chore(deps-dev): bump the python-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the python-dependencies group with 4 updates in the / directory: coverage, uv, ruff and astroid.

Updates coverage from 7.15.3 to 7.15.4

Release notes

Sourced from coverage's releases.

7.15.4

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
• Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

Changelog

Sourced from coverage's changelog.

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn't escaped where it's dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare <pull 2227_>_.

• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare <pull 2226_>_.

• Wheels are now provided for Python 3.15.

.. _pull 2226: coveragepy/coveragepy#2226 .. _pull 2227: coveragepy/coveragepy#2227

.. _changes_7-15-3:

Commits

• 4c0e7ff docs: sample HTML for 7.15.4
• db4cc32 docs: prep for 7.15.4
• c33085c style: start gradual move to ruff 0.16
• 53a0fd5 fix: neutralize control characters in lcov report fields (#2226)
• b64d53d build: make 3.15 wheels
• 53792ab build: show the python version for kits
• f6b03c7 chore: make upgrade_one package=cibuildwheel
• d9b660a chore: make upgrade
• b128a31 docs: oops, move this entry to the correct place
• a7a2c15 fix: escape filename urls in html report href attributes (#2227)
• Additional commits viewable in compare view

Updates uv from 0.12.2 to 0.12.3

Release notes

Sourced from uv's releases.

0.12.3

Release Notes

Released on 2026-08-07.

Python

• Add CPython 3.13.15 (#20997)

Preview features

• Add --output-format to select automatic, human-readable, or raw-byte output for uv cache size (#20992)
• Preserve JSON output from uv workspace metadata --quiet while suppressing diagnostics (#20991)
• Reduce memory usage for large workspaces by streaming uv workspace metadata JSON output (#20990)

Performance

• Reduce Linux startup latency by initializing the workspace cache before spawning another thread (#20989)
• Reuse compiled workspace exclusion patterns during workspace discovery (#20988)
• Speed up conflict-heavy resolutions by avoiding materialized range complements (#20982)
• Avoid slow procfs reads during Python interpreter discovery on Linux (#20987)

Documentation

• Add PEP 740 attestations to the GitHub Actions publishing example (#20986)
• Restrict the GitHub Actions publishing example to Python version tags (#20973)
• Correct --python-pin to --pin-python in the uv init --bare example (#20876)

Install uv 0.12.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.ps1 | iex"

Download uv 0.12.3

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.3

Released on 2026-08-07.

Python

• Add CPython 3.13.15 (#20997)

Preview features

• Add --output-format to select automatic, human-readable, or raw-byte output for uv cache size (#20992)
• Preserve JSON output from uv workspace metadata --quiet while suppressing diagnostics (#20991)
• Reduce memory usage for large workspaces by streaming uv workspace metadata JSON output (#20990)

Performance

• Reduce Linux startup latency by initializing the workspace cache before spawning another thread (#20989)
• Reuse compiled workspace exclusion patterns during workspace discovery (#20988)
• Speed up conflict-heavy resolutions by avoiding materialized range complements (#20982)
• Avoid slow procfs reads during Python interpreter discovery on Linux (#20987)

Documentation

• Add PEP 740 attestations to the GitHub Actions publishing example (#20986)
• Restrict the GitHub Actions publishing example to Python version tags (#20973)
• Correct --python-pin to --pin-python in the uv init --bare example (#20876)

Commits

• 5072309 Bump version to 0.12.3 (#20998)
• 57c6ca2 Sync latest Python releases: Include 3.13.15 (#20997)
• c8d39cb Avoid materializing complements during resolution (#20982)
• 544157b Add --output-format to uv cache size (#20992)
• 5d4a62d Preserve workspace metadata output in quiet mode (#20991)
• 1979349 Reuse compiled workspace exclusion patterns (#20988)
• b60da7a Stream workspace metadata JSON serialization (#20990)
• 91b5613 Initialize the workspace cache before spawning the main thread (#20989)
• 8259776 Update issue context when comments add useful information (#20980)
• 6348636 Avoid reading procfs to detect the Linux OS type (#20987)
• Additional commits viewable in compare view

Updates ruff from 0.16.1 to 0.16.2

Release notes

Sourced from ruff's releases.

0.16.2

Release Notes

Released on 2026-08-06.

Bug fixes

• [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

• Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

• @​MeGaGiGaGon
• @​charliermarsh
• @​epage
• @​sharkdp
• @​ntBre

Install ruff 0.16.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.ps1 | iex"

Download ruff 0.16.2

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
ruff-i686-pc-windows-msvc.zip	x86 Windows	checksum
ruff-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ruff-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
ruff-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz	PPC64 Linux	checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
ruff-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
ruff-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.2

Released on 2026-08-06.

Bug fixes

• [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

• Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

• @​MeGaGiGaGon
• @​charliermarsh
• @​epage
• @​sharkdp
• @​ntBre

Commits

• 5b48a04 Bump 0.16.2 (#27555)
• 1b9e5fc Update Swatinem/rust-cache action to v2.9.2 (#27568)
• c4e86fc [ty] Add helper extension methods for half-range and equality constraints (#2...
• 17a00de [ty] Reuse primer commands in memory reports (#27553)
• 6ea296b [ty] Normalize type labels in structured docstrings (#26923)
• 2fc445f [ty] Diagnose invalid getattr calls (#27502)
• 22c7823 [ty] Enable (but downrank) auto-import completion suggestions from stub-only ...
• 05160d5 [ty] Diagnose invalid descriptor __get__ calls (#27400)
• baea3d0 [ty] Expose strict analysis options in the playground (#27543)
• c88946e [ty] Bump ecosystem-analyzer for strict project settings (#27542)
• Additional commits viewable in compare view

Updates astroid from 4.1.2 to 4.3.0

Release notes

Sourced from astroid's releases.

v4.3.0

What's New in astroid 4.3.0?

Release date: 2026-08-07

Version 4.2.0 was skipped: a v4.2.0 tag was created by mistake during an aborted release attempt, so the changes from the 4.2.0 betas are released as 4.3.0.

• Fix a crash on a functional namedtuple whose field name changes under NFKC normalization, such as namedtuple("mu", ["µ"]). Python normalizes identifiers, so the parsed class stores the field under "μ" while the brain looked it up as written, raising KeyError on a definition that namedtuple itself accepts.

  Closes pylint-dev/pylint#8746

• Fix inference of a method's first argument (self or cls) when the method's return value is stored on an unrelated object. This avoids inferring cls as the caller's class when indexing a tuple returned by a classmethod such as A.c()[0].

  Closes pylint-dev/pylint#11101

• super() with no argument now resolves against the class of the object the method was called on, instead of the class the method is written in. One consequence is that a typing.Self return value survives a chain of super() calls.

  Closes #2852 Closes pylint-dev/pylint#10807

• typing.overload stubs no longer shadow the implementation when a special method is looked up in the MRO.

  Closes #2448

• Fix a crash when the field names of a functional Enum or namedtuple call are bytes, as in Enum("", b""). Such a definition is invalid, so inference now falls back to its default instead of raising TypeError.

  Closes #3189

• Fix a crash when the body of a typing.NamedTuple subclass contains an assignment whose target is not a single name, such as cat.color = "black", basket[0] = "apple" or apple, banana = "red", "yellow". The names bound by unpacking are now copied to the inferred class as well.

  Closes #3190

• Fix a crash when a binary operation involves a class whose metaclass is not a

... (truncated)

Changelog

Sourced from astroid's changelog.

What's New in astroid 4.3.0?

Release date: 2026-08-07

Version 4.2.0 was skipped: a v4.2.0 tag was created by mistake during an aborted release attempt, so the changes from the 4.2.0 betas are released as 4.3.0.

• Fix a crash on a functional namedtuple whose field name changes under NFKC normalization, such as namedtuple("mu", ["µ"]). Python normalizes identifiers, so the parsed class stores the field under "μ" while the brain looked it up as written, raising KeyError on a definition that namedtuple itself accepts.

  Closes pylint-dev/pylint#8746

• Fix inference of a method's first argument (self or cls) when the method's return value is stored on an unrelated object. This avoids inferring cls as the caller's class when indexing a tuple returned by a classmethod such as A.c()[0].

  Closes pylint-dev/pylint#11101

• super() with no argument now resolves against the class of the object the method was called on, instead of the class the method is written in. One consequence is that a typing.Self return value survives a chain of super() calls.

  Closes #2852 Closes pylint-dev/pylint#10807

• typing.overload stubs no longer shadow the implementation when a special method is looked up in the MRO.

  Closes #2448

• Fix a crash when the field names of a functional Enum or namedtuple call are bytes, as in Enum("", b""). Such a definition is invalid, so inference now falls back to its default instead of raising TypeError.

  Closes #3189

• Fix a crash when the body of a typing.NamedTuple subclass contains an assignment whose target is not a single name, such as cat.color = "black", basket[0] = "apple" or apple, banana = "red", "yellow". The names bound by unpacking are now copied to the inferred class as well.

  Closes #3190

• Fix a crash when a binary operation involves a class whose metaclass is not a class, as in class C(metaclass=sum) followed by C | None. The type of

... (truncated)

Commits

• a52596a Bump astroid to 4.3.0, update changelog
• 3dfb6ca Rename the 4.2.0 changelog section to 4.3.0
• 941430e Ignore typing.overload stubs in dunder lookup (#3150)
• 1e71c7d Fix crash on a namedtuple field name that changes under NFKC normalization (#...
• 3316637 Fix crash on a dataclass base that annotates init (#3206)
• 8577346 Infer the value of a data descriptor as unknown
• 8666418 Fix crash in has_known_bases() for a non-class metaclass
• 5952c15 Fix crash on non-name assignment targets in typing.NamedTuple body
• 331e9d9 Fix crash on bytes field names in functional Enum/namedtuple
• a68e42c build(deps): bump CodSpeedHQ/action from 4.19.1 to 5.0.1 (#3194)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.