Skip to content

deps: bump the python-minor-and-patch group with 13 updates - #67

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-7569f5cfaa
Closed

deps: bump the python-minor-and-patch group with 13 updates#67
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-7569f5cfaa

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 13 updates:

Package From To
tzdata 2026.4 2026.5
pycryptodome 3.23.0 3.24.0
boto3 1.43.108 1.43.111
google-cloud-storage 3.16.0 3.17.0
typer 0.27.2 0.27.3
filelock 4.0.12 4.1.0
aiohttp 3.14.3 3.14.4
tenacity 9.1.4 9.2.1
opentelemetry-api 1.45.0 1.45.1
opentelemetry-sdk 1.45.0 1.45.1
ruff 0.16.10 0.17.0
ty 0.0.84 0.0.86
hypothesis 6.168.4 6.168.5

Updates tzdata from 2026.4 to 2026.5

Release notes

Sourced from tzdata's releases.

2026.5: Release of upstream tzdata 2026e

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00.

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.)

As the change affects both America/Winnipeg and its backward compatibility link, the obsolescent setting TZ="Canada/Central" will now use the abbreviation EST for affected timestamps, akin to TZ="Canada/Pacific" behavior introduced in 2026b.

Another TZDB release may be needed soon if any of the portions of northwestern Ontario historically aligned with America/Winnipeg do not follow. For now, given the short leadtime with Manitoba’s announcement, assume that they will, to avoid creating new zones that may not be needed if no divergence occurs.

Changes to past timestamps

In 1925 Ireland fell back on 09-20 not 10-04 (thanks to Stan Ulbrych).

Changes to commentary

Discussion on timekeeping practices in northwestern Ontario has been expanded in light of Manitoba’s recent announcement. It is not yet known whether or to what extent these areas may adapt their own timekeeping practices in response.

Changelog

Sourced from tzdata's changelog.

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.)

As the change affects both America/Winnipeg and its backward compatibility link, the obsolescent setting TZ="Canada/Central" will now use the abbreviation EST for affected timestamps, akin to TZ="Canada/Pacific" behavior introduced in 2026b.

Another TZDB release may be needed soon if any of the portions of northwestern Ontario historically aligned with America/Winnipeg do not follow. For now, given the short leadtime with Manitoba’s announcement, assume that they will, to avoid creating new zones that may not be needed if no divergence occurs.

Changes to past timestamps

In 1925 Ireland fell back on 09-20 not 10-04 (thanks to Stan Ulbrych).

Changes to commentary

Discussion on timekeeping practices in northwestern Ontario has been expanded in light of Manitoba’s recent announcement. It is not yet known whether or to what extent these areas may adapt their own timekeeping practices in response.

Commits

Updates pycryptodome from 3.23.0 to 3.24.0

Release notes

Sourced from pycryptodome's releases.

v3.24.0 - Evreux

New features

  • Speed up KangarooTwelve by 50% for long messages (1MB or more).
  • New parameter threads for Crypto.Hash.KangarooTwelve.new(), to hash long messages on several CPU cores (threads=0 for all of them). The output does not depend on the number of threads.

Resolved issues

  • GH#875: Fixed the Object Identifiers (OID) for BLAKE2.
  • Fixed a potential DOS attack when decrypting a password-encrypted PKCS#8 key, when the iteration count is enourmous. Decryption will now fail if it exceeds 50M iterations; the limit can be changed or removed via the new max_iteration_count option. Thanks to afldl for reporting.
  • Fixed the maximum number of bytes that GCM should encrypt. Thanks to Loganaden Velvindron.
  • Fixed ECC operations on 32-bit Windows (x86) wheels: due to a compiler bug in Visual Studio 2022, the modular inversion skipped half of the exponent bits, producing wrong results.
  • Fixed a bug in KangarooTwelve in the scenario where customization string is very long (8190 bytes or longer) and the message to hash is empty.

Other changes

  • Build Windows wheel with Visual Studio 2022, from Visual Studio 2019.
  • Remove support for Python 3.7.
Changelog

Sourced from pycryptodome's changelog.

3.24.0 (4 October 2026) ++++++++++++++++++++++++++

New features

  • Speed up KangarooTwelve by 50% for long messages (1MB or more).
  • New parameter threads for Crypto.Hash.KangarooTwelve.new(), to hash long messages on several CPU cores (threads=0 for all of them). The output does not depend on the number of threads.

Resolved issues

  • GH#875: Fixed the Object Identifiers (OID) for BLAKE2.
  • Fixed a potential DOS attack when decrypting a password-encrypted PKCS#8 key, when the iteration count is enourmous. Decryption will now fail if it exceeds 50M iterations; the limit can be changed or removed via the new max_iteration_count option. Thanks to afldl for reporting.
  • Fixed the maximum number of bytes that GCM should encrypt. Thanks to Loganaden Velvindron.
  • Fixed ECC operations on 32-bit Windows (x86) wheels: due to a compiler bug in Visual Studio 2022, the modular inversion skipped half of the exponent bits, producing wrong results.
  • Fixed a bug in KangarooTwelve in the scenario where customization string is very long (8190 bytes or longer) and the message to hash is empty.
  • GH#922: Fixed incorrect verification of an otherwise valid ECDSA signature, when the raw x-coordinate of the computed point is not reduced. Thanks to afldl for reporting and Ville Vesilehto for the fix.

Other changes

  • Build Windows wheel with Visual Studio 2022, from Visual Studio 2019.
  • Remove support for Python 3.7.
Commits
  • a0ed9b6 Bump version
  • b178b48 Use multiple threads for K12
  • ecc840d Further optimization to K12
  • f3cb4e3 Update Changelog
  • 3441382 Fix K12 bug with empty message and long custom string
  • 1552435 Speed up K12
  • 9b5790b Fix for older python versions
  • 77cc653 Update typing stub with _DEFAULT_MAX_ITERATION_COUNT
  • 319f22f Fix max limit of GCM encryption
  • 0336386 Update Changelog
  • Additional commits viewable in compare view

Updates boto3 from 1.43.108 to 1.43.111

Commits

Updates google-cloud-storage from 3.16.0 to 3.17.0

Release notes

Sourced from google-cloud-storage's releases.

google-cloud-storage: v3.17.0

3.17.0 (2026-10-08)

Features

  • storage: add OpenTelemetry metrics gating and configuration module (#18407) (654e768)
Changelog

Sourced from google-cloud-storage's changelog.

Changelog

PyPI History

Commits
  • 3720106 chore: release main (#18572)
  • 654e768 feat(storage): add OpenTelemetry metrics gating and configuration module (#18...
  • 181e26a perf(spanner): eliminate redundant tracing span in run_in_transaction (#18357)
  • d28458c feat(google-devicesandservices-health): add v4beta (#18597)
  • fd5a20e chore(auth): remove rsa from optional dependencies (#18586)
  • 947949b fix(firestore): add generic typing for DocumentSnapshot (#18587)
  • b9ea66a chore(firestore): correct samples link in README (#18473)
  • 7d18b25 feat(observability): implement universal 4-path OpenTelemetry tracing (#18433)
  • d0505e8 feat: update API sources and regenerate (#18593)
  • 0370367 chore(main): release google-auth 2.61.0 (#18595)
  • Additional commits viewable in compare view

Updates typer from 0.27.2 to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Commits

Updates filelock from 4.0.12 to 4.1.0

Release notes

Sourced from filelock's releases.

4.1.0

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@4.0.12...4.1.0

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.1.1 (2026-10-11)

  • Bound the shared-lock contention test by worker progress so slow CI machines can finish the workload. :pr:819
  • Avoid the macOS /dev/fd lookup implicated in a kernel panic by opening SQLite through a validated hard link. The database directory must be writable and support hard links; alias creation failure raises OSError. :pr:820
  • Ignore non-ASCII PID or start-time fields and out-of-range PIDs in ReadWriteLock hard-link directory names so forged owners cannot abort acquisition. :pr:821
  • Use Python 3.15 for development and automation. :pr:816

4.1.0 (2026-10-09)

  • Import :data:~filelock.OwnerMode, :data:~filelock.CompromiseReason and :data:~filelock.has_fcntl from filelock. :pr:790
  • :class:~filelock.AcquireReturnProxy is generic in the lock type, so with lock.acquire() as held: types held as the lock's own class. :pr:803
  • A :class:~filelock.Timeout from a soft lock names a holder on another host or in another PID namespace, which no contender ever reclaims. :pr:815
  • :attr:~filelock.SoftFileLock.is_lock_held_by_us and :attr:~filelock.MarkerSoftFileLock.is_lock_held_by_us return False for a marker an earlier process with the same PID left behind. :pr:774
  • :class:~filelock.SoftFileLock removes its marker when writing it fails and closing the descriptor fails too, so the lock path no longer stays blocked. :pr:775
  • :meth:~filelock.BaseFileLock.acquire and :meth:~filelock.BaseAsyncFileLock.acquire no longer wait past timeout when poll_interval is longer than the time left. :pr:777
  • :class:~filelock.SoftReadWriteLock ignores a generation-log entry whose name is not 20 ASCII digits, which used to stop its heartbeat thread or delete real generations. :pr:778
  • :class:~filelock.ReadWriteLock, :class:~filelock.SoftReadWriteLock and their async wrappers treat a :data:math.inf timeout like -1 and raise :class:ValueError for a blocking nan one. :pr:779
  • :class:~filelock.ReadWriteLock and :class:~filelock.SoftReadWriteLock accept a timeout above :data:threading.TIMEOUT_MAX instead of raising :class:OverflowError. :pr:780
  • :meth:~filelock.BaseFileLock.acquire raises :class:ValueError for a blocking nan timeout or a poll_interval above :data:threading.TIMEOUT_MAX, and treats a :data:math.inf timeout like -1. :pr:781
  • :class:~filelock.SoftFileLock and :class:~filelock.MarkerSoftFileLock treat a marker cut before its final newline as malformed, so a crash-truncated record self-heals and a read mid-write no longer breaks a live lock. :pr:782
  • :class:~filelock.UnixFileLock no longer deletes another process's live marker when it falls back to a soft lock on ENOSYS, and on macOS a lock path ending in a separator raises :class:FileNotFoundError instead of retrying. :pr:785
  • :class:~filelock.SoftFileLock and :class:~filelock.SoftFileLease put back a live successor's marker that a racing stale break moved aside, so a third contender no longer acquires beside the successor. :pr:786
  • :class:~filelock.StrictSoftFileLock removes every claim a failed acquire published, counts an EEXIST link that

... (truncated)

Commits
  • 6c0ecc2 Release 4.1.0
  • df06bbd 🐛 fix: close regressions since 4.0.12 (#815)
  • 0712045 🐛 fix(read-write): refuse a database moved mid-acquire (#808)
  • 73fefc1 📝 docs: point canonical and og:url at versioned pages (#813)
  • 181b36b 🧪 test(lease): give the age-out test a real-time margin (#814)
  • 2c19af4 🐛 fix(api): release thread holds, guard reentry (#810)
  • 367b111 🐛 fix(soft-rw): publish the head through gen/HEAD (#799)
  • 61582c5 🐛 fix(api): validate lock options up front (#803)
  • 20c4b5a 🐛 fix(descriptor): reject poll intervals above TIMEOUT_MAX (#802)
  • cf092c7 🧪 test: drop timing races from two runner-load flakes (#809)
  • Additional commits viewable in compare view

Updates aiohttp from 3.14.3 to 3.14.4
Updates tenacity from 9.1.4 to 9.2.1

Release notes

Sourced from tenacity's releases.

9.2.1

9.2.0 was tagged but never reached PyPI: the upload rejected its package description (#714). 9.2.1 is the first release on PyPI with everything in 9.2.0, plus the changes below.

What's Changed

New Contributors

Full Changelog: jd/tenacity@9.2.0...9.2.1

9.2.0

What's Changed

... (truncated)

Commits
  • 4410996 ci: check built distributions with twine (#742)
  • b238441 fix: restore PyPI-compatible package description (#725)
  • b6201ec fix: only treat None and 0 as "no wait" (#741)
  • 4a74682 ci: drop the Mergify queue rule (#739)
  • 9116971 ci: drop Mergify dismiss_reviews rule (#737)
  • 2374b61 ci: rely on the ruleset for the ci-gate check (#736)
  • 6df1aab ci: gate merges on a single ci-gate job (#734)
  • 5f540fa chore(mergify): replace deprecated autoqueue with auto_merge_conditions (#733)
  • 8be01b1 chore(deps-dev): bump ruff from 0.16.5 to 0.16.9 in the python group (#726)
  • 3e58094 chore(deps-dev): bump the python group with 2 updates (#707)
  • Additional commits viewable in compare view

Updates opentelemetry-api from 1.45.0 to 1.45.1

Release notes

Sourced from opentelemetry-api's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Changelog

Sourced from opentelemetry-api's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Commits
  • 14971ce Prepare release 1.45.1/0.66b1 (#5752)
  • 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
  • a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
  • d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
  • db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
  • See full diff in compare view

Updates opentelemetry-sdk from 1.45.0 to 1.45.1

Release notes

Sourced from opentelemetry-sdk's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Changelog

Sourced from opentelemetry-sdk's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Commits
  • 14971ce Prepare release 1.45.1/0.66b1 (#5752)
  • 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
  • a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
  • d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
  • db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
  • See full diff in compare view

Updates ruff from 0.16.10 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabl...

    Description has been truncated

@dependabot
deps: bump the python-minor-and-patch group with 13 updates
e5c2e8f 
---
updated-dependencies:
- dependency-name: tzdata
  dependency-version: '2026.5'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pycryptodome
  dependency-version: 3.24.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: boto3
  dependency-version: 1.43.111
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: google-cloud-storage
  dependency-version: 3.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: filelock
  dependency-version: 4.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: aiohttp
  dependency-version: 3.14.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: tenacity
  dependency-version: 9.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: opentelemetry-api
  dependency-version: 1.45.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: opentelemetry-sdk
  dependency-version: 1.45.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: ty
  dependency-version: 0.0.86
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: hypothesis
  dependency-version: 6.168.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 13, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 19, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python-minor-and-patch-7569f5cfaa branch October 19, 2026 08:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants