deps(uv): bump the uv-minor-patch group across 1 directory with 29 updates

[dependabot]

Bumps the uv-minor-patch group with 29 updates in the / directory:

Package	From	To
anyio	4.14.2	4.15.1
click	8.4.2	8.5.0
cryptography	50.0.0	50.0.1
fonttools	4.63.0	4.64.0
joblib	1.5.3	1.6.0
kiwisolver	1.5.0	1.5.1
pypdf	6.16.1	6.17.0
regex	2026.7.19	2026.9.3
pymssql	2.3.13	2.4.0
pymongo	4.17.0	4.18.0
snowflake-connector-python	4.7.2	4.7.3
sentence-transformers	6.0.0	6.0.1
rapidfuzz	3.14.5	3.14.6
pillow-heif	1.5.0	1.6.0
streamlit	1.62.0	1.63.0
gitpython	3.1.59	3.1.61
hypothesis	6.165.10	6.167.1
maturin	1.14.1	1.15.0
ruff	0.16.4	0.16.6
ast-serialize	0.6.0	0.9.0
cyclonedx-python-lib	11.11.0	11.12.0
filelock	3.32.2	3.32.5
librt	0.13.0	0.15.0
lxml	6.1.1	6.1.3
narwhals	2.24.0	2.25.0
platformdirs	4.11.1	4.11.7
python-discovery	1.5.1	1.6.0
stevedore	5.9.0	5.9.1
virtualenv	21.7.4	21.7.8

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

• Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

• Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

  • follow_symlinks on exists() (Python 3.12+)
  • follow_symlinks on is_dir() (Python 3.13+)
  • follow_symlinks on is_file() (Python 3.13+)
  • follow_symlinks on owner() (Python 3.13+)
  • follow_symlinks on group() (Python 3.13+)
  • newline on read_text() (Python 3.13+)

  (#1286, #1293; PR by @​jaideeppyne)

• Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

• Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

• Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

• Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

• Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

• Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

• Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

• Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

• Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

• Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

• Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

• Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

• Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

• Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

• Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

• Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

• Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

• Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits

• ffcd154 Bumped up the version
• 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
• 9283662 Bumped up the version
• d137692 Improved the instructions for AI agents
• 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
• 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
• b825c3b Fixed pyproject.toml changes not triggering the test suite
• 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
• b05fe6d Fixed wrong type in move_on_after (#1297)
• 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
• Additional commits viewable in compare view

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). {pr}3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
• {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
• The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits

• 8b19813 Release version 8.5.0
• 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
• 131c86a Add FAQ entry about UnicodeEncodeError on Windows
• e1fd594 Add support of pathlib.Path to edit (#3781)
• a1d8785 Add support of pathlib.Path to edit
• 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
• a6256bf Forwards all user's parameters set in PAGER
• 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
• 9835b0f Resolve the pager command once, in _pager_contextmanager
• f36d58b Refactor pager stream handling (#3767)
• Additional commits viewable in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates fonttools from 4.63.0 to 4.64.0

Release notes

Sourced from fonttools's releases.

4.64.0

• [feaLib] Fix name-table parsing for multibyte Mac encodings (#1196, #4092).
• [ttProgram] Also indent TrueType assembly following IDEF[ ], like function definitions (#4093).
• [subset] Keep East Asian spacing palt by default (#4094).
• [subset] Bug fix for MATH table in which constructions for glyphs that are only added during MATH closure were kept (#4096).
• [ufoLib] Make glyph-to-group construction accessible outside of lookup function (#4102).
• [glyf] Use reverse glyph map for O(1) __setitem__ membership (#4103).
• [ttLib] Fix fixLookupOverFlows() reporting success when it had not promoted any lookup to Extension, masking unresolvable overflows.
• [ttLib] Add support for TrueType Collection version 2 (#4100).
• [ttLib] Pin a single head.modified timestamp across TTCollection.save (#4111).
• [ttLib] Give an actionable error when LookupList overflow is unrecoverable (#4109).
• [ttLib] Add support for the AAT bitmap tables bhed, bdat, bloc, variants of head, EBDT, EBLC used in legacy Apple bitmap-only fonts (#4115).
• [ttLib] Check OS/2 fsSelection/macStyle consistency against bhed as well as head (#4118, #4119).
• [misc.roundTools] Add types and documentation (#4123).
• [varLib.instancer] Instance the BASE table (#4137).
• [varLib.instancer] Fix Private-dict vsindex handling in instantiateCFF2 (#4129, #4132).
• [varLib.instancer] Fix crash instancing CFF2 fonts without a VariationStore (#4130, #4131).
• [sfnt] Raise TTLibError instead of AssertionError or struct.error when reading a font truncated within the table directory or a table entry (#4147, #4149).
• [misc.xmlWriter] Escape the ]]> terminator inside CDATA sections, so an SVG document containing it can no longer smuggle markup past a TTX round trip (#4139).
• [varLib.instancer] Implement avar2 partial-instancing: the avar version 2 ItemVariationStore is adjusted so that remaining axes behave the same after limiting the designspace (#4045).
• [feaLib] Add shorthand for the value at the default location in a variable scalar: (100 wght=900:120) means (wght=400:100 wght=900:120) when the wght default is 400 (#4024).
• [cmap] Raise TTLibError for a truncated or out-of-bounds cmap subtable header (#4151).
• [designspaceLib] Reject conflicting duplicate inputs in axis maps instead of silently keeping the last one (#4153).
• [designspaceLib] Read an empty <lib> element as an empty lib instead of raising IndexError (#4142, #4144).
• [colorLib] Raise a legible error when a COLRv0 layer, or a COLRv1 PaintGlyph or PaintColrGlyph, references a glyph missing from the glyphMap, instead of failing obscurely later (#2629, #4141).
• [cmap] Don't drop subtables in unsupported formats when compiling or dumping a font read from binary (#4136).
• [ttLib] Implement splitSinglePos so GPOS lookup type 1 offset overflows can be recovered by splitting the subtable (#4091, #4108).
• [cmap] Round-trip empty Macintosh format 2 subtables (#3663, #4117).
• [glyf] Raise TTLibError instead of RecursionError when recalcBounds() hits a composite-component reference cycle (#3899, #4116).
• [svgLib] Fix crash parsing an SVG path with consecutive closepath commands (Z Z) (#4122).
• [ttLib] Fix DefaultTable type annotations (#4126).
• [ttLib] Add support for the EBSC (Embedded Bitmap Scaling) table (#4113).
• [svgLib] Suppress spurious close segments caused by floating-point drift in relative path commands (#3860, #4127).
• [qu2cu] Fix TypeError in the Cython-compiled build when Qu2CuPen passes tuple splines (#4160).
• [mort] Add semantic decompilation, TTX, and compilation support for rearrangement, contextual-substitution, ligature, and insertion subtables (#4158, #4159, #4161).
• [svgLib] Start a new subpath at the just-closed subpath's initial point when a drawto command follows a closepath, per SVG spec (#4154, #4155).
• [misc.filesystem] SECURITY Reject paths that resolve outside the filesystem root: a malicious UFO could read arbitrary files via .. components in contents.plist, and a crafted .ufoz could create files outside its temporary mirror (#4124).
• [ttLib] SECURITY Sanitise glyph names used as filenames in EBDT/CBDT ttx -z extfile export, preventing arbitrary file writes from untrusted fonts (#4128).
• [misc.etree] SECURITY Don't resolve external XML entities in XMLParser when lxml is used, preventing XXE file disclosure on lxml < 5.0 (#4145).
• [subset] Fully prune VARC auxiliary data: collect and remap variation indices referenced by condition tables when subsetting the MultiVarStore, and drop the AxisIndicesList, ConditionList, and MultiVarStore when they end up empty (#4162).

Changelog

Sourced from fonttools's changelog.

4.64.0 (released 2026-08-31)

• [feaLib] Fix name-table parsing for multibyte Mac encodings (#1196, #4092).
• [ttProgram] Also indent TrueType assembly following IDEF[ ], like function definitions (#4093).
• [subset] Keep East Asian spacing palt by default (#4094).
• [subset] Bug fix for MATH table in which constructions for glyphs that are only added during MATH closure were kept (#4096).
• [ufoLib] Make glyph-to-group construction accessible outside of lookup function (#4102).
• [glyf] Use reverse glyph map for O(1) __setitem__ membership (#4103).
• [ttLib] Fix fixLookupOverFlows() reporting success when it had not promoted any lookup to Extension, masking unresolvable overflows.
• [ttLib] Add support for TrueType Collection version 2 (#4100).
• [ttLib] Pin a single head.modified timestamp across TTCollection.save (#4111).
• [ttLib] Give an actionable error when LookupList overflow is unrecoverable (#4109).
• [ttLib] Add support for the AAT bitmap tables bhed, bdat, bloc, variants of head, EBDT, EBLC used in legacy Apple bitmap-only fonts (#4115).
• [ttLib] Check OS/2 fsSelection/macStyle consistency against bhed as well as head (#4118, #4119).
• [misc.roundTools] Add types and documentation (#4123).
• [varLib.instancer] Instance the BASE table (#4137).
• [varLib.instancer] Fix Private-dict vsindex handling in instantiateCFF2 (#4129, #4132).
• [varLib.instancer] Fix crash instancing CFF2 fonts without a VariationStore (#4130, #4131).
• [sfnt] Raise TTLibError instead of AssertionError or struct.error when reading a font truncated within the table directory or a table entry (#4147, #4149).
• [misc.xmlWriter] Escape the ]]> terminator inside CDATA sections, so an SVG document containing it can no longer smuggle markup past a TTX round trip (#4139).
• [varLib.instancer] Implement avar2 partial-instancing: the avar version 2 ItemVariationStore is adjusted so that remaining axes behave the same after limiting the designspace (#4045).
• [feaLib] Add shorthand for the value at the default location in a variable scalar: (100 wght=900:120) means (wght=400:100 wght=900:120) when the wght default is 400 (#4024).
• [cmap] Raise TTLibError for a truncated or out-of-bounds cmap subtable header (#4151).
• [designspaceLib] Reject conflicting duplicate inputs in axis maps instead of silently keeping the last one (#4153).
• [designspaceLib] Read an empty <lib> element as an empty lib instead of raising IndexError (#4142, #4144).
• [colorLib] Raise a legible error when a COLRv0 layer, or a COLRv1 PaintGlyph or PaintColrGlyph, references a glyph missing from the glyphMap, instead of failing obscurely later (#2629, #4141).
• [cmap] Don't drop subtables in unsupported formats when compiling or dumping a

... (truncated)

Commits

• 37dfa71 Release 4.64.0
• 5cab496 Update NEWS.rst [skip ci]
• 6f1429b [subset] Fully prune VARC auxiliary data (#4162)
• 93fc470 Merge pull request #4145 from insaf021/etree-no-external-entities
• 1ce6993 [misc.etree] only override resolve_entities on lxml < 5.0
• 9c10287 Merge pull request #4128 from insaf021/ebdt-extfile-basename
• 53e2b0b [E_B_D_T_] don't let sanitised glyph names collide
• 3bbd268 Merge pull request #4124 from insaf021/osfs-path-containment
• 6840516 [misc.filesystem] simplify containment check, pin symlink strictness
• 8f4b4ee [misc.filesystem] don't publish a half-built zip directory mirror
• Additional commits viewable in compare view

Updates joblib from 1.5.3 to 1.6.0

Changelog

Sourced from joblib's changelog.

Release 1.6.0 - 2026/08/31

• Fix caching of functions whose source cannot be retrieved, such as functions defined in a notebook cell. Their identity fell back to str(hash(func.__code__)), which is salted by PYTHONHASHSEED and so differed between processes. A worker reading the func_code.py written by another one concluded that the function had changed and wiped the whole cache directory for it, discarding results computed by its peers. func_code.py is also no longer rewritten in place, so a reader can no longer catch it half-written and draw the same conclusion. joblib/joblib#1694

• Drop python 3.9 support. The oldest supported Python version is now Python 3.10. joblib/joblib#1773

• Fix eval_expr (used to evaluate the pre_dispatch argument of Parallel) to raise a ValueError as documented instead of leaking a ZeroDivisionError for expressions that divide or take a modulo by zero. joblib/joblib#1810

• MemorizedResult now forwards mmap_mode to its store backend, so a cached array reconstructed from a location is memory-mapped as requested instead of being loaded fully into memory. joblib/joblib#1799

• Unvendor cloudpickle to more quickly benefit from maintenance releases of cloudpickle joblib/joblib#1775

• Fix Memory.cache for functions with a keyword-only argument that has a default declared before a keyword-only argument without a default. joblib/joblib#1731

• Fix behavior of filter_args on some precise cases. joblib/joblib#1800

• Fix a concurrency error that could happen with unordered generator. joblib/joblib#1789

• Fix: dump() now accepts any input os.PathLike object to be consistent with load. joblib/joblib#1812

• The documentation now uses pydata sphinx theme. Furthermore, optional dependencies test and docs have been added to pyproject.toml. joblib/joblib#1774

• Vendor loky 3.6.0

... (truncated)

Commits

• cd9a6b0 Release 1.6.0 (#1844)
• d873f97 MNT vendor loky 3.6.0 (#1843)
• 4ff61af Bump the github-actions group with 4 updates (#1832)
• 804f472 FIX make func_code stable across processes when the source is unavailable (#1...
• 65cc49d TST Restore RNG sequence in hash compatibility test (#1837)
• c1b6541 CI Use pytest-run-parallel on free-threaded build (#1819)
• f6b80d3 MNT Simplify isinstance check in hashing (#1835)
• fa4d5af MNT remove python 3.9 from CI (#1773)
• 53cea7b DOC Update release docs to reflect usage of trusted publishing (#1826)
• 26500e9 Bump the github-actions group across 1 directory with 3 updates (#1790)
• Additional commits viewable in compare view

Updates kiwisolver from 1.5.0 to 1.5.1

Release notes

Sourced from kiwisolver's releases.

1.5.1

What's Changed

• build(deps): bump docker/setup-qemu-action from 2 to 4 by @​dependabot[bot] in nucleic/kiwi#218
• build(deps): bump actions/download-artifact from 5.0.0 to 8.0.0 by @​dependabot[bot] in nucleic/kiwi#219
• build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @​dependabot[bot] in nucleic/kiwi#222
• build(deps): bump sigstore/gh-action-sigstore-python from 3.2.0 to 3.3.0 by @​dependabot[bot] in nucleic/kiwi#233
• build(deps): bump sigstore/gh-action-sigstore-python from 3.3.0 to 3.4.0 by @​dependabot[bot] in nucleic/kiwi#236
• build(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in nucleic/kiwi#237
• build(deps): bump codecov/codecov-action from 5 to 7 by @​dependabot[bot] in nucleic/kiwi#235
• build(deps): bump actions/setup-python from 6 to 7 by @​dependabot[bot] in nucleic/kiwi#239
• Add iOS build configuration. by @​freakboy3742 in nucleic/kiwi#238
• build(deps): bump sigstore/gh-action-sigstore-python from 3.4.0 to 3.5.0 by @​dependabot[bot] in nucleic/kiwi#242
• ci: start testing on Python 3.15 by @​MatthieuDartiailh in nucleic/kiwi#243

New Contributors

• @​freakboy3742 made their first contribution in nucleic/kiwi#238

Full Changelog: nucleic/kiwi@1.5.0...1.5.1

Changelog

Sourced from kiwisolver's changelog.

Wrappers 1.5.1 | Solver 1.5.1 | 28/08/2026

• add support for Python 3.15 PR #243
• fix bad version reported in C++ code PR #243

Commits

• 166899b cut release 1.5.1
• 1af7c11 ci: start testing on Python 3.15 (#243)
• 2e7291d build(deps): bump sigstore/gh-action-sigstore-python from 3.4.0 to 3.5.0 (#242)
• e8acf1e Add iOS build configuration. (#238)
• bd4b983 build(deps): bump actions/setup-python from 6 to 7 (#239)
• 00be78d build(deps): bump codecov/codecov-action from 5 to 7 (#235)
• 91a75dd build(deps): bump actions/checkout from 6 to 7 (#237)
• 9f56ae2 build(deps): bump sigstore/gh-action-sigstore-python from 3.3.0 to 3.4.0 (#236)
• 613c5bc build(deps): bump sigstore/gh-action-sigstore-python from 3.2.0 to 3.3.0 (#233)
• a7331ee build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 (#222)
• Additional commits viewable in compare view

Updates pypdf from 6.16.1 to 6.17.0

Release notes

Sourced from pypdf's releases.

Version 6.17.0, 2026-09-04

What's new

Security (SEC)

• Limit value for Roman numerals (#4047) by @​stefan6419846

New Features (ENH)

• _cmap.py: Also parse encoding for embedded CFF Type1 fonts (#4032) by @​PJBrs

Performance Improvements (PI)

• Cache repeated text extraction character lookups (#4036) by @​petermik68-sudo

Bug Fixes (BUG)

• Treat an empty /Filter array as no filter when extracting images (#4026) by @​Anai-Guo
• Detect a duplicate dictionary key whose first value is falsy (#4024) by @​devYRPauli
• Make is_open=False collapse outline items (#3998) by @​SomSamantray

Robustness (ROB)

• Multiple changes for wrong inputs by @​RavSinghChandan
• Skip trailing duplicate %%EOF markers when locating startxref (#4015) by @​Anai-Guo
• Do not crash on a non-array destination (#3976) by @​eeshsaxena
• Handle annotations without subtype during merge (#3999) by @​Nexlu1

Documentation (DOC)

• Use AnnotationFlag enum instead of plain integers (#3997) by @​RavSinghChandan

Code Style (STY)

• Multiple small changes detected from test runs by @​RavSinghChandan

Full Changelog

Version 6.16.2, 2026-08-23

What's new

Bug Fixes (BUG)

• Make remove_from_tree() work on outline items (#3939) by @​RISHIKKASULA
• Be more lenient about space width in layout mode text extraction (#3992) by @​PJBrs
• Do not scale the text leading by the font size (#3987) by @​matthewkogan
• Update annotation appearance stream matrix on page transform (#3968) by @​BashfulHippo
• Allow repeated page references (#3959) by @​yuming-long

Robustness (ROB)

• Improve RC4 fallback when cryptography can't provide it (#3853) by @​msylw

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.17.0, 2026-09-04

Security (SEC)

• Limit value for Roman numerals (#4047)

New Features (ENH)

• _cmap.py: Also parse encoding for embedded CFF Type1 fonts (#4032)

Performance Improvements (PI)

• Cache repeated text extraction character lookups (#4036)

Bug Fixes (BUG)

• Treat an empty /Filter array as no filter when extracting images (#4026)
• Detect a duplicate dictionary key whose first value is falsy (#4024)
• Make is_open=False collapse outline items (#3998)

Robustness (ROB)

• Multiple changes for wrong inputs
• Skip trailing duplicate %%EOF markers when locating startxref (#4015)
• Do not crash on a non-array destination (#3976)
• Handle annotations without subtype during merge (#3999)

Documentation (DOC)

• Use AnnotationFlag enum instead of plain integers (#3997)

Code Style (STY)

• Multiple small changes detected from test runs

Full Changelog

Version 6.16.2, 2026-08-23

Bug Fixes (BUG)

• Make remove_from_tree() work on outline items (#3939)
• Be more lenient about space width in layout mode text extraction (#3992)
• Do not scale the text leading by the font size (#3987)
• Update annotation appearance stream matrix on page transform (#3968)
• Allow repeated page references (#3959)

Robustness (ROB)

• Improve RC4 fallback when cryptography can't provide it (#3853)

Full Changelog

Commits

• c76eed7 REL: 6.17.0
• 89db7c4 SEC: Limit value for Roman numerals (#4047)
• a667e9d ROB: Do not crash on a malformed embedded files name tree (#4037)
• 816b120 ROB: Do not crash when a destination tree node entry is not an array (#4039)
• 3818d66 ROB: Reject a page box that is not an array (#4041)
• 939ae0c STY: Type read_object as the PdfObject it always returns (#4038)
• 9c308b4 PI: Cache repeated text extraction character lookups (#4036)
• 17d57a5 ROB: Do not crash when the XObject resources are not a dictionary (#4030)
• 2f3ed6b ROB: Do not crash when the AcroForm entry is not a dictionary (Description has been truncated

[github-actions]

requirements.txt drift (unsigned push blocked)

uv.lock / pyproject.toml changed but GitHub Actions cannot push an unsigned commit under the required_signatures ruleset (#1419).

Option A — signed commit on this Dependabot branch:

git fetch origin pull/1871/head:dependabot-review
git checkout dependabot-review
uv export --frozen --no-emit-project -o requirements.txt
git add requirements.txt
git commit -S -m "chore(deps): regenerate requirements.txt after uv.lock update"
git push origin "HEAD:<dependabot-branch-name>"

Option B — supersede PR: apply the bump + export locally with signed commits (see CONTRIBUTING.md).

Download the CI-generated requirements.txt from the workflow artifact on this run when present.

[github-actions]

requirements.txt drift (unsigned push blocked)

uv.lock / pyproject.toml changed but GitHub Actions cannot push an unsigned commit under the required_signatures ruleset (#1419).

Option A — signed commit on this Dependabot branch:

git fetch origin pull/1871/head:dependabot-review
git checkout dependabot-review
uv export --frozen --no-emit-project -o requirements.txt
git add requirements.txt
git commit -S -m "chore(deps): regenerate requirements.txt after uv.lock update"
git push origin "HEAD:<dependabot-branch-name>"

Option B — supersede PR: apply the bump + export locally with signed commits (see CONTRIBUTING.md).

Download the CI-generated requirements.txt from the workflow artifact on this run when present.

[FabioLeitao]

Option A is in #1916 (filterwarnings on the exact BlockingPortal alias message; addopts = -v -W error kept). Follow-up to drop the filter: #1915.

After #1916 is on main, rebase this Dependabot group so CI can pass. Independent of OSSF Wave 2 (#1903–#1906).

[FabioLeitao]

Rebased onto main after #1916 (27c9c6f3) — BlockingPortal filterwarnings + addopts = -W error are on the base. CI should re-run on 3a65ebd5.

[github-actions]

requirements.txt drift (unsigned push blocked)

uv.lock / pyproject.toml changed but GitHub Actions cannot push an unsigned commit under the required_signatures ruleset (#1419).

Option A — signed commit on this Dependabot branch:

git fetch origin pull/1871/head:dependabot-review
git checkout dependabot-review
uv export --frozen --no-emit-project -o requirements.txt
git add requirements.txt
git commit -S -m "chore(deps): regenerate requirements.txt after uv.lock update"
git push origin "HEAD:<dependabot-branch-name>"

Option B — supersede PR: apply the bump + export locally with signed commits (see CONTRIBUTING.md).

Download the CI-generated requirements.txt from the workflow artifact on this run when present.

[FabioLeitao]

Collection still failed after #1916 (warning on import starlette.testclient during collection, before item marks). Follow-up: #1917 — pytest_configure warm-import + pytest_collection ignore of the exact BlockingPortal message; -W error unchanged. Rebase this Dependabot PR after #1917 is on main.

[FabioLeitao]

Rebased onto main after #1917 (e5455f5c). Head is 928bb434. Collection-time BlockingPortal filter should now apply; watching CI.

[github-actions]

requirements.txt drift (unsigned push blocked)

uv.lock / pyproject.toml changed but GitHub Actions cannot push an unsigned commit under the required_signatures ruleset (#1419).

Option A — signed commit on this Dependabot branch:

git fetch origin pull/1871/head:dependabot-review
git checkout dependabot-review
uv export --frozen --no-emit-project -o requirements.txt
git add requirements.txt
git commit -S -m "chore(deps): regenerate requirements.txt after uv.lock update"
git push origin "HEAD:<dependabot-branch-name>"

Option B — supersede PR: apply the bump + export locally with signed commits (see CONTRIBUTING.md).

Download the CI-generated requirements.txt from the workflow artifact on this run when present.

[FabioLeitao]

Collection is unblocked after #1917. First CI on 928bb434 failed only on requirements.txt vs uv.lock (not BlockingPortal). Synced with uv export --frozen --no-emit-project in 1d315095.