Open
Conversation
442d3f6 to
6062773
Compare
3ad8b03 to
c846920
Compare
c846920 to
10be4d7
Compare
maxdymond
approved these changes
Sep 15, 2025
25df641 to
23d2c10
Compare
3a5b4a4 to
6bf9381
Compare
6bf9381 to
267306e
Compare
a503a82 to
7810ce5
Compare
0e1d35a to
99c437d
Compare
8846368 to
64d2df1
Compare
88e1e19 to
b47a2fb
Compare
b0d84a8 to
dc89ee2
Compare
e31bbd1 to
2070afd
Compare
57b94ac to
7fe3c4e
Compare
4ad12c7 to
19ecaf7
Compare
009be28 to
f106ce7
Compare
b4549d8 to
ba365e4
Compare
ba365e4 to
5d22351
Compare
5d22351 to
bc2f8f7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==1.8.6→==1.9.3==1.17.1→==1.19.1==4.0.2→==4.0.4==8.4.1→==8.4.23.13→3.143.13-alpine→3.14-alpine==4.28.4→==4.34.1>=0.9.5,<0.10.0→>=0.10.0,<0.11.0==3.1.3→==3.1.5==0.45.1→==0.46.3==1.37.1→==1.38.0Release Notes
PyCQA/bandit (bandit)
v1.9.3Compare Source
What's Changed
VALUES(without space by @kfess in #1337New Contributors
Full Changelog: PyCQA/bandit@1.9.2...1.9.3
v1.9.2Compare Source
What's Changed
Full Changelog: PyCQA/bandit@1.9.1...1.9.2
v1.9.1Compare Source
What's Changed
Full Changelog: PyCQA/bandit@1.9.0...1.9.1
python/mypy (mypy)
v1.19.1Compare Source
types.NoneTypein match cases (A5rocks, PR 20383)v1.19.0Compare Source
v1.18.2Compare Source
object.__init__(Stephen Morton, PR 19733)v1.18.1Compare Source
We’ve just uploaded mypy 1.18.1 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new features, performance
improvements and bug fixes. You can install it as follows:
You can read the full documentation for this release on Read the Docs.
Mypy Performance Improvements
Mypy 1.18.1 includes numerous performance improvements, resulting in about 40% speedup
compared to 1.17 when type checking mypy itself. In extreme cases, the improvement
can be 10x or higher. The list below is an overview of the various mypy optimizations.
Many mypyc improvements (discussed in a separate section below) also improve performance.
Type caching optimizations have a small risk of causing regressions. When
reporting issues with unexpected inferred types, please also check if
--disable-expression-cachewill work around the issue, as it turns off some ofthese optimizations.
Fixed‑Format Cache (Experimental)
Mypy now supports a new cache format used for faster incremental builds. It makes
incremental builds up to twice as fast. The feature is experimental and
currently only supported when using a compiled version of mypy. Use
--fixed-format-cacheto enable the new format, or
fixed_format_cache = Truein a configuration file.We plan to enable this by default in a future mypy release, and we'll eventually
deprecate and remove support for the original JSON-based format.
Unlike the JSON-based cache format, the new binary format is currently
not easy to parse and inspect by mypy users. We are planning to provide a tool to
convert fixed-format cache files to JSON, but details of the output JSON may be
different from the current JSON format. If you rely on being able to inspect
mypy cache files, we recommend creating a GitHub issue and explaining your use
case, so that we can more likely provide support for it. (Using
MypyFile.read(binary_data)to inspect cache data may be sufficient to supportsome use cases.)
This feature was contributed by Ivan Levkivskyi (PR 19668, 19735, 19750, 19681, 19752, 19815).
Flexible Variable Definitions: Update
Mypy 1.16.0 introduced
--allow-redefinition-new, which allows redefining variableswith different types, and inferring union types for variables from multiple assignments.
The feature is now documented in the
--helpoutput, but the feature is still experimental.We are planning to enable this by default in mypy 2.0, and we will also deprecate the
older
--allow-redefinitionflag. Since the new behavior differs significantly fromthe older flag, we encourage users of
--allow-redefinitionto experiment with--allow-redefinition-newand create a GitHub issue if the new functionality doesn'tsupport some important use cases.
This feature was contributed by Jukka Lehtosalo.
Inferred Type for Bare ClassVar
A ClassVar without an explicit type annotation now causes the type of the variable
to be inferred from the initializer:
This feature was contributed by Ivan Levkivskyi (PR 19573).
Disjoint Base Classes (@disjoint_base, PEP 800)
Mypy now understands disjoint bases (PEP 800): it recognizes the
@disjoint_basedecorator, and rejects class definitions that combine mutually incompatible base classes,
and takes advantage of the fact that such classes cannot exist in reachability and
narrowing logic.
This class definition will now generate an error:
pylint-dev/pylint (pylint)
v4.0.4Compare Source
What's new in Pylint 4.0.4?
Release date: 2025-11-30
False Positives Fixed
Fixed false positive for
invalid-namewhere module-level constants were incorrectly classified as variables when a class-level attribute with the same name exists.Closes #10719
Fix a false positive for
invalid-nameon an UPPER_CASED name inside anifbranch that assigns an object.Closes #10745
v4.0.3Compare Source
What's new in Pylint 4.0.3?
Release date: 2025-11-13
False Positives Fixed
Add Enum dunder methods
_generate_next_value_,_missing_,_numeric_repr_,_add_alias_, and_add_value_alias_to the list passed to--good-dunder-names.Closes #10435
Fixed false positive for
invalid-namewithtyping.Annotated.Closes #10696
Fix false positive for
f-string-without-interpolationwith template stringswhen using format spec.
Closes #10702
Fix a false positive when an UPPER_CASED class attribute was raising an
invalid-namewhen typed withFinal.Closes #10711
Fix a false positive for
unbalanced-tuple-unpackingwhen a tuple is assigned to a function call and the structure of the function's return value is ambiguous.Closes #10721
Other Bug Fixes
Make 'ignore' option work as expected again.
Closes #10669
Fix crash for
consider-using-assignment-exprwhen a variable annotation without assignmentis used as the
iftest expression.Closes #10707
Fix crash for
prefer-typing-namedtupleandconsider-math-not-floatwhena
sliceobject is called.Closes #10708
pytest-dev/pytest (pytest)
v8.4.2Compare Source
pytest 8.4.2 (2025-09-03)
Bug fixes
#13478: Fixed a crash when using
console_output_style{.interpreted-text role="confval"} withtimesand a module is skipped.#13530: Fixed a crash when using
pytest.approx{.interpreted-text role="func"} anddecimal.Decimal{.interpreted-text role="class"} instances with thedecimal.FloatOperation{.interpreted-text role="class"} trap set.#13549: No longer evaluate type annotations in Python
3.14when inspecting function signatures.This prevents crashes during module collection when modules do not explicitly use
from __future__ import annotationsand import types for annotations within aif TYPE_CHECKING:block.#13559: Added missing [int]{.title-ref} and [float]{.title-ref} variants to the [Literal]{.title-ref} type annotation of the [type]{.title-ref} parameter in
pytest.Parser.addini{.interpreted-text role="meth"}.#13563:
pytest.approx{.interpreted-text role="func"} now only importsnumpyif NumPy is already insys.modules. This fixes unconditional import behavior introduced in [8.4.0]{.title-ref}.Improved documentation
pytest_generate_testsis discovered in test modules/classes; other hooks must be inconftest.pyor plugins.Contributor-facing changes
-Wdefaultor a similar override.test_doctest_unexpected_exceptionin Python3.14.CIenvironment variable -- byogrisel{.interpreted-text role="user"}.actions/python-versions (python)
v3.14.3: 3.14.3Compare Source
Python 3.14.3
v3.14.2: 3.14.2Compare Source
Python 3.14.2
v3.14.1: 3.14.1Compare Source
Python 3.14.1
v3.14.0: 3.14.0Compare Source
Python 3.14.0
tox-dev/tox (tox)
v4.34.1Compare Source
What's Changed
Full Changelog: tox-dev/tox@4.34.0...4.34.1
v4.34.0Compare Source
What's Changed
Full Changelog: tox-dev/tox@4.33.0...4.34.0
v4.33.0Compare Source
What's Changed
py{39-314}by @ferdnyc in #3652sphinx-issuesextension by @webknjaz in #3655New Contributors
Full Changelog: tox-dev/tox@4.32.0...4.33.0
v4.32.0Compare Source
What's Changed
New Contributors
Full Changelog: tox-dev/tox@4.31.0...4.32.0
v4.31.0Compare Source
What's Changed
Full Changelog: tox-dev/tox@4.30.3...4.31.0
v4.30.3Compare Source
What's Changed
DEFAULT_CONFIG_FILEfile by @kurtmckee in #3612New Contributors
Full Changelog: tox-dev/tox@4.30.2...4.30.3
v4.30.2Compare Source
What's Changed
Full Changelog: tox-dev/tox@4.30.1...4.30.2
v4.30.1Compare Source
What's Changed
--installpkgsdist due to orphaned build backend by @vytas7 in #3530New Contributors
Full Changelog: tox-dev/tox@4.30.0...4.30.1
v4.30.0Compare Source
What's Changed
CIas__TOX_ENVIRONMENT_VARIABLE_ORIGINAL_CIby @Liam-DeVoe in #3592tox.tomlby @webknjaz in #3594tox_extend_envsby @webknjaz in #3595tox_extend_envslist can be read twice by @webknjaz in #3598New Contributors
Full Changelog: tox-dev/tox@4.29.0...4.30.0
v4.29.0Compare Source
What's Changed
tox_extend_envshook in plugins API by @webknjaz in #3591Full Changelog: tox-dev/tox@4.28.4...4.29.0
astral-sh/uv (uv_build)
v0.10.0Compare Source
Since we released uv 0.9.0 in October of 2025, we've accumulated various changes that improve correctness and user experience, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution. We expect most users to be able to upgrade without making changes.
This release also includes the stabilization of preview features. Python upgrades are now stable, including the
uv python upgradecommand,uv python install --upgrade, and automatically upgrading Python patch versions in virtual environments when a new version is installed. Theadd-boundsandextra-build-dependenciessettings are now stable. Finally, theuv workspace diranduv workspace listutilities for writing scripts against workspace members are now stable.Breaking changes
Require
--clearto remove existing virtual environments inuv venv(#17757)Previously,
uv venvwould prompt for confirmation before removing an existing virtual environment in interactive contexts, and remove it without confirmation in non-interactive contexts. Now,uv venvrequires the--clearflag to remove an existing virtual environment. A warning for this change was added in uv 0.8.You can opt out of this behavior by passing the
--clearflag or settingUV_VENV_CLEAR=1.Error if multiple indexes include
default = true(#17011)Previously, uv would silently accept multiple indexes with
default = trueand use the first one. Now, uv will error if multiple indexes are marked as the default.You cannot opt out of this behavior. Remove
default = truefrom all but one index.Error when an
explicitindex is unnamed (#17777)Explicit indexes can only be used via the
[tool.uv.sources]table, which requires referencing the index by name. Previously, uv would silently accept unnamed explicit indexes, which could never be referenced. Now, uv will error if an explicit index does not have a name.You cannot opt out of this behavior. Add a
nameto the explicit index or remove the entry.Install alternative Python executables using their implementation name (#17756, #17760)
Previously,
uv python installwould install PyPy, GraalPy, and Pyodide executables with names likepython3.10into the bin directory. Now, these executables will be named using their implementation name, e.g.,pypy3.10,graalpy3.10, andpyodide3.12, to avoid conflicting with CPython installations.You cannot opt out of this behavior.
Respect global Python version pins in
uv tool runanduv tool install(#14112)Previously,
uv tool runanduv tool installdid not respect the global Python version pin (set viauv python pin --global). Now, these commands will use the global Python version when no explicit version is requested.For
uv tool install, if the tool is already installed, the Python version will not change unless--reinstallor--pythonis provided. If the tool was previously installed with an explicit--pythonflag, the global pin will not override it.You can opt out of this behavior by providing an explicit
--pythonflag.Remove Debian Bookworm, Alpine 3.21, and Python 3.8 Docker images (#17755)
The Debian Bookworm and Alpine 3.21 images were replaced by Debian Trixie and Alpine 3.22 as defaults in uv 0.9. These older images are now removed. Python 3.8 images are also removed, as Python 3.8 is no longer supported in the Trixie or Alpine base images.
The following image tags are no longer published:
uv:bookworm,uv:bookworm-slimuv:alpine3.21uv:python3.8-*Use
uv:debianoruv:trixieinstead ofuv:bookworm,uv:alpineoruv:alpine3.22instead ofuv:alpine3.21, and a newer Python version instead ofuv:python3.8-*.Drop PPC64 (big endian) builds (#17626)
uv no longer provides pre-built binaries for PPC64 (big endian). This platform appears to be largely unused and is only supported on a single manylinux version. PPC64LE (little endian) builds are unaffected.
Building uv from source is still supported for this platform.
Skip generating
activate.cshfor relocatable virtual environments (#17759)Previously,
uv venv --relocatablewould generate anactivate.cshscript that contained hardcoded paths, making it incompatible with relocation. Now, theactivate.cshscript is not generated for relocatable virtual environments.You cannot opt out of this behavior.
Require username when multiple credentials match a URL (#16983)
When using
uv auth loginto store credentials, you can register multiple username and password combinations for the same host. Previously, when uv needed to authenticate and multiple credentials matched the URL (e.g., when retrieving a token withuv auth token), uv would pick the first match. Now, uv will error instead.You cannot opt out of this behavior. Include the username in the request, e.g.,
uv auth token --username foo example.com.Avoid invalidating the lockfile versions after an
exclude-newerchange (#17721)Previously, changing the
exclude-newersetting would cause package versions to be upgraded, ignoring the lockfile entirely. Now, uv will only change package versions if they are no longer within theexclude-newerrange.You can restore the previous behavior by using
--upgradeor--upgrade-packageto opt-in to package version changes.Upgrade
uv formatto Ruff 0.15.0 (#17838)uv formatnow uses Ruff 0.15.0, which uses the 2026 style guide. See the blog post for details.The formatting of code is likely to change. You can opt out of this behavior by requesting an older Ruff version, e.g.,
uv format --version 0.14.14.Update uv crate test features to use
test-as a prefix (#17860)This change only affects redistributors of uv. The Cargo features used to gate test dependencies, e.g.,
pypi, have been renamed with atest-prefix for clarity, e.g.,test-pypi.Stabilizations
uv python upgradeanduv python install --upgrade(#17766)When installing Python versions, an intermediary directory without the patch version attached will be created, and virtual environments will be transparently upgraded to new patch versions.
See the Python version documentation for more details.
uv add --boundsand theadd-boundsconfiguration option (#17660)This does not come with any behavior changes. You will no longer see an experimental warning when using
uv add --boundsoradd-boundsin configuration.uv workspace listanduv workspace dir(#17768)This does not come with any behavior changes. You will no longer see an experimental warning when using these commands.
extra-build-dependencies(#17767)This does not come with any behavior changes. You will no longer see an experimental warning when using
extra-build-dependenciesin configuration.Enhancements
pyx.devas a target inuv authcommands despitePYX_API_URLdiffering (#17856)Bug fixes
pallets/werkzeug (werkzeug)
v3.1.5Compare Source
Released 2026-01-08
safe_joinon Windows does not allow more special device names, regardlessof extension or surrounding spaces. :ghsa:
87hc-h4r5-73f7\r\nsequence at a chunk boundary.This fixes the previous attempt, which caused incorrect content lengths.
:issue:
3065:issue:3077AttributeErrorwhen initializingDebuggedApplicationwithpin_security=False. :issue:3075v3.1.4Compare Source
Released 2025-11-28
safe_joinon Windows does not allow special device names. This preventsreading from these when using
send_from_directory.secure_filenamealready prevented writing to these. :ghsa:
hgf8-39gv-g3f23020\r\nsequence at a chunk boundary.:issue:
30653054Request.jsonannotation is more accurate. :issue:3067source lines. :issue:
3044HTTPException.get_responseannotation and doc better conveys thedistinction between WSGI and sans-IO responses. :issue:
3056pypa/wheel (wheel)
v0.46.3Compare Source
ImportError: cannot import name '_setuptools_logging' from 'wheel'when installed alongside an old version of setuptools and running thebdist_wheelcommand (#676)v0.46.2Compare Source
bdist_wheelcommand for compatibility withsetuptoolsolder than v70.1wheel.bdist_wheelnow emits aFutureWarninginstead of aDeprecationWarningwheel unpackpotentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)v0.46.1Compare Source
wheel.macosx_libfilemodule (#659)v0.46.0Compare Source
bdist_wheelsetuptools command implementation and entry point. Thewheel.bdist_wheelmodule is now just an alias tosetuptools.command.bdist_wheel, emitting a deprecation warning on import.packagingin favor of a run-time dependency on itwheel.metadatamodule private (with a deprecation warning if it's importedwheel.clipackage private (no deprecation warning)convertcommand with an empty description fieldadrienverge/yamllint (yamllint)
v1.38.0Compare Source
yaml-filesandignoreindentation: Fix error message forcheck-multi-line-stringsquoted-strings: Addquote-type: consistentConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.