Skip to content

⬆ Bump the python-packages group across 1 directory with 6 updates#426

Merged
YuriiMotov merged 3 commits into
mainfrom
dependabot/uv/python-packages-e279d96c05
Jun 11, 2026
Merged

⬆ Bump the python-packages group across 1 directory with 6 updates#426
YuriiMotov merged 3 commits into
mainfrom
dependabot/uv/python-packages-e279d96c05

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-packages group with 6 updates in the / directory:

Package From To
fastapi 0.136.1 0.136.3
ruff 0.15.12 0.15.15
uvicorn 0.46.0 0.49.0
ty 0.0.35 0.0.43
prek 0.3.13 0.4.3
zizmor 1.24.1 1.25.2

Updates fastapi from 0.136.1 to 0.136.3

Release notes

Sourced from fastapi's releases.

0.136.3

Refactors

  • ♻️ Do not accept underscore headers when using convert_underscores=True (the default). PR #15589 by @​tiangolo.

0.136.2

Refactors

  • ♻️ Validate Server Sent Event fields to avoid applications from sending broken data. PR #15588 by @​tiangolo.

Docs

Translations

Internal

... (truncated)

Commits
  • 8206485 🔖 Release version 0.136.3
  • c910e01 📝 Update release notes
  • 063b5bf ♻️ Do not accept underscore headers when using convert_underscores=True (th...
  • 22b02e2 🔖 Release version 0.136.2
  • 3b252a2 📝 Update release notes
  • c7fb785 ♻️ Validate Server Sent Event fields to avoid applications from sending broke...
  • cb83b83 📝 Update release notes
  • 00f805c ✅ Update tests, don't double dispose the engine (#15587)
  • 3675137 📝 Update release notes
  • 7b57e42 📝 Document --entrypoint CLI option (#15464)
  • Additional commits viewable in compare view

Updates ruff from 0.15.12 to 0.15.15

Release notes

Sourced from ruff's releases.

0.15.15

Release Notes

Released on 2026-05-28.

Preview features

  • Fix Markdown closing fence handling (#25310)
  • [pyflakes] Report duplicate imports in typing.TYPE_CHECKING block (F811) (#22560)

Bug fixes

  • [pyflakes] Treat function-scope bare annotations as locals per PEP 526 (F821) (#21540)

Performance

  • Avoid redundant TokenValue drops in the lexer (#25300)
  • Reduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens Vec size (#25354)
  • Use ThinVec in AST to shrink Stmt (#25361)

Documentation

  • Fix line-length example for --config option (#25389)
  • [flake8-comprehensions] Document RecursionError edge case in __len__ (C416) (#25286)
  • [mccabe] Improve example (C901) (#25287)
  • [pyupgrade] Clarify fix safety docs (UP007, UP045) (#25288)
  • [refurb] Document FURB192 exception change for empty sequences (#25317)
  • [ruff] Document false negative for user-defined types (RUF013) (#25289)

Formatter

  • Fix formatting of lambdas nested within f-strings (#25398)

Server

  • Return code action for codeAction/resolve requests that contain no or no valid URL (#25365)

Other changes

  • Expand semantic syntax errors for invalid walruses (#25415)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.15

Released on 2026-05-28.

Preview features

  • Fix Markdown closing fence handling (#25310)
  • [pyflakes] Report duplicate imports in typing.TYPE_CHECKING block (F811) (#22560)

Bug fixes

  • [pyflakes] Treat function-scope bare annotations as locals per PEP 526 (F821) (#21540)

Performance

  • Avoid redundant TokenValue drops in the lexer (#25300)
  • Reduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens Vec size (#25354)
  • Use ThinVec in AST to shrink Stmt (#25361)

Documentation

  • Fix line-length example for --config option (#25389)
  • [flake8-comprehensions] Document RecursionError edge case in __len__ (C416) (#25286)
  • [mccabe] Improve example (C901) (#25287)
  • [pyupgrade] Clarify fix safety docs (UP007, UP045) (#25288)
  • [refurb] Document FURB192 exception change for empty sequences (#25317)
  • [ruff] Document false negative for user-defined types (RUF013) (#25289)

Formatter

  • Fix formatting of lambdas nested within f-strings (#25398)

Server

  • Return code action for codeAction/resolve requests that contain no or no valid URL (#25365)

Other changes

  • Expand semantic syntax errors for invalid walruses (#25415)

Contributors

... (truncated)

Commits
  • db5aa0a Bump 0.15.15 (#25431)
  • 366fe21 [ty] Improve diagnostics for syntax errors in forward annotations (#25158)
  • e2e1e64 [ty] Remove excess capacity from more Salsa cached collections (#25411)
  • 1bd77e1 [ty] Use diagnostic message as tie breaker when sorting (#25424)
  • 7e1bc1e Add agent skills for working on ty (#25422)
  • 574e107 Expand semantic syntax errors for invalid walruses (#25415)
  • 4a7ca06 [ty] Display docs for matching parameter when hovering over the name of an ar...
  • 5432709 Refine a few agents instructions (#25423)
  • 3cb09eb [ty] Support typing.TypeForm (#25334)
  • c8cd59f [ty] Infer class attributes assigned by metaclass initialization (#25342)
  • Additional commits viewable in compare view

Updates uvicorn from 0.46.0 to 0.49.0

Release notes

Sourced from uvicorn's releases.

Version 0.49.0

What's Changed

Full Changelog: Kludex/uvicorn@0.48.0...0.49.0

Version 0.48.0

What's Changed

Full Changelog: Kludex/uvicorn@0.47.0...0.48.0

Version 0.47.0

What's Changed

Full Changelog: Kludex/uvicorn@0.46.0...0.47.0

Changelog

Sourced from uvicorn's changelog.

0.49.0 (June 3, 2026)

Changed

  • Bump httptools minimum version to 0.8.0 (#2962)
  • Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) (#2971)

0.48.0 (May 24, 2026)

Changed

  • Default ssl_ciphers to None and use OpenSSL defaults (#2940)

Fixed

  • Ignore duplicate forwarding headers in ProxyHeadersMiddleware (#2944)

0.47.0 (May 14, 2026)

Added

  • Add ssl_context_factory for custom SSLContext configuration (#2920)

Changed

  • Eagerly import the ASGI app in the parent process (#2919)

Fixed

  • Treat fd=0 as a valid file descriptor with reload/workers (#2927)
Commits
  • 3ef2e3e Version 0.49.0 (#2973)
  • eeb64b1 Consume duplicate forwarding headers in ProxyHeadersMiddleware (#2971)
  • 630f4ac Make the watchfiles reload tests deterministic (#2972)
  • 9154922 chore(deps): bump the github-actions group across 1 directory with 6 updates ...
  • 739727a Migrate docs deploy from Cloudflare Pages to Workers (#2967)
  • be4a240 Gate docs preview deploy on Cloudflare token presence (#2966)
  • c489d7e Bump httptools minimum version to 0.8.0 (#2962)
  • 9f547bd Skip docs preview deploy for Dependabot PRs (#2961)
  • 44446b8 Migrate documentation from MkDocs Material to Zensical (#2959)
  • cfd659c Bump pymdown-extensions to 10.21.3 (#2958)
  • Additional commits viewable in compare view

Updates ty from 0.0.35 to 0.0.43

Release notes

Sourced from ty's releases.

0.0.43

Release Notes

Released on 2026-06-03.

Bug fixes

  • Don't inject Unknown from non-callable elements of intersection call (#25538)
  • Don't needlessly disambiguate the same type alias (#25563)
  • Fix variance inference for nested type aliases (#25567)
  • Ignore rejected member annotations for synthesized bindings (#25427)
  • Normalize dynamic class literals in cycle recovery (#25558)
  • Register file roots for first-party search paths (#25522)
  • Treat union-bound typevars like unions for possibly-missing-attribute (#25561)

LSP server

  • Suppress importable completions that are already in scope (#25479)

Performance

  • Avoid retaining duplicate function signatures (#25609)
  • Compact retained definition inference results (#25593)
  • Compact retained definition kinds (#25610)
  • Compact retained definitions by node (#25498)
  • Consolidate AST ID reverse lookup (#25455)
  • Consolidate retained use-def definition maps (#25499)
  • Omit redundant definitions-by-node entries (#25501)
  • Reuse common protocol constraints for TypedDict unions (#25598)

Diagnostics

  • Improve error context for not-iterable diagnostics (#24944)

Core type checking

  • Detect disjointness due to incompatible generic specializations (#24822)
  • Distinguish typing.Callable from collections.abc.Callable (#24954)
  • Include nested global/nonlocal bindings in type inference (#25387)
  • Optional lower/upper bounds in individual constraints (#25435)
  • Preserve slice-bound types in subscript inference (#25446)
  • Reject Self in type aliases (#25529)
  • Require literal booleans for TypedDict flags (#25594)
  • Support narrowing on lengths (#25347)
  • Synthesize precise __len__ methods for literals (#25600)
  • Use callable type context to implicitly specialize generic class (#25471)
  • expand type aliases inside type context unions (#25553)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.43

Released on 2026-06-03.

Bug fixes

  • Don't inject Unknown from non-callable elements of intersection call (#25538)
  • Don't needlessly disambiguate the same type alias (#25563)
  • Fix variance inference for nested type aliases (#25567)
  • Ignore rejected member annotations for synthesized bindings (#25427)
  • Normalize dynamic class literals in cycle recovery (#25558)
  • Register file roots for first-party search paths (#25522)
  • Treat union-bound typevars like unions for possibly-missing-attribute (#25561)

LSP server

  • Suppress importable completions that are already in scope (#25479)

Performance

  • Avoid retaining duplicate function signatures (#25609)
  • Compact retained definition inference results (#25593)
  • Compact retained definition kinds (#25610)
  • Compact retained definitions by node (#25498)
  • Consolidate AST ID reverse lookup (#25455)
  • Consolidate retained use-def definition maps (#25499)
  • Omit redundant definitions-by-node entries (#25501)
  • Reuse common protocol constraints for TypedDict unions (#25598)

Diagnostics

  • Improve error context for not-iterable diagnostics (#24944)

Core type checking

  • Detect disjointness due to incompatible generic specializations (#24822)
  • Distinguish typing.Callable from collections.abc.Callable (#24954)
  • Include nested global/nonlocal bindings in type inference (#25387)
  • Optional lower/upper bounds in individual constraints (#25435)
  • Preserve slice-bound types in subscript inference (#25446)
  • Reject Self in type aliases (#25529)
  • Require literal booleans for TypedDict flags (#25594)
  • Support narrowing on lengths (#25347)
  • Synthesize precise __len__ methods for literals (#25600)
  • Use callable type context to implicitly specialize generic class (#25471)
  • expand type aliases inside type context unions (#25553)

Contributors

... (truncated)

Commits

Updates prek from 0.3.13 to 0.4.3

Release notes

Sourced from prek's releases.

0.4.3

Release Notes

Released on 2026-05-27.

Bug fixes

  • Ignore stat-only hook rewrites (#2131)

Sponsorship

If prek saves time for you or your team, please consider sponsoring the project on GitHub Sponsors. It helps keep new features, performance work, and maintenance moving.

Contributors

Install prek 0.4.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.3/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.3/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.4.3

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-i686-pc-windows-msvc.zip x86 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum
prek-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
prek-i686-unknown-linux-gnu.tar.gz x86 Linux checksum

... (truncated)

Changelog

Sourced from prek's changelog.

0.4.3

Released on 2026-05-27.

Bug fixes

  • Ignore stat-only hook rewrites (#2131)

Sponsorship

If prek saves time for you or your team, please consider sponsoring the project on GitHub Sponsors. It helps keep new features, performance work, and maintenance moving.

Contributors

0.4.2

Released on 2026-05-26.

Highlights

0.4.2 is mainly about making prek run faster in large repos.

prek now does less git diff work. After hooks run, prek uses diff checks to detect files changed by hooks. If a hook modifies files, prek marks that hook as failed. That is important, but full diff snapshots can be slow in big repos, especially when they happen after every hook group.

We skip the expensive diff path in two common cases: built-in hooks that prek knows are read-only, and clean worktrees where a cheap dirty check is enough unless a hook actually changes files. In the right large-repo workload, skipping that work can make runs up to 10x faster.

Workspace mode is faster too. Hooks have historically been too serial. Priority-based concurrency helped, but it required users to choose good priority values. Now sibling projects at the same workspace depth run in parallel automatically. Their files do not overlap, so this is safe and needs no extra config. For multi-project workspaces, this can dramatically reduce total hook time.

Sponsorship

If prek saves time for you or your team, please consider sponsoring the project on GitHub Sponsors. It helps keep new features, performance work, and maintenance moving.

Enhancements

... (truncated)

Commits

Updates zizmor from 1.24.1 to 1.25.2

Release notes

Sourced from zizmor's releases.

v1.25.2

Bug Fixes 🐛🔗

v1.25.1

Bug Fixes 🐛🔗

v1.25.0

New Features 🌈🔗

  • zizmor's finding severities can now be remapped on a per-audit basis. See the configuration for details (#1913)

    Many thanks to @​Proximyst for proposing and implementing this improvement!

  • New audit: github-app detects dangerous usages of GitHub App installation tokens (#1926)

  • New audit: [unpinned-tools] detects actions that install tools without pinning to a specific version (#1820)

  • zizmor now accepts the --no-ignores flag to disable all ignore comments and configurations when reporting findings (#1935)

  • zizmor's LSP now honors the --persona flag on the CLI (#1943)

  • zizmor is now aware of Docker-based action definitions, in addition to the pre-existing support for "composite" actions (#1965)

Enhancements🔗

... (truncated)

Changelog

Sourced from zizmor's changelog.

1.25.2

Bug Fixes 🐛

  • Fixed a bug where the [unpinned-tools] audit would incorrectly flag the @​aquasecurity/trivy-action action as installing an unpinned tool version, rather than @​aquasecurity/setup-trivy (#2018)

1.25.1

Bug Fixes 🐛

  • Fixed a bug where the [cache-poisoning] audit would fail to consider release events as exempt from cache usage findings when filtered by a tag condition (#2004)

  • Fixed a typo when suggesting --fix flags for findings (#2010)

    Many thanks to @​0xdea for implementing this fix!

  • Fixed a typo in [unpinned-tools] annotations (#2008)

    Many thanks to @​martincostello for implementing this fix!

  • Fixed a bug where the [github-app] audit would incorrectly flag some safe uses of @​actions/create-github-app-token as unsafe (#2011)

1.25.0

New Features 🌈

  • zizmor's finding severities can now be remapped on a per-audit basis. See the configuration for details (#1913)

    Many thanks to @​Proximyst for proposing and implementing this improvement!

  • New audit: [github-app] detects dangerous usages of GitHub App installation tokens (#1926)

  • New audit: [unpinned-tools] detects actions that install tools without pinning to a specific version (#1820)

  • zizmor now accepts the --no-ignores flag to disable all ignore comments and configurations when reporting findings (#1935)

  • zizmor's LSP now honors the --persona flag on the CLI (#1943)

  • zizmor is now aware of Docker-based action definitions, in addition to the pre-existing support for "composite" actions (#1965)

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jun 4, 2026
@dependabot dependabot Bot force-pushed the dependabot/uv/python-packages-e279d96c05 branch from 73783d7 to eb1b7bb Compare June 4, 2026 07:43
@dependabot
⬆ Bump the python-packages group across 1 directory with 6 updates
005c809 
Bumps the python-packages group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.136.1` | `0.136.3` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.12` | `0.15.15` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.46.0` | `0.49.0` |
| [ty](https://github.com/astral-sh/ty) | `0.0.35` | `0.0.43` |
| [prek](https://github.com/j178/prek) | `0.3.13` | `0.4.3` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.24.1` | `1.25.2` |



Updates `fastapi` from 0.136.1 to 0.136.3
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.136.1...0.136.3)

Updates `ruff` from 0.15.12 to 0.15.15
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.12...0.15.15)

Updates `uvicorn` from 0.46.0 to 0.49.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.46.0...0.49.0)

Updates `ty` from 0.0.35 to 0.0.43
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.35...0.0.43)

Updates `prek` from 0.3.13 to 0.4.3
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.3.13...v0.4.3)

Updates `zizmor` from 1.24.1 to 1.25.2
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.24.1...v1.25.2)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.136.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: prek
  dependency-version: 0.4.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: ruff
  dependency-version: 0.15.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: ty
  dependency-version: 0.0.40
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: uvicorn
  dependency-version: 0.48.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: zizmor
  dependency-version: 1.25.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/uv/python-packages-e279d96c05 branch from eb1b7bb to 005c809 Compare June 11, 2026 05:55
YuriiMotov
YuriiMotov reviewed Jun 11, 2026
View reviewed changes
Comment thread pyproject.toml Outdated
@YuriiMotov YuriiMotov force-pushed the dependabot/uv/python-packages-e279d96c05 branch from 0863d67 to 2b1b744 Compare June 11, 2026 09:33
@YuriiMotov YuriiMotov merged commit b01ab0e into main Jun 11, 2026
23 checks passed
@YuriiMotov YuriiMotov deleted the dependabot/uv/python-packages-e279d96c05 branch June 11, 2026 09:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@YuriiMotov YuriiMotov YuriiMotov left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file internal python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@YuriiMotov @tiangolo