Bump the python-minor-and-patch group across 1 directory with 6 updates by dependabot[bot] · Pull Request #50 · samlowe106/PaperScraper

dependabot · 2026-10-28T19:15:35Z

Bumps the python-minor-and-patch group with 6 updates in the / directory:

Package	From	To
python-dotenv	`1.2.3`	`1.2.4`
pre-commit	`4.6.2`	`4.7.0`
vcrpy	`8.3.0`	`8.4.0`
pytest-recording	`0.13.4`	`0.14.0`
coverage	`7.16.0`	`7.17.0`
ty	`0.0.75`	`0.0.91`

Updates python-dotenv from 1.2.3 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

dotenv get no longer exits with code 1 for empty string values (KEY=) by [@ShamikOfficial] in #700

An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@Noethix55555] in #663

dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@ROTl24] in #698

Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

dotenv get no longer exits with code 1 for empty string values (KEY=) by [@ShamikOfficial] in #700

An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@Noethix55555] in #663

dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@ROTl24] in #698

Commits

a565c2c Bump version: 1.2.3 → 1.2.4
4a7abd0 docs: add 1.2.4 release notes (#663, #698, #700)
f215c02 fix: dotenv get exits 0 for empty string values (#700)
58f2d7c test: make test_run_with_command_flags portable and meaningful (#709)
e0310e5 fix: honor --no-override when expanding variables in dotenv run (#698)
a00cb2e docs: add CHANGELOG entry for #663 (fix #600)
f5485a6 fix: parse empty unquoted value with inline comment as empty string
See full diff in compare view

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

Fix language: node hooks during commit with -a or inside a submodule.

Regressed in 4.6.1.

#3773 issue by @cbirkhold.

#3774 PR by @cbirkhold.

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

Fix language: node hooks during commit with -a or inside a submodule.

Regressed in 4.6.1.

#3773 issue by @cbirkhold.

#3774 PR by @cbirkhold.

Commits

65bb884 v4.7.0
73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
860d07d don't leak GIT_* env into npm install for language: node
9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
9905e88 use contextlib.chdir
59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
2be1701 remove triple-nested withs for 3.14 coverage
4c8d22a py311+
c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
f49e251 [pre-commit.ci] pre-commit autoupdate
Additional commits viewable in compare view

Updates vcrpy from 8.3.0 to 8.4.0

Release notes

Sourced from vcrpy's releases.

v8.4.0

What's Changed

Behavior change: the all record mode

Fix re-recording in the all record mode (#1071, fixes #578 and #208):

A re-recorded interaction now replaces the interaction it matches. Before, the new one was saved next to the old one, and the stale response was replayed first on the next run.

With drop_unused_requests=True, the cassette is now replaced with only what was just recorded. Before, it was saved empty.

Behavior change: re-recording now removes every previously recorded interaction that matches a new one under your match_on setting. With loose matchers (e.g. match_on=["method"]), one new request can replace many old ones. Cassettes re-recorded in all mode also no longer accumulate responses across runs.

Fixes

Fix httpx and httpx2 replay crashing on cassettes that store a null reason phrase, which includes cassettes recorded before 8.2.0 (#1028, #1029). Thanks @dgunning

Fix bare-host URLs such as https://example.com not matching cassettes that recorded them as https://example.com/, a regression in 8.2.0 (#1013, #1031). The uri matcher is otherwise as strict as before. Thanks @DSeaStar

Fix AttributeError: 'VCRFakeSocket' object has no attribute 'gettimeout' when niquests reuses a pooled connection with urllib3-future 2.25.901 or later (#1056). Thanks @pylaterreur

Streaming (file-like or iterator) request bodies are now forwarded with Content-Length instead of chunked encoding, which some servers reject (#1002)

Maintenance

CI: pin the PyPy jobs to PyPy 7.3, fix a flaky urllib3 test, bump actions/checkout to v7 and ruff to 0.17.1 (#1060, #1059, #1005, #1065). Thanks @pylaterreur

Full Changelog: kevin1024/vcrpy@v8.3.0...v8.4.0

Changelog

Sourced from vcrpy's changelog.

Changelog

All help in providing PRs to close out bug issues is appreciated. Even if that is providing a repo that fully replicates issues. We have very generous contributors that have added these to bug issues which meant another contributor picked up the bug and closed it out.

Unreleased

Docs: note that before_record_response also runs when a cassette is loaded, so it should be idempotent (#1042, #1044) - thanks @ciastek

Docs: replace Python 2's urllib2 with urllib.request in the examples - thanks @TejasAmle

9.2.0

New before_save_interaction and after_load_interaction options: hooks that get each interaction's request and response (and the cassette, if they take a third argument) when a cassette is saved and loaded, and can change them or leave the interaction out. Cassettes also get a public path. Like Ruby VCR's before_record and before_playback hooks (#527, #556) - thanks @tzturner and co-authors for #679, and @akaihola for #594, which explored this

New filter_sensitive_data option: replace secrets with placeholders everywhere in recorded interactions (URL, headers and bodies), and put the real values back when a cassette is loaded, built on the new hooks, so requests still match and your code sees the same responses whether they're recorded or played back. Inspired by Ruby VCR's option of the same name (#527, #544, #912)

9.1.0

Set raw_headers on replayed aiohttp responses, so code that reads them (e.g. httpx-aiohttp) works on replay (#970, #1034) - thanks @HostX0

Add release_conn() to replayed urllib3 responses, for code that releases pooled responses (#816, #1054) - thanks @cristianchiriac

Accept pathlib.Path and other path-like objects for cassette paths and cassette_library_dir (#567, #920, #1064) - thanks @fredrikblau

Make filter_post_data_parameters match urlencoded parameter names, so e.g. api:key also filters api%3Akey (#686, #1066) - thanks @b84330808

Fix the body matcher crashing on form-urlencoded and XML-RPC requests without a body (#913, #1032) - thanks @M001N

Close the response stream when reading an httpx response fails while recording (#1068) - thanks @Claire-ovo

ignore_localhost also ignores ::1 (#639) - thanks @dragonpaw for the report

Add json() to replayed urllib3 responses, as urllib3 2.x responses have (#774) - thanks @gschnellOnera for the report

Allow a persister option on use_cassette, to use a custom persister for one cassette (#575) - thanks @gioele for the report

Publish releases to PyPI from GitHub Actions with trusted publishing (#860, #1078)

9.0.0

Fix the body matcher crashing (e.g. with JSONDecodeError) when a body doesn't parse as its headers say, such as invalid JSON sent as application/json or malformed XML-RPC. Such bodies are now compared as raw bytes

Breaking: drop support for Python 3.10, which reached its end of life on 2026-10-01 - thanks @pylaterreur

Breaking: aiohttp error responses are now recorded and replayed when raise_for_status is used, on the session or the request. Before, aiohttp raised before vcrpy could record the response, and a replayed error response didn't raise even with raise_for_status set. Tests that relied on either need updating (#635, #925) - thanks @andrescollares

Breaking: filter_post_data_parameters now filters the body of requests with any method (PUT, PATCH, DELETE, ...), not just POST (#328, #1004). Requests are filtered before they're matched, so if you match on body, re-record cassettes that have unfiltered bodies for those methods. vcr.filters.replace_post_data_parameters still only filters POST; the new replace_body_parameters filters any method - thanks @andrescollares

Breaking: rewrite the CannotOverwriteExistingCassetteException message. It now starts with what went wrong (the cassette doesn't exist, the matching interactions were already played back, or no recorded interaction matches), shows the cassette's settings and the closest recorded requests with how they differ, and ends with suggestions for fixing it. Body mismatches show a short diff instead of nothing, and the message stays short when a cassette holds many similar requests. Code that matched the old message text (e.g. "Can't overwrite existing cassette") needs updating; the exception class and its cassette and failed_request attributes are unchanged, and new reason and similar_requests attributes describe the failure (#516, #673, #837, #838, #840, #929). Thanks @philsong4-ai (#1027) and @ChrisJr404 (#1037) for the PRs that started this

urllib3 (and requests) responses now have HTTPHeaderDict headers, as they do without vcrpy, instead of an HTTPMessage. Headers sent more than once (e.g. two Link headers) now keep every value (#841, #947) - thanks @Sanjays2402

8.5.0

Fix filter_post_data_parameters crashing with UnicodeDecodeError on binary request bodies passed as bytes or bytearray, which are now left untouched, and stop it mangling form segments without a = (#660) - thanks @philsong4-ai

Fix recording aiohttp requests that upload an open file as a form field (data={"file": f}), which crashed with TypeError: cannot pickle '_io.BufferedReader' object. The file's contents are recorded and the whole file is still sent (#737) - thanks @LilSpazJoekp for the report

Fix recording aiohttp requests whose body is an async generator (e.g. a streaming upload), which crashed with TypeError: cannot pickle 'async_generator' object. The chunks are recorded and still sent as before (#974) - thanks @smoltafet

Fix aiohttp response bodies being empty when streamed from response.content while recording a cassette (#502, #1055) - thanks @pylaterreur

Fix aiohttp response.content restarting from the start of the body on each access when replaying, which made readline() loops (e.g. google-genai streaming) never end (#927, #1055) - thanks @pylaterreur

Make response.content an aiohttp StreamReader when replaying aiohttp responses, as it is when recording: iter_any() and iter_chunks() no longer raise AttributeError, lines over 64 KiB are no longer refused, and readuntil(), is_eof(), total_bytes and the rest of its API work (#1055) - thanks @pylaterreur

If your tests patch vcr.stubs.aiohttp_stubs to work around #502 or #927 (e.g. overriding MockClientResponse.content, or putting the recorded body back with unread_data()), remove the patch: it is no longer needed, and no longer works (#1055)

Support Python 3.14 and 3.15, and test them in CI along with their free-threaded builds, 3.14t and 3.15t (#940) - thanks @pylaterreur

8.4.0

Fix AttributeError: 'VCRFakeSocket' object has no attribute 'gettimeout' when niquests reuses a pooled connection, with urllib3-future 2.25.901 or later - thanks @pylaterreur

Make the urllib3 POST test send its form fields again: since urllib3 2.0 it sent the dict as a chunked body, which the local httpbin server rejects, so the test failed now and then with BrokenPipeError - thanks @pylaterreur

Fix httpx and httpx2 replay crashing on cassettes that store a null reason phrase, as those recorded before 8.2.0 do (#1028) - thanks @dgunning

Fix bare-host URLs such as https://example.com not matching cassettes that recorded them as https://example.com/, a regression in 8.2.0 (#1013, #1031) - thanks @DSeaStar

Forward streaming (file-like or iterator) request bodies with Content-Length instead of chunked encoding, which some servers reject (#1002)

Fix the all record mode: a re-recorded interaction now replaces the one it matches instead of being saved next to it, and with drop_unused_requests the cassette keeps what was just recorded instead of being saved empty (#578, #208). Behavior change: re-recording in all mode now removes every previously recorded interaction that matches a new one under your match_on setting, so with loose matchers (e.g. match_on=["method"]) one new request can replace many old ones. Cassettes re-recorded with all also no longer accumulate responses across runs.

... (truncated)

Commits

9daef64 Release v8.4.0
8df3f6e Merge pull request #1071 from kevin1024/fix-all-record-mode
79b3214 Remove uv.lock that was committed by accident
1ac8b98 Merge remote-tracking branch 'origin/master' into fix-all-record-mode
0c404ee Merge pull request #1031 from DSeaStar/fix-empty-path-match
1928f5d Merge pull request #1029 from dgunning/fix-httpx-null-reason-phrase
6b2dc30 Note the all record mode behavior change in the changelog
9efc158 Merge remote-tracking branch 'origin/master' into pr-1029-update
2aceeea Fix re-recording in the all record mode
c6dd3e0 Merge remote-tracking branch 'origin/master' into pr-1031
Additional commits viewable in compare view

Updates pytest-recording from 0.13.4 to 0.14.0

Release notes

Sourced from pytest-recording's releases.

Release 0.14.0

Add support for Python 3.15.

Add support for Python 3.14 and drop EOL 3.9. #185

Document ignore_hosts in the vcr_config fixture example. #170

Fix ValueError: 'rewrite' is not a valid record_mode raised by VCR.py 8.2.1+ when the rewrite mode is set via the vcr_config fixture or the vcr mark. #205

Changelog

Sourced from pytest-recording's changelog.

0.14.0_ - 2026-10-02

Add support for Python 3.15.

Add support for Python 3.14 and drop EOL 3.9. [#185](https://github.com/kiwicom/pytest-recording/issues/185)_

Document ignore_hosts in the vcr_config fixture example. [#170](https://github.com/kiwicom/pytest-recording/issues/170)_

Fix ValueError: 'rewrite' is not a valid record_mode raised by VCR.py 8.2.1+ when the rewrite mode is set via the vcr_config fixture or the vcr mark. [#205](https://github.com/kiwicom/pytest-recording/issues/205)_

Commits

243e582 chore: Release 0.14.0
a2891d4 chore: Add support for Python 3.15
fd43488 fix: stop passing the rewrite record mode to VCR.py (#205)
1b54902 chore(deps): update codecov/codecov-action action to v7
daae47e docs: show ignore_hosts in the vcr_config example (refs #170)
f59af68 chore(deps): update codecov/codecov-action action to v6.0.1
0fc60bc chore(deps): update codecov/codecov-action action to v6
22f03db fix(deps): update dependency werkzeug to v3.1.8
07451ce fix(deps): update dependency werkzeug to v3.1.6
3313326 chore: Add support for Python 3.14 and drop EOL 3.9 (#185)
Additional commits viewable in compare view

Updates coverage from 7.16.0 to 7.17.0

Release notes

Sourced from coverage's releases.

7.17.0

Version 7.17.0 — 2026-10-22

Dropped support for Python 3.10.

Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.

Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.

Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.

Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.

Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.

Fix: The “Can’t combine statement coverage data with branch data” error now names the two data files it couldn’t combine. The error description in the docs now lists common causes and how to find the process that wrote the file.

Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293 and issue 2294.

Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338.

Fixes for obscure but legal file names:

File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and coverage debug data replace non-printable characters in names. Printable names are unchanged.

A file pattern (from include, omit, or a [paths] alias) containing a newline sent the glob-to-regex translation into an infinite loop, hanging the process. Newlines in patterns are now handled like any other character.

Fixes in the implementation of the C tracer:

If a plugin’s dynamic_source_filename method raised an exception, lines in that function could be recorded as belonging to a different file. Also fixed some minor memory leaks in the C tracer.

The refcount of None was mismanaged during function calls, including comprehensions. This was unlikely to cause an actual problem, but is now fixed. Thanks, Andrew Dalke.

The C tracer held borrowed references to dictionary values, which was unsafe on free-threaded Python. Now it takes its own references.

An internal error while recording a new file could be reported as a confusing SystemError instead of the actual exception.

Performance: the text summary report (coverage report) held on to every file’s parsed source until it finished, so its memory use grew with the size of the project: ten times or more what 7.14 used on large projects. Now it keeps only what it needs to print. Fixes issue 2277.

Performance: HTML reports should be about 5% faster to produce.

Kept the political banner in the README. Closes issue 2344.

➡️ PyPI page: coverage 7.17.0. :arrow_right: To install: python3 -m pip install coverage==7.17.0

7.16.2

Version 7.16.2 — 2026-09-27

Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.

Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.

Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️ PyPI page: coverage 7.16.2. :arrow_right: To install: python3 -m pip install coverage==7.16.2

7.16.1

Version 7.16.1 — 2026-09-13

Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.

Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.

Fix: the Total row in the footer of the HTML report’s index page was recomputed in JavaScript with rounding that could disagree with the total the server rendered in the heading, including showing 100% when coverage was not complete. The footer now clamps values the way the rest of the report does, and when nothing is filtered out it is shown exactly as the server rendered it, so the two can’t disagree. That also keeps rows the report omits (--skip-covered drops fully covered files) in the total. Fixes issue 2256.

➡️ PyPI page: coverage 7.16.1. :arrow_right: To install: python3 -m pip install coverage==7.16.1

Changelog

Sourced from coverage's changelog.

Version 7.17.0 — 2026-10-22

Dropped support for Python 3.10.

Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.

Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987_.

Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314_.

Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.

Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.

Fix: The "Can't combine statement coverage data with branch data" error now names the two data files it couldn't combine. The :ref:error description <error_cant_combine> in the docs now lists common causes and how to find the process that wrote the file.

Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293_ and issue 2294_.

Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338_.

Fixes for obscure but legal file names:

File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and ``coverage debug

... (truncated)

Commits

393ac71 docs: prep for 7.17.0
14257d3 test: check that 100% files haven't lost coverage
db056ac docs: keep the ukraine banner #2344
6033660 fix: update the data file hash when a parallel data file is saved again (#2339)
99024b5 fix: clamp rate in XML report to prevent false 1.0/0.0 rounding and scientifi...
ff62a02 refactor: remove unused caching branches
24d0b67 fix: KeyError for a with statement at the end of a finally clause (#2336)
934f5b8 chore: upgrade pip==26.2.2 certifi==2026.10.19
f95c980 fix: triply nested with statements don't cause false branch misses #1987
6aaa858 docs: more changelog gardening
Additional commits viewable in compare view

Updates ty from 0.0.75 to 0.0.91

Release notes

Sourced from ty's releases.

0.0.91

Release Notes

Released on 2026-10-22.

Bug fixes

Improve generics solving when an intersection is passed into a generic call to prefer solving the call to a more precise type when it is safe to do so (#29578)

Fix recursive type materialization (#29532)

Infer return intersections from correlated call specializations (#28303)

Preserve Self when checking universal protocols (#29207)

Fix stack overflows involving recursive descriptor setter types (#29148)

Preserve the namespace-package fallback in module discovery when the namespace-package fallback is obscured by a partial stub package (#29559)

Report all missing @override decorators together (#29557)

Fix false-positive invalid-argument-type diagnostics when inferring constrained type variables from callbacks that return an invariant generic with a gradual type argument (#29577)

Performance improvements

Compare protocol receiver restrictions before binding (#29443)

LSP server

Avoid cancelling requests for unrelated file changes (#29604)

Core type checking

Generics solving: check for unsatisfiable bodies before existentially quantifying (#29504)

Liskov diagnostics: Check inherited attribute conflicts (#28559)

Return type inference: eneralize nested types in inferred return types (#29488)

Contributors

@charliermarsh

@sharkdp

@dhruvmanila

@carljm

@MichaReiser

@dcreager

Install ty 0.0.91

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.91/ty-installer.sh | sh
Install prebuilt binaries via powershell script
</tr></table> 

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.91

Released on 2026-10-22.

Bug fixes

Improve generics solving when an intersection is passed into a generic call to prefer solving the call to a more precise type when it is safe to do so (#29578)

Fix recursive type materialization (#29532)

Infer return intersections from correlated call specializations (#28303)

Preserve Self when checking universal protocols (#29207)

Fix stack overflows involving recursive descriptor setter types (#29148)

Preserve the namespace-package fallback in module discovery when the namespace-package fallback is obscured by a partial stub package (#29559)

Report all missing @override decorators together (#29557)

Fix false-positive invalid-argument-type diagnostics when inferring constrained type variables from callbacks that return an invariant generic with a gradual type argument (#29577)

Performance improvements

Compare protocol receiver restrictions before binding (#29443)

LSP server

Avoid cancelling requests for unrelated file changes (#29604)

Core type checking

Generics solving: check for unsatisfiable bodies before existentially quantifying (#29504)

Liskov diagnostics: Check inherited attribute conflicts (#28559)

Return type inference: eneralize nested types in inferred return types (#29488)

Contributors

@charliermarsh

@sharkdp

@dhruvmanila

@carljm

@MichaReiser

@dcreager

0.0.90

Released on 2026-10-20.

Bug fixes

Allow subclasses to restore hashability (#29471)

Avoid crashes when negating recursive aliases (#29429)

Avoid stack overflow for recursive descriptor setter checks (#29467)

Defer constructor type variable defaults (#29469)

Preserve bound receivers for strict signature checks (#29396)

Preserve read types for dynamic attributes (#29461)

... (truncated)

Commits

67fbd28 Bump version to 0.0.91 (#4795)
0c569fd Use the Astral simple token service action (#4794)
805d35b Update docker/build-push-action action to v7.4.0 (#4779)
9b9029f Update docker/setup-buildx-action action to v4.4.1 (#4780)
339e923 Clarify daily fuzz issue reports (#4790)
f30e8fb [ty] Update anyio to 4.14.2 (#4784)
8b1e773 [ty] Update urllib3 to 2.8.0 (#4783)
c612ab8 [ty] Update GitPython to 3.2.1 (#4782)
5c51718 Update uv Docker image after eMudhra incident (#4781)
d24aa0d Update prek dependencies (#4778)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-minor-and-patch group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.3` | `1.2.4` | | [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.2` | `4.7.0` | | [vcrpy](https://github.com/kevin1024/vcrpy) | `8.3.0` | `8.4.0` | | [pytest-recording](https://github.com/kiwicom/pytest-recording) | `0.13.4` | `0.14.0` | | [coverage](https://github.com/coveragepy/coveragepy) | `7.16.0` | `7.17.0` | | [ty](https://github.com/astral-sh/ty) | `0.0.75` | `0.0.91` | Updates `python-dotenv` from 1.2.3 to 1.2.4 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.2.3...v1.2.4) Updates `pre-commit` from 4.6.2 to 4.7.0 - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md) - [Commits](pre-commit/pre-commit@v4.6.2...v4.7.0) Updates `vcrpy` from 8.3.0 to 8.4.0 - [Release notes](https://github.com/kevin1024/vcrpy/releases) - [Changelog](https://github.com/kevin1024/vcrpy/blob/master/docs/changelog.rst) - [Commits](kevin1024/vcrpy@v8.3.0...v8.4.0) Updates `pytest-recording` from 0.13.4 to 0.14.0 - [Release notes](https://github.com/kiwicom/pytest-recording/releases) - [Changelog](https://github.com/kiwicom/pytest-recording/blob/master/docs/changelog.rst) - [Commits](kiwicom/pytest-recording@v0.13.4...v0.14.0) Updates `coverage` from 7.16.0 to 7.17.0 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.16.0...7.17.0) Updates `ty` from 0.0.75 to 0.0.91 - [Release notes](https://github.com/astral-sh/ty/releases) - [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md) - [Commits](astral-sh/ty@0.0.75...0.0.91) --- updated-dependencies: - dependency-name: python-dotenv dependency-version: 1.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: pre-commit dependency-version: 4.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: vcrpy dependency-version: 8.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: pytest-recording dependency-version: 0.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: coverage dependency-version: 7.17.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: ty dependency-version: 0.0.91 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 28, 2026

Navigation Menu

Repository navigation

Bump the python-minor-and-patch group across 1 directory with 6 updates - #50

Bump the python-minor-and-patch group across 1 directory with 6 updates#50
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-151f94c332

dependabot Bot commented on behalf of github Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 28, 2026

v1.2.4

Fixed

[1.2.4] - 2026-10-01

Fixed

pre-commit v4.7.0

Fixes

4.7.0 - 2026-10-12

Fixes

v8.4.0

What's Changed

Behavior change: the all record mode

Fixes

Maintenance

Changelog

Release 0.14.0

0.14.0_ - 2026-10-02

7.17.0

Version 7.17.0 — 2026-10-22

7.16.2

Version 7.16.2 — 2026-09-27

7.16.1

Version 7.16.1 — 2026-09-13

Version 7.17.0 — 2026-10-22

0.0.91

Release Notes

Bug fixes

Performance improvements

LSP server

Core type checking

Contributors

Install ty 0.0.91

Install prebuilt binaries via shell script

Install prebuilt binaries via powershell script

0.0.91

Bug fixes

Performance improvements

LSP server

Core type checking

Contributors

0.0.90

Bug fixes

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Behavior change: the `all` record mode

`0.14.0`_ - 2026-10-02