Update Python dependencies #474
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/python"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
>=0.31.0→>=0.32.0>=1.8.0→>=1.9.1>=7.2.0,<7.3→>=7.2.4,<7.3>=50.0.1→>=50.0.2>=0.141.1→>=0.159.1>=0.8.0→>=0.9.0>=26.2.1→>=26.2.2>=2.13.5→>=2.14.1>=2.15.0→>=2.16.1>=3.14.7→>=3.15.1>=0.16.9→>=0.17.1>=2.1.1→>=2.1.6>=0.0.84→>=0.0.90>=0.22.1→>=0.23.0Release Notes
MagicStack/asyncpg (asyncpg)
v0.32.0Compare Source
Improvements
Support Python 3.15 (#1367, #1378)
(by @elprans in
1b11846and58c0c59)Support PostgreSQL 19 (#1379)
(by @elprans in
8d2a5ae)Make pool
min_sizea maintained connection floor and addinit_sizetocontrol the number of connections opened at startup (#1323).
Idle connections at or below
min_sizeare retained, and closed connectionsare replaced in the background.
init_sizedefaults tomin_size.To preserve the previous behavior, where the pool could drain to zero,
replace
min_size=Nwithinit_size=N, min_size=0.(by @shatilov-diman in
67a1cbc)Use
hashlib.pbkdf2_hmac()for faster SCRAM password derivation (#1359)(by @twelfthlabor in
00319a9)Use the statement cache for
copy_records_to_table()introspection (#1360)(by @matemax in
dd05865)Fixes
Clean up connections rejected by
target_session_attrsimmediately so anunresponsive rejected host cannot delay the selected connection, and cleanup
tasks cannot outlive the event loop. Rejected connections are aborted without
waiting for a graceful disconnect; servers may log "unexpected EOF on client
connection" if the Terminate message is not delivered before the transport
closes.
Fix a connection pool deadlock when releasing a connection after a protocol
abort (#1324)
(by @pchaseh in
4a83cc2)Honor
Connection.close(timeout=...)while waiting for a pendingcancellation (#1361)
(by @gyanu2507 in
c06bcb4)Prevent stuck cancellation from blocking connection teardown or pool release
by bounding cancellation with the command or release timeout (#1370)
(by @elprans in
4cf0220)Preserve the server error when the connection closes mid-operation (#1369)
(by @RitiGrover in
6c8f1a7)Fix COPY cleanup when a records generator raises, preserving the original
exception and avoiding protocol desynchronization and stalled rollback (#1358)
(by @CodingCossack in
fdc6bc8)Reparse unnamed statements before cursor binding when the statement cache
is disabled (#1364)
(by @elprans in
302ba49)Allow cursors in transactions started outside
Connection.transaction(),such as with an explicit
BEGIN(#1350)(by @aryansk in
25aaaf5)Remove the query logger when the
query_logger()block raises (#1373)(by @kratos0718 in
6a7fbd3)Fix a segfault in
Record.get()with an invalid number of positionalarguments (#1333)
(by @apoorvdarshan in
40a3832)Align SSL startup retries with libpq and improve SSL rejection diagnostics
(#1366). Retry alternative transports only before authentication succeeds.
Direct TLS now requires
sslmode=require,verify-ca, orverify-full,or an explicit
SSLContext.(by @elprans in
78752c9)Preserve password errors during SSL fallback when the fallback fails with
a less specific authorization error (#1331)
(by @Mauricio0129 in
2d97947)Handle cleartext password authentication when no password is supplied
without raising an
AttributeError(#1351)(by @aryansk in
6be5915)Set the
postgresqlALPN protocol on SSL contexts created by asyncpg sodirect TLS connections work with PostgreSQL 17 and later (#1372).
User-provided contexts must set this protocol for direct TLS connections.
(by @DurandA in
b21325d)Link explicitly against
libmon non-Windows platforms to fix undefinedmath symbol errors when loading the extensions (#1305)
(by @veeceey in
db8ecc2)Fix builds on FreeBSD 15 by linking against
libstdthreads(#1368)(by @elprans in
87bcaf9)Other
Replace
pkg_resourceswithpackaginginsetup.py(#1362)(by @elprans in
6695db7)Build Linux and macOS ARM64 wheels on native runners and add Windows ARM64
wheel builds (#1308)
(by @ddelange in
1e8cc1c)Add manual and PR-label-triggered dry runs to the release workflow (#1374)
(by @elprans in
1bd643e)Clarify how
execute()uses prepared statements and how to confirm anINSERTin the documentation (#1336)(by @pctablet505 in
cdf816c)Fix typos in comments and docstrings (#1332)
(by @maxtaran2010 in
bc3e246)authlib/authlib (authlib)
v1.9.1Compare Source
Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1
What's Changed
Full Changelog: https://github.com/authlib/authlib/compare/v1.9.0...v1.9.1
v1.9.0Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/authlib/authlib/compare/v1.8.0...v1.9.0
tkem/cachetools (cachetools)
v7.2.4Compare Source
===================
Restore autospec calls to
@cachedmethoddecorated methods.Improve branch coverage of unit tests.
Minor type stub improvements.
v7.2.3Compare Source
===================
Fix
@cacheddecorator stacking behavior.Minor type stub improvements.
v7.2.2Compare Source
===================
Fix
@cachedmethodfor subclasses that override a decoratedmethod and call the base class implementation via
super().Restore class access to instance methods decorated with
@cachedmethod.Improve
TTLCacherobustness when calculating expiration timefails.
Various unit test improvements.
v7.2.1Compare Source
===================
Improve error handling for
RRCache.popitem()when the cache isempty.
Minor style and documentation improvements.
Update CI environment.
pyca/cryptography (cryptography)
v50.0.2Compare Source
fastapi/fastapi (fastapi)
v0.159.1Compare Source
Features
v0.159.0Compare Source
Features
v0.158.2Compare Source
Features
v0.158.1Compare Source
Fixes
v0.158.0Compare Source
Features
v0.157.0Compare Source
Features
Docs
Internal
v0.156.8Compare Source
Fixes
bytes. PR #16566 by @tiangolo.v0.156.7Compare Source
Fixes
AliasChoices. PR #16564 by @tiangolo.v0.156.6Compare Source
Fixes
v0.156.5Compare Source
Fixes
AliasChoicesfor path parameters. PR #16560 by @tiangolo.v0.156.4Compare Source
Fixes
AliasChoicesfor named JSON body parameters. PR #16559 by @tiangolo.AliasChoicesextraction for form models. PR #16557 by @tiangolo.v0.156.3Compare Source
Fixes
AliasChoicesfor query parameters, headers, and cookies. PR #16555 by @tiangolo.v0.156.2Compare Source
Fixes
v0.156.1Compare Source
Fixes
v0.156.0Compare Source
Fixes
Field()attributes in request parameters. PR #16547 by @tiangolo.v0.155.0Compare Source
The deprecated
**extrakeyword arguments have been removed fromPath,Query,Header,Cookie,Body,Form, andFile. Unknown keyword arguments now raiseTypeError. For additional JSON Schema properties, replace, for example,Query(custom="value")withQuery(json_schema_extra={"custom": "value"}).Breaking Changes
**extrafrom request parameters. PR #16545 by @tiangolo.v0.154.0Compare Source
Features
v0.153.0Compare Source
Unions of form models now apply the same browser form handling as individual models. Empty scalar fields use defaults or produce missing-field errors, empty list items are preserved, omitted boolean fields become
False, and unselected files are treated as missing. JSON request bodies are unchanged.Fixes
v0.152.0Compare Source
Validation errors for header parameter models now report the HTTP header name, such as
int-val, instead of the Python field name,int_val. Explicit aliases,Header(convert_underscores=False), and Pydantic models withloc_by_alias=Falsekeep their existing behavior.Fixes
v0.151.0Compare Source
JSON request bodies now distinguish an explicit
nullfrom an omitted value. For individualBodyparameters,nullis validated asNone: nullable types accept it, and non-nullable types reject it even when a default is defined. Defaults and default factories apply only when the value is omitted. This applies both to parameters inside JSON objects and to parameters representing the entire body. Clients that usednullto request a default should omit the value instead.When a JSON object is expected because of
Body(embed=True)or multiple body parameters, sendingnullas the entire body now returns a validation error.Breaking Changes
v0.150.0Compare Source
When no file is selected, browsers submit a file part with an empty filename and empty content. FastAPI now treats this as missing: required file fields return a validation error, and fields with defaults or default factories use them. Unselected inputs are ignored in lists of files. Named zero-byte files are still accepted.
Breaking Changes
v0.149.0Compare Source
Browsers submit empty text inputs as empty strings (
""). FastAPI now treats empty scalar form values as missing in form models, matching individualFormparameters. Required fields return a validation error. Fields with defaults or default factories use them and remain unset inmodel_dump(exclude_unset=True).Empty strings inside lists are preserved. Omitted boolean form fields still become
False. JSON requests and direct Pydantic validation are unchanged.Breaking Changes
v0.148.0Compare Source
Defaults for omitted
Query,Header,Cookie, andFormparameters and model fields are no longer treated as user input. Defaults are not validated unlessvalidate_default=Trueis enabled. If you rely on validators running for omitted values, enable default validation withField(validate_default=True)for model fields or, for example,Query(validate_default=True)for individual parameters.Body(validate_default=True)is now honored too.For parameter models, applying a default no longer marks a field as explicitly set, so
model_dump(exclude_unset=True)excludes it. Default factories run once, and validation errors no longer include injected defaults ininput.Omitted boolean form fields still become
Falseand count as explicitly set.Breaking Changes
v0.147.0Compare Source
Omitted
boolandbool | Noneform fields are now interpreted asFalse, matching unchecked HTML checkboxes. This applies to individualFormparameters and form models, including required fields and fields with defaults ofTrueorNone. The inferred value is considered explicitly set, including inmodel_dump(exclude_unset=True).JSON requests and direct Pydantic validation are unchanged. See Boolean Form Fields.
Breaking Changes
Internal
v0.146.0Compare Source
The
root_pathparameter inFastAPI()is deprecated. Configure the server withfastapi run --root-path /api/v1instead.Breaking Changes
root_pathparameter inFastAPI. PR #16520 by @tiangolo.v0.145.0Compare Source
Breaking Changes
openapi_prefixand unused**extrafromFastAPI. PR #16518 by @tiangolo.Docs
v0.144.0Compare Source
Features
v0.143.5Compare Source
Fixes
bytefile list parameter. PR #9383 by @Viicos.v0.143.4Compare Source
Upgrades
v0.143.3Compare Source
Fixes
Docs
v0.143.2Compare Source
Fixes
Translations
Internal
v0.143.1Compare Source
Fixes
iter_route_contexts(). PR #16484 by @tiangolo.v0.143.0Compare Source
Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from
OTEL_*environment variables, setFASTAPI_OTEL_AUTO_CONFIGURE=trueor useFastAPI(telemetry={"auto_configure": True})to retain the previous behavior.Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.
Breaking Changes
v0.142.4Compare Source
Fixes
v0.142.3Compare Source
Fixes
Docs
Translations
Internal
bump-pre-commit-hooksworkflow. PR #16463 by @YuriiMotov.gpt-6-astramodel for translations. PR #16453 by @YuriiMotov.v0.142.2Compare Source
Fixes
v0.142.1Compare Source
Fixes
v0.142.0Compare Source
Features
Refactors
Docs
Translations
Internal
setup-uvaction to10.0.1. PR #16249 by @YuriiMotov.commit_in_placeinput intranslate.yml. PR #16216 by @YuriiMotov.zizmor.ymlworkflow (main->master). PR #16178 by @YuriiMotov..cacheinbuild-docs.yml. PR #16156 by @YuriiMotov.MagicStack/httptools (httptools)
v0.9.0Compare Source
Upgrade llhttp to 9.4.3 (#153)
(by @elprans in
eab7f64)Build CPython 3.15 wheels (#148)
(by @edgarrmondragon in
b03516d)Add RISC-V 64-bit wheels (#137)
(by @gounthar in
1c6946d)Add Windows ARM64 support in CI (#141)
(by @Harishmcw in
5a2bb07)Build PPC64LE wheels (#143)
(by @Sunidhi-Gaonkar1 in
ff08b99)Modernize test and release workflows (#152)
(by @elprans in
d80e26f)pypa/pip (pip)
v26.2.2Compare Source
pydantic/pydantic (pydantic)
v2.14.1Compare Source
GitHub release
The code released in v2.5.0 is functionally identical to that of v2.5.0b1.
What's Changed
Packaging
pyright==1.1.335by @Viicos in #8075New Features
ValidationErrorerrors by @adriangb in #7806__doc__argument increate_model()by @chris-spann in #7863regex_engineflag - meaning you can use with the Rust or Python regex libraries in constraints by @utkini in #7768ComputedFieldInfoby @alexmojaki in #7889ruffformatter by @Luca-Blight in #7930validation_error_causeto config by @zakstucke in #7626CallableDiscriminatorandTagby @dmontagu in #7983CallableDiscriminatorrenamed toDiscriminatorby @dmontagu in #8047examplesandjson_schema_extrato@computed_fieldby @alexmojaki in #8013JsonValuetype by @dmontagu in #7998stras argument toDiscriminatorby @dmontagu in #8047SchemaSerializer.__reduce__method to enable pickle serialization by @edoakes in pydantic/pydantic-core#1006Changes
ultra_strictwith new smart union implementation, the way unions are validated has changed significantly to improve performance and correctness, we have worked hard to absolutely minimise the number of cases where behaviour has changed, see the PR for details - by @davidhewitt in pydantic/pydantic-core#867extra='allow'by @sydney-runkle in #7683Enumtypes with no cases by @sydney-runkle in #7927GenericbeforeBaseModelby @alexmojaki in #7891Performance
jiterby @samuelcolvin in pydantic/pydantic-core#974__getattr__for all package imports, improve import time by @samuelcolvin in #7947Fixes
mypyissue with subclasses ofRootModelby @sydney-runkle in #7677FieldInfowhen a forward ref gets evaluated by @dmontagu in #7698SecretStrfrom JSON (regression in v2.4) by @sydney-runkle in #7729defer_buildbehavior withTypeAdapterby @sydney-runkle in #7736mypyversions by @dmontagu in #7742TypeVarhandling when default is not set by @pmmmwh in #7719strictonEnumtype fields by @sydney-runkle in #7761weakref.refinstead of subclassing to fixcloudpickleserialization by @edoakes in #7780model_post_initin subclasses by @alexmojaki in #7775json_schema_extraby @alexmojaki in #7803strictspecification forUUIDtypes by @sydney-runkle in #7865pydantic.Field(kw_only=True)with inherited dataclasses by @PrettyWood in #7827validate_calldecorator for methods in classes with__slots__by @sydney-runkle in #7883dataclasses.fielddefault by @hramezani in #7898importlib_metadataon python 3.7 by @sydney-runkle in #7904|operator (Union) in PydanticRecursiveRef by @alexmojaki in #7892display_as_typeforTypeAliasTypein python 3.12 by @dmontagu in #7929NotRequiredgenerics inTypedDictby @sydney-runkle in #7932TypeAliasTypespecifications produce different schema definitions by @alexdrydew in #7893PrivateAttris passed fromAnnotateddefault position by @tabassco in #8004classmethodinstead ofclassmethod[Any, Any, Any]by @Mr-Pepe in #7979Optionalfield withvalidate_defaultonly performing one field validation by @sydney-runkle in pydantic/pydantic-core#1002definition-refbug withDictkeys by @sydney-runkle in pydantic/pydantic-core#1014booltypes withcoerce_numbers_to_str=Trueby @sydney-runkle in pydantic/pydantic-core#1017NaNin float and decimal constraints by @davidhewitt in pydantic/pydantic-core#1037lax_strandlax_intsupport for enum values not inherited from str/int by @michaelhly in pydantic/pydantic-core#1015UnionofListtypes by @sydney-runkle in pydantic/pydantic-core#1039max_digitsanddecimalsto pass if normalized or non-normalized input is valid by @sydney-runkle in pydantic/pydantic-core#1049ValidationErrormessages by @Iipin in pydantic/pydantic-core#1050'-'asdatetimeinput by @davidhewitt in pydantic/speedate#52 & pydantic/pydantic-core#1060New Contributors
pydanticpydantic-corev2.14.0Compare Source
GitHub release
What's Changed
The highlights of the v2.14 release are available in the blog post.
Several minor changes (considered non-breaking changes according to our versioning policy)
are also included in this release. Make sure to look into them before upgrading.
This release drops support for Python 3.9 and adds support for Python 3.15.
New Features
multiple_ofconstraint infractionandtimedeltacore schemas by @Viicos in #13873__namespace__parameter tocreate_model()by @Viicos in #13895Changes
ordered-dictcore schema by @Viicos in #13796countercore schema by @Viicos in #13824model_configattribute by @Viicos in #13825NameEmailvalidation by @Viicos in #13897Fixes
string_sub_typeunused error code by @Viicos in #13821OverflowErrorduringByteSizevalidation by @Viicos in #13850multiple_ofconstraints to be positive by @Viicos in #13862TypeErrorgracefully during docstring extraction by @Viicos in #13874TypedDicts in JSON Schema by @Viicos in #13891ser_json_timedeltato all datetime types in serialization inference by @Viicos in #13892initandkw_only=FalsefromField()to stdlib dataclass fields by @Viicos in #13898ZoneInfovalidation by @Viicos in #13912Decimalvalidation by @Viicos in #13940Fractionvalidation by @Viicos in #13944New Contributors
pydantic/pydantic-settings (pydantic-settings)
v2.16.1Compare Source
Highlights
This patch release fixes two CLI regressions introduced in 2.16.0.
Bug fixes
CLI
CliPositionalArg[tuple[int, int]]andNamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with aSettingsErroror put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...]and bareTuple) are still variadic.type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0,--xx '[{"a":1},{"b":2}]'was merged into the single dict{"a": 1, "b": 2}and failed validation.All changes (including dependency bumps and internal maintenance)
What's Changed
Full Changelog: https://github.com/pydantic/pydantic-settings/compare/v2.16.0...v2.16.1
v2.16.0Compare Source
Highlights
Breaking changes and behavior changes
tomlifallback is gone in favor of stdlibtomllib; thetomlextra is kept as an empty extra sopip install pydantic-settings[toml]keeps working.python-dotenv>=1.2.2is now required (#971) to pick up the fix for CVE-2026-28684.validate_by_alias=False(#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raisingextra_forbidden, and the CLI exposes--applerather than--pomo.validation_aliastakes precedence overalias(#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists thevalidation_aliasflag first, andCliApp.serializeemits it.case_sensitive=False, args after--and those captured byCliUnknownArgskeep their case (-Xmx4Gno longer becomes-xmx4g). Unrecognized options are now reported as typed (--NOPEinstead of--nope).json_file_encoding/yaml_file_encodingstill override it.nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.New features
CliApp.runandvalidate_by_alias=Falsehandling; both are fixed.Settings.settings_cached()andSettings.settings_clear_cache()(#952). These give you a process-local singleton per settings class without hand-rollinglru_cachewrappers. Calling the class directly still builds a fresh instance.AWSSystemsManagerSettingsSource(#941). It recursively reads every parameter under anssm_path, with/mapping onto nested models. Install it with the newaws-systems-managerextra.env_file_depth(#940) lets a relativeenv_filebe found in parent directories, mirroringpyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to0, which keeps the current behavior.CliVariadicArgfor named variadic options (#949, #958). It accepts--param a b cin addition to repeated--param a --param b. Required fields need at least one value.Bug fixes
CLI
CliApp.serializeoutput now round-trips throughCliApp.runfor enums, tuples, dates andDecimals (#988), explicitNonevalues (#981), empty containers (#1008),CliVariadicArgvalues (#976) and populatedCliUnknownArgsfields, which previously raisedIndexError(#992).--items []) now give an empty list instead of[''](#994).frozenset,MutableSequenceand other collection subtypes are now treated as repeatable/variadic options (#972), and so are named collection type aliases such asTypeAliasType('Addrs', list[IPvAnyAddress])(#1032).cli_exit_on_error=Falseis now honored inCliSubCommandparsers, which raiseSettingsErrorinstead of exiting (#977).CliSubCommandaliases keep their case withcase_sensitive=False(#989).CliUnknownArgsfield now receives only its own subcommand's leftover args (#1004).CliApp.format_helpno longer crashes whencli_prefixis set inmodel_config(#945).Type aliases and parsing
TypeAliasType('V', list[int] | str)) now decode like their inline equivalents in env and dotenv sources, including underOptional,Annotatedand custom validation aliases (#1006, #1030, #1041).Annotatedtype alias no longer mutates sharedFieldInfometadata, which made validators run twice on subclasses or aftermodel_rebuild()(#979).AliasPath('SOME_KEY')no longer tries to JSON-decode plain string values (#980).collections.abc.Set/MutableSet/typing.AbstractSetfields now JSON-decode env values (#973).typing.Dictfield withenv_nested_delimiterno longer raisesIndexError, which was a regression in 2.13.0 (#1009).Dotenv, secrets and config files
extra='allow', a non-lowercaseenv_prefixis now stripped from dotenv extras (#959, #968).secrets_case_sensitive=Trueis now honored on Windows (#1001).~paths are now expanded when checking that the file exists (#1034), and an explicittoml_table_header=()now overrides the model config to read the file root (#1027).Cloud sources
env_parse_none_str(#1019, #1040).dash_to_underscore=Truenow works for nested model fields (#1025).NestedSecretsSettingsSourcenow validates its specific constructor arguments (#975).DotenvFilteringis exported frompydantic_settings.sources.types(#944).Documentation
strict,extra,context) passed tomodel_validate()are not applied toBaseSettings, and give a workaround (#1017).extra='forbid'doesn't reject misspelled top-level env vars (#986).populate_by_name(#933), and add a nested model example forenv_prefix_target(#953).All changes (including dependency bumps and internal maintenance)
What's Changed
NestedSecretsSettingsSourcespecific arguments by @makukha in https://github.com/pydantic/pydantic-settings/pull/975CliApp.serializeoutput parseable for enum and non-JSON values by @SulimanAbdulrazzaq in https://github.com/pydantic/pydantic-settings/pull/988CliApp.serializefor models withCliUnknownArgsfields by @truecallerabreham in https://github.com/pydantic/pydantic-settings/pull/992secrets_case_sensitiveon Windows by overriding_load_env_varsby @hramezani in https://github.com/pydantic/pydantic-settings/pull/1001samuelcolvin/check-python-versionaction to v5.1 by @Viicos in https://github.com/pydantic/pydantic-settings/pull/1014validate_by_alias=Falseon pydantic 2.14 by @maharanay22 in https://github.com/pydantic/pydantic-settings/pull/1022validate_by_alias=Falseby @hramezani in https://github.com/pydantic/pydantic-settings/pull/1033New Contributors
Full Changelog: https://github.com/pydantic/pydantic-settings/compare/v2.15.0...v2.16.0
python/cpython (python)
v3.15.1Compare Source
v3.15.0Compare Source
v3.14.9Compare Source
v3.14.8Compare Source
astral-sh/ruff (ruff)
v0.17.1Compare Source
Released on 2026-10-15.
Preview features
pycodestyle] Don't treatNone,True, orFalseas keywords (E271-E274) (#29322)Bug fixes
flake8-pyi] Detect legacy positional-only parameters in__new__methods (PYI063) (#28502)flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)perflint] Avoid invalid comprehension suggestions (PERF401,PERF403) (#29366)Rule changes
collectionsandweakrefcontainers as mutable (#29213)Documentation
flake8-import-conventions] Update default and examplealiases(#29333)Contributors
v0.17.0Compare Source
Released on 2026-10-09.
The executables in our macOS and Windows release archives and
ruffwheels are now code-signed.macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows
executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables
verification of the release publisher and binary integrity, supports publisher-based allowlisting,
and should reduce security warnings and antivirus false positives.
Breaking changes
Update the default and latest Python versions for 3.15 (#28792)
Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through
target-versionorrequires-python. Whenchecking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15
instead of 3.14.
Update the default rule set (#28786)
Several of the
flake8-datetimezrules(
DTZ001,DTZ005,DTZ006,DTZ007,DTZ011,DTZ012, andDTZ901) are no longer enabled by default,while
undefined-local-with-nested-import-star-usage(
F406), which corresponds to a syntax error, is now enabled by default.Update Rust crate quick-junit to 0.8.0 (#27295)
JUnit output now uses a
skippedattribute instead ofdisabledon<testsuite>elements andincludes a
skippedattribute on the root<testsuites>element.[
flake8-import-conventions] Adddatetime as dtas a conventional alias (ICN001) (#28790)Support Unicode dummy variable names (#28722)
The default
lint.dummy-variable-rgxnow recognizes underscore-prefixed Unicode names, such as
_次, as dummy variables.Update to Unicode 17 (#21229, #28784)
Ruff now uses Unicode 17 data for identifier normalization and named character escapes (
"\N{...}").Always show unsafe and display-only fixes in the CLI (#27810)
The default
fulloutput format now shows unsafe fixes and suggestions requiring manual review,regardless of the
unsafe-fixessetting.Actually applying unsafe fixes still requires explicit opt-in.
Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)
The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and
linux-ppc64le platforms, and now includes shell completions. However, no longer depending on
Python means that
python -m ruffandimport ruffwill no longer work. Useruffdirectly fromPATHinstead. PyPI installations and those from the standalone installer are unaffected.Remove support for ruff-lsp (#28750)
Support for
ruff-lsp, the legacy Python language server deprecated in Ruffv0.9.5, has been removed. The Ruff VS Code
extension now always uses the native language server;
ruff.nativeServeris deprecated andignored. See the migration guide.
Stabilization
The following rules have been stabilized and are no longer in preview:
lazy-import-mismatch(TID254)lazy-import-immediately-resolved(
TID255)os-path-commonprefix(RUF071)The following behaviors have been stabilized:
unsorted-imports(I001),line-too-long(E501), anddoc-line-too-long(W505) nowconsistently ignore trailing pragma comments when computing line length. This resolved several
bugs involving interactions between these rules
(#27313) but may also cause existing imports to be
reformatted and was thus classified as a breaking change.
Preview features
flake8-bugbear] Report the method name and a more precise range (B005) (#27050)refurb] Mark fix unsafe and move tosuspicious(FURB152) (#28405)ruff] Allow docstrings in strict mode (RUF067) (#28679)Bug fixes
flake8-builtins] Expand checks in class scopes (A001) (#29076)flake8-self] Allow private access onobject.__new__(cls)instances (SLF001) (#29001)flake8-tidy-imports] Skiplazy-import-mismatchin stubs (TID254) (#29095)flake8-type-checking] Add the notion of runtime-ambiguous references (#26508)flake8-type-checking] Never flag annotations in function scopes (#29183)pyflakes] Mark the fix as unsafe when it creates a docstring (F541) (#28258)pylint] Preserve trailing comments inuseless-returnfix (PLR1711) (#29180)ruff] Avoid false positive whenpytest.raisesis used in awithstatement (RUF061) (#28186)Rule changes
pyupgrade] Suggesttyping.TypeFormon Python 3.15 (UP035) (#29084)Contributors
v0.16.10Compare Source
Release Notes
Released on 2026-10-01.
Preview features
pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)Performance
Server
uv formatin untrusted workspaces (#28873)Documentation
Other changes
Contributors
Install ruff 0.16.10
Install prebuilt binaries via shell script
Install prebuilt binaries via powershell script
Download ruff 0.16.10
Verifying GitHub Artifact Attestations
The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:
You can also download the attestation from GitHub and verify against that directly:
astral-sh/ty (ty)
v0.0.90Compare Source
Released on 2026-10-20.
Bug fixes
LSP server
Other changes
Contributors
v0.0.89Compare Source
Released on 2026-10-16.
Core type checking
Added support for return type inference for unannotated functions and methods (#29253).
Return type inference is currently disabled by default. Enable it with the
analysis.return-type-inferencesetting inpyproject.toml:Or in
ty.toml:Please share your feedback, especially any problems you encounter, in the return type inference feedback issue.
Sync vendored typeshed stubs (#29402). Typeshed diff
Bug fixes
GenericandProtocolarguments containing nested variadic type variables (#29146)Performance
Contributors
v0.0.88Compare Source
Released on 2026-10-15.
Bug fixes
invalid-mutable-overrideerrors when overridingobjectattributes (#29373)ClassVar(#29367)Diagnostic improvements
Core type checking
AnyorUnknown(#28973)Contributors
v0.0.87Compare Source
Released on 2026-10-13.
LSP server
Diagnostic improvements
mismatched-sentinel-namerule (#27206)invalid-mutable-overrideby default (#29335)Core type checking
TypedDict.getcalls (#29136)type[...]type context (#29248)Performance
Contributors
v0.0.86Compare Source
Released on 2026-10-09.
The executables in our macOS and Windows release archives and
tywheels are now code-signed.macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows
executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables
verification of the release publisher and binary integrity, supports publisher-based allowlisting,
and should reduce security warnings and antivirus false positives.
Bug fixes
Annotatedvalues (#29058)LSP server
Core type checking
Performance
Memory usage improvements
Other changes
Contributors
v0.0.85Compare Source
Released on 2026-10-06.
Preview features
Bug fixes
CLI
LSP server
Diagnostic improvements
truthiness-test-of-none-unionrule (#28889)disjoint-castdiagnostics in situations where the value could have been inferred as being compatible with the casted type if it had only been inferred with the right type context (#28851)Core type checking
__all__(#28972)TypeVarTuples in materialization checks (#28815)Performance
Memory usage improvements
Contributors
MagicStack/uvloop (uvloop)
v0.23.0Compare Source
Changes
Add Python 3.15 and 3.15t wheel builds and CI coverage (#758)
(by @honglei @fantix in
f7c0547)Add support for the
eager_startkeyword argument in create_task() (#748)(by @samypr100 in
3cbb095for #746 #718)Add thread name prefix to the default thread pool executor (#636)
(by @inikolaev @fantix in
0582f94for #562)Add support for special hostname
<broadcast>(#592)(by @jpbede in
3060cebfor #540)Upgrade libuv to v1.52.1 (#753)
(by @fantix in
e8efea4for #752)Improve performance by using Python C API to enter/exit context (#627)
(by @tarasko in
837ef22)Improve performance/latency of Transport.write (#619)
(by @tarasko in
1d9b6e0)Replace some SSL vectorcall with direct methods (#626)
(by @tarasko in
6a27cbe)Optimize SSL buffered reads using C values (#629)
(by @tarasko in
a308f75)Fixes
Detach socket on create_connection cancellation to prevent fd double-close (#740)
(by @junjzhang @fantix in
dc680ebfor #645 #738)Remove
loop._ready_lenin favor oflen(loop._ready)(#721)(by @x42005e1f in
5910a18for #720)Prefer inspect.iscoroutinefunction (#705)
(by @MatthieuDartiailh in
fd65027for #703)Fix context tests by explicitly yielding after run_in_executor (#743)
(by @samypr100 in
6cd24cb)Fix test_create_connection_open_con_addr with Python 3.13.9+ (#713)
(by @shadchin in
b93141afor #701)Skip flaky test_cancel_post_init on asyncio 3.13+ (#714)
(by @fantix in
3ea5c85for #709)Fix flaky test_fs_event (#717)
(by @fantix in
8da4547)Use C __atomic builtins for debug counters (#719)
(by @fantix in
836e3b2)Update the example to work with Python 3.14 (#710)
(by @Jamie-Chang in
b74c2f1)Build
Replace pkg_resources with packaging and use Cython 3.1 (#742)
(by @samypr100 in
b377b7cfor #729)Remove wheel as a build dependency (#696)
(by @DimitriPapadopoulos in
173e88c)Support any number of flags in UVLOOP_OPT_CFLAGS (#630)
(by @mgorny in
963a5f3)Configuration
📅 Schedule: (in timezone Europe/Amsterdam)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
672a5eee192f715112ff2f715112ff055674187b055674187b98e90452dd98e90452ddf26c559725f26c5597253d2dee6a223d2dee6a22886523038c886523038cd95b645815⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: backend/uv.lock
d95b64581534f84a722e34f84a722e34453e4b3b34453e4b3bef03e7372def03e7372dcc09b88775cc09b887751d518b9d031d518b9d0332b86b834a32b86b834a2a87dba00d2a87dba00d98711f5d4eView command line instructions
Checkout
From your project repository, check out a new branch and test the changes.