Update Python dependencies

robbertbos commented

2026-08-23 02:04:05 +00:00

Owner

This PR contains the following updates:

Package	Change	Age	Confidence
alembic (changelog)	`>=1.19.1` → `>=1.19.2`
anyio (changelog)	`>=4.14.2` → `>=4.15.0`
authlib	`>=1.7.2` → `>=1.8.0`
cachetools (changelog)	`>=7.1.7,<7.2` → `>=7.1.8,<7.2`
cryptography (changelog)	`>=50.0.0` → `>=50.0.1`
pydantic (changelog)	`>=2.13.4` → `>=2.13.5`
ruff (source, changelog)	`>=0.16.3` → `>=0.16.6`
ty (changelog)	`>=0.0.72` → `>=0.0.78`
uvicorn (changelog)	`>=0.52.3` → `>=0.52.4`

Release Notes

agronholm/anyio (anyio)

`v4.15.0`

Compare Source

Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:
- follow_symlinks on exists() (Python 3.12+)
- follow_symlinks on is_dir() (Python 3.13+)
- follow_symlinks on is_file() (Python 3.13+)
- follow_symlinks on owner() (Python 3.13+)
- follow_symlinks on group() (Python 3.13+)
- newline on read_text() (Python 3.13+)
(#1286, #1293; PR by @jaideeppyne)
Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @Graeme22)
Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @EmmanuelNiyonshuti)
Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @Vizonex)
Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @nightcityblade)
Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @davidbrochart)
Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()
Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @gschaffner)
Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)
Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @EmmanuelNiyonshuti)
Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @c-tonneslan)
Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @Graeme22)
Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @gschaffner)
Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @tapetersen)
Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @Sanjays2402)
Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @alloutflo)
Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @matthewfeickert)
Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @hansu650)
Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @zelinewang)
Fixed asyncio task groups leaking unawaited coroutines when a custom task constructor fails; default task creation is unaffected (#1274; PR by @dsfaccini)
Fixed inconsistencies between Trio and asyncio when target TaskGroup is cancelled before a task created with .start() calls TaskStatus.started()
- The started task shouldn't get a CancelledError until the first checkpoint after the started() call.
- A value passed to started() should be available on the TaskHandle and correctly passed back to the caller of start even if cancelled.
- The CancelledError shouldn't leak out of the TaskGroup.start() call to the calling task.
(#1197; PR by @tapetersen)
Fixed TemporaryDirectory not cleaning up when the host task was cancelled while exiting the context manager, as the cleanup now runs in a shielded cancel scope (#1304; PR by @smurfix)

authlib/authlib (authlib)

`v1.8.0`

Compare Source

What's Changed

Prefer id_token_signed_response_alg client metadata to guess algs by @azmeuk in #888
fix: Catch InvalidKeyIdError in RFC 9068 JWTBearerTokenValidator by @liudonggalaxy in #891
fix: make leeway configurable in JWTBearerTokenValidator by @mondi04 in #903
feat: add default jti claim to sign_jwt_bearer_assertion by @liudonggalaxy in #897
fix(oauth): cast sub claim to string in JWTBearerTokenGenerator by @levinKaus in #911
Declare lower bounds for dependencies by @azmeuk in #912
feat(client): use httpx2 instead of httpx by @levinKaus in #909
Fix RFC7523 malformed claims handling by @azmeuk in #916
Fix httpx oauth1 binary form data by @shc261392 in #779
fix(starlette_client): remove default= keyword from config.get calls by @aliaksei-protchanka in #770
Added client_id parameter to AssertionClient by @vilmar-hillow in #476
fix(oauth): save device credential with authenticated client id by @arpitjain099 in #908
fix(oauth1): correct protocol name in InsecureTransportError description by @RavSinghChandan in #919
fix(client): client can be flexible with jwt's header by @lepture in #922
fix(oidc): omit claims when the value is None by @lepture in #923

New Contributors

@mondi04 made their first contribution in #903
@levinKaus made their first contribution in #911
@aliaksei-protchanka made their first contribution in #770
@vilmar-hillow made their first contribution in #476
@arpitjain099 made their first contribution in #908
@RavSinghChandan made their first contribution in #919

Full Changelog: https://github.com/authlib/authlib/compare/v1.7.2...v1.8.0

tkem/cachetools (cachetools)

`v7.1.8`

Compare Source

===================

Reject negative maxsize in Cache.__init__.

pyca/cryptography (cryptography)

`v50.0.1`

Compare Source

pydantic/pydantic (pydantic)

`v2.13.5`

Compare Source

v2.13.5 (2026-08-28)

What's Changed

Fixes

Allow reuse of validators when plugins are set by @Viicos in #13535
Fix missing GC traversal on some pydantic-core struct fields by @Viicos in #13624
Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @Viicos in #13629
Count validated model fields once in smart unions by @tamird in #13731

astral-sh/ruff (ruff)

`v0.16.6`

Compare Source

Released on 2026-09-03.

Preview features

Move pytest-fixture-autouse to the restriction category (#28219)
[flake8-pytest-style] Add an autofix for PT020 (#27993)
[flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
[isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

Validate unary expressions when parsing (#28233)
[flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
[flake8-bugbear] Fix panic on match subjects (B031) (#27781)
[flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
[flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
[ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

[flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

Add another example and glob reference for lint.per-file-ignores (#28106)
Add duplicate work guidance (#28229)
[flake8-async] Document thread offloading (ASYNC240) (#28008)
[pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

`v0.16.5`

Compare Source

Released on 2026-08-27.

Preview features

Allow rules without codes (#28049)
Introduce category selectors (#27666)
Update preview default rules and categories (#27877)

Bug fixes

[flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
[flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
[flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

Document rule acceptance guidelines (#27910)
Document the new category selectors (#27906)

Contributors

`v0.16.4`

Compare Source

Released on 2026-08-20.

Preview features

[flake8-use-pathlib] Add autofix for PTH116 (#26460)
[refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
[refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
[pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
[pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

[syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
[ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
[syntax-errors] Detect duplicate keyword arguments (#17804)
[syntax-errors] Detect parameters declared nonlocal (#27628)

Server

Offer display-only fixes and mark safe fixes preferred (#27807)
Support pull diagnostics for notebook cells (#27779)

Documentation

Add default indicator to rules table (#27724)
Fix broken link to Python docs (#27757)

Other changes

Fix s390x stacker assembly in release builds (#27776)
Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
Reduce configuration deserialization code size (#27924)
Check packed AST index bounds (#27849)

Contributors

astral-sh/ty (ty)

`v0.0.78`

Compare Source

Released on 2026-09-02.

Bug fixes

Defer decorator-call diagnostics to avoid recursive-default cycles (#28226)
Make cyclic intersection simplification deterministic (#28156)
Stabilize cyclic terminal-call reachability (#28216)

Preview features

Refresh uv workspace metadata when dependencies change (#28224)

Diagnostics

Add a new disjoint-cast rule (#28129)
Report deprecated property accessors on intersections (#28250)
Report deprecations for implicit constructor calls (#28251)
Report deprecations for overloads, operators, and properties (#28134)
Respect overload selection in deprecation diagnostics (#28148)

Core type checking

Fix negative narrowing for protocols with gradual members (#28198)
Preserve ParamSpec bindings inferred against type context (#28084)
Preserve generic protocol materialization relations (#28246)
Preserve uncertain branches during quantification (#28211)
Respect type variables in top/bottom materializations of invariant generics (#28072)
Sync vendored typeshed stubs (#28217). Typeshed diff
Treat captured bound-method receivers covariantly (#28180)
Unsound intersection simplification for generic iterables (#28068)
Validate type variable scopes in constructors and aliases (#28130)
lambda functions are always truthy (#28254)

Performance

Optimize materialized recursive protocol comparisons (#28079)
Optimize recursive protocol checks for nested type variables (#28257)

Contributors

`v0.0.77`

Compare Source

Released on 2026-08-31.

Bug fixes

Bound recursive protocol traversal in generic intersections (#28215)
Preserve recursion guards across nested type operations (#28150)
Preserve syntax and comments when removing redundant casts (#28145)
Stabilize recursive receiver inference (#28042)
Stabilize condition truthiness during cyclic inference (#28212)

Core type checking

Preserve generic receivers in implicit __init_subclass__ calls (#28138)
Preserve specialization for inherited TypedDict methods (#28111)
Propagate deletions through nested loop headers (#28044)

Performance

Avoid repeated inference for literal union call results (#28196)

Contributors

`v0.0.76`

Compare Source

Released on 2026-08-31.

Preview features

Add a missing-direct-dependency rule (#28001)
Cancel superseded queued uv requests (#28108)
Check direct dependencies in PEP 723 scripts (#28136)
Fix Goto definition in script dependencies (#27747)
Move script environment initialization to the CLI and LSP (#28038)
Refresh uv project metadata in the background (#27933)
Synchronize PEP 723 script environments in the language server (#27619)
Warn when uv metadata cannot support dependency checks (#28133)

Bug fixes

Avoid panics on incomplete protocol type parameter lists (#28088)
Fix auto-completion panic involving bare declarations (#28191)
Guard recursive meta-type expansion (#28143)
Preserve parentheses when removing redundant casts (#28092)

LSP server

Add "Find references" support for pytest fixtures (#28075)
Highlight PEP 723 script metadata as TOML (#27746)
Synchronize saved script metadata on open (#27873)

Core type checking

Apply mixin specialization when validating enum members (#28101)
Bind Self through generic type aliases (#28117)
Infer lambda parameters through callable type aliases (#28109)
Intersection simplifications with subtype-related generic specializations (#26880)
Invalidate member narrowing across loop iterations (#28009)
Narrow functional enum members in == and match (#28103)
Only treat recursive types with unbounded specializations as fallback cycles (#27538)
Preserve Final variance in stubs (#28119)
Preserve inferred types for unknown class-decorator results (#28067)
Preserve list literal positions in starred unpacking (#28061)
Preserve short-circuit reachability for direct conditions (#28082)
Preserve type variables in bounded generic defaults (#28122)
Reject circular type alias definitions (#28140)
Reject class access to generic instance attributes (#28123)
Use the subclass receiver when checking method overrides (#28124)
Validate declared variance in method signatures (#28116)

Performance

Avoid cubic narrowing with repeated assignments and context managers (#27787)
Avoid repeated traversal of shared alias arguments (#28147)
Reject impossible eager protocol comparisons early (#28081)

Contributors

`v0.0.75`

Compare Source

Released on 2026-08-26.

Preview features

Initialize PEP 723 script environments in the CLI (#27544)
Refresh PEP 723 script environments in watch mode (#27617)
Run PEP 723 script synchronization on bounded workers (#27615)

Bug fixes

Specialize Self bounds of inherited methods (#27990)

LSP server

Add "Go to Definition" support for pytest fixtures (#27444)

Documentation

Fix documented Python package build command (#4384)
Link untyped-call tracking issue in migration guide (#4382)

Library support

Resolve imported pytest fixture exposures (#27539)
Resolve installed core pytest fixture providers (#27770)
Resolve pytest fixtures through conftest (#27540)

Diagnostics

Add more autofixes (#28029)
Add a dedicated missing-slot diagnostic (#28039)
Explain missing storage for declared slotted attributes (#27969)
Improve diagnostic spans for unpacked variable assignments (#28041)

Core type checking

Account for known subclasses in equality inference (#28005)
Expand ParamSpec signatures inferred from bound receivers (#28020)
Fix Self binding in ParamSpec protocols (#28016)
Fix TypedDict variance inference (#28052)
Fix unsound narrowing through branch-assigned conditions (#28006)
Ignore inconsistent binding decorators on overloads (#28036)
Infer yield from send/return types from the iterator returned by __iter__ (#27987)
Infer tuple type parameters from union arguments (#28062)
Infer variance through nonrecursive protocol references (#28065)
Preserve bounds of non-literal metaclasses (#28046)
Preserve correlated generic-call inference (#28043)
Preserve invariant materialization constraints (#28047)
Recover bare TypeVarTuples in tuple annotations (#27950)
Reject fixed tuples for non-inferable TypeVarTuples (#27943)
Reject incompatible constructor context for variadic packs (#27966)
Support mixed gradual tuple assignability with TypeVarTuple (#27957)
Support tagged union with multiple tags per type (#27984)
Sync vendored typeshed stubs (#28035). Typeshed diff
Treat typing.Union as a class on Python 3.14+ (#28003)
Validate generic protocol variance (#27531)
collections.abc.Callable is an instance of type (#27991)

Contributors

`v0.0.74`

Compare Source

Released on 2026-08-22.

Bug fixes

Avoid duplicate bindings in multi-target assignments (#27938)
Avoid panic on unpacked kwargs in string annotations (#27963)
Fix stack overflow in recursive TypedDict dictionary compatibility (#27951)
Handle assignment expressions in string annotations (#27921)
Handle dynamic classes in string annotations (#27883)
Preserve string annotation context in lambda defaults and TypedDict types (#27914)
Skip invalid subscript arguments in string annotations (#27917)
Skip invalid subscript operands in string annotations (#27882)

LSP server

Add untrustedWorkspace option to the LSP (#27828)
Add executable discovery to the server command (#27806)
Handle file-valued workspace folders from Zed (#27836)
Skip scripts with an invalid PEP 723 configuration (#27505)
Support pull diagnostics for notebook cells (#27778)

Documentation

Update mypy/pyright comparison table (#4165)

Diagnostics

Add an opt-in unsound-assignment rule for variables (#27874)
Fix variadic signature display (#27869)
Highlight declarations in invalid-assignment diagnostics (#27872)
Improve LiteralString suggestions in string annotations (#27931)
Use invalid-type-form for non-generic class annotations (#27889)

Core type checking

Add bounded constraint solution projections (#27949)
Fix invariant gradual tuple materialization ranges (#27946)
Guard recursive constructor bindings by receiver (#27958)
Preserve all alternatives in bounded intersections (#27898)
Preserve keyword safety for unpacked callables (#27517)
Preserve source protocol members and classify finite aliases (#27772)
Preserve type-variable order when reloading constraints (#27904)
Propagate narrowing through statically known branches (#27752)
Recognize ABC metaclass methods on protocols (#27897)
Support __slots__ (#27730)

Performance

Lazily infer function parameter default types (#27857)
Optimize inherited recursive protocol comparisons (#27922)
Traverse shared constraint source-order nodes once (#27947)

Contributors

`v0.0.73`

Compare Source

Released on 2026-08-18.

LSP server

Do not prefer unsafe fixes in the language server (#27822)
Fix signature help in trailing whitespace (#27784)

Library support

Preserve variadic generics in functools.partial (#27774)

Diagnostics

Add an opt-in rule flagging function decorators that transform a non-dynamic type into a dynamic type (#27829)
Disambiguate same-named types in several diagnostics (#27814)
Show error spans for errors originating in script metadata (#26693)

Core type checking

Avoid bypassing solver during literal promotion (#27763)
Expand nested union aliases when finding a TypedDict or callable (#27740)
Implement intersection meta-type projection (#27660)
Infer generic protocols from class objects (#27812)
Model exception-suppressing context managers (#27219)
Preserve TypeAliasType runtime origin (#27813)
Preserve class objects in lazy protocol checks (#27815)
Preserve declared types in exception handlers (#27817)
Preserve explicit globals after conditional rebinding (#27786)
Preserve property subclass types and accessors (#27833)
Preserve required stub fields in generated constructors (#27765)
Preserve static upper bounds of gradual solutions (#27664)
Prevent unrelated quantified constraints from destabilizing recursive queries (#27737)
Separate generic constraint accumulation from legacy projection (#27743)
Simplify generic protocol inference (#27819)
Specialize inherited members of unspecialized generic classes (#27658)
Specialize type variables determined by bound receivers (#27732)
Support unpacking tuple type aliases (#27825)
Sync vendored typeshed stubs (#27771). Typeshed diff

Performance

Cache py.typed contents (#27805)
Deduplicate exception checkpoints across equivalent branches (#27703)

Contributors

Kludex/uvicorn (uvicorn)

`v0.52.4`: Version 0.52.4

Compare Source

Fixed

Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: https://github.com/Kludex/uvicorn/compare/0.52.3...0.52.4

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

Branch creation
- "before 6am on sunday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [alembic](https://github.com/sqlalchemy/alembic) ([changelog](https://alembic.sqlalchemy.org/en/latest/changelog.html)) | `>=1.19.1` → `>=1.19.2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/alembic/1.19.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/alembic/1.19.1/1.19.2?slim=true) | | [anyio](https://github.com/agronholm/anyio) ([changelog](https://anyio.readthedocs.io/en/stable/versionhistory.html)) | `>=4.14.2` → `>=4.15.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/anyio/4.15.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/anyio/4.14.2/4.15.0?slim=true) | | [authlib](https://github.com/authlib/authlib) | `>=1.7.2` → `>=1.8.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/authlib/1.8.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/authlib/1.7.2/1.8.0?slim=true) | | [cachetools](https://github.com/tkem/cachetools) ([changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)) | `>=7.1.7,<7.2` → `>=7.1.8,<7.2` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/cachetools/7.1.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/cachetools/7.1.7/7.1.8?slim=true) | | [cryptography](https://github.com/pyca/cryptography) ([changelog](https://cryptography.io/en/latest/changelog/)) | `>=50.0.0` → `>=50.0.1` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/cryptography/50.0.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/cryptography/50.0.0/50.0.1?slim=true) | | [pydantic](https://github.com/pydantic/pydantic) ([changelog](https://docs.pydantic.dev/latest/changelog/)) | `>=2.13.4` → `>=2.13.5` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pydantic/2.13.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pydantic/2.13.4/2.13.5?slim=true) | | [ruff](https://docs.astral.sh/ruff) ([source](https://github.com/astral-sh/ruff), [changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)) | `>=0.16.3` → `>=0.16.6` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/ruff/0.16.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/ruff/0.16.3/0.16.6?slim=true) | | [ty](https://github.com/astral-sh/ty) ([changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)) | `>=0.0.72` → `>=0.0.78` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/ty/0.0.78?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/ty/0.0.72/0.0.78?slim=true) | | [uvicorn](https://github.com/Kludex/uvicorn) ([changelog](https://uvicorn.dev/release-notes)) | `>=0.52.3` → `>=0.52.4` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/uvicorn/0.52.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/uvicorn/0.52.3/0.52.4?slim=true) | --- ### Release Notes <details> <summary>agronholm/anyio (anyio)</summary> ### [`v4.15.0`](https://github.com/agronholm/anyio/releases/tag/4.15.0) [Compare Source](https://github.com/agronholm/anyio/compare/4.14.2...4.15.0) - Added support for the newer keyword-only arguments on `anyio.Path` methods to match the standard library `pathlib.Path`: - `follow_symlinks` on `exists()` (Python 3.12+) - `follow_symlinks` on `is_dir()` (Python 3.13+) - `follow_symlinks` on `is_file()` (Python 3.13+) - `follow_symlinks` on `owner()` (Python 3.13+) - `follow_symlinks` on `group()` (Python 3.13+) - `newline` on `read_text()` (Python 3.13+) ([#1286](https://github.com/agronholm/anyio/pull/1286), [#1293](https://github.com/agronholm/anyio/pull/1293); PR by [@jaideeppyne](https://github.com/jaideeppyne)) - Added `amap`, `gather`, and `as_completed` utility functions to simplify common patterns ([#1173](https://github.com/agronholm/anyio/pull/1173); PR by [@Graeme22](https://github.com/Graeme22)) - Added `--anyio-mode` command-line option as an alternative to the `anyio_mode` ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: `pytest_asyncio`). ([#1242](https://github.com/agronholm/anyio/pull/1242); PR by [@EmmanuelNiyonshuti](https://github.com/EmmanuelNiyonshuti)) - Added the `anyio.Future` synchronization primitive which behaves similar to `asyncio.Future`, allowing tasks to wait for a value (or exception) from another task ([#1146](https://github.com/agronholm/anyio/pull/1146); PR by [@Vizonex](https://github.com/Vizonex)) - Added guidance for managing multiple memory object stream producers and consumers with cloned streams ([#330](https://github.com/agronholm/anyio/issues/330); PR by [@nightcityblade](https://github.com/nightcityblade)) - Added `StapledObjectStream.send_nowait()` that delegates to the underlying `ObjectSendStream`, if it implements it ([#1241](https://github.com/agronholm/anyio/pull/1241); PR by [@davidbrochart](https://github.com/davidbrochart)) - Added the `move_on_at()` and `fail_at()` functions to complement `move_on_after()` and `fail_after()` - Changed the default name for a task spawned with `TaskGroup.create_task(func())` to match the default task name for the analogous task spawned with `TaskGroup.start_soon(func)` or `TaskGroup.start(func)` in more situations. Previously, the default name of a `TaskGroup.create_task` task never included the module name. (The default name for a task spawned with `TaskGroup.start_soon` or `TaskGroup.start` typically includes the module name.) ([#1234](https://github.com/agronholm/anyio/pull/1234); PR by [@gschaffner](https://github.com/gschaffner)) - Changed the `anyio` and `anyio.abc` modules to lazily (much like `810`) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the `if TYPE_CHECKING:` block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). ([#1169](https://github.com/agronholm/anyio/pull/1169)) - Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to `start_blocking_portal()` and `anyio.to_thread.run_sync()` ([#1224](https://github.com/agronholm/anyio/pull/1224); PR by [@EmmanuelNiyonshuti](https://github.com/EmmanuelNiyonshuti)) - Fixed `SpooledTemporaryFile.readinto()` and `readinto1()` reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data ([#1215](https://github.com/agronholm/anyio/pull/1215); PR by [@c-tonneslan](https://github.com/c-tonneslan)) - Added a `reason` parameter to `fail_after` (and the new `fail_at`) allowing for added exception context when raising `TimeoutError` ([#1227](https://github.com/agronholm/anyio/pull/1227); PR by [@Graeme22](https://github.com/Graeme22)) - Fixed the default `TaskHandle.name` missing part of the task name for tasks started with `TaskGroup.start` on Trio ([#1231](https://github.com/agronholm/anyio/issues/1231); PR by [@gschaffner](https://github.com/gschaffner)) - Fixed `anyio.run` leaking, or at least, delaying collection of loop and root\_task due to the root task being cached in a `RunVar`. ([#1203](https://github.com/agronholm/anyio/issues/1203); PR by [@tapetersen](https://github.com/tapetersen)) - Fixed `anyio.Path.with_stem()` silently producing a wrong path (e.g. `Path(".txt")`) instead of raising `ValueError` when given an empty stem on a path with a non-empty suffix, unlike `pathlib.PurePath.with_stem` ([#1200](https://github.com/agronholm/anyio/pull/1200); PR by [@Sanjays2402](https://github.com/Sanjays2402)) - Fixed `UNIXSocketStream.aclose()` raising `asyncio.InvalidStateError` when a concurrent receive or send operation had just been cancelled on the asyncio backend ([#1267](https://github.com/agronholm/anyio/issues/1267); PR by [@alloutflo](https://github.com/alloutflo)) - Fixed the pytest plugin importing the deprecated `_pytest.python.CallSpec2` alias, which triggers `PytestRemovedIn10Warning` on `pytest>=9.2` and crashes pytest at startup when `filterwarnings = error` is configured ([#1271](https://github.com/agronholm/anyio/issues/1271); PR by [@matthewfeickert](https://github.com/matthewfeickert)) - Fixed an asyncio worker thread race that could raise `RuntimeError` when the event loop closed between checking its state and scheduling the worker result ([#1265](https://github.com/agronholm/anyio/issues/1265); PR by [@hansu650](https://github.com/hansu650)) - Fixed `CapacityLimiter` on the asyncio backend over-granting tokens when `total_tokens` was raised while the limiter was over-subscribed ([#1223](https://github.com/agronholm/anyio/pull/1223); PR by [@zelinewang](https://github.com/zelinewang)) - Fixed asyncio task groups leaking unawaited coroutines when a custom task constructor fails; default task creation is unaffected ([#1274](https://github.com/agronholm/anyio/issues/1274); PR by [@dsfaccini](https://github.com/dsfaccini)) - Fixed inconsistencies between Trio and asyncio when target `TaskGroup` is cancelled before a task created with `.start()` calls `TaskStatus.started()` - The started task shouldn't get a `CancelledError` until the first checkpoint after the `started()` call. - A value passed to `started()` should be available on the `TaskHandle` and correctly passed back to the caller of start even if cancelled. - The CancelledError shouldn't leak out of the `TaskGroup.start()` call to the calling task. ([#1197](https://github.com/agronholm/anyio/issues/1197); PR by [@tapetersen](https://github.com/tapetersen)) - Fixed `TemporaryDirectory` not cleaning up when the host task was cancelled while exiting the context manager, as the cleanup now runs in a shielded cancel scope ([#1304](https://github.com/agronholm/anyio/pull/1304); PR by [@smurfix](https://github.com/smurfix)) </details> <details> <summary>authlib/authlib (authlib)</summary> ### [`v1.8.0`](https://github.com/authlib/authlib/releases/tag/v1.8.0) [Compare Source](https://github.com/authlib/authlib/compare/v1.7.2...v1.8.0) #### What's Changed - Prefer `id_token_signed_response_alg` client metadata to guess algs by [@azmeuk](https://github.com/azmeuk) in [#888](https://github.com/authlib/authlib/pull/888) - fix: Catch InvalidKeyIdError in RFC 9068 JWTBearerTokenValidator by [@liudonggalaxy](https://github.com/liudonggalaxy) in [#891](https://github.com/authlib/authlib/pull/891) - fix: make leeway configurable in JWTBearerTokenValidator by [@mondi04](https://github.com/mondi04) in [#903](https://github.com/authlib/authlib/pull/903) - feat: add default jti claim to sign\_jwt\_bearer\_assertion by [@liudonggalaxy](https://github.com/liudonggalaxy) in [#897](https://github.com/authlib/authlib/pull/897) - fix(oauth): cast sub claim to string in JWTBearerTokenGenerator by [@levinKaus](https://github.com/levinKaus) in [#911](https://github.com/authlib/authlib/pull/911) - Declare lower bounds for dependencies by [@azmeuk](https://github.com/azmeuk) in [#912](https://github.com/authlib/authlib/pull/912) - feat(client): use httpx2 instead of httpx by [@levinKaus](https://github.com/levinKaus) in [#909](https://github.com/authlib/authlib/pull/909) - Fix RFC7523 malformed claims handling by [@azmeuk](https://github.com/azmeuk) in [#916](https://github.com/authlib/authlib/pull/916) - Fix httpx oauth1 binary form data by [@shc261392](https://github.com/shc261392) in [#779](https://github.com/authlib/authlib/pull/779) - fix(starlette\_client): remove default= keyword from config.get calls by [@aliaksei-protchanka](https://github.com/aliaksei-protchanka) in [#770](https://github.com/authlib/authlib/pull/770) - Added client\_id parameter to AssertionClient by [@vilmar-hillow](https://github.com/vilmar-hillow) in [#476](https://github.com/authlib/authlib/pull/476) - fix(oauth): save device credential with authenticated client id by [@arpitjain099](https://github.com/arpitjain099) in [#908](https://github.com/authlib/authlib/pull/908) - fix(oauth1): correct protocol name in InsecureTransportError description by [@RavSinghChandan](https://github.com/RavSinghChandan) in [#919](https://github.com/authlib/authlib/pull/919) - fix(client): client can be flexible with jwt's header by [@lepture](https://github.com/lepture) in [#922](https://github.com/authlib/authlib/pull/922) - fix(oidc): omit claims when the value is None by [@lepture](https://github.com/lepture) in [#923](https://github.com/authlib/authlib/pull/923) #### New Contributors - [@mondi04](https://github.com/mondi04) made their first contribution in [#903](https://github.com/authlib/authlib/pull/903) - [@levinKaus](https://github.com/levinKaus) made their first contribution in [#911](https://github.com/authlib/authlib/pull/911) - [@aliaksei-protchanka](https://github.com/aliaksei-protchanka) made their first contribution in [#770](https://github.com/authlib/authlib/pull/770) - [@vilmar-hillow](https://github.com/vilmar-hillow) made their first contribution in [#476](https://github.com/authlib/authlib/pull/476) - [@arpitjain099](https://github.com/arpitjain099) made their first contribution in [#908](https://github.com/authlib/authlib/pull/908) - [@RavSinghChandan](https://github.com/RavSinghChandan) made their first contribution in [#919](https://github.com/authlib/authlib/pull/919) **Full Changelog**: <https://github.com/authlib/authlib/compare/v1.7.2...v1.8.0> </details> <details> <summary>tkem/cachetools (cachetools)</summary> ### [`v7.1.8`](https://github.com/tkem/cachetools/blob/HEAD/CHANGELOG.rst#v718-2026-08-31) [Compare Source](https://github.com/tkem/cachetools/compare/v7.1.7...v7.1.8) \=================== - Reject negative `maxsize` in `Cache.__init__`. </details> <details> <summary>pyca/cryptography (cryptography)</summary> ### [`v50.0.1`](https://github.com/pyca/cryptography/compare/50.0.0...50.0.1) [Compare Source](https://github.com/pyca/cryptography/compare/50.0.0...50.0.1) </details> <details> <summary>pydantic/pydantic (pydantic)</summary> ### [`v2.13.5`](https://github.com/pydantic/pydantic/releases/tag/v2.13.5) [Compare Source](https://github.com/pydantic/pydantic/compare/v2.13.4...v2.13.5) #### v2.13.5 (2026-08-28) ##### What's Changed ##### Fixes - Allow reuse of validators when plugins are set by [@Viicos](https://github.com/Viicos) in [#13535](https://github.com/pydantic/pydantic/pull/13535) - Fix missing GC traversal on some `pydantic-core` struct fields by [@Viicos](https://github.com/Viicos) in [#13624](https://github.com/pydantic/pydantic/pull/13624) - Fix missing GC traversal in `pydantic-core` for `GeneralFieldsSerializer` by [@Viicos](https://github.com/Viicos) in [#13629](https://github.com/pydantic/pydantic/pull/13629) - Count validated model fields once in smart unions by [@tamird](https://github.com/tamird) in [#13731](https://github.com/pydantic/pydantic/pull/13731) </details> <details> <summary>astral-sh/ruff (ruff)</summary> ### [`v0.16.6`](https://github.com/astral-sh/ruff/blob/HEAD/CHANGELOG.md#0166) [Compare Source](https://github.com/astral-sh/ruff/compare/0.16.5...0.16.6) Released on 2026-09-03. ##### Preview features - Move `pytest-fixture-autouse` to the `restriction` category ([#28219](https://github.com/astral-sh/ruff/pull/28219)) - \[`flake8-pytest-style`] Add an autofix for `PT020` ([#27993](https://github.com/astral-sh/ruff/pull/27993)) - \[`flake8-tidy-imports`] Prevent fix loop between `TID254` and `TID255` ([#28262](https://github.com/astral-sh/ruff/pull/28262)) - \[`isort`] Exclude pragma comments from line length calculation (`I001`) ([#27313](https://github.com/astral-sh/ruff/pull/27313)) ##### Bug fixes - Validate unary expressions when parsing ([#28233](https://github.com/astral-sh/ruff/pull/28233)) - \[`flake8-async`, `pylint`] Recognize `builtins.open` (`ASYNC230`, `PLW1514`) ([#28021](https://github.com/astral-sh/ruff/pull/28021)) - \[`flake8-bugbear`] Fix panic on `match` subjects (`B031`) ([#27781](https://github.com/astral-sh/ruff/pull/27781)) - \[`flake8-datetimez`] Reject `tzinfo=None` for `datetime` bounds (`DTZ901`) ([#28022](https://github.com/astral-sh/ruff/pull/28022)) - \[`flake8-pytest-style`] Avoid duplicate `PT017` diagnostics ([#27918](https://github.com/astral-sh/ruff/pull/27918)) - \[`ruff`] Remove `lint.external` hint for Ruff-specific suppressions (`RUF102`) ([#27923](https://github.com/astral-sh/ruff/pull/27923)) ##### Rule changes - \[`flake8-use-pathlib`] Add display-only fix for `os.listdir` (`PTH208`) ([#28027](https://github.com/astral-sh/ruff/pull/28027)) ##### Documentation - Add another example and glob reference for `lint.per-file-ignores` ([#28106](https://github.com/astral-sh/ruff/pull/28106)) - Add duplicate work guidance ([#28229](https://github.com/astral-sh/ruff/pull/28229)) - \[`flake8-async`] Document thread offloading (`ASYNC240`) ([#28008](https://github.com/astral-sh/ruff/pull/28008)) - \[`pyupgrade`] Clarify default `encoding` argument handling (`UP012`) ([#27315](https://github.com/astral-sh/ruff/pull/27315)) ##### Other changes - Allow unary plus in match patterns on Python 3.15 ([#28231](https://github.com/astral-sh/ruff/pull/28231)) ##### Contributors - [@flying-sheep](https://github.com/flying-sheep) - [@pikammmmm](https://github.com/pikammmmm) - [@fly1d](https://github.com/fly1d) - [@waterWang](https://github.com/waterWang) - [@Pierre-Sassoulas](https://github.com/Pierre-Sassoulas) - [@ntBre](https://github.com/ntBre) - [@jelle-openai](https://github.com/jelle-openai) - [@ericbuehl](https://github.com/ericbuehl) - [@tjkuson](https://github.com/tjkuson) - [@AbhinavMir](https://github.com/AbhinavMir) - [@Whning0513](https://github.com/Whning0513) - [@chirizxc](https://github.com/chirizxc) ### [`v0.16.5`](https://github.com/astral-sh/ruff/blob/HEAD/CHANGELOG.md#0165) [Compare Source](https://github.com/astral-sh/ruff/compare/0.16.4...0.16.5) Released on 2026-08-27. ##### Preview features - Allow rules without codes ([#28049](https://github.com/astral-sh/ruff/pull/28049)) - Introduce category selectors ([#27666](https://github.com/astral-sh/ruff/pull/27666)) - Update preview default rules and categories ([#27877](https://github.com/astral-sh/ruff/pull/27877)) ##### Bug fixes - \[`flake8-async`] Detect blocking generic HTTP requests (`ASYNC210`) ([#28024](https://github.com/astral-sh/ruff/pull/28024)) - \[`flake8-datetimez`] Allow timezone-safe `strptime` chains (`DTZ007`) ([#28023](https://github.com/astral-sh/ruff/pull/28023)) - \[`flake8-simplify`] Respect side effects in `lambda` defaults (`SIM401`) ([#28000](https://github.com/astral-sh/ruff/pull/28000)) ##### Server - Fix duplicated "of" in `ClientOptions` doc comment ([#27978](https://github.com/astral-sh/ruff/pull/27978)) ##### Documentation - Document rule acceptance guidelines ([#27910](https://github.com/astral-sh/ruff/pull/27910)) - Document the new category selectors ([#27906](https://github.com/astral-sh/ruff/pull/27906)) ##### Contributors - [@AlexWaygood](https://github.com/AlexWaygood) - [@sharkdp](https://github.com/sharkdp) - [@jelle-openai](https://github.com/jelle-openai) - [@charliermarsh](https://github.com/charliermarsh) - [@ntBre](https://github.com/ntBre) - [@aarushkandukoori](https://github.com/aarushkandukoori) ### [`v0.16.4`](https://github.com/astral-sh/ruff/blob/HEAD/CHANGELOG.md#0164) [Compare Source](https://github.com/astral-sh/ruff/compare/0.16.3...0.16.4) Released on 2026-08-20. ##### Preview features - \[`flake8-use-pathlib`] Add autofix for `PTH116` ([#26460](https://github.com/astral-sh/ruff/pull/26460)) - \[`refurb`] Restrict `delete-full-slice` to lists (`FURB131`) ([#27711](https://github.com/astral-sh/ruff/pull/27711)) - \[`refurb`] Skip `FURB101` and `FURB103` when the `open` argument is a file descriptor ([#27643](https://github.com/astral-sh/ruff/pull/27643)) ##### Bug fixes - Fix `InvalidInstruction` on Windows CPUs that do not support `POPCNT` ([#27803](https://github.com/astral-sh/ruff/pull/27803)) - \[`pyflakes`] Emit semantic syntax errors in string type definitions as `F722` ([#27835](https://github.com/astral-sh/ruff/pull/27835)) - \[`pylint`] Allow `os._exit` imports in `import-private-name` (`PLC2701`) ([#27738](https://github.com/astral-sh/ruff/pull/27738)) ##### Rule changes - \[syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 ([#27766](https://github.com/astral-sh/ruff/pull/27766)) - \[`ruff`] Add `ctypes.LittleEndianStructure` and related types to existing exception (`RUF012`) ([#27753](https://github.com/astral-sh/ruff/pull/27753)) - \[syntax-errors] Detect duplicate keyword arguments ([#17804](https://github.com/astral-sh/ruff/pull/17804)) - \[syntax-errors] Detect parameters declared `nonlocal` ([#27628](https://github.com/astral-sh/ruff/pull/27628)) ##### Server - Offer display-only fixes and mark safe fixes preferred ([#27807](https://github.com/astral-sh/ruff/pull/27807)) - Support pull diagnostics for notebook cells ([#27779](https://github.com/astral-sh/ruff/pull/27779)) ##### Documentation - Add default indicator to rules table ([#27724](https://github.com/astral-sh/ruff/pull/27724)) - Fix broken link to Python docs ([#27757](https://github.com/astral-sh/ruff/pull/27757)) ##### Other changes - Fix s390x stacker assembly in release builds ([#27776](https://github.com/astral-sh/ruff/pull/27776)) - Guarantee minimum stack size when parsing a module, standalone expression, and suites ([#25464](https://github.com/astral-sh/ruff/pull/25464)) - Reduce configuration deserialization code size ([#27924](https://github.com/astral-sh/ruff/pull/27924)) - Check packed AST index bounds ([#27849](https://github.com/astral-sh/ruff/pull/27849)) ##### Contributors - [@AbhinavMir](https://github.com/AbhinavMir) - [@eduardorittner](https://github.com/eduardorittner) - [@royb3](https://github.com/royb3) - [@MichaReiser](https://github.com/MichaReiser) - [@carljm](https://github.com/carljm) - [@rosstitmarsh](https://github.com/rosstitmarsh) - [@ntBre](https://github.com/ntBre) - [@zaniebot](https://github.com/zaniebot) - [@ewdurbin](https://github.com/ewdurbin) - [@woodruffw](https://github.com/woodruffw) - [@Sacrimento](https://github.com/Sacrimento) - [@lakshayxi](https://github.com/lakshayxi) - [@WhiteFox0-0](https://github.com/WhiteFox0-0) - [@baltasarblanco](https://github.com/baltasarblanco) </details> <details> <summary>astral-sh/ty (ty)</summary> ### [`v0.0.78`](https://github.com/astral-sh/ty/blob/HEAD/CHANGELOG.md#0078) [Compare Source](https://github.com/astral-sh/ty/compare/0.0.77...0.0.78) Released on 2026-09-02. ##### Bug fixes - Defer decorator-call diagnostics to avoid recursive-default cycles ([#28226](https://github.com/astral-sh/ruff/pull/28226)) - Make cyclic intersection simplification deterministic ([#28156](https://github.com/astral-sh/ruff/pull/28156)) - Stabilize cyclic terminal-call reachability ([#28216](https://github.com/astral-sh/ruff/pull/28216)) ##### Preview features - Refresh uv workspace metadata when dependencies change ([#28224](https://github.com/astral-sh/ruff/pull/28224)) ##### Diagnostics - Add a new `disjoint-cast` rule ([#28129](https://github.com/astral-sh/ruff/pull/28129)) - Report deprecated property accessors on intersections ([#28250](https://github.com/astral-sh/ruff/pull/28250)) - Report deprecations for implicit constructor calls ([#28251](https://github.com/astral-sh/ruff/pull/28251)) - Report deprecations for overloads, operators, and properties ([#28134](https://github.com/astral-sh/ruff/pull/28134)) - Respect overload selection in deprecation diagnostics ([#28148](https://github.com/astral-sh/ruff/pull/28148)) ##### Core type checking - Fix negative narrowing for protocols with gradual members ([#28198](https://github.com/astral-sh/ruff/pull/28198)) - Preserve `ParamSpec` bindings inferred against type context ([#28084](https://github.com/astral-sh/ruff/pull/28084)) - Preserve generic protocol materialization relations ([#28246](https://github.com/astral-sh/ruff/pull/28246)) - Preserve uncertain branches during quantification ([#28211](https://github.com/astral-sh/ruff/pull/28211)) - Respect type variables in top/bottom materializations of invariant generics ([#28072](https://github.com/astral-sh/ruff/pull/28072)) - Sync vendored typeshed stubs ([#28217](https://github.com/astral-sh/ruff/pull/28217)). [Typeshed diff](https://github.com/python/typeshed/compare/6b7f7b93300550eb55380db8ca62488eb0c78c77...cf09d2a4d7614f648e9109dce609887499a7c6ee) - Treat captured bound-method receivers covariantly ([#28180](https://github.com/astral-sh/ruff/pull/28180)) - Unsound intersection simplification for generic iterables ([#28068](https://github.com/astral-sh/ruff/pull/28068)) - Validate type variable scopes in constructors and aliases ([#28130](https://github.com/astral-sh/ruff/pull/28130)) - `lambda` functions are always truthy ([#28254](https://github.com/astral-sh/ruff/pull/28254)) ##### Performance - Optimize materialized recursive protocol comparisons ([#28079](https://github.com/astral-sh/ruff/pull/28079)) - Optimize recursive protocol checks for nested type variables ([#28257](https://github.com/astral-sh/ruff/pull/28257)) ##### Contributors - [@charliermarsh](https://github.com/charliermarsh) - [@sharkdp](https://github.com/sharkdp) - [@zsol](https://github.com/zsol) - [@AlexWaygood](https://github.com/AlexWaygood) - [@ibraheemdev](https://github.com/ibraheemdev) - [@carljm](https://github.com/carljm) ### [`v0.0.77`](https://github.com/astral-sh/ty/blob/HEAD/CHANGELOG.md#0077) [Compare Source](https://github.com/astral-sh/ty/compare/0.0.76...0.0.77) Released on 2026-08-31. ##### Bug fixes - Bound recursive protocol traversal in generic intersections ([#28215](https://github.com/astral-sh/ruff/pull/28215)) - Preserve recursion guards across nested type operations ([#28150](https://github.com/astral-sh/ruff/pull/28150)) - Preserve syntax and comments when removing redundant casts ([#28145](https://github.com/astral-sh/ruff/pull/28145)) - Stabilize recursive receiver inference ([#28042](https://github.com/astral-sh/ruff/pull/28042)) - Stabilize condition truthiness during cyclic inference ([#28212](https://github.com/astral-sh/ruff/pull/28212)) ##### Core type checking - Preserve generic receivers in implicit `__init_subclass__` calls ([#28138](https://github.com/astral-sh/ruff/pull/28138)) - Preserve specialization for inherited `TypedDict` methods ([#28111](https://github.com/astral-sh/ruff/pull/28111)) - Propagate deletions through nested loop headers ([#28044](https://github.com/astral-sh/ruff/pull/28044)) ##### Performance - Avoid repeated inference for literal union call results ([#28196](https://github.com/astral-sh/ruff/pull/28196)) ##### Contributors - [@charliermarsh](https://github.com/charliermarsh) - [@carljm](https://github.com/carljm) ### [`v0.0.76`](https://github.com/astral-sh/ty/blob/HEAD/CHANGELOG.md#0076) [Compare Source](https://github.com/astral-sh/ty/compare/0.0.75...0.0.76) Released on 2026-08-31. ##### Preview features - Add a missing-direct-dependency rule ([#28001](https://github.com/astral-sh/ruff/pull/28001)) - Cancel superseded queued uv requests ([#28108](https://github.com/astral-sh/ruff/pull/28108)) - Check direct dependencies in PEP 723 scripts ([#28136](https://github.com/astral-sh/ruff/pull/28136)) - Fix Goto definition in script dependencies ([#27747](https://github.com/astral-sh/ruff/pull/27747)) - Move script environment initialization to the CLI and LSP ([#28038](https://github.com/astral-sh/ruff/pull/28038)) - Refresh uv project metadata in the background ([#27933](https://github.com/astral-sh/ruff/pull/27933)) - Synchronize PEP 723 script environments in the language server ([#27619](https://github.com/astral-sh/ruff/pull/27619)) - Warn when uv metadata cannot support dependency checks ([#28133](https://github.com/astral-sh/ruff/pull/28133)) ##### Bug fixes - Avoid panics on incomplete protocol type parameter lists ([#28088](https://github.com/astral-sh/ruff/pull/28088)) - Fix auto-completion panic involving bare declarations ([#28191](https://github.com/astral-sh/ruff/pull/28191)) - Guard recursive meta-type expansion ([#28143](https://github.com/astral-sh/ruff/pull/28143)) - Preserve parentheses when removing redundant casts ([#28092](https://github.com/astral-sh/ruff/pull/28092)) ##### LSP server - Add "Find references" support for pytest fixtures ([#28075](https://github.com/astral-sh/ruff/pull/28075)) - Highlight PEP 723 script metadata as TOML ([#27746](https://github.com/astral-sh/ruff/pull/27746)) - Synchronize saved script metadata on open ([#27873](https://github.com/astral-sh/ruff/pull/27873)) ##### Core type checking - Apply mixin specialization when validating enum members ([#28101](https://github.com/astral-sh/ruff/pull/28101)) - Bind `Self` through generic type aliases ([#28117](https://github.com/astral-sh/ruff/pull/28117)) - Infer lambda parameters through callable type aliases ([#28109](https://github.com/astral-sh/ruff/pull/28109)) - Intersection simplifications with subtype-related generic specializations ([#26880](https://github.com/astral-sh/ruff/pull/26880)) - Invalidate member narrowing across loop iterations ([#28009](https://github.com/astral-sh/ruff/pull/28009)) - Narrow functional enum members in `==` and `match` ([#28103](https://github.com/astral-sh/ruff/pull/28103)) - Only treat recursive types with unbounded specializations as fallback cycles ([#27538](https://github.com/astral-sh/ruff/pull/27538)) - Preserve `Final` variance in stubs ([#28119](https://github.com/astral-sh/ruff/pull/28119)) - Preserve inferred types for unknown class-decorator results ([#28067](https://github.com/astral-sh/ruff/pull/28067)) - Preserve list literal positions in starred unpacking ([#28061](https://github.com/astral-sh/ruff/pull/28061)) - Preserve short-circuit reachability for direct conditions ([#28082](https://github.com/astral-sh/ruff/pull/28082)) - Preserve type variables in bounded generic defaults ([#28122](https://github.com/astral-sh/ruff/pull/28122)) - Reject circular type alias definitions ([#28140](https://github.com/astral-sh/ruff/pull/28140)) - Reject class access to generic instance attributes ([#28123](https://github.com/astral-sh/ruff/pull/28123)) - Use the subclass receiver when checking method overrides ([#28124](https://github.com/astral-sh/ruff/pull/28124)) - Validate declared variance in method signatures ([#28116](https://github.com/astral-sh/ruff/pull/28116)) ##### Performance - Avoid cubic narrowing with repeated assignments and context managers ([#27787](https://github.com/astral-sh/ruff/pull/27787)) - Avoid repeated traversal of shared alias arguments ([#28147](https://github.com/astral-sh/ruff/pull/28147)) - Reject impossible eager protocol comparisons early ([#28081](https://github.com/astral-sh/ruff/pull/28081)) ##### Contributors - [@AlexWaygood](https://github.com/AlexWaygood) - [@MichaReiser](https://github.com/MichaReiser) - [@charliermarsh](https://github.com/charliermarsh) - [@BitWeaverDev](https://github.com/BitWeaverDev) - [@gorewilliams](https://github.com/gorewilliams) - [@zsol](https://github.com/zsol) - [@malkin0xb8](https://github.com/malkin0xb8) - [@sharkdp](https://github.com/sharkdp) - [@mtshiba](https://github.com/mtshiba) - [@carljm](https://github.com/carljm) - [@lerebear](https://github.com/lerebear) - [@jamtat](https://github.com/jamtat) ### [`v0.0.75`](https://github.com/astral-sh/ty/blob/HEAD/CHANGELOG.md#0075) [Compare Source](https://github.com/astral-sh/ty/compare/0.0.74...0.0.75) Released on 2026-08-26. ##### Preview features - Initialize PEP 723 script environments in the CLI ([#27544](https://github.com/astral-sh/ruff/pull/27544)) - Refresh PEP 723 script environments in watch mode ([#27617](https://github.com/astral-sh/ruff/pull/27617)) - Run PEP 723 script synchronization on bounded workers ([#27615](https://github.com/astral-sh/ruff/pull/27615)) ##### Bug fixes - Specialize `Self` bounds of inherited methods ([#27990](https://github.com/astral-sh/ruff/pull/27990)) ##### LSP server - Add "Go to Definition" support for pytest fixtures ([#27444](https://github.com/astral-sh/ruff/pull/27444)) ##### Documentation - Fix documented Python package build command ([#4384](https://github.com/astral-sh/ty/pull/4384)) - Link untyped-call tracking issue in migration guide ([#4382](https://github.com/astral-sh/ty/pull/4382)) ##### Library support - Resolve imported pytest fixture exposures ([#27539](https://github.com/astral-sh/ruff/pull/27539)) - Resolve installed core pytest fixture providers ([#27770](https://github.com/astral-sh/ruff/pull/27770)) - Resolve pytest fixtures through conftest ([#27540](https://github.com/astral-sh/ruff/pull/27540)) ##### Diagnostics - Add more autofixes ([#28029](https://github.com/astral-sh/ruff/pull/28029)) - Add a dedicated missing-slot diagnostic ([#28039](https://github.com/astral-sh/ruff/pull/28039)) - Explain missing storage for declared slotted attributes ([#27969](https://github.com/astral-sh/ruff/pull/27969)) - Improve diagnostic spans for unpacked variable assignments ([#28041](https://github.com/astral-sh/ruff/pull/28041)) ##### Core type checking - Account for known subclasses in equality inference ([#28005](https://github.com/astral-sh/ruff/pull/28005)) - Expand `ParamSpec` signatures inferred from bound receivers ([#28020](https://github.com/astral-sh/ruff/pull/28020)) - Fix `Self` binding in `ParamSpec` protocols ([#28016](https://github.com/astral-sh/ruff/pull/28016)) - Fix `TypedDict` variance inference ([#28052](https://github.com/astral-sh/ruff/pull/28052)) - Fix unsound narrowing through branch-assigned conditions ([#28006](https://github.com/astral-sh/ruff/pull/28006)) - Ignore inconsistent binding decorators on overloads ([#28036](https://github.com/astral-sh/ruff/pull/28036)) - Infer `yield from` send/return types from the iterator returned by `__iter__` ([#27987](https://github.com/astral-sh/ruff/pull/27987)) - Infer tuple type parameters from union arguments ([#28062](https://github.com/astral-sh/ruff/pull/28062)) - Infer variance through nonrecursive protocol references ([#28065](https://github.com/astral-sh/ruff/pull/28065)) - Preserve bounds of non-literal metaclasses ([#28046](https://github.com/astral-sh/ruff/pull/28046)) - Preserve correlated generic-call inference ([#28043](https://github.com/astral-sh/ruff/pull/28043)) - Preserve invariant materialization constraints ([#28047](https://github.com/astral-sh/ruff/pull/28047)) - Recover bare `TypeVarTuple`s in tuple annotations ([#27950](https://github.com/astral-sh/ruff/pull/27950)) - Reject fixed tuples for non-inferable `TypeVarTuple`s ([#27943](https://github.com/astral-sh/ruff/pull/27943)) - Reject incompatible constructor context for variadic packs ([#27966](https://github.com/astral-sh/ruff/pull/27966)) - Support mixed gradual tuple assignability with `TypeVarTuple` ([#27957](https://github.com/astral-sh/ruff/pull/27957)) - Support tagged union with multiple tags per type ([#27984](https://github.com/astral-sh/ruff/pull/27984)) - Sync vendored typeshed stubs ([#28035](https://github.com/astral-sh/ruff/pull/28035)). [Typeshed diff](https://github.com/python/typeshed/compare/6fba3ae73db5a9807780514b463126f1ee8ff216...6b7f7b93300550eb55380db8ca62488eb0c78c77) - Treat `typing.Union` as a class on Python 3.14+ ([#28003](https://github.com/astral-sh/ruff/pull/28003)) - Validate generic protocol variance ([#27531](https://github.com/astral-sh/ruff/pull/27531)) - `collections.abc.Callable` is an instance of `type` ([#27991](https://github.com/astral-sh/ruff/pull/27991)) ##### Contributors - [@sharkdp](https://github.com/sharkdp) - [@jelle-openai](https://github.com/jelle-openai) - [@marcelo-souzaf](https://github.com/marcelo-souzaf) - [@AlexWaygood](https://github.com/AlexWaygood) - [@krzkaczor](https://github.com/krzkaczor) - [@carljm](https://github.com/carljm) - [@charliermarsh](https://github.com/charliermarsh) - [@lerebear](https://github.com/lerebear) - [@MichaReiser](https://github.com/MichaReiser) ### [`v0.0.74`](https://github.com/astral-sh/ty/blob/HEAD/CHANGELOG.md#0074) [Compare Source](https://github.com/astral-sh/ty/compare/0.0.73...0.0.74) Released on 2026-08-22. ##### Bug fixes - Avoid duplicate bindings in multi-target assignments ([#27938](https://github.com/astral-sh/ruff/pull/27938)) - Avoid panic on unpacked kwargs in string annotations ([#27963](https://github.com/astral-sh/ruff/pull/27963)) - Fix stack overflow in recursive `TypedDict` dictionary compatibility ([#27951](https://github.com/astral-sh/ruff/pull/27951)) - Handle assignment expressions in string annotations ([#27921](https://github.com/astral-sh/ruff/pull/27921)) - Handle dynamic classes in string annotations ([#27883](https://github.com/astral-sh/ruff/pull/27883)) - Preserve string annotation context in lambda defaults and `TypedDict` types ([#27914](https://github.com/astral-sh/ruff/pull/27914)) - Skip invalid subscript arguments in string annotations ([#27917](https://github.com/astral-sh/ruff/pull/27917)) - Skip invalid subscript operands in string annotations ([#27882](https://github.com/astral-sh/ruff/pull/27882)) ##### LSP server - Add `untrustedWorkspace` option to the LSP ([#27828](https://github.com/astral-sh/ruff/pull/27828)) - Add executable discovery to the server command ([#27806](https://github.com/astral-sh/ruff/pull/27806)) - Handle file-valued workspace folders from Zed ([#27836](https://github.com/astral-sh/ruff/pull/27836)) - Skip scripts with an invalid PEP 723 configuration ([#27505](https://github.com/astral-sh/ruff/pull/27505)) - Support pull diagnostics for notebook cells ([#27778](https://github.com/astral-sh/ruff/pull/27778)) ##### Documentation - Update mypy/pyright comparison table ([#4165](https://github.com/astral-sh/ty/pull/4165)) ##### Diagnostics - Add an opt-in `unsound-assignment` rule for variables ([#27874](https://github.com/astral-sh/ruff/pull/27874)) - Fix variadic signature display ([#27869](https://github.com/astral-sh/ruff/pull/27869)) - Highlight declarations in invalid-assignment diagnostics ([#27872](https://github.com/astral-sh/ruff/pull/27872)) - Improve `LiteralString` suggestions in string annotations ([#27931](https://github.com/astral-sh/ruff/pull/27931)) - Use `invalid-type-form` for non-generic class annotations ([#27889](https://github.com/astral-sh/ruff/pull/27889)) ##### Core type checking - Add bounded constraint solution projections ([#27949](https://github.com/astral-sh/ruff/pull/27949)) - Fix invariant gradual tuple materialization ranges ([#27946](https://github.com/astral-sh/ruff/pull/27946)) - Guard recursive constructor bindings by receiver ([#27958](https://github.com/astral-sh/ruff/pull/27958)) - Preserve all alternatives in bounded intersections ([#27898](https://github.com/astral-sh/ruff/pull/27898)) - Preserve keyword safety for unpacked callables ([#27517](https://github.com/astral-sh/ruff/pull/27517)) - Preserve source protocol members and classify finite aliases ([#27772](https://github.com/astral-sh/ruff/pull/27772)) - Preserve type-variable order when reloading constraints ([#27904](https://github.com/astral-sh/ruff/pull/27904)) - Propagate narrowing through statically known branches ([#27752](https://github.com/astral-sh/ruff/pull/27752)) - Recognize ABC metaclass methods on protocols ([#27897](https://github.com/astral-sh/ruff/pull/27897)) - Support `__slots__` ([#27730](https://github.com/astral-sh/ruff/pull/27730)) ##### Performance - Lazily infer function parameter default types ([#27857](https://github.com/astral-sh/ruff/pull/27857)) - Optimize inherited recursive protocol comparisons ([#27922](https://github.com/astral-sh/ruff/pull/27922)) - Traverse shared constraint source-order nodes once ([#27947](https://github.com/astral-sh/ruff/pull/27947)) ##### Contributors - [@carljm](https://github.com/carljm) - [@lerebear](https://github.com/lerebear) - [@charliermarsh](https://github.com/charliermarsh) - [@dhruvmanila](https://github.com/dhruvmanila) - [@AlexWaygood](https://github.com/AlexWaygood) - [@MichaReiser](https://github.com/MichaReiser) - [@jelle-openai](https://github.com/jelle-openai) ### [`v0.0.73`](https://github.com/astral-sh/ty/blob/HEAD/CHANGELOG.md#0073) [Compare Source](https://github.com/astral-sh/ty/compare/0.0.72...0.0.73) Released on 2026-08-18. ##### LSP server - Do not prefer unsafe fixes in the language server ([#27822](https://github.com/astral-sh/ruff/pull/27822)) - Fix signature help in trailing whitespace ([#27784](https://github.com/astral-sh/ruff/pull/27784)) ##### Library support - Preserve variadic generics in `functools.partial` ([#27774](https://github.com/astral-sh/ruff/pull/27774)) ##### Diagnostics - Add an opt-in rule flagging function decorators that transform a non-dynamic type into a dynamic type ([#27829](https://github.com/astral-sh/ruff/pull/27829)) - Disambiguate same-named types in several diagnostics ([#27814](https://github.com/astral-sh/ruff/pull/27814)) - Show error spans for errors originating in script metadata ([#26693](https://github.com/astral-sh/ruff/pull/26693)) ##### Core type checking - Avoid bypassing solver during literal promotion ([#27763](https://github.com/astral-sh/ruff/pull/27763)) - Expand nested union aliases when finding a `TypedDict` or callable ([#27740](https://github.com/astral-sh/ruff/pull/27740)) - Implement intersection meta-type projection ([#27660](https://github.com/astral-sh/ruff/pull/27660)) - Infer generic protocols from class objects ([#27812](https://github.com/astral-sh/ruff/pull/27812)) - Model exception-suppressing context managers ([#27219](https://github.com/astral-sh/ruff/pull/27219)) - Preserve `TypeAliasType` runtime origin ([#27813](https://github.com/astral-sh/ruff/pull/27813)) - Preserve class objects in lazy protocol checks ([#27815](https://github.com/astral-sh/ruff/pull/27815)) - Preserve declared types in exception handlers ([#27817](https://github.com/astral-sh/ruff/pull/27817)) - Preserve explicit globals after conditional rebinding ([#27786](https://github.com/astral-sh/ruff/pull/27786)) - Preserve property subclass types and accessors ([#27833](https://github.com/astral-sh/ruff/pull/27833)) - Preserve required stub fields in generated constructors ([#27765](https://github.com/astral-sh/ruff/pull/27765)) - Preserve static upper bounds of gradual solutions ([#27664](https://github.com/astral-sh/ruff/pull/27664)) - Prevent unrelated quantified constraints from destabilizing recursive queries ([#27737](https://github.com/astral-sh/ruff/pull/27737)) - Separate generic constraint accumulation from legacy projection ([#27743](https://github.com/astral-sh/ruff/pull/27743)) - Simplify generic protocol inference ([#27819](https://github.com/astral-sh/ruff/pull/27819)) - Specialize inherited members of unspecialized generic classes ([#27658](https://github.com/astral-sh/ruff/pull/27658)) - Specialize type variables determined by bound receivers ([#27732](https://github.com/astral-sh/ruff/pull/27732)) - Support unpacking tuple type aliases ([#27825](https://github.com/astral-sh/ruff/pull/27825)) - Sync vendored typeshed stubs ([#27771](https://github.com/astral-sh/ruff/pull/27771)). [Typeshed diff](https://github.com/python/typeshed/compare/1b116673774d062a4af7b0a0b3d05533a6be55d0...6fba3ae73db5a9807780514b463126f1ee8ff216) ##### Performance - Cache `py.typed` contents ([#27805](https://github.com/astral-sh/ruff/pull/27805)) - Deduplicate exception checkpoints across equivalent branches ([#27703](https://github.com/astral-sh/ruff/pull/27703)) ##### Contributors - [@charliermarsh](https://github.com/charliermarsh) - [@AlexWaygood](https://github.com/AlexWaygood) - [@MichaReiser](https://github.com/MichaReiser) - [@augustelalande](https://github.com/augustelalande) - [@carljm](https://github.com/carljm) - [@woodruffw](https://github.com/woodruffw) - [@dhruvmanila](https://github.com/dhruvmanila) - [@ibraheemdev](https://github.com/ibraheemdev) - [@zaniebot](https://github.com/zaniebot) </details> <details> <summary>Kludex/uvicorn (uvicorn)</summary> ### [`v0.52.4`](https://github.com/Kludex/uvicorn/releases/tag/0.52.4): Version 0.52.4 [Compare Source](https://github.com/Kludex/uvicorn/compare/0.52.3...0.52.4) ##### Fixed - Remove duplicate `Date` headers from accepted WebSocket handshakes with `websockets-sansio` ([#3078](https://github.com/Kludex/uvicorn/pull/3078)) **Full Changelog**: <https://github.com/Kludex/uvicorn/compare/0.52.3...0.52.4> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Amsterdam) - Branch creation - "before 6am on sunday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

robbertbos force-pushed renovate/python from 43522290aa

CI / pre-commit (pull_request) Successful in 3m3s

Details

CI / frontend-test (pull_request) Failing after 5m48s

Details

CI / release-scripts (pull_request) Successful in 9s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 50s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 30s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 30s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 22s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 2m13s

Details

test-build / build (frontend) (pull_request) Successful in 2m8s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 19m47s

Details

CI / e2e (pull_request) Failing after 15m26s

Details

to b8b29bc243

CI / pre-commit (pull_request) Successful in 3m1s

Details

CI / frontend-test (pull_request) Successful in 5m32s

Details

CI / release-scripts (pull_request) Successful in 8s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 50s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 29s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 30s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 21s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 2m7s

Details

test-build / build (frontend) (pull_request) Successful in 1m59s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 16m11s

Details

CI / e2e (pull_request) Failing after 15m51s

Details

2026-08-26 02:03:46 +00:00

Compare

robbertbos force-pushed renovate/python from b8b29bc243

CI / pre-commit (pull_request) Successful in 3m1s

Details

CI / frontend-test (pull_request) Successful in 5m32s

Details

CI / release-scripts (pull_request) Successful in 8s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 50s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 29s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 30s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 21s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 2m7s

Details

test-build / build (frontend) (pull_request) Successful in 1m59s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 16m11s

Details

CI / e2e (pull_request) Failing after 15m51s

Details

to 1456095766

CI / pre-commit (pull_request) Successful in 2m58s

Details

CI / frontend-test (pull_request) Failing after 5m58s

Details

CI / release-scripts (pull_request) Successful in 9s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 53s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 33s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 32s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 23s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 15s

Details

test-build / build (backend) (pull_request) Successful in 2m14s

Details

test-build / build (frontend) (pull_request) Successful in 1m44s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 19m23s

Details

CI / e2e (pull_request) Failing after 13m10s

Details

2026-08-27 02:04:10 +00:00

Compare

robbertbos force-pushed renovate/python from 1456095766

CI / pre-commit (pull_request) Successful in 2m58s

Details

CI / frontend-test (pull_request) Failing after 5m58s

Details

CI / release-scripts (pull_request) Successful in 9s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 53s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 33s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 32s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 23s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 15s

Details

test-build / build (backend) (pull_request) Successful in 2m14s

Details

test-build / build (frontend) (pull_request) Successful in 1m44s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 19m23s

Details

CI / e2e (pull_request) Failing after 13m10s

Details

to a32b67d460

CI / pre-commit (pull_request) Successful in 3m13s

Details

CI / frontend-test (pull_request) Failing after 5m37s

Details

CI / release-scripts (pull_request) Successful in 10s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 49s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 32s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 30s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 23s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 15s

Details

test-build / build (backend) (pull_request) Successful in 2m14s

Details

test-build / build (frontend) (pull_request) Successful in 2m8s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 19m24s

Details

CI / e2e (pull_request) Failing after 15m15s

Details

2026-08-28 02:04:15 +00:00

Compare

robbertbos force-pushed renovate/python from a32b67d460

CI / pre-commit (pull_request) Successful in 3m13s

Details

CI / frontend-test (pull_request) Failing after 5m37s

Details

CI / release-scripts (pull_request) Successful in 10s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 49s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 32s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 30s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 23s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 15s

Details

test-build / build (backend) (pull_request) Successful in 2m14s

Details

test-build / build (frontend) (pull_request) Successful in 2m8s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 19m24s

Details

CI / e2e (pull_request) Failing after 15m15s

Details

to 15ac78bb43

CI / pre-commit (pull_request) Successful in 3m11s

Details

CI / frontend-test (pull_request) Successful in 6m4s

Details

CI / release-scripts (pull_request) Successful in 9s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 50s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 30s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 32s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 23s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 2m17s

Details

test-build / build (frontend) (pull_request) Successful in 2m8s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 22m25s

Details

CI / e2e (pull_request) Failing after 15m52s

Details

2026-08-29 02:03:51 +00:00

Compare

robbertbos force-pushed renovate/python from 15ac78bb43

CI / pre-commit (pull_request) Successful in 3m11s

Details

CI / frontend-test (pull_request) Successful in 6m4s

Details

CI / release-scripts (pull_request) Successful in 9s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 50s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 30s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 32s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 23s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 2m17s

Details

test-build / build (frontend) (pull_request) Successful in 2m8s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 22m25s

Details

CI / e2e (pull_request) Failing after 15m52s

Details

to 450da40bb8

CI / pre-commit (pull_request) Successful in 3m11s

Details

CI / frontend-test (pull_request) Failing after 5m34s

Details

CI / release-scripts (pull_request) Successful in 9s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 51s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 32s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 34s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 16s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 26s

Details

test-build / build (frontend) (pull_request) Successful in 2m8s

Details

test-build / build (backend) (pull_request) Successful in 2m15s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 18m9s

Details

CI / e2e (pull_request) Failing after 13m11s

Details

2026-08-31 02:09:16 +00:00

Compare

robbertbos force-pushed renovate/python from 450da40bb8

CI / pre-commit (pull_request) Successful in 3m11s

Details

CI / frontend-test (pull_request) Failing after 5m34s

Details

CI / release-scripts (pull_request) Successful in 9s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 51s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 32s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 34s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 16s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 26s

Details

test-build / build (frontend) (pull_request) Successful in 2m8s

Details

test-build / build (backend) (pull_request) Successful in 2m15s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 18m9s

Details

CI / e2e (pull_request) Failing after 13m11s

Details

to 46f2ea97e1

CI / pre-commit (pull_request) Successful in 3m12s

Details

CI / frontend-test (pull_request) Failing after 5m25s

Details

CI / release-scripts (pull_request) Successful in 8s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 49s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 29s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 29s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 22s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 2m8s

Details

test-build / build (frontend) (pull_request) Successful in 2m2s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 18m58s

Details

CI / e2e (pull_request) Failing after 14m54s

Details

2026-09-01 02:09:41 +00:00

Compare

robbertbos force-pushed renovate/python from 46f2ea97e1

CI / pre-commit (pull_request) Successful in 3m12s

Details

CI / frontend-test (pull_request) Failing after 5m25s

Details

CI / release-scripts (pull_request) Successful in 8s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 49s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 29s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 29s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 22s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 2m8s

Details

test-build / build (frontend) (pull_request) Successful in 2m2s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 18m58s

Details

CI / e2e (pull_request) Failing after 14m54s

Details

to b4d47b1b59

CI / pre-commit (pull_request) Successful in 3m12s

Details

CI / frontend-test (pull_request) Failing after 5m29s

Details

CI / release-scripts (pull_request) Successful in 9s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 51s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 32s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 31s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 22s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 2m9s

Details

test-build / build (frontend) (pull_request) Successful in 2m2s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 19m23s

Details

CI / e2e (pull_request) Failing after 14m8s

Details

2026-09-03 02:10:10 +00:00

Compare

robbertbos force-pushed renovate/python from b4d47b1b59

CI / pre-commit (pull_request) Successful in 3m12s

Details

CI / frontend-test (pull_request) Failing after 5m29s

Details

CI / release-scripts (pull_request) Successful in 9s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 51s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 32s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 31s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 22s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 2m9s

Details

test-build / build (frontend) (pull_request) Successful in 2m2s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 19m23s

Details

CI / e2e (pull_request) Failing after 14m8s

Details

to aec8c56cdd

CI / pre-commit (pull_request) Successful in 4m40s

Details

CI / frontend-test (pull_request) Successful in 5m20s

Details

CI / release-scripts (pull_request) Successful in 8s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 46s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 26s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 19s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 1m45s

Details

CI / backend-test (pull_request) Successful in 14m26s

Details

test-build / build (frontend) (pull_request) Successful in 1m28s

Details

test-build / build (pull_request) Successful in 0s

Details

security-scan / JS SCA (npm audit) (pull_request) Failing after 7m26s

Details

CI / e2e (pull_request) Successful in 15m9s

Details

2026-09-04 02:09:24 +00:00

Compare

robbertbos force-pushed renovate/python from aec8c56cdd

CI / pre-commit (pull_request) Successful in 4m40s

Details

CI / frontend-test (pull_request) Successful in 5m20s

Details

CI / release-scripts (pull_request) Successful in 8s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 46s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 26s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 19s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 1m45s

Details

CI / backend-test (pull_request) Successful in 14m26s

Details

test-build / build (frontend) (pull_request) Successful in 1m28s

Details

test-build / build (pull_request) Successful in 0s

Details

security-scan / JS SCA (npm audit) (pull_request) Failing after 7m26s

Details

CI / e2e (pull_request) Successful in 15m9s

Details

to b658343cc2

CI / pre-commit (pull_request) Successful in 3m14s

Details

CI / frontend-test (pull_request) Successful in 5m31s

Details

CI / release-scripts (pull_request) Successful in 8s

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 49s

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 30s

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 29s

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 21s

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Details

test-build / build (backend) (pull_request) Successful in 2m17s

Details

test-build / build (frontend) (pull_request) Successful in 2m7s

Details

test-build / build (pull_request) Successful in 0s

Details

CI / backend-test (pull_request) Successful in 20m18s

Details

CI / e2e (pull_request) Failing after 23m49s

Details

2026-09-05 02:10:02 +00:00

Compare

robbertbos referenced this pull request

2026-09-05 11:30:07 +00:00

Bundle the open Renovate updates #352

robbertbos commented

2026-09-05 11:46:08 +00:00

Author

Owner

Superseded by #352, which carries this bump.

robbertbos closed this pull request

2026-09-05 11:46:08 +00:00

CI / pre-commit (pull_request) Successful in 3m14s

Required

Details

CI / frontend-test (pull_request) Successful in 5m31s

Required

Details

CI / release-scripts (pull_request) Successful in 8s

Required

Details

security-scan / Python SCA (pip-audit) (pull_request) Successful in 49s

Required

Details

security-scan / Python SAST (bandit) (pull_request) Successful in 30s

Required

Details

security-scan / JS SCA (npm audit) (pull_request) Successful in 29s

Required

Details

security-scan / Filesystem scan (trivy fs) (pull_request) Successful in 21s

Required

Details

security-scan / SBOM (trivy) (pull_request) Successful in 14s

Required

Details

test-build / build (backend) (pull_request) Successful in 2m17s

Required

Details

test-build / build (frontend) (pull_request) Successful in 2m7s

Required

Details

test-build / build (pull_request) Successful in 0s

Required

Details

CI / backend-test (pull_request) Successful in 20m18s

Required

Details

CI / e2e (pull_request) Failing after 23m49s

Required

Details

Pull request closed

Please reopen this pull request to perform a merge.

Rows
Columns

Update Python dependencies #345

Release Notes

What's Changed

New Contributors

v2.13.5 (2026-08-28)

What's Changed

Fixes

Preview features

Bug fixes

Rule changes

Documentation

Other changes

Contributors

Preview features

Bug fixes

Server

Documentation

Contributors

Preview features

Bug fixes

Rule changes

Server

Documentation

Other changes

Contributors

Bug fixes

Preview features

Diagnostics

Core type checking

Performance

Contributors

Bug fixes

Core type checking

Performance

Contributors

Preview features

Bug fixes

LSP server

Core type checking

Performance

Contributors

Preview features

Bug fixes

LSP server

Documentation

Library support

Diagnostics

Core type checking

Contributors

Bug fixes

LSP server

Documentation

Diagnostics

Core type checking

Performance

Contributors

LSP server

Library support

Diagnostics

Core type checking

Performance

Contributors

v0.52.4: Version 0.52.4

Fixed

Configuration

Pull request closed

`v0.52.4`: Version 0.52.4