Skip to content

deps: bump the python-minor-and-patch group across 1 directory with 14 updates - #70

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-e1c9ecdadd
Open

deps: bump the python-minor-and-patch group across 1 directory with 14 updates#70
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-e1c9ecdadd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 14 updates in the / directory:

Package From To
tzdata 2026.4 2026.5
boto3 1.43.108 1.43.114
google-cloud-storage 3.16.0 3.17.1
typer 0.27.2 0.27.3
filelock 4.0.12 4.2.0
aiohttp 3.14.3 3.14.5
tenacity 9.1.4 9.2.1
opentelemetry-api 1.45.0 1.45.1
opentelemetry-sdk 1.45.0 1.45.1
sentry-sdk 2.71.0 2.72.0
pymdown-extensions 12.1 12.3
ruff 0.16.10 0.17.1
ty 0.0.84 0.0.88
hypothesis 6.168.4 6.170.0

Updates tzdata from 2026.4 to 2026.5

Release notes

Sourced from tzdata's releases.

2026.5: Release of upstream tzdata 2026e

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00.

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.)

As the change affects both America/Winnipeg and its backward compatibility link, the obsolescent setting TZ="Canada/Central" will now use the abbreviation EST for affected timestamps, akin to TZ="Canada/Pacific" behavior introduced in 2026b.

Another TZDB release may be needed soon if any of the portions of northwestern Ontario historically aligned with America/Winnipeg do not follow. For now, given the short leadtime with Manitoba’s announcement, assume that they will, to avoid creating new zones that may not be needed if no divergence occurs.

Changes to past timestamps

In 1925 Ireland fell back on 09-20 not 10-04 (thanks to Stan Ulbrych).

Changes to commentary

Discussion on timekeeping practices in northwestern Ontario has been expanded in light of Manitoba’s recent announcement. It is not yet known whether or to what extent these areas may adapt their own timekeeping practices in response.

Changelog

Sourced from tzdata's changelog.

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b TEMPORARY HACK FOR CLDR AND CANADA” below.)

As the change affects both America/Winnipeg and its backward compatibility link, the obsolescent setting TZ="Canada/Central" will now use the abbreviation EST for affected timestamps, akin to TZ="Canada/Pacific" behavior introduced in 2026b.

Another TZDB release may be needed soon if any of the portions of northwestern Ontario historically aligned with America/Winnipeg do not follow. For now, given the short leadtime with Manitoba’s announcement, assume that they will, to avoid creating new zones that may not be needed if no divergence occurs.

Changes to past timestamps

In 1925 Ireland fell back on 09-20 not 10-04 (thanks to Stan Ulbrych).

Changes to commentary

Discussion on timekeeping practices in northwestern Ontario has been expanded in light of Manitoba’s recent announcement. It is not yet known whether or to what extent these areas may adapt their own timekeeping practices in response.

Commits

Updates boto3 from 1.43.108 to 1.43.114

Commits
  • 432fa17 Merge branch 'release-1.43.114'
  • bf4aed7 Bumping version to 1.43.114
  • fa3e3f2 Add changelog entries from botocore
  • 69ed308 Merge branch 'release-1.43.113'
  • 3abaa49 Merge branch 'release-1.43.113' into develop
  • 741f8d9 Bumping version to 1.43.113
  • ad1c6b5 Add changelog entries from botocore
  • 9ca5e36 Merge branch 'release-1.43.112'
  • f5581ba Merge branch 'release-1.43.112' into develop
  • 6f065c3 Bumping version to 1.43.112
  • Additional commits viewable in compare view

Updates google-cloud-storage from 3.16.0 to 3.17.1

Release notes

Sourced from google-cloud-storage's releases.

google-cloud-storage: v3.17.1

3.17.1 (2026-10-15)

Bug Fixes

  • storage: set GRPC_ALTS_MAX_CONCURRENT_HANDSHAKES=2 in benchmark runner (#18703) (a9ca134)

google-cloud-storage: v3.17.0

3.17.0 (2026-10-08)

Features

  • storage: add OpenTelemetry metrics gating and configuration module (#18407) (654e768)
Changelog

Sourced from google-cloud-storage's changelog.

Changelog

PyPI History

Commits
  • 2d29c31 chore: release main (#18608)
  • 7032a89 fix(gapic-generator): resolve showcase-mypy incompatible redefinition and add...
  • 9025061 fix(bigquery): remove PendingDeprecationWarning from RowIterator.to_arrow (#1...
  • 3743ff0 perf(spanner): avoid allocating empty RequestOptions on read and query paths ...
  • a9ca134 fix(storage): set GRPC_ALTS_MAX_CONCURRENT_HANDSHAKES=2 in benchmark runner (...
  • 09a3823 refactor(bigquery): move Arrow query result reading to _arrow_query (#18644)
  • 939bdd0 feat(bigquery-storage): add Arrow options and cancel to read_rows (#18643)
  • 8e640e0 chore(deps): update dependency nox to v2026 (#18681)
  • 706ced0 chore(deps): update dependency shapely to v2.2.0 (#18694)
  • af32b51 chore(deps): update dependency typing-extensions to v4.16.0 (#18697)
  • Additional commits viewable in compare view

Updates typer from 0.27.2 to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Commits

Updates filelock from 4.0.12 to 4.2.0

Release notes

Sourced from filelock's releases.

4.2.0

  • import filelock is about twice as fast: lock types other than FileLock load on first use. #831
  • Fix StrictSoftFileLock raising SoftFileLockProtocolError on Windows when a contender read a claim whose owner was still finishing its unlink. #829

PyPI release

Full Changelog: tox-dev/filelock@4.1.2...4.2.0

4.1.2

  • Fix read-lock acquisition on SQLite versions older than 3.33.0 by using sqlite_master for the schema probe. #770
  • Raise IsADirectoryError (or PermissionError on Windows) for a directory lock path regardless of its write permissions. #822
  • Fix a forked child hanging at exit on PyPy when the parent forked while an AsyncReadWriteLock worker thread was between two operations. #828
  • Hash all cache keys in the lock filename recipe so short path-like keys stay in the chosen directory. The example also accepts path-derived surrogate escapes and works before the cache directory exists. #824

PyPI release

Full Changelog: tox-dev/filelock@4.1.1...4.1.2

4.1.1

  • Bound the shared-lock contention test by worker progress so slow CI machines can finish the workload. #819
  • Avoid the macOS /dev/fd lookup implicated in a kernel panic by opening SQLite through a validated hard link. The database directory must be writable and support hard links; alias creation failure raises OSError. #820
  • Ignore non-ASCII PID or start-time fields and out-of-range PIDs in ReadWriteLock hard-link directory names so forged owners cannot abort acquisition. #821
  • Use Python 3.15 for development and automation. #816

PyPI release

Full Changelog: tox-dev/filelock@4.1.0...4.1.1

4.1.0

  • Import OwnerMode, CompromiseReason and has_fcntl from filelock. #790
  • AcquireReturnProxy is generic in the lock type, so with lock.acquire() as held: types held as the lock's own class. #803
  • A Timeout from a soft lock names a holder on another host or in another PID namespace, which no contender ever reclaims. #815
  • is_lock_held_by_us and is_lock_held_by_us return False for a marker an earlier process with the same PID left behind. #774
  • SoftFileLock removes its marker when writing it fails and closing the descriptor fails too, so the lock path no longer stays blocked. #775
  • acquire and acquire no longer wait past timeout when poll_interval is longer than the time left. #777
  • SoftReadWriteLock ignores a generation-log entry whose name is not 20 ASCII digits, which used to stop its heartbeat thread or delete real generations. #778
  • ReadWriteLock, SoftReadWriteLock and their async wrappers treat a

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.2.4 (2026-10-19)

  • Keep GitHub Release notes free of extra blank lines while retaining the PyPI and version comparison links. :pr:863

4.2.3 (2026-10-19)

  • Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. :pr:860
  • Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error.

4.2.2 (2026-10-18)

  • Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises :class:FileNotFoundError, and it now leaves the lock's hold count unchanged. :pr:856

4.2.1 (2026-10-17)

  • On a singleton wrapper, :meth:AsyncReadWriteLock.close() <filelock.AsyncReadWriteLock.close> and :meth:AsyncSoftReadWriteLock.close() <filelock.AsyncSoftReadWriteLock.close> end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. :pr:832
  • :class:~filelock.ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. :class:~filelock.AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an :class:~filelock.AsyncFileLock call joins its queue no longer blocks every later call on that lock. :pr:833
  • Fix :class:~filelock.ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database

... (truncated)

Commits
  • e2e7d70 Release 4.2.0
  • 7389d8a perf(import): defer asyncio and sqlite3 loading (#831)
  • b512268 build(deps): bump the github-actions group with 2 updates (#830)
  • 568e5b2 fix(strict): skip Windows claims pending deletion (#829)
  • 05d841f Release 4.1.2
  • 1649e88 fix(rw): forget the async lock's worker after fork (#828)
  • 8aaa373 fix(read-write): use sqlite_master for read lock schema probe on older SQLite...
  • e95d9ea [pre-commit.ci] pre-commit autoupdate (#826)
  • b831496 docs: hash all keys in the lock filename recipe (#824)
  • fd0d6e3 📝 docs(security): add an email reporting contact (#825)
  • Additional commits viewable in compare view

Updates aiohttp from 3.14.3 to 3.14.5
Updates tenacity from 9.1.4 to 9.2.1

Release notes

Sourced from tenacity's releases.

9.2.1

9.2.0 was tagged but never reached PyPI: the upload rejected its package description (#714). 9.2.1 is the first release on PyPI with everything in 9.2.0, plus the changes below.

What's Changed

New Contributors

Full Changelog: jd/tenacity@9.2.0...9.2.1

9.2.0

What's Changed

... (truncated)

Commits
  • 4410996 ci: check built distributions with twine (#742)
  • b238441 fix: restore PyPI-compatible package description (#725)
  • b6201ec fix: only treat None and 0 as "no wait" (#741)
  • 4a74682 ci: drop the Mergify queue rule (#739)
  • 9116971 ci: drop Mergify dismiss_reviews rule (#737)
  • 2374b61 ci: rely on the ruleset for the ci-gate check (#736)
  • 6df1aab ci: gate merges on a single ci-gate job (#734)
  • 5f540fa chore(mergify): replace deprecated autoqueue with auto_merge_conditions (#733)
  • 8be01b1 chore(deps-dev): bump ruff from 0.16.5 to 0.16.9 in the python group (#726)
  • 3e58094 chore(deps-dev): bump the python group with 2 updates (#707)
  • Additional commits viewable in compare view

Updates opentelemetry-api from 1.45.0 to 1.45.1

Release notes

Sourced from opentelemetry-api's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Changelog

Sourced from opentelemetry-api's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Commits
  • 14971ce Prepare release 1.45.1/0.66b1 (#5752)
  • 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
  • a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
  • d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
  • db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
  • See full diff in compare view

Updates opentelemetry-sdk from 1.45.0 to 1.45.1

Release notes

Sourced from opentelemetry-sdk's releases.

Version 1.45.1/0.66b1

This is a patch release on the previous 1.45.0/0.66b0 release, fixing the issue(s) below.

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Changelog

Sourced from opentelemetry-sdk's changelog.

Version 1.45.1/0.66b1 (2026-10-06)

Fixed

  • opentelemetry-api: make AnyValue and AttributeValue explicit type aliases (#5703)
  • opentelemetry-sdk: fix thread leak bug in resource initialization logic for long running resource detectors (#5706)
  • opentelemetry-exporter-otlp-proto-http: restore requests as the default HTTP transport so proxy environment variables such as HTTPS_PROXY are honored again (#5714)
  • opentelemetry-api: fix quadratic time parsing of the tracestate header and discard tracestate headers longer than 8192 characters (#5746)
Commits
  • 14971ce Prepare release 1.45.1/0.66b1 (#5752)
  • 44ac26e opentelemetry-sdk: fix thread leak bug in resource initialization logic (#570...
  • a2ec3f9 [release/v1.45.x-0.66bx] opentelemetry-exporter-otlp-proto-http: restore requ...
  • d5224bf opentelemetry-api: improve performance of tracestate parsing (#5746) (#5749)
  • db61173 Declare AnyValue and AttributeValue as explicit type aliases (#5703) (#5750)
  • See full diff in compare view

Updates sentry-sdk from 2.71.0 to 2.72.0

Release notes

Sourced from sentry-sdk's releases.

2.72.0

New Features ✨

Asgi

Boto3

Wsgi

Other

Bug Fixes 🐛

Boto3

Other

Internal Changes 🔧

Deps

Openai Agents

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.72.0

New Features ✨

Asgi

Boto3

Wsgi

Other

Bug Fixes 🐛

Boto3

Other

Internal Changes 🔧

Deps

Openai Agents

... (truncated)

Commits
  • 9d24514 release: 2.72.0
  • 4dc1d72 fix: Fix span, metrics, log client reports (#7933)
  • 5780399 feat(types): Export DataCollectionUserOptions from sentry_sdk.types (#7957)
  • 1ca0326 chore(deps): lock file maintenance (#7848)
  • f5bf69b ci(mypy): Bump version to 2.4.0 (#7937)
  • 02210fa ci(openai-agents): Bump version for type checking to 0.23.1 (#7935)
  • fcccb7b ci(strawberry-graphql): Bump version for type checking to 0.332.0 (#7936)
  • 7cb8094 chore: Deprecate ai.monitoring.record_token_usage() (#7918)
  • 1f4ba26 chore: Deprecate send_default_pii (#7694)
  • 4b9d329 refactor: move FastAPI active thread tracking into Starlette (#7825)
  • Additional commits viewable in compare view

Updates pymdown-extensions from 12.1 to 12.3

Release notes

Sourced from pymdown-extensions's releases.

12.3

  • NEW: BetterEm: Expose a way to disable CommonMark punctuation rules in BetterEm if desired via a new punctuation option.

12.2

  • NEW: Add official support for Python 3.15.
  • NEW: Tilde, Caret...

    Description has been truncated

@dependabot
deps: bump the python-minor-and-patch group across 1 directory with 1…
f590269 
…4 updates

---
updated-dependencies:
- dependency-name: tzdata
  dependency-version: '2026.5'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: boto3
  dependency-version: 1.43.114
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: google-cloud-storage
  dependency-version: 3.17.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: filelock
  dependency-version: 4.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: tenacity
  dependency-version: 9.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: opentelemetry-api
  dependency-version: 1.45.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: opentelemetry-sdk
  dependency-version: 1.45.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: sentry-sdk
  dependency-version: 2.72.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pymdown-extensions
  dependency-version: '12.3'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: ty
  dependency-version: 0.0.88
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: hypothesis
  dependency-version: 6.170.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 19, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants