language (#16734)
4c140e1 [build] Add update_cddl script to refresh pinned w3c/webref CDDL files (#17743)
Additional commits viewable in compare view

Updates pyvirtualdisplay to 3.0

Commits

7f200dd version = "3.0"
adfd5ce doc: install xmessage and gnumeric #71
daa1711 test: gh action: drop unused packages
35c7242 drop py25 support
0ce64a0 doc
fb3ba6f timeout (10m) is back in _wait_for_pipe_text() #62
6387601 replace EasyProcess with subprocess for xauth
6ccd8e1 test: more sleep
8335a37 remove unused png files
031af34 replace terminate() with kill() (fixes 22.04 test)
Additional commits viewable in compare view

Updates requests to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

Widened json input type from dict and list to Mapping and Sequence. (#7436)

Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)

Response.reason moved from str | None to str to improve handling for users. (#7437)

Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

Special thanks to @bastimeyer, @cthoyt, @edgarrmondragon, and @srittau for helping review and test the types ahead of the release. (#7272)

Improvements

Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)

Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)

Requests added support for Python 3.14t. (#7419)

Bugfixes

Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)

Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)

Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

6e83187 v2.34.2
84d10f0 Move Request.headers back to Mapping (#7441)
b7b549b v2.34.1
e511bc7 Fix mutability issues with headers input types (#7431)
5691f59 Update JsonType containers to read-based collections (#7436)
2144213 Constrain Response.reason to str (#7437)
6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
0b401c7 v2.34.0
86b378d Align Session.get parameters with requests.get (#7429)
a4f9a59 Port bpo-39057 to Requests (#7427)
Additional commits viewable in compare view

Bumps the infrastructure group with 11 updates:

Package	From	To
setuptools	`80`	`83.0.0`
https://github.com/asottile/pyupgrade	`v3.10.1`	`3.21.2`
pyproject-flake8	`0.0.1a2`	`7.0.0`
flake8-bugbear	`22.1.11`	`25.11.29`
flake8-comprehensions	`3.8.0`	`3.17.0`
flake8-2020	`1.6.1`	`1.8.1`
pycodestyle	`2.10.0`	`2.14.0`
pyflakes	`2.4.0`	`3.4.0`
https://github.com/codespell-project/codespell	`v2.2.5`	`2.4.2`
https://github.com/pylint-dev/pylint	`v4.0.5`	`4.0.6`
https://github.com/pre-commit/mirrors-mypy	`v2.1.0`	`2.3.0`

Updates setuptools from 80 to 83.0.0

Updates https://github.com/asottile/pyupgrade from v3.10.1 to 3.21.2

Commits

75992aa v3.21.2
3a1254b Merge pull request #1043 from asottile/unstring-annotation-multiline
98a3718 fix unstringing multiline string annotations
46c3d52 v3.21.1
372cb61 Merge pull request #1040 from asottile/315-hax
fb9f503 vendor cookie_re from cpython
afcce08 Merge pull request #1036 from asottile/pre-commit-ci-update-config
2deeeb0 [pre-commit.ci] pre-commit autoupdate
cde85ea Merge pull request #1035 from asottile/all-repos_autofix_all-repos-manual
c612b1b py310+
Additional commits viewable in compare view

Updates pyproject-flake8 from 0.0.1a2 to 7.0.0

Updates flake8-bugbear from 22.1.11 to 25.11.29

Updates flake8-comprehensions from 3.8.0 to 3.17.0

Updates flake8-2020 from 1.6.1 to 1.8.1

Updates pycodestyle from 2.10.0 to 2.14.0

Updates pyflakes from 2.4.0 to 3.4.0

Updates https://github.com/codespell-project/codespell from v2.2.5 to 2.4.2

Release notes

Sourced from https://github.com/codespell-project/codespell's releases.

v2.4.2

Highlights

Fixed compatibility with chardet 7+

What's Changed

Fix and clarify cases in ignore patterns by @DanielYang59 in codespell-project/codespell#3583

codespell-private.yml: Do not codespell digital signature files by @cclauss in codespell-project/codespell#3623

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3634

numbes->numbers and numbesr->numbers by @skshetry in codespell-project/codespell#3635

Add spelling corrections for disclose and variables. by @cfi-gb in codespell-project/codespell#3622

Add spelling correction for Vulnererability and variants. by @cfi-gb in codespell-project/codespell#3625

Remove lets->let's by @Piedone in codespell-project/codespell#3633

Add corrections for "dictate" by @jdufresne in codespell-project/codespell#3636

Add specicification (and pl) typo by @yarikoptic in codespell-project/codespell#3639

Remove "blueish" correction by @hadess in codespell-project/codespell#3510

Add "lighting" as an option to fix "lighning" by @yarikoptic in codespell-project/codespell#3648

Revert adding lien to the rare dictionary by @nikolaik in codespell-project/codespell#3631

"ane" could have been "one" by @yarikoptic in codespell-project/codespell#3645

Add spelling correction for "priort" by @cfi-gb in codespell-project/codespell#3647

Remove "fix" of "deques" - it is quite legit by @yarikoptic in codespell-project/codespell#3649

Several new suggestions by @mdeweerd in codespell-project/codespell#3621

Add proposal constraints to containts by @mdeweerd in codespell-project/codespell#3652

Additions dleay,infp,practive,utiliy by @mdeweerd in codespell-project/codespell#3643

Add calncelled and its variations by @mdeweerd in codespell-project/codespell#3650

Use raw strings for regex by @DimitriPapadopoulos in codespell-project/codespell#3654

Allow multiple spaces before codespell:ignore by @DimitriPapadopoulos in codespell-project/codespell#3653

Added correction from timeour to timeout by @jamesbraza in codespell-project/codespell#3656

Add typos found in various software projects by @luzpaz in codespell-project/codespell#3640

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3659

Add codespell suggestions for enabke and friends by @mdeweerd in codespell-project/codespell#3657

END: add "queues" (plural from queue) as possible fix for ques by @yarikoptic in codespell-project/codespell#3591

agreegate, lesda, realod, colouer by @mdeweerd in codespell-project/codespell#3665

Update pre-commit version in documentation by @prchoward in codespell-project/codespell#3666

MAINT: Rename CI file and run name by @larsoner in codespell-project/codespell#3667

preoccuption->preoccupation; occuption->occupation by @TheGiraffe3 in codespell-project/codespell#3668

Suggestions for: checkto, diminsion, waitfor by @mdeweerd in codespell-project/codespell#3670

Typos found in sigstore-python by @DimitriPapadopoulos in codespell-project/codespell#3664

usgin->using by @ydah in codespell-project/codespell#3672

Add typos found in various software projects by @luzpaz in codespell-project/codespell#3669

Add coered -> coerced by @effigies in codespell-project/codespell#3680

backwward(s)->backward(s), onwward(s)->onward(s) by @cjwatson in codespell-project/codespell#3682

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3685

telemetery->telemetry by @august-soderberg in codespell-project/codespell#3686

Add hexedacimal and similar typos by @Akuli in codespell-project/codespell#3692

Add rounted->routed, rounded and friends by @peternewman in codespell-project/codespell#3693

Add symmectric and similar typos by @Akuli in codespell-project/codespell#3694

Fix CI on Windows: pip upgrade pip by @DimitriPapadopoulos in codespell-project/codespell#3698

... (truncated)

Commits

2ccb47f Compat with chardet 7 (#3886)
4ec53bf [pre-commit.ci] pre-commit autoupdate
2a4acba Bump actions/download-artifact from 7 to 8
be17cac Bump actions/upload-artifact from 6 to 7
04a0712 Bump ruff (#3879)
583d879 avoide->avoid, avoided, avoids,
1f59f34 Add correction for 'foudation' to 'foundation'
e047fda Add spelling correction for gather and variants.
b5cd66d respondant->respondent
92125a3 Add detection of ivoice and variants.
Additional commits viewable in compare view

Updates https://github.com/pylint-dev/pylint from v4.0.5 to 4.0.6

Release notes

Sourced from https://github.com/pylint-dev/pylint's releases.

v4.0.6

What's new in Pylint 4.0.6?

Release date: 2026-06-14

False Positives Fixed

implicit-str-concat is no longer emitted for an implicit concatenation of a raw string with a non-raw one (e.g. r"\d" "\n"). Such literals cannot be merged into a single string, so the concatenation is intentional rather than a forgotten comma.

Closes #6663

Fix a false positive for invalid-name (C0103) where the default typevar-rgx rejected TypeVar names containing digits, such as Ec2T.

Closes #8499

Fix a false positive for too-many-arguments in (non-static) methods and classmethods.

Closes #8675

Fix a false positive for no-member when a value is inferred to several possible types and at least one of them defines a dynamic __getattr__.

Closes #9833

Fix a false positive for function-redefined (E0102) when reusing names that match dummy-variables-rgx (such as _), which is common for pytest-bdd step definitions. This restores the behavior from before pylint 4.0.0; as a consequence the false negative fixed in #9894 is reintroduced for functions whose name matches dummy-variables-rgx.

Closes #10665

Fix undefined-variable false positive when a name used as a metaclass argument in a nested class is referenced again later in the module.

Closes #10823

Fix a false positive for unused-variable where global variables matching dummy-variables-rgx were still reported as unused when allow-global-unused-variables was disabled.

Closes #10890

... (truncated)

Commits

8a39635 Bump pylint to 4.0.6, update changelog (#11105)
150f23c [Backport maintenance/4.0.x] Allow digits in ParamSpec and TypeVarTuple names...
8b6251e [Backport maintenance/4.0.x] Fix crash when enum member inference fails (#11093)
d57aadb [Backport maintenance/4.0.x] Fix implicit-str-concat false positive for mix...
d9ea8d9 [Backport maintenance/4.0.x] Fix unnecessary-comprehension suggestion when ...
cb1792a [Backport maintenance/4.0.x] Allow digits in TypeVar names for invalid-name c...
ee2ab9a Handle InferenceError in decorator return analysis
5bb5498 [Backport maintenance/4.0.x] Fix crash in typecheck checker when metaclass ar...
a940533 [Backport maintenance/4.0.x] Fix a crash in consider-using-enumerate for no...
b7a873a [Backport maintenance/4.0.x] Fix crash in deprecated checker for non-string `...
Additional commits viewable in compare view

Updates https://github.com/pre-commit/mirrors-mypy from v2.1.0 to 2.3.0

Commits

41e6916 Mirror: 2.3.0
0cbe8f6 Mirror: 2.2.0
See full diff in compare view

Bumps the infrastructure group with 9 updates:

Package	From	To
actions/checkout	`4`	`7`
zizmorcore/zizmor-action	`0.5.6`	`0.5.7`
home-assistant/builder	`2026.03.2`	`2026.06.0`
home-assistant/builder/actions/publish-multi-arch-manifest	`8b139affa26d40fa3cc0d0cb77a8aefaf417a460`	`91a3a46c1c8b6c7397a5ee722ee4f63931f82aeb`
actions/setup-python	`5`	`6`
actions/cache	`4`	`6`
mdeweerd/logToCheckStyle	`2024.2.9`	`2026.7.1`
actions/upload-artifact	`4`	`7`
release-drafter/release-drafter	`5`	`7`

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

block checking out fork pr for pull_request_target and workflow_run by @aiqiaoy in actions/checkout#2454

Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458

Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in actions/checkout#2460

Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in actions/checkout#2461

Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in actions/checkout#2459

upgrade module to esm and update dependencies by @aiqiaoy in actions/checkout#2463

Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in actions/checkout#2462

getting ready for checkout v7 release by @aiqiaoy in actions/checkout#2464

update error wording by @aiqiaoy in actions/checkout#2467

New Contributors

@aiqiaoy made their first contribution in actions/checkout#2454

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

Update changelog by @ericsciple in actions/checkout#2357

fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in actions/checkout#2414

Fix checkout init for SHA-256 repositories by @yaananth in actions/checkout#2439

Update changelog for v6.0.3 by @yaananth in actions/checkout#2446

New Contributors

@yaananth made their first contribution in actions/checkout#2414

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by @TingluoHuang in actions/checkout#2355

Fix tag...
Description has been truncated

Updates the requirements on [urllib3](https://github.com/urllib3/urllib3), [colorama](https://github.com/tartley/colorama), [selenium](https://github.com/SeleniumHQ/Selenium), [pyvirtualdisplay](https://github.com/ponty/pyvirtualdisplay) and [requests](https://github.com/psf/requests) to permit the latest version. Updates `urllib3` to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@1.24.2...2.7.0) Updates `colorama` to 0.4.6 - [Changelog](https://github.com/tartley/colorama/blob/master/CHANGELOG.rst) - [Commits](tartley/colorama@0.3.7...0.4.6) Updates `selenium` to 4.46.0 - [Release notes](https://github.com/SeleniumHQ/Selenium/releases) - [Commits](SeleniumHQ/selenium@selenium-3.141.0...selenium-4.46.0) Updates `pyvirtualdisplay` to 3.0 - [Commits](ponty/PyVirtualDisplay@0.2.4...3.0) Updates `requests` to 2.34.2 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.23.0...v2.34.2) :arrow_up: Bump the infrastructure group with 11 updates Bumps the infrastructure group with 11 updates: | Package | From | To | | --- | --- | --- | | setuptools | `80` | `83.0.0` | | [https://github.com/asottile/pyupgrade](https://github.com/asottile/pyupgrade) | `v3.10.1` | `3.21.2` | | pyproject-flake8 | `0.0.1a2` | `7.0.0` | | flake8-bugbear | `22.1.11` | `25.11.29` | | flake8-comprehensions | `3.8.0` | `3.17.0` | | flake8-2020 | `1.6.1` | `1.8.1` | | pycodestyle | `2.10.0` | `2.14.0` | | pyflakes | `2.4.0` | `3.4.0` | | [https://github.com/codespell-project/codespell](https://github.com/codespell-project/codespell) | `v2.2.5` | `2.4.2` | | [https://github.com/pylint-dev/pylint](https://github.com/pylint-dev/pylint) | `v4.0.5` | `4.0.6` | | [https://github.com/pre-commit/mirrors-mypy](https://github.com/pre-commit/mirrors-mypy) | `v2.1.0` | `2.3.0` | Updates `setuptools` from 80 to 83.0.0 Updates `https://github.com/asottile/pyupgrade` from v3.10.1 to 3.21.2 - [Commits](asottile/pyupgrade@v3.10.1...v3.21.2) Updates `pyproject-flake8` from 0.0.1a2 to 7.0.0 Updates `flake8-bugbear` from 22.1.11 to 25.11.29 Updates `flake8-comprehensions` from 3.8.0 to 3.17.0 Updates `flake8-2020` from 1.6.1 to 1.8.1 Updates `pycodestyle` from 2.10.0 to 2.14.0 Updates `pyflakes` from 2.4.0 to 3.4.0 Updates `https://github.com/codespell-project/codespell` from v2.2.5 to 2.4.2 - [Release notes](https://github.com/codespell-project/codespell/releases) - [Commits](codespell-project/codespell@v2.2.5...v2.4.2) Updates `https://github.com/pylint-dev/pylint` from v4.0.5 to 4.0.6 - [Release notes](https://github.com/pylint-dev/pylint/releases) - [Commits](pylint-dev/pylint@v4.0.5...v4.0.6) Updates `https://github.com/pre-commit/mirrors-mypy` from v2.1.0 to 2.3.0 - [Commits](pre-commit/mirrors-mypy@v2.1.0...v2.3.0) :arrow_up: Bump the infrastructure group with 9 updates Bumps the infrastructure group with 9 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `7` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.6` | `0.5.7` | | [home-assistant/builder](https://github.com/home-assistant/builder) | `2026.03.2` | `2026.06.0` | | [home-assistant/builder/actions/publish-multi-arch-manifest](https://github.com/home-assistant/builder) | `8b139affa26d40fa3cc0d0cb77a8aefaf417a460` | `91a3a46c1c8b6c7397a5ee722ee4f63931f82aeb` | | [actions/setup-python](https://github.com/actions/setup-python) | `5` | `6` | | [actions/cache](https://github.com/actions/cache) | `4` | `6` | | [mdeweerd/logToCheckStyle](https://github.com/mdeweerd/logtocheckstyle) | `2024.2.9` | `2026.7.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` | | [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `5` | `7` | Updates `actions/checkout` from 4 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Commits](actions/checkout@v4...v7) Updates `zizmorcore/zizmor-action` from 0.5.6 to 0.5.7 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@5f14fd0...192e21d) Updates `home-assistant/builder` from 2026.03.2 to 2026.06.0 - [Release notes](https://github.com/home-assistant/builder/releases) - [Commits](home-assistant/builder@2026.03.2...2026.06.0) Updates `home-assistant/builder/actions/publish-multi-arch-manifest` from 8b139affa26d40fa3cc0d0cb77a8aefaf417a460 to 91a3a46c1c8b6c7397a5ee722ee4f63931f82aeb - [Release notes](https://github.com/home-assistant/builder/releases) - [Commits](home-assistant/builder@8b139af...91a3a46) Updates `actions/setup-python` from 5 to 6 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5...v6) Updates `actions/cache` from 4 to 6 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v6) Updates `mdeweerd/logToCheckStyle` from 2024.2.9 to 2026.7.1 - [Commits](mdeweerd/LogToCheckStyle@v2024.2.9...v2026.7.1) Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) Updates `release-drafter/release-drafter` from 5 to 7 - [Release notes](https://github.com/release-drafter/release-drafter/releases) - [Commits](release-drafter/release-drafter@v5...v7) :arrow_up: Bump the infrastructure group with 2 updates Bumps the infrastructure group with 2 updates: ubuntu and alpine. Updates `ubuntu` from 24.04 to 26.04 Updates `alpine` from 3.23 to 3.24 --- updated-dependencies: - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production dependency-group: infrastructure - dependency-name: colorama dependency-version: 0.4.6 dependency-type: direct:production dependency-group: infrastructure - dependency-name: selenium dependency-version: 4.46.0 dependency-type: direct:production dependency-group: infrastructure - dependency-name: pyvirtualdisplay dependency-version: '3.0' dependency-type: direct:production dependency-group: infrastructure - dependency-name: requests dependency-version: 2.34.2 dependency-type: direct:production dependency-group: infrastructure - dependency-name: setuptools dependency-version: 83.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: https://github.com/asottile/pyupgrade dependency-version: 3.21.2 dependency-type: direct:production dependency-group: infrastructure - dependency-name: pyproject-flake8 dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: flake8-bugbear dependency-version: 25.11.29 dependency-type: direct:production update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: flake8-comprehensions dependency-version: 3.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: infrastructure - dependency-name: flake8-2020 dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: infrastructure - dependency-name: pycodestyle dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: infrastructure - dependency-name: pyflakes dependency-version: 3.4.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: https://github.com/codespell-project/codespell dependency-version: 2.4.2 dependency-type: direct:production dependency-group: infrastructure - dependency-name: https://github.com/pylint-dev/pylint dependency-version: 4.0.6 dependency-type: direct:production dependency-group: infrastructure - dependency-name: https://github.com/pre-commit/mirrors-mypy dependency-version: 2.3.0 dependency-type: direct:production dependency-group: infrastructure - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: infrastructure - dependency-name: home-assistant/builder dependency-version: 2026.06.0 dependency-type: direct:production dependency-group: infrastructure - dependency-name: home-assistant/builder/actions/publish-multi-arch-manifest dependency-version: 91a3a46c1c8b6c7397a5ee722ee4f63931f82aeb dependency-type: direct:production dependency-group: infrastructure - dependency-name: actions/setup-python dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: actions/cache dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: mdeweerd/logToCheckStyle dependency-version: 2026.7.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: release-drafter/release-drafter dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: ubuntu dependency-version: '26.04' dependency-type: direct:production dependency-group: infrastructure - dependency-name: alpine dependency-version: '3.24' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: infrastructure ... Signed-off-by: dependabot[bot] <support@github.com>

      - name: Prepare build matrix
        id: matrix
-        uses: home-assistant/builder/actions/prepare-multi-arch-matrix@2026.03.2
+        uses: home-assistant/builder/actions/prepare-multi-arch-matrix@2026.06.0



      - name: Build image
-        uses: home-assistant/builder/actions/build-image@2026.03.2
+        uses: home-assistant/builder/actions/build-image@2026.06.0


        if: false
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7


          python-version: 3.12.1
      - run: python -m pip install pre-commit
-      - uses: actions/cache/restore@v4
+      - uses: actions/cache/restore@v6


          pre-commit run --show-diff-on-failure --color=always --all-files | tee ${RAW_LOG}
      - name: Convert Raw Log to Checkstyle format (launch action)
-        uses: mdeweerd/logToCheckStyle@v2024.2.9
+        uses: mdeweerd/logToCheckStyle@v2026.7.1


          key: pre-commit-4|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
      - name: Provide log as artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7


    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7


          fetch-depth: 0
      - name: Create Release
-        uses: release-drafter/release-drafter@v5
+        uses: release-drafter/release-drafter@v7


    steps:
      - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7


        if: false
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7


dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 14, 2026

github-advanced-security AI found potential problems Jul 14, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the "infrastructure" group with 4 updates across multiple ecosystems - #54

Bump the "infrastructure" group with 4 updates across multiple ecosystems#54
dependabot[bot] wants to merge 1 commit into
meters-to-hafrom
dependabot/infrastructure-f88e6f9dcf

dependabot Bot commented on behalf of github Jul 14, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

Security

Deprecations and Removals

Bugfixes

2.7.0 (2026-05-07)

Security

Deprecations and Removals

Bugfixes

Selenium 4.46.0

Detailed Changelogs by Component

What's Changed

v2.34.2

2.34.2 (2026-05-14)

2.34.2 (2026-05-14)

2.34.1 (2026-05-13)

2.34.0 (2026-05-11)

v2.4.2

Highlights

What's Changed

v4.0.6

What's new in Pylint 4.0.6?

False Positives Fixed

v7.0.0

What's Changed

New Contributors

v6.0.3

What's Changed

New Contributors

v6.0.2

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 14, 2026 •

edited

Loading