Repository navigation
⬆️(dependencies) update python dependencies - #2617
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
from
April 7, 2025 11:51
15eacda to
9880a61
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
3 times, most recently
from
April 16, 2025 08:24
41692a7 to
6f09c7b
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
5 times, most recently
from
April 29, 2025 15:28
41c7b66 to
6ce81a2
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
2 times, most recently
from
May 4, 2025 19:04
6eb7ab4 to
09624ee
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
3 times, most recently
from
May 19, 2025 10:36
f8c99e7 to
8a30859
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
6 times, most recently
from
May 23, 2025 12:47
6c15983 to
c86535e
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
2 times, most recently
from
June 2, 2025 19:30
d163c34 to
a891b2d
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
6 times, most recently
from
June 17, 2025 07:32
730f552 to
ca27721
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
from
June 17, 2025 17:22
ca27721 to
304327e
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
3 times, most recently
from
July 2, 2025 09:26
67c62c2 to
1c14fcb
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
9 times, most recently
from
July 11, 2025 13:30
22595f0 to
39dac54
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
4 times, most recently
from
July 21, 2025 13:35
8fb2bd6 to
8f85e0d
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
from
July 22, 2025 13:45
8f85e0d to
ff24ace
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
2 times, most recently
from
July 30, 2025 15:30
a100266 to
821924b
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
3 times, most recently
from
August 14, 2025 18:45
ee5c62c to
0d84c11
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
5 times, most recently
from
August 26, 2025 16:25
9e630bc to
a9f2fa7
Compare
renovate
Bot
force-pushed
the
renovate/python-dependencies
branch
2 times, most recently
from
September 1, 2025 18:51
5e9b801 to
b12650e
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
==1.8.3→==1.9.4==3.10.1→==4.0.1==25.1.0→==26.10.1==1.3.0→==1.6.0<4→<6>=2.1,<2.6→>=2.7,<2.8>=4.11.0,<6→>=7,<8==1.14.5→==1.14.6<5→<8<4→<5==2024.4.2→==2026.3.4>=2.8,<2.10→>=2.10,<2.11==7.2.0→==7.4.1==1.2.3→==1.2.4==23.0.0→==26.2.0<9→<11==9.0.2→==9.17.1==6.0.1→==9.0.2==5.3.1→==6.1.3==1.1.0→==1.2.3==2.2.7→==2.3.0>=3.2.2,<4→>=4,<5==2.9.10→==2.9.13==3.3.6→==4.1.3==2.6.1→==2.8.0==3.6.4→==3.6.5==8.3.5→==9.1.1==6.0.0→==7.1.0==4.10.0→==4.14.0==0.25.7→==0.26.3==2.24.1→==2.73.0==6.1.0→==7.0.0Release Notes
PyCQA/bandit (bandit)
v1.9.4Compare Source
What's Changed
New Contributors
Full Changelog: PyCQA/bandit@1.9.3...1.9.4
v1.9.3Compare Source
What's Changed
VALUES(without space by @kfess in #1337New Contributors
Full Changelog: PyCQA/bandit@1.9.2...1.9.3
v1.9.2Compare Source
What's Changed
Full Changelog: PyCQA/bandit@1.9.1...1.9.2
v1.9.1Compare Source
What's Changed
Full Changelog: PyCQA/bandit@1.9.0...1.9.1
v1.8.6Compare Source
What's Changed
New Contributors
Full Changelog: PyCQA/bandit@1.8.5...1.8.6
v1.8.5Compare Source
What's Changed
Full Changelog: PyCQA/bandit@1.8.4...1.8.5
petereon/beaupy (beaupy)
v4.0.1Compare Source
Breaking changes
Configis a per-call object,select(..., config=Config(...)), carryingconsoleandkeys(DefaultKeys→KeyBindings). Module-levelconsoleis removed. Using a removed global raisesRemovedInV4Error(orAttributeErrorwhen assigning on theConfig/KeyBindingsclass) with a message explaining the replacement.select,select_multiple,prompt,confirmandSpinneris positional (Spinner(DOTS, text="...")).KeyboardInterruptby default (Config.raise_on_interrupt=True). It used to returnNone, so a script carried on as if the user had chosen "nothing". Esc still returnsNone.strictdefaults toTrueonselect/select_multiple(#157): emptyoptionsraisesValueErrorunlessstrict=Falseis passed.paginationflag removed.page_sizealone now controls paging:Nonefits the terminal and paginates only when needed, an integer always paginates with that many options per page. Before,page_sizewas silently ignored unlesspagination=Truewas passed too, andpagination=Falsecould not actually turn paging off.ctrl+ainstead ofa, soacan be typed into a filter. Select-all keeps existing ticks (filling up tomaximal_countin list order) and acts on visible options when filtering.Console(stderr=True, highlight=False)), restoring the 3.8.2 look.emojiis dropped andrich>=14.3.0is required. Cursor/tick widths now come fromrich.cells.cell_len, which matchesemojion every cursor/tick tried and is more accurate for CJK and combining characters, but only measures variation-selector/ZWJ emoji correctly from Rich 14.3 (which still supports Python 3.8).>=3.8is still declared, but only 3.10+ is tested in CI (noted in the README). The built wheel imports on 3.8, 3.9, 3.10 and 3.14.New features
title=onselect/select_multiple,instructions=on all elements (Nonehides it).(section, index)tuples, enforced at runtime and by type checkers via@overload.filterable=Truenarrows options by typed text (case-insensitive, markup ignored), and shows a(matches/total)count next to the query (#157).ValueErrornaming the entry, e.g.option at ('Veg', 1) is blank,section name '' is blank. Not gated bystrict.optionsraisesTypeErrorinstead of silently offering its letters.confirmraises on a blankyes_text/no_text(it used to crash withIndexError) and when both labels start with the same letter while the(Y/N)hint is shown.RuntimeError('Interactive terminal required')instead of an opaquetermios.error.Spinneris a context manager (with Spinner(...):also stops it if the body raises) and acceptsconsole=so it can share a console with the other elements.py.typedis now shipped (the wheel had none, so the overloads were invisible to downstream type checkers).prompt(..., target_type=int)is typedOptional[int]and its validator is checked against that type.optionsaccepts anySequence/Mapping; tuples and ranges already worked at runtime.__all__and__version__are declared.ValidationErrorandConversionErrorare nowValueErrorsubclasses. A failed validator can no longer be mistaken for a failed conversion, and a validator that raisesValueErroritself is no longer swallowed as one.Fixes
selectbut only 1 inselect_multiple, soselect_multiplerendered taller than the terminal and Rich'sLivecropped its page indicator and instructions (confirmed in a real pty). It is now derived from what is actually rendered (title/filter line, page indicator, instructions, the error line when min/max counts can produce one), identically for both, and section headers are bounded by what a page can hold. A property test asserts no render is taller than the terminal across heights, section counts, titles, filtering and error states.prompt()docstring pointed at a nonexistentrich.internalsmodule.Docs
docs/content/examples.md: rewritten Configuration section, new sections for title/instructions/sections, filtering, pagination, input validation and spinners, and a 3.x → 4.x migration table. The README spinner example uses the context manager.Tooling & CI
[tool.poetry]→ PEP 621[project],poetry.lock→uv.lock, build backendpoetry-core→uv_build. Releases now build and publish withuv build/uv publishinstead of Poetry +pypa/gh-action-pypi-publish.requirements-dev.txt/docs/requirements.txt(hand-pinned, unlocked, installed via two separate untrackedpip installs) folded into[dependency-groups]dev/docs, resolved and hash-locked together inuv.lock. Declared as[tool.uv] conflictssince they were never actually installed together (dev'swatchdog==6.0.0vs.novella'swatchdog<3.0.0).expycted,mock(tests use stdlibunittest.mock),radon,xenon,toml-sort,perflint, a duplicatepydoc-markdownpin, andtypes-emoji.ruff check/ruff formatreplacepflake8,black,isort, andflake8-simplify/-pie/-bandit/-cognitive-complexity/-expression-complexity/-quotes/-print/-eradicate. Fixed the 8 real findings ruff's rules turned up that flake8's narrowerselectlist and dead plugins never caught.relock-with-autocommit job replaced with a plainuv lock --check.astral-sh/setup-uv,JamesIves/github-pages-deploy-action), flagged by Sonar as a high-severity supply-chain risk (tag refs are mutable).docsgroup needsuv pip install --group docsrather thanuv sync: novella'spkg_resources-based plugin loader can't resolveuv's dist-info metadata for dotted distribution names (e.g.databind.json). Also needssetuptools<81(pkg_resourceswas removed in 81+).v3.12.0Compare Source
What's Changed
03f86feby @renovate[bot] in #134e2bab26by @renovate[bot] in #168cef2210by @renovate[bot] in #169Full Changelog: petereon/beaupy@v3.11.0...v3.12.0
v3.11.0Compare Source
What's Changed
New Contributors
Full Changelog: petereon/beaupy@v3.10.2...v3.11.0
v3.10.2Compare Source
What's Changed
Full Changelog: petereon/beaupy@v3.10.1...v3.10.2
psf/black (black)
v26.10.1Compare Source
Highlights
This release fixes a security issue in Black's bundled GitHub Action. Repositories that
use the action are encouraged to update to the latest version of Black immediately. This
update is received automatically when using
psf/black@stable, and is independent ofthe version of Black installed by the action.
When the GitHub Action reads version specifiers from
tool.black.required-version, itnow only accepts released versions of Black, as it already did for
blackrequirementsin dependency lists. Other values, such as URL references, are now rejected. This issue
has been registered as
GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.Stable style
x = !ls -la) being wrappedin parentheses, which IPython can no longer run; such cells are now left unchanged
(#5481)
--line-rangesunchanged (#5436)--line-rangesformatting lines that follow a statement when formatting joins orre-indents that statement (#5484)
--line-rangescrashing with an internal error when an unselected statement has a# fmt: skipcomment on the last line before a closing bracket (#5477)# -*- coding: latin-1 -*-) ontothe first two lines of a file (#5487)
last line is near the line length limit (#5494)
{(x := f())}) when targeting Python 3.9 or older, since Python 3.8 and 3.9.0 can'tparse it without them (#5502)
Preview style
or comprehensions) inside brackets when preceded by a standalone comment (#5455)
string_processingfeature removing backslash-newline sequences fromraw strings, which changed their value (#5482)
assignments (such as annotated assignments or subscript targets) (#5473)
under
--preview(#5442)wrap_long_dict_values_in_parensdropping the parentheses around a right-handside that contains a dictionary, leaving a line over the length limit (#5492)
string_processingfeature adding a space after*or**in a PEP695 type parameter (
* Ts = ...) when it splits a string in the parameter's default(#5504)
earlier bracket split exceeds the line length only due to a trailing comment (#5498)
Configuration
--cache-dirto configure the cache directory from the command line (#5433)--line-ranges,which made a later full
black --checkpass andblackskip the unformatted lines(#5476)
.gitignorethat starts with a UTF-8 byte order mark. The mark became partof the first pattern, so that pattern never matched and Black formatted files that git
ignores (#5497)
Performance
pairs (such as consecutive subscripts) (#5475)
Integrations
use_pyprojectisenabled (#5479)
tool.black.required-version, itnow only accepts released versions of Black, as it already did for
blackrequirements in dependency lists. Other values, such as URL references, are now
rejected. (#5510)
v26.10.0Compare Source
Stable style
--line-rangesno longer inserts an empty line after a docstring when the rangecovers only the docstring itself (#5312)
# fmt: skipon a bracketed ternary turning the surrounding tuple into a call(#5464)
# fmt: skipis placed on a one-line function or class with PEP 695type parameters (#5429)
inside the parentheses when the parenthesized expression contains own-line comments
(#5395)
# fmt: skipis placed on a bracket of anif,while,for, orwithheader (#5401, #5405)# fmt: skip(#5414)earlier on the line (#5381)
# fmt: oncomment (#5300)(x): int = 5), which prevent CPython from including the name in__annotations__(#5321)
t" spam "asthe first statement of a module, class or function) (#5287)
t'\'{a["b"]}\'') (#5265)already-escaped double quote (e.g.
'''\'''\"''') (#5262)--skip-magic-trailing-commadropping the trailing comma from a splitsingle-element tuple used as a lambda parameter default (#5246)
parenthesized assert message) (#5241)
--skip-magic-trailing-commadropping the trailing comma of a one-elementsubscript (
a[x,]) when the line is long enough to be split and contains a poweroperator (#5272)
(#5144)
*TypeVarTupleor**ParamSpec(#5244)# fmt: off/# fmt: onblock is followed by awithstatement after another standalone comment (#5189)
case case if ...match patterns at very small linelengths (#5147)
docstrings (#5148)
# fmt: skipon a line that opens a bracket (e.g.from x import ( # fmt: skip) when a standalone comment is among the bracket'scontents (#5161)
# type: ignorecomments in a parenthesizedattribute chain were merged onto one physical line (#5297)
--line-ranges(#5175)# fmt: skipis used on one-lineasync def,async with, andasync forstatements containing a semicolon (#5311)(#5461)
--skip-source-first-lineturning the skipped line's CRLF ending into\r\r\nwhen reformatting a file with CRLF line endings (#5438)
Preview style
New preview features
(e.g. stop splitting inside the
[2]of[1,][2](3)) (#5448)wrapped onto a new line instead (#5435)
for (x), (y) in points:becomesfor x, y in points:) (#5416)Tprefixes on t-strings to lowercase (#5425)# fmt: offblockafter an import (#5238)
(e.g.
x[key] = expr) (#5095)yieldstatements for consistency with functioncalls and returns (#5170)
not in,==,is, ...) whenthe right-hand side is a bracketed expression, and instead split inside the brackets
(#5135)
.pyistub files, enforce a blank line after a function or method that has adocstring-only body when another comment or statement follows it (#5158)
Updates to existing preview features
# fmt: skipis placed on a function in a group ofsame-name decorated functions (e.g.
@overloads or a property setter) (#5430)[x for x in (lambda: 0) if x]) (#5176, #5200)Updates to existing unstable features
# type: ignorecomments as single-line unsplittable expressions (#5466)
merging a backslash-continued string on the same line (#5449)
(#5427)
# type: ignorecomments onto oneline (#5271)
# type: ignoreis lost during formatting of a long parenthesizedstring (#5329)
r"..." r"...") being wrapped in parentheses (#5434)Configuration
NO_COLORenvironment variable to disable ANSI output (#5129)--target-versionflag (#5167)--force-excludenot excluding files whose path contains..(e.g.black ../generated/file.pyrun from a subdirectory) (#5471)no common project root (e.g. they are on different drives on Windows) instead of
crashing (#5386)
pyproject.tomlpath when--codeis used from differentworking directories in the same process (#5152)
--line-rangesvalues (#5107)EOFError(#5192)includeandforce-excludevalues inpyproject.toml(#5193)BLACK_NUM_WORKERSvalues and report invalid values as usage errors insteadof crashing (#5211)
Packaging
PyInstaller release build (#5223)
Immutable Releases
(#5296)
Performance
# fmt: skip/# fmt: off/# fmt: oncomments(#5169, #5190, #5232)
with triple-quoted strings as values) (#5188)
match/caseblocks)(#5186)
large dict literals (in
--preview) (#5184)--line-rangeson files with many sibling blocks (a longif/elifchain, amatchwith many cases, or many top-level definitions) (#5213)operators (e.g. a long run of implicitly concatenated strings inside
[]) (#5239)a ** b ** c ** ...chain) (#5235)
if/elifchains and other compound statements with manyclauses (#5322)
string_processing:(#5165)
"%s ..." % (a, b, c, ...)) (#5178, #5199, #5220)Output
path:line:columnlocations (#5237)sys.stdoutthat has nobufferattribute (e.g. in Jupyter notebooks) (#5411)
Blackd
X-Python-Variantheader is empty or has anempty entry (e.g. a trailing comma) (#5428)
pyiin theX-Python-Variantheader (#5441)Integrations
migrate-blackscript (#5319)tool.black.required-versionfor the GitHubAction (#5399)
is_formatted,change_count,same_count,failure_count) to GitHubAction runs (#5408)
Documentation
vim-python-pep8-indent, which provides anindentexprfor Black-styleinsert-mode indentation (#5288)
v26.5.1Compare Source
Stable style
an inline comment (e.g.
x: list[ # pyright: ignore[...]) (#5130)# type: ignore) immediately before a# fmt: skipline, avoiding AST equivalence failures (#5139)Packaging
Documentation
(#5124)
v26.5.0Compare Source
Highlights
both new syntactic features in Python 3.15 ([#5048](h
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.