build(deps): Bump the python group with 3 updates

[dependabot]

Bumps the python group with 3 updates: pydantic, qc-core and jupytext.

Updates pydantic from 2.13.5 to 2.14.0

Release notes

Sourced from pydantic's releases.

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

Full Changelog: pydantic/pydantic@v2.13.0...v2.14.0

v2.14.0b2 2026-09-09

What's Changed

This pre-release adds full support for Python 3.15 specific features, such as support for frozendict, making use of TypeForm and stabilizing the MISSING sentinel type.

New Features

• Allow any CoreSchema to be used as serialization by @​Viicos in #13680
• Add support for frozendict type by @​Viicos in #13634

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

v2.14.0b2 (2026-09-09)

GitHub release

... (truncated)

Commits

• fcdefa7 Correct v2.14.0 release date (#13952)
• c821eac Revert "Respect config in TypeAdapter.json_schemas() (#13890)" (#13951)
• a656b75 Prepare release v2.14.0 (#13948)
• b4028f9 Avoid validating URL prefix multiple times in multi host URLs (#13945)
• 69ed168 Reject large exponents in Fraction validation (#13944)
• 895c0c2 Fix datetime parsing in custom validator examples (#13931)
• d2cbaaa Bump virtualenv from 20.36.1 to 21.7.13 (#13943)
• 3fbc25a Bump pydantic-core dependencies (#13942)
• 027b5c7 Rebuild incomplete types during serialization inference (#13922)
• 2706d1f Handle exceptions during Decimal validation (#13940)
• Additional commits viewable in compare view

Updates qc-core from 0.0.1 to 0.0.4

Updates jupytext from 1.19.5 to 1.19.6

Release notes

Sourced from jupytext's releases.

Version 1.19.6

Security

• The Quarto conversions now run in a private temporary directory, so that the output file that quarto convert names after its input can no longer be pre-created as a symlink by another user of the machine. Thanks to Naveed for the PR (#1615).
• Paired paths from notebook formats metadata are now prevented from escaping the working tree, including when an absolute notebook path is used. Thanks to Naveed for addressing the issue (#1588).
• The CLI now ignores trusted cell metadata when the notebook signature is invalid, so a trusted=true option in a paired text file cannot make untrusted notebook outputs trusted during --sync. Thanks to Naveed for the fix (#1617).
• Custom cell_markers and endofcell values in the light format are now matched literally, preventing regular-expression injection, parsing errors, and excessive processing time on crafted notebooks. This also fixes writing OCaml notebooks with custom cell markers. Thanks to Naveed again for the PR (#1618).
• We have merged Dependabot security updates for the JupyterLab extension and the documentation website (#1614, #1620, #1622, #1624, #1634, #1639, #1642, #1643, #1647, #1653, #1654).

Fixed

• Menu entries such as "Rename Notebook…" name the file type again, instead of saying "default". Thanks to Michał Krassowski for this PR (#1632).
• Mermaid %% comments inside a markdown cell are no longer mistaken for py:percent cell markers (#1533). Thanks to Sanjay Santhanam for his PR (#1609)
• A whitespace-only final line in a percent-format cell is now preserved when reading and round-tripping the notebook (#1599). Thanks to lowbyteguy for the PR (#1610).
• The JupyterLab extension's development install script now uses the correct jupyter-builder import (#1632). Thanks again to Michał Krassowski for this fix.
• Fixed JupyterLab extension build issues related to Yarn package checksums. Thanks to Mahendra Paipuri for his contributions to #1614, #1620, and #1621.
• Fixed pairing on Windows when a prefix root contains subdirectories, such as notebooks/tutorials///ipynb.

Changed

• Updated the JupyterLab extension's production dependencies (#1621, #1641, #1652).
• Updated the documentation website's Astro, Starlight, and Sharp dependencies (#1612, #1621, #1625, #1641, #1646, #1650, #1652).
• Updated the GitHub Actions used for CI and publishing (#1613, #1619, #1633, #1640, #1649, #1651).
• Updated Jupyter Server in the Pixi environments. Thanks again to Mahendra Paipuri for this update (#1646).

Added

• We have added a development container that can be opened with VS Code’s Dev Containers extension (#1655).
• Added support for the Jenner language. Thanks to Lawrence Sinclair for this contribution (#1493).

Changelog

Sourced from jupytext's changelog.

1.19.6 (2026-10-04)

Security

• The Quarto conversions now run in a private temporary directory, so that the output file that quarto convert names after its input can no longer be pre-created as a symlink by another user of the machine. Thanks to Naveed for the PR (#1615).
• Paired paths from notebook formats metadata are now prevented from escaping the working tree, including when an absolute notebook path is used. Thanks to Naveed for addressing the issue (#1588).
• The CLI now ignores trusted cell metadata when the notebook signature is invalid, so a trusted=true option in a paired text file cannot make untrusted notebook outputs trusted during --sync. Thanks to Naveed for the fix (#1617).
• Custom cell_markers and endofcell values in the light format are now matched literally, preventing regular-expression injection, parsing errors, and excessive processing time on crafted notebooks. This also fixes writing OCaml notebooks with custom cell markers. Thanks to Naveed again for the PR (#1618).
• We have merged Dependabot security updates for the JupyterLab extension and the documentation website (#1614, #1620, #1622, #1624, #1634, #1639, #1642, #1643, #1647, #1653, #1654).

Fixed

• Menu entries such as "Rename Notebook…" name the file type again, instead of saying "default". Thanks to Michał Krassowski for this PR (#1632).
• Mermaid %% comments inside a markdown cell are no longer mistaken for py:percent cell markers (#1533). Thanks to Sanjay Santhanam for his PR (#1609)
• A whitespace-only final line in a percent-format cell is now preserved when reading and round-tripping the notebook (#1599). Thanks to lowbyteguy for the PR (#1610).
• The JupyterLab extension's development install script now uses the correct jupyter-builder import (#1632). Thanks again to Michał Krassowski for this fix.
• Fixed JupyterLab extension build issues related to Yarn package checksums. Thanks to Mahendra Paipuri for his contributions to #1614, #1620, and #1621.
• Fixed pairing on Windows when a prefix root contains subdirectories, such as notebooks/tutorials///ipynb.

Changed

• Updated the JupyterLab extension's production dependencies (#1621, #1641, #1652).
• Updated the documentation website's Astro, Starlight, and Sharp dependencies (#1612, #1621, #1625, #1641, #1646, #1650, #1652).
• Updated the GitHub Actions used for CI and publishing (#1613, #1619, #1633, #1640, #1649, #1651).

... (truncated)

Commits

• 9fccc3d Version 1.19.6 (#1656)
• 85c65a9 Add Jenner language support (#1493)
• ca39ad2 Add development container (#1655)
• 0176ff2 reject paired paths that escape the notebook directory tree (#1588)
• 1eb4653 Ignore '%%' lines inside fenced blocks of py:percent markdown cells (#1609)
• b1d7b65 build(deps): bump the jupytext-extension-security-updates group across 2 dire...
• 85df69a build(deps): bump the actions-dependencies group with 3 updates (#1651)
• c3bb81d run quarto convert in a private temp directory (#1615)
• 9bbd990 build(deps): bump the jupytext-extension-security-updates group across 1 dire...
• f96ae7d build(deps): bump the jupytext-extension-dependencies group across 2 director...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!