Skip to content

Bump the python-dev-dependencies group with 5 updates - #51

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/uv/develop/python-dev-dependencies-be60823675
Open

Bump the python-dev-dependencies group with 5 updates#51
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/uv/develop/python-dev-dependencies-be60823675

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 26, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on ruff, basedpyright, pyrefly, tox and uv-build to permit the latest version.
Updates ruff to 0.16.7

Release notes

Sourced from ruff's releases.

0.16.7

Release Notes

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)
  • [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

  • Alternate nested quotes inside format spec interpolations (#28259)
  • [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
  • [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
  • [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

  • Correct D211 and D203 rule conflict diagnostic (#28444)
  • Recognize slice and frozendict generics (#28477)
  • Stop defining __cached__ for Python 3.15 (#28476)
  • [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

  • Reuse parser name lookups when interning (#28399)
  • Speed up inherited configuration resolution (#28299)

Documentation

  • Fix line-length path in --config example (#28392)
  • Remove the "Who’s Using Ruff?" list (#28455)

Other changes

  • Embed archive checksums in the shell installer (#28281)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.7

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)
  • [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

  • Alternate nested quotes inside format spec interpolations (#28259)
  • [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
  • [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
  • [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

  • Correct D211 and D203 rule conflict diagnostic (#28444)
  • Recognize slice and frozendict generics (#28477)
  • Stop defining __cached__ for Python 3.15 (#28476)
  • [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

  • Reuse parser name lookups when interning (#28399)
  • Speed up inherited configuration resolution (#28299)

Documentation

  • Fix line-length path in --config example (#28392)
  • Remove the "Who’s Using Ruff?" list (#28455)

Other changes

  • Embed archive checksums in the shell installer (#28281)

Contributors

... (truncated)

Commits

Updates basedpyright to 1.40.1

Release notes

Sourced from basedpyright's releases.

v1.40.1 (pyright 1.1.414)

What's Changed

Full Changelog: DetachHead/basedpyright@v1.40.0...v1.40.1

Commits
  • e7fca69 1.40.1
  • f7b6ad0 add checks when there are multiline indents for doc strings, update (#1882)
  • 1bc4879 fix broken docs links
  • 845bfe1 move and baseline basedpyright errors in new build scripts from upstream
  • a9189ef prettier fix
  • 756bfaa fix build:extension:dev script
  • a7a2efd syncpack fix
  • 5f6749f fix tests
  • bb9b24f fix zizmor errors in new workflows from upstream
  • b8ccd0e fix compile errors from merge
  • Additional commits viewable in compare view

Updates pyrefly to 1.3.0

Release notes

Sourced from pyrefly's releases.

Pyrefly v1.3.0

Release date: September 10, 2026

Pyrefly v1.3.0 bundles 934 commits from 71 contributors.

🔍Release Highlights

Type Checking

  • New diagnostics and more accurate type inference. Pyrefly now catches invalid literal regular expressions, invalid mock.patch targets, unsupported dataclass_transform arguments, incompatible Protocol.__call__ overrides, and unimplemented abstract methods. Pattern-match exhaustiveness, overload resolution, narrowing, and generic inference are also more accurate.
  • Better support for major Python frameworks. Pyrefly understands same-file Django reverse relationships, checks SQLAlchemy updates against model fields, and recognizes attributes registered on PyTorch modules.

Language Server

  • Search the whole workspace for methods and nested definitions. Workspace symbol search now covers methods, nested classes and functions, and class attributes even in unopened files.
  • New editor refactorings and quick fixes. Change Signature updates a function and its call sites together, while new quick fixes remove unused imports and insert assert x is not None. Inlay hints can also insert required imports and link to definitions.

Configuration & CLI

  • Target individual Pyrefly errors with standard suppression comments. # type: ignore[pyrefly:<code>] suppresses a specific Pyrefly diagnostic without hiding unrelated errors on the same line.
  • Choose how Pyrefly handles untyped dependencies. The new --replace-untyped-imports-with-any option replaces selected third-party packages that lack stubs or a py.typed marker with Any, and pyrefly init translates mypy's follow_untyped_imports setting automatically.
  • Baseline files are easier to maintain and review. Baselines can match by concise description instead of source position, use a compact format, show existing errors at reduced severity, remove stale entries with --prune-baseline, and reject them in CI with --error-stale-baseline.

Experimental Extensions

  • Much broader shape-aware JAX and NumPy support. New JAX stubs cover array creation, manipulation, and linear algebra, while the new pyrefly-numpy-stubs package brings shape checking to NumPy. These stubs use a new type-level shape DSL, which replaces the old @shaped_array API.
  • Expanded Polars and pandas DataFrame schema support. Pyrefly tracks Polars schemas through common DataFrame transformations, with support for typed Series and schema annotations. pandas columns= projections now preserve the requested schema as well.

✨ New & Improved

Type Checking

  • Pattern matching gained stronger exhaustiveness checking, including tuple subjects and open types such as unions. Open-type exhaustiveness now has its own configurable non-exhaustive-match-open-type error kind.
  • Overload selection now follows the latest typing specification more closely, producing a safe common return type for gradual arguments and reducing false positives in complex overloads.
  • Type inference and narrowing are more precise for membership tests, equality checks, hasattr, wide Literal unions, callable values, reverse tuple slices, and values assigned from Any.
  • Dataclass fields backed by descriptors are now checked for incompatible read and write types under the new bad-dataclass-descriptor error kind.
  • String targets passed to unittest.mock.patch are validated, with nonexistent attributes reported as missing-attribute-patch-target warnings.
  • Literal regular expressions are checked for invalid patterns and capturing groups under the new regex error kind.
  • Django support now understands reverse ForeignKey, OneToOneField, and ManyToManyField relationships in the same file, while Django REST Framework serializers avoid false override errors for common Meta and field patterns.
  • SQLAlchemy update().values() checks values against mapped model fields.
  • PyTorch modules recognize attributes registered through register_buffer and register_parameter.

Language Server

  • Workspace symbol search now includes methods, nested classes, nested functions, and class attributes.
  • Cross-file call hierarchy, type hierarchy, and find-references now work without first opening every relevant file.

... (truncated)

Commits
  • 624bdc4 cut 1.3.0
  • ad6958c feat: support Pyrefly-specific type ignore codes
  • f1d8f62 Bump fast-uri from 3.1.5 to 3.1.7 in /website (#4789)
  • cb178b9 add type stubs for remaining jax.lax APIs (#4875)
  • 8ee41ca Model polars join(..., coalesce=...) (#4833) (#4859)
  • 5d00010 Find methods and other nested definitions in workspace symbols
  • 5b392ca Cache flat symbols for first-party modules
  • eaa1fd2 Trim the add_var_bound doc comment to its invariant
  • df4cfe0 Add build system integration tests (#3628)
  • aec8224 Deduplicate and stably rank workspace symbol results
  • Additional commits viewable in compare view

Updates tox to 4.61.4

Release notes

Sourced from tox's releases.

v4.61.4

What's Changed

New Contributors

Full Changelog: tox-dev/tox@4.61.3...4.61.4

Changelog

Sourced from tox's changelog.

Bug fixes - 4.61.4

  • Shebang parsing now uses shlex, so a quoted interpreter path that contains spaces is kept as one argument when TOX_LIMITED_SHEBANG rewrites the invocation - by :user:r3wretrhy. (:issue:4064)

v4.61.3 (2026-09-08)

Bug fixes - 4.61.3

  • A set_env environment file (file|.env) is now read as UTF-8 instead of the platform's locale encoding, so non-ASCII values no longer arrive mangled on Windows - by :user:MohammedAlkindi. (:issue:4059)
  • Preserve UNC and extended-length paths in Windows commands, including quoted paths - by :user:MohammedAlkindi. (:issue:4060)
  • Normalize project and extra names in dependency-group self-references - by :user:MohammedAlkindi. (:issue:4061)
  • Register factor labels and defaults for bare labeled dicts in env_list - by :user:dylanpulver. (:issue:4062)

v4.61.2 (2026-08-31)

Bug fixes - 4.61.2

  • tox now expands a generative digit range only where a factor starts, so an environment such as py313-django4-2 keeps its name rather than becoming py313-django4, 3 and 2 - by :user:MohammedAlkindi. (:issue:4053)

Improved documentation - 4.61.2

  • Document how factors work in one place, covering what a factor is, the characters tox accepts in one, the platform and architecture factors that apply to conditions without appearing in a name, and how selecting by factor differs from selecting by name - by :user:gaborbernat. (:issue:4055)
  • Give a reference entry to the configuration keys that had none. interrupt_post_commands runs commands_post after an interrupt, and config_file_path, host_python, home and tox_root_name are constants a configuration can substitute - by :user:gaborbernat. (:issue:4056)

Contributor-facing changes - 4.61.2

  • Declare license metadata per PEP 639, adding license-files and dropping the license classifier in pyproject.toml - by :user:mwtoews. (:issue:4052)

v4.61.1 (2026-08-28)

... (truncated)

Commits

Updates uv-build to 0.12.13

Release notes

Sourced from uv-build's releases.

0.12.13

Release Notes

Released on 2026-09-10.

Python

Enhancements

  • Verify hashes when downloading PEP 658 metadata sidecars (#21563)

Preview features

  • Respect ty exclusions when uv check automatically selects members of a virtual workspace (#21555)

Performance

  • Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (#21279)

Bug fixes

  • Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (#18713)
  • Prefer core-metadata over legacy aliases in JSON index responses (#21563)

Install uv 0.12.13

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex"

Download uv 0.12.13

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.12.13

Released on 2026-09-10.

Python

Enhancements

  • Verify hashes when downloading PEP 658 metadata sidecars (#21563)

Preview features

  • Respect ty exclusions when uv check automatically selects members of a virtual workspace (#21555)

Performance

  • Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (#21279)

Bug fixes

  • Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (#18713)
  • Prefer core-metadata over legacy aliases in JSON index responses (#21563)

0.12.12

Released on 2026-09-09.

The executables in our macOS and Windows release archives and uv and uv_build wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

  • Exclude distributions uploaded after the exclude-newer cutoff from lockfiles and generated requirement hashes (#21539)

0.12.11

Released on 2026-09-08.

Preview features

  • Generate missing artifact hashes when exporting pylock.toml files to ensure they conform to PEP 751 (#20146)
  • Warn when pylock.toml artifact hash tables are empty, which will be rejected in a future uv release (#21462)

Performance

  • Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (#21478)
  • Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (#21468)
  • Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (#21500)
  • Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (#21499)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python-dev-dependencies group with 5 updates
b1b3e72 
Updates the requirements on [ruff](https://github.com/astral-sh/ruff), [basedpyright](https://github.com/detachhead/basedpyright), [pyrefly](https://github.com/facebook/pyrefly), [tox](https://github.com/tox-dev/tox) and [uv-build](https://github.com/astral-sh/uv) to permit the latest version.

Updates `ruff` to 0.16.7
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.6...0.16.7)

Updates `basedpyright` to 1.40.1
- [Release notes](https://github.com/detachhead/basedpyright/releases)
- [Commits](DetachHead/basedpyright@v1.39.10...v1.40.1)

Updates `pyrefly` to 1.3.0
- [Release notes](https://github.com/facebook/pyrefly/releases)
- [Commits](facebook/pyrefly@1.2.0...1.3.0)

Updates `tox` to 4.61.4
- [Release notes](https://github.com/tox-dev/tox/releases)
- [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst)
- [Commits](tox-dev/tox@4.61.2...4.61.4)

Updates `uv-build` to 0.12.13
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.10...0.12.13)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.7
  dependency-type: direct:production
  dependency-group: python-dev-dependencies
- dependency-name: basedpyright
  dependency-version: 1.40.1
  dependency-type: direct:production
  dependency-group: python-dev-dependencies
- dependency-name: pyrefly
  dependency-version: 1.3.0
  dependency-type: direct:production
  dependency-group: python-dev-dependencies
- dependency-name: tox
  dependency-version: 4.61.4
  dependency-type: direct:production
  dependency-group: python-dev-dependencies
- dependency-name: uv-build
  dependency-version: 0.12.13
  dependency-type: direct:development
  dependency-group: python-dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 26, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants