Skip to content

deps(uv): bump the uv-minor-patch group with 26 updates - #1945

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-minor-patch-6e2b5eb343
Closed

deps(uv): bump the uv-minor-patch group with 26 updates#1945
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-minor-patch-6e2b5eb343

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the uv-minor-patch group with 26 updates:

Package From To
contourpy 1.3.3 1.4.0
fonttools 4.64.0 4.65.0
matplotlib 3.11.1 3.11.2
numpy 2.5.2 2.5.3
pydantic-core 2.48.0 2.49.0
pypdf 6.17.0 6.18.1
pyjwt 2.13.0 2.14.0
regex 2026.9.3 2026.9.10
scikit-learn 1.9.0 1.9.1
psycopg2-binary 2.9.12 2.9.13
pymssql 2.4.0 2.4.1
pymongo 4.18.0 4.18.1
pillow-heif 1.6.0 1.7.0
gitpython 3.1.61 3.1.62
hypothesis 6.167.1 6.168.0
ruff 0.16.6 0.16.7
ast-serialize 0.6.0 0.11.1
cyclonedx-python-lib 11.11.0 11.12.0
filelock 3.32.2 3.32.6
librt 0.13.0 0.15.0
lxml 6.1.1 6.1.3
narwhals 2.24.0 2.26.0
platformdirs 4.11.1 4.11.8
python-discovery 1.5.1 1.6.0
stevedore 5.9.0 5.9.1
virtualenv 21.7.4 21.7.9

Updates contourpy from 1.3.3 to 1.4.0

Release notes

Sourced from contourpy's releases.

Version 1.4.0

ContourPy 1.4.0 introduces a new readonly property ContourGenerator.name for the algorithm name, adds support for CPython 3.15, and is the first release to upload pyodide wheels to PyPI. Support for riscv64 and iOS architectures is added but considered experimental, wheels are available from the Scientific Python Nightly Wheels service but not PyPI.

Enhancements:

  • Add ContourGenerator.name readonly property (#566)

Compatibility:

Code improvements:

  • Remove unused ntotal argument in mpl2005 build_cntr_list_v2 (#550)

Documentation improvements:

  • Use myst markdown for documentation instead of RST (#551)
  • Switch docs to sphinx book theme (#552)

Build, testing and CI improvements:

  • Switch from macos-13 to macos-15-intel github runners (#507)
  • Fully test on python 3.14 (#509)
  • Build intel mac wheels on macos-15-intel runner (#513)
  • Update license metadata to use PEP 639 (#525)
  • Update test images for bokeh 3.9.0 (#533)
  • Remove use of cirrus CI (#537)
  • Add zizmor to pre-commit (#546)
  • Remove testing on python 3.13t (#555)
  • Update test images and thresholds (#542, #561)
Changelog

Sourced from contourpy's changelog.

v1.4.0 (2026-09-11)

ContourPy 1.4.0 introduces a new readonly property ContourGenerator.name for the algorithm name, adds support for CPython 3.15, and is the first release to upload pyodide wheels to PyPI. Support for riscv64 and iOS architectures is added but considered experimental, wheels are available from the Scientific Python Nightly Wheels service but not PyPI.

Enhancements:

  • Add ContourGenerator.name readonly property (#566)

Compatibility:

Code improvements:

  • Remove unused ntotal argument in mpl2005 build_cntr_list_v2 (#550)

Documentation improvements:

  • Use myst markdown for documentation instead of RST (#551)
  • Switch docs to sphinx book theme (#552)

Build, testing and CI improvements:

  • Switch from macos-13 to macos-15-intel github runners (#507)
  • Fully test on python 3.14 (#509)
  • Build intel mac wheels on macos-15-intel runner (#513)
  • Update license metadata to use PEP 639 (#525)
  • Update test images for bokeh 3.9.0 (#533)
  • Remove use of cirrus CI (#537)
  • Add zizmor to pre-commit (#546)
  • Remove testing on python 3.13t (#555)
  • Update test images and thresholds (#542, #561)
Commits
  • ae4126a Prepare for v1.4.0 release (#567)
  • b723928 Add ContourGenerator.name readonly property (#566)
  • 6f84ad1 Enable building pyodide 3.15 wheels (#565)
  • d04c7a9 Bump docker/setup-qemu-action from 4.2.0 to 4.3.0 in the actions group (#564)
  • 21475ec Bump pypa/cibuildwheel from 4.1.0 to 4.2.0 in the actions group (#562)
  • 51f45a4 Remove setup-python when testing using cibuildwheel (#563)
  • 1403562 Update test images and thresholds (#561)
  • 3bbb2df Bump the actions group with 2 updates (#558)
  • cc418a2 Add build configurations for iOS wheels. (#556)
  • 3a618f7 Increase pyodide test coverage (#557)
  • Additional commits viewable in compare view

Updates fonttools from 4.64.0 to 4.65.0

Release notes

Sourced from fonttools's releases.

4.65.0

  • [glyf] Add __iter__, items and values methods to the glyf table to make it more dict-like (#4156).
  • [feaLib] Escape the anonymous block tag when scanning for its terminator, so tags containing regex metacharacters are matched literally (#4167).
  • [varLib] Strip directory components from <variable-font name="..."/> when deriving the output filename in the varLib command line, so a designspace cannot write outside the output directory (#4168).
  • [feaLib] Fix tracking of the current script and language across redundant script statements. Rules following a script statement that names the first declared language system no longer end up under the DFLT script, and a script statement naming the already-current script still narrows the language systems and terminates the current lookup while leaving the lookupflag alone, matching makeotf (#1824, #2522, #4169).
  • [varLib.interpolatable] Escape glyph names in the HTML report (#4172).
  • [otlLib] Fix overflow handling when building contextual lookups: offset overflows now raise OTLOffsetOverflowError instead of AttributeError so another contextual format can be tried (regression from #3439). When all formats overflow, split the ruleset in halves until it fits (#4171).
Changelog

Sourced from fonttools's changelog.

4.65.0 (released 2026-09-10)

  • [glyf] Add __iter__, items and values methods to the glyf table to make it more dict-like (#4156).
  • [feaLib] Escape the anonymous block tag when scanning for its terminator, so tags containing regex metacharacters are matched literally (#4167).
  • [varLib] Strip directory components from <variable-font name="..."/> when deriving the output filename in the varLib command line, so a designspace cannot write outside the output directory (#4168).
  • [feaLib] Fix tracking of the current script and language across redundant script statements. Rules following a script statement that names the first declared language system no longer end up under the DFLT script, and a script statement naming the already-current script still narrows the language systems and terminates the current lookup while leaving the lookupflag alone, matching makeotf (#1824, #2522, #4169).
  • [varLib.interpolatable] Escape glyph names in the HTML report (#4172).
  • [otlLib] Fix overflow handling when building contextual lookups: offset overflows now raise OTLOffsetOverflowError instead of AttributeError so another contextual format can be tried (regression from #3439). When all formats overflow, split the ruleset in halves until it fits (#4171).
Commits
  • 656f89d Release 4.65.0
  • 1643950 Update NEWS.rst [skip ci]
  • fd0f083 Merge pull request #4177 from fonttools/sbix-to-otsvg-snippet
  • 9c625d4 Merge pull request #4171 from fonttools/fix-contextual-size-overflow
  • 5f04c38 Add sbix to OT-SVG conversion snippet
  • 48a0cf9 Merge pull request #4172 from insaf021/interpolatable-html-escape
  • d30db24 Merge pull request #4169 from cmyr/fealib-script-tracking-afdko
  • ac342d7 [varLib.interpolatable] escape glyph name in HTML report
  • 2a93de2 Split contextual rulesets when all formats overflow
  • e6bb5fe Fix overflow reporting when sizing contextual lookups
  • Additional commits viewable in compare view

Updates matplotlib from 3.11.1 to 3.11.2

Release notes

Sourced from matplotlib's releases.

REL: v3.11.2

This is the second bugfix release of the 3.11.x series.

This release contains several bug-fixes and adjustments:

  • Speed up RGBA-stage image resampling
  • Fix hexbin clipping in PDF output
  • Fix \text with internal braces
  • Fix some crashes and make some checks more robust to unlikely cases
  • Fix frame skew when saving GIF animations with PillowWriter
  • Fix HiDPI handling in Qt toolbar and WebAgg embeddings
  • Fix ResizeEvent handling for TextBox
  • Fix bug with PGF hatch linewidth and color
  • Fix a bug with drawing an empty Collection
  • Fix incorrect glyphs in Cairo backends
  • Improve build system to prevent conflicts between wheels and system libraries
Commits
  • d3ca917 REL: v3.11.2
  • b76fea9 DOC: Set current version to 3.11.2
  • 39c7f06 DOC: Prepare GitHub stats for 3.11.2
  • 5dd13e3 Merge branch 'v3.11.1-doc' into release-3.11.2
  • aa484be Merge branch 'v3.11.0-doc' into v3.11.1-doc
  • 0e10f83 Merge pull request #32330 from meeseeksmachine/auto-backport-of-pr-32324-on-v...
  • ebe947b Backport PR #32324: Don't force any diagnostics to be errors in bundled Harfbuzz
  • 8f4b7c5 Merge pull request #32322 from meeseeksmachine/auto-backport-of-pr-32321-on-v...
  • 93278ad Backport PR #32321: DOC: correct note about PyOS_InputHook
  • b0aee78 Merge pull request #32319 from meeseeksmachine/auto-backport-of-pr-32305-on-v...
  • Additional commits viewable in compare view

Updates numpy from 2.5.2 to 2.5.3

Release notes

Sourced from numpy's releases.

v2.5.3 (Sep 6, 2026)

NumPy 2.5.3 Release Notes

The NumPy 2.5.3 is a patch release that fixes bugs discovered after the 2.5.2 release. Apart from the usual bug and maintenance work, there are a number of StringDType related fixes for problems discovered during the ongoing string work in the main branch.

This release supports Python versions 3.12-3.15

Changes

  • Casting a fixed-width byte string array (np.bytes_) to StringDType now raises TypeError when the bytes are not valid UTF-8. Previously the invalid bytes were stored as-is and later caused undefined behavior in string operations.

    (gh-32296)

  • MaskedArray._fill_value would become stale when ufuncs that change dtype left the result holding a fill_value typed for the old dtype. The mismatch was silent until something later called _check_fill_value, such as .view(), and then a TypeError would be raised. Now, when the copied fill_value is no longer valid for the new dtype, fall back to the default fill_value for that dtype instead of propagating the stale value. This may raise a ComplexWarning if the fill_value is complex and the new dtype is real.

    (gh-32423)

Contributors

A total of 9 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Charles Harris
  • Iason Krommydas
  • James Davies +
  • Joren Hammudoglu
  • Maanas Arora
  • Matti Picus
  • Nathan Goldbaum
  • Shikhar Goel +
  • Yeonho Kim +

Pull requests merged

A total of 27 pull requests were merged for this release.

  • #32235: MAINT: Prepare 2.5.x for further development

... (truncated)

Commits
  • dd88c0c Merge pull request #32511 from charris/prepare-2.5.3
  • edcac6a REL: Prepare for the NumPy 2.5.3 release
  • fd4d908 Merge pull request #32509 from charris/backport-32496
  • 65bb1da BUG: fix crash in ufunc.resolve_dtypes with a Python scalar type (#32496)
  • 294956e Merge pull request #32506 from charris/backport-32503
  • 26428d9 DOC: fix scipy docs links in intersphinx mapping (#32507)
  • 5fab1cb DOC: use static scipy doc site for intershpinx (#32503)
  • 7beed2f Merge pull request #32481 from ngoldbaum/stringdtype-backport
  • 8972f70 Merge pull request #32478 from charris/backport-32466
  • ab1b589 Merge pull request #32477 from charris/backport-32423
  • Additional commits viewable in compare view

Updates pydantic-core from 2.48.0 to 2.49.0

Commits

Updates pypdf from 6.17.0 to 6.18.1

Release notes

Sourced from pypdf's releases.

Version 6.18.1, 2026-09-11

What's new

Security (SEC)

Bug Fixes (BUG)

Robustness (ROB)

Documentation (DOC)

Full Changelog

Version 6.18.0, 2026-09-07

What's new

Please note that this release requires users which previously overwrote the default limits to migrate to the new approach: Docs

In short:

  • Use apply_configuration as a context manager to temporarily overwrite configuration values.
  • Use overwrite_configuration to change the configuration values for the whole session.

The old overwrites should continue to work in most cases. If you have migrated successfully and do not need the legacy handling anymore (which can cause some overhead), consider using the temporary disable_legacy_handling setting:

from pypdf import overwrite_configuration
overwrite_configuration(disable_legacy_handling=True)

In case you are experiencing some unexpected issues after the migration, consider opening a new issue (or commenting on an existing one) with the necessary details to reproduce it.

Security (SEC)

Deprecations (DEP)

New Features (ENH)

  • Draw borders and backgrounds for appearance streams and annotations (#4033) by @​PJBrs

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.18.1, 2026-09-11

Security (SEC)

  • Further restrict FlateDecode recovery (#4073)
  • Limit entry count for TrueType and Type1 font /Widths (#4072)
  • Limit allowed length of tokens in parse_bfchar (#4071)

Bug Fixes (BUG)

  • Use current text matrix for visitor_text (#4062)
  • Repeat the letter for /S /A and /S /a page labels past Z (#4065)
  • Use font color for FreeText default appearance (#4051)

Robustness (ROB)

  • Fix compatibility with fonttools < 4.58.0 (#4050, #4059)

Documentation (DOC)

  • Use combined matrix in visitor examples (#4066)

Full Changelog

Version 6.18.0, 2026-09-07

Security (SEC)

  • Limit allowed length of indirect object tokens (#4055)

Deprecations (DEP)

  • Rework configuration value handling (#4044)

New Features (ENH)

  • Draw borders and backgrounds for appearance streams and annotations (#4033)

Full Changelog

Commits
  • caf8cde REL: 6.18.1
  • d9d38cf SEC: Further restrict FlateDecode recovery (#4073)
  • 0fb26eb SEC: Limit entry count for TrueType and Type1 font /Widths (#4072)
  • 319d0b8 SEC: Limit allowed length of tokens in parse_bfchar (#4071)
  • 735d284 BUG: Use current text matrix for visitor_text (#4062)
  • 808a318 DOC: Use combined matrix in visitor examples (#4066)
  • c38feda BUG: Repeat the letter for /S /A and /S /a page labels past Z (#4065)
  • 3f7bc19 ROB: Do not crash when the XFA entry is not a well-formed array (#4064)
  • d80ccfc ROB: Fix compatibility for fonttools < 4.57.0 (#4050)
  • 7bb71dd ROB: Do not crash when the font encoding differences are not an array (#4058)
  • Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt's releases.

PyJWT 2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security


- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.

Fixed



- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.

Fixed




    

  • Raise the documented PyJWTError subclass instead of leaking a
    
TypeError when the exp, nbf, or iat claim decodes to a
    
non-numeric, non-string value such as a list, dict, or null.
Commits
  • c6fe464 release: prepare v2.14.0
  • f541302 style: apply Ruff formatting
  • 801cd12 fix: reject public JWK container HMAC keys
  • af8181c fix: reject empty HMAC keys from JWKs
  • ba4853a Throttle repeated PyJWKClient refreshes
  • 2798504 fix: reject DER public keys as HMAC secrets
  • 8b4e233 fix: reject loader-accepted PEM variants
  • 1f8180a fix: format JWS tests
  • cff1ac5 Fix redirect handler return annotation
  • 0a795b8 Reject redirects in PyJWKClient fetches
  • Additional commits viewable in compare view

Updates regex from 2026.9.3 to 2026.9.10

Changelog

Sourced from regex's changelog.

Version: 2026.9.10

Fixed version.

Version: 2026.9.9

PR [#615](https://github.com/mrabarnett/mrab-regex/issues/615): Fix Python API error propagation in match helpers

PR #616: Preserve Python Exceptions in Input Decoding and String Detachment


PR #617: Prevent Invalid Pointer Use and Exception State Corruption in Byte String Joining


PR #618: Propagate Allocation and Internal Errors During Pattern Compilation and Scanner Execution

Version: 2026.9.3

New version of cibuildwheel no longer supports building for free-threaded Python 3.13.

Version: 2026.9.2

New version of cibuildwheel no longer needs nor supports cpython-freethreading option.

Version: 2026.9.1

Updated cibuildwheel.
Support Python 3.15.

Version: 2026.8.31

Fixed version.

Version: 2026.8.30

Git issue 611: Heap out-of-bounds write at compile time
Git issue 612: count_one() size underflow through the stale required-string cache
Git issue 613: (*SKIP) inside an atomic group, plus an equality-only scan stop
Git issue 614: build_GROUP() does not propagate the match direction

Version: 2026.8.12

Support Python 3.15.

Version: 2026.7.19

Git issue 607: SIGSEGV: NULL pointer dereference in `basic_match()` when `(?R)`/`(?0)` recursion is used inside a fuzzy-matching quantifier
Git issue 608: SIGSEGV: out-of-bounds read in `bytes1_char_at()` with `DOTALL` + a fuzzy constraint + `(?r)` reverse-direction matching

Version: 2026.7.10

Clarified that the POSIX flag makes it look for only the longest overall match.

... (truncated)

Commits
  • 7dd71c1 Fixed version.
  • 59124d6 PR #615: Fix Python API error propagation in match helpers
  • 25e1521 Merge pull request #618 from dynapx/fix-compiler-error-propagation
  • 3ad78cf Merge pull request #616 from dynapx/fix-detach-string-error-propagation
  • f54253c Merge pull request #615 from dynapx/fix-python-api-error-propagation
  • c442244 Propagate scanner internal errors
  • 68837e7 Propagate node stack allocation failures
  • f1df538 Propagate check stack allocation failures
  • d8873b1 Preserve Python exceptions in input decoding
  • 910784f Propagate detach_string slicing errors
  • Additional commits viewable in compare view

Updates scikit-learn from 1.9.0 to 1.9.1

Release notes

Sourced from scikit-learn's releases.

Scikit-learn 1.9.1

We're happy to announce the 1.9.1 release.

This release contains a few bug fixes and is the first version supporting Python 3.15.

You can see the changelog here: https://scikit-learn.org/stable/whats_new/v1.9.html#version-1-9-1

You can upgrade with pip as usual:

pip install -U scikit-learn

The conda-forge builds can be installed using:

conda install -c conda-forge scikit-learn

Thanks to everyone who contributed to this release !

Commits
  • 866c0f5 generate changelog
  • 12f135f update upper bounds
  • 43ff2f2 bump version
  • b851524 DOC Mark dev index as orphan (#34916)
  • 01d56d4 DOC Fix wikipedia principal eigenvector example references (#34915)
  • b86a1e2 🔒 🤖 CI Update lock files for array-api CI build(s) 🔒 🤖 ...
  • d282698 🔒 🤖 CI Update lock files for main CI build(s) 🔒 🤖 (#34897)
  • eb34279 🔒 🤖 CI Update lock files for free-threaded CI build(s) 🔒 :rob...
  • 7581303 FIX: Fix QuantileTransformer(ignore_implicit_zeros=True) sub-sampling behav...
  • ac47f4d FIX: avoid EfficiencyWarning in OPTICS with metric='precomputed' (#34692)
  • Additional commits viewable in compare view

Updates psycopg2-binary from 2.9.12 to 2.9.13

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
  • Fix parsing of malformed bytea input.
  • Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
  • Add a pyproject.toml file to declare a PEP 517 build backend (:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
  • Drop support for Python 3.9.

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.14.
  • Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
  • Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
  • ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
  • Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.13.
  • Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
  • ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
  • Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.12.
  • Drop support for Python 3.6.

What's new in psycopg 2.9.8

... (truncated)

Commits
  • f650e7a chore: bump to release 2.9.13
  • 368c8a1 chore!: drop support for Python 3.9
  • 9b39e65 chore: drop scaleway build support
  • 2ca7041 fix: fix handling of PostgreSQL 18 exceptions
  • 5385c02 Build CPython 3.15 wheels
  • 1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
  • 433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
  • 8fb80bc fix: fix parsing of malformed int64 input in arrays
  • f98014a fix: fix parsing of malformed bytea input
  • 822b79c chore: bump dependencies in binary package
  • Additional commits viewable in compare view

Updates pymssql from 2.4.0 to 2.4.1

Release notes

Sourced from pymssql's releases.

pymssql 2.0 greenish

Experimental support for greening for gevent, etc.

Changelog

Sourced from pymssql's changelog.

Version 2.4.1 - 2026-09-07 - Mikhail Terekhov

General

  • Fix socket resource leak on failed connections (#1002), thanks to gintsmurans.
  • Enable free-threaded Python 3.14 wheel builds (#1004).
  • Add wheels for Python 3.15 (PR #1016), thanks to edgarrmondragon.
Commits
  • dfb9051 Update ChangeLog.rst
  • 0908736 Add concurrency limits to wheel-building job
  • 8fdadd4 PyPy is opt-in, so no need to skip it
  • 926541e Build Python 3.15 wheels
  • 9a21ce7 Protect connection_object_list with Lock
  • c751db2 Add free-threaded Python specific tests
  • 42a4f4a Enable free-threaded Python 3.14 wheel builds
  • 0be64d1 Fix socket resource leak on failed connections (#1002)
  • deda6bc Add test for #968
  • See full diff in compare view

Updates pymongo from 4.18.0 to 4.18.1

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.1 (2026/09/10)

Version 4.18.1 is a bug fix release.

  • Use an exact match for the file ID in GridFS delete methods (CVE-2026-88029_).

.. _CVE-2026-88029: https://www.cve.org/CVERecord?id=CVE-2026-88029

Commits
  • 127d140 PYTHON-6085 Prep for 4.18.1 release (#3047)
  • fa67658 PYTHON-5994 Use exact match for file ID in GridFS delete methods (#3046)
  • 1011e57 Prep branch v4.18
  • 4dd7303 PYTHON-6076 Request workflows permission in create-release-branch (#3039)
  • e66da83 PYTHON-5956 Use shared python/setup action for CI setup (#2990)
  • 22a2ec8 PYTHON-6021 Move _write_concern_for_cmd into BaseObject (#3036)
  • 2a4a004 PYTHON-5874 Fix test_fork.py failures on Python 3.15 due to fork() Deprecatio...
  • 0f6da1c PYTHON-6071 Fix ML-KEM OCSP tests and run min-deps OCSP task on PRs (#3037)
  • 3890060 BUMP 4.19.0.dev0
  • See full diff in compare view

Updates pillow-heif from 1.6.0 to 1.7.0

Release notes

Sourced from pillow-heif's releases.

v1.7.0

Added

  • Reading and writing nominal diffuse white luminance HDR metadata: nominal_diffuse_white_luminance key in info dictionary. #468
  • py.typed marker, the package type annotations are now visible to type checkers. #475

Changed

  • libheif was updated from the 1.23.2 to 1.23.3 version. #470
  • libde265 was updated from the 1.1.1 to 1.1.2 version. #471

Fixed

  • Out-of-bounds read in encode() when stride was smaller than the image row width. (GHSA-ccw6-q225-c975) Thanks to @​arpitjain099 for finding this!
  • TypeError when saving an image whose info dictionary contains non-string keys. #475
Changelog

Sourced from pillow-heif's changelog.

[1.7.0 - 2026-09-06]

Added

  • Reading and writing nominal diffuse white luminance HDR metadata: nominal_diffuse_white_luminance key in info dictionary. #468
  • py.typed marker, the package type annotations are now visible to type checkers. #475

Changed

  • libheif was updated from the 1.23.2 to 1.23.3 version. #470
  • libde265 was updated from the 1.1.1 to 1.1.2 version. #471

Fixed

  • Out-of-bounds read in encode() when stride was smaller than the image row width. (GHSA-ccw6-q225-c975) Thanks to @​arpitjain099 for finding this!
  • TypeError when saving an image whose info dictionary contains non-string keys. #475
Commits
  • f65a9ac v1.7.0
  • a327768 feat: py.typed marker; fix the mypy errors it exposes (#475)
  • b7d8f39 fix: out-of-bounds read in encode() when stride is smaller than the row (#474)
  • cb0edae chore(deps): update pypa/cibuildwheel action to v4.2.1 (#472)
  • 9a25554 chore(deps): update dependency strukturag/libheif to v1.23.3 (#470)
  • fb3a384 ci: let renovate update every bundled library version reference (#473)
  • 14c0c24 chore(deps): update dependency strukturag/libde265 to v1.1.2 (#471)
  • 1460a21 feat: read and write nominal diffuse white ...

    Description has been truncated

@dependabot
deps(uv): bump the uv-minor-patch group with 26 updates
4a7b7f1 
Bumps the uv-minor-patch group with 26 updates:

| Package | From | To |
| --- | --- | --- |
| [contourpy](https://github.com/contourpy/contourpy) | `1.3.3` | `1.4.0` |
| [fonttools](https://github.com/fonttools/fonttools) | `4.64.0` | `4.65.0` |
| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.1` | `3.11.2` |
| [numpy](https://github.com/numpy/numpy) | `2.5.2` | `2.5.3` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.48.0` | `2.49.0` |
| [pypdf](https://github.com/py-pdf/pypdf) | `6.17.0` | `6.18.1` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.14.0` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.9.3` | `2026.9.10` |
| [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.9.0` | `1.9.1` |
| [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.12` | `2.9.13` |
| [pymssql](https://github.com/pymssql/pymssql) | `2.4.0` | `2.4.1` |
| [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.18.0` | `4.18.1` |
| [pillow-heif](https://github.com/bigcat88/pillow_heif) | `1.6.0` | `1.7.0` |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.61` | `3.1.62` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.167.1` | `6.168.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.6` | `0.16.7` |
| [ast-serialize](https://github.com/mypyc/ast_serialize) | `0.6.0` | `0.11.1` |
| [cyclonedx-python-lib](https://github.com/CycloneDX/cyclonedx-python-lib) | `11.11.0` | `11.12.0` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.2` | `3.32.6` |
| [librt](https://github.com/mypyc/librt) | `0.13.0` | `0.15.0` |
| [lxml](https://github.com/lxml/lxml) | `6.1.1` | `6.1.3` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.24.0` | `2.26.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.1` | `4.11.8` |
| [python-discovery](https://github.com/tox-dev/python-discovery) | `1.5.1` | `1.6.0` |
| [stevedore](https://docs.openstack.org/stevedore) | `5.9.0` | `5.9.1` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.7.4` | `21.7.9` |


Updates `contourpy` from 1.3.3 to 1.4.0
- [Release notes](https://github.com/contourpy/contourpy/releases)
- [Changelog](https://github.com/contourpy/contourpy/blob/main/docs/changelog.md)
- [Commits](contourpy/contourpy@v1.3.3...v1.4.0)

Updates `fonttools` from 4.64.0 to 4.65.0
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.64.0...4.65.0)

Updates `matplotlib` from 3.11.1 to 3.11.2
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](matplotlib/matplotlib@v3.11.1...v3.11.2)

Updates `numpy` from 2.5.2 to 2.5.3
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.5.2...v2.5.3)

Updates `pydantic-core` from 2.48.0 to 2.49.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/commits)

Updates `pypdf` from 6.17.0 to 6.18.1
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.17.0...6.18.1)

Updates `pyjwt` from 2.13.0 to 2.14.0
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.13.0...2.14.0)

Updates `regex` from 2026.9.3 to 2026.9.10
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.9.3...2026.9.10)

Updates `scikit-learn` from 1.9.0 to 1.9.1
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](scikit-learn/scikit-learn@1.9.0...1.9.1)

Updates `psycopg2-binary` from 2.9.12 to 2.9.13
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.12...2.9.13)

Updates `pymssql` from 2.4.0 to 2.4.1
- [Release notes](https://github.com/pymssql/pymssql/releases)
- [Changelog](https://github.com/pymssql/pymssql/blob/master/ChangeLog.rst)
- [Commits](pymssql/pymssql@v2.4.0...v2.4.1)

Updates `pymongo` from 4.18.0 to 4.18.1
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/main/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.18.0...4.18.1)

Updates `pillow-heif` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/bigcat88/pillow_heif/releases)
- [Changelog](https://github.com/bigcat88/pillow_heif/blob/master/CHANGELOG.md)
- [Commits](bigcat88/pillow_heif@v1.6.0...v1.7.0)

Updates `gitpython` from 3.1.61 to 3.1.62
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.61...3.1.62)

Updates `hypothesis` from 6.167.1 to 6.168.0
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.167.1...v6.168.0)

Updates `ruff` from 0.16.6 to 0.16.7
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.6...0.16.7)

Updates `ast-serialize` from 0.6.0 to 0.11.1
- [Commits](mypyc/ast_serialize@v0.6.0...v0.11.1)

Updates `cyclonedx-python-lib` from 11.11.0 to 11.12.0
- [Release notes](https://github.com/CycloneDX/cyclonedx-python-lib/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md)
- [Commits](CycloneDX/cyclonedx-python-lib@v11.11.0...v11.12.0)

Updates `filelock` from 3.32.2 to 3.32.6
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.2...3.32.6)

Updates `librt` from 0.13.0 to 0.15.0
- [Commits](mypyc/librt@v0.13.0...v0.15.0)

Updates `lxml` from 6.1.1 to 6.1.3
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.1.1...lxml-6.1.3)

Updates `narwhals` from 2.24.0 to 2.26.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](narwhals-dev/narwhals@v2.24.0...v2.26.0)

Updates `platformdirs` from 4.11.1 to 4.11.8
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.1...4.11.8)

Updates `python-discovery` from 1.5.1 to 1.6.0
- [Release notes](https://github.com/tox-dev/python-discovery/releases)
- [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst)
- [Commits](tox-dev/python-discovery@1.5.1...1.6.0)

Updates `stevedore` from 5.9.0 to 5.9.1

Updates `virtualenv` from 21.7.4 to 21.7.9
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.7.4...21.7.9)

---
updated-dependencies:
- dependency-name: contourpy
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: fonttools
  dependency-version: 4.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: matplotlib
  dependency-version: 3.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: numpy
  dependency-version: 2.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: pydantic-core
  dependency-version: 2.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: pypdf
  dependency-version: 6.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: pyjwt
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: regex
  dependency-version: 2026.9.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: scikit-learn
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: pymssql
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: pymongo
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: pillow-heif
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: gitpython
  dependency-version: 3.1.62
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: hypothesis
  dependency-version: 6.168.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: ast-serialize
  dependency-version: 0.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: cyclonedx-python-lib
  dependency-version: 11.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: filelock
  dependency-version: 3.32.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: librt
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: lxml
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: narwhals
  dependency-version: 2.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: platformdirs
  dependency-version: 4.11.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: python-discovery
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: stevedore
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: virtualenv
  dependency-version: 21.7.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 18, 2026
@github-actions

github-actions Bot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

requirements.txt drift (unsigned push blocked)

uv.lock / pyproject.toml changed but GitHub Actions cannot push an unsigned commit under the required_signatures ruleset (#1419).

Option A — signed commit on this Dependabot branch:

git fetch origin pull/1945/head:dependabot-review
git checkout dependabot-review
uv export --frozen --no-emit-project -o requirements.txt
git add requirements.txt
git commit -S -m "chore(deps): regenerate requirements.txt after uv.lock update"
git push origin "HEAD:<dependabot-branch-name>"

Option B — supersede PR: apply the bump + export locally with signed commits (see CONTRIBUTING.md).

Download the CI-generated requirements.txt from the workflow artifact on this run when present.

@FabioLeitao FabioLeitao added this to the v1.8.0 milestone Sep 21, 2026
@FabioLeitao FabioLeitao self-assigned this Sep 21, 2026
@FabioLeitao

FabioLeitao commented Sep 21, 2026

Copy link
Copy Markdown
Collaborator

Superseded by merged #1956 (same bumps landed with signed commits on chore/v180-deps-lote-a-no-oracledb). Not merging this Dependabot branch. #1948 oracledb 4→26 remains HOLD.

@dependabot @github

dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/uv/uv-minor-patch-6e2b5eb343 branch September 21, 2026 20:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@FabioLeitao FabioLeitao

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

v1.8.0

Development

Successfully merging this pull request may close these issues.

1 participant

@FabioLeitao