Skip to content

Bump the python-packages group with 3 updates - #74

Merged
d33bs merged 1 commit into
mainfrom
dependabot/uv/python-packages-705cf304c2
Oct 1, 2026
Merged

Bump the python-packages group with 3 updates#74
d33bs merged 1 commit into
mainfrom
dependabot/uv/python-packages-705cf304c2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-packages group with 3 updates: copier, pandas and prek.

Updates copier from 9.17.2 to 9.18.2

Release notes

Sourced from copier's releases.

v9.18.2 (2026-09-07)

Fix

  • allow overwriting destination symlinks when preserve_symlinks: false
  • cache: resolve submodules from the current checkout's .gitmodules (#2767)

Security

  • prevent trust bypass via ambiguous URL characters

    To prevent URL confusion attacks, trusted prefix matching is now restricted to repository URL paths containing only RFC 3986 §2.3 "unreserved" characters (letters, digits, -, ., _, ~) and /. URL paths containing other characters now require an exact, verbatim match.

v9.18.1 (2026-09-01)

Fix

  • disambiguate Windows paths from SCP URLs in trust check

v9.18.0 (2026-09-01)

Feat

  • exclude: add support for multiple exclude patterns in a single entry (#2804)

Fix

  • preserve the original error when cleanup fails (#2824)

Security

  • prevent trust bypass via encoded URL traversal for alias and SCP-style URLs
Changelog

Sourced from copier's changelog.

v9.18.2 (2026-09-07)

Fix

  • allow overwriting destination symlinks when preserve_symlinks: false
  • cache: resolve submodules from the current checkout's .gitmodules (#2767)

Security

  • prevent trust bypass via ambiguous URL characters

    To prevent URL confusion attacks, trusted prefix matching is now restricted to repository URL paths containing only RFC 3986 §2.3 "unreserved" characters (letters, digits, -, ., _, ~) and /. URL paths containing other characters now require an exact, verbatim match.

v9.18.1 (2026-09-01)

Fix

  • disambiguate Windows paths from SCP URLs in trust check

v9.18.0 (2026-09-01)

Feat

  • exclude: add support for multiple exclude patterns in a single entry (#2804)

Fix

  • preserve the original error when cleanup fails (#2824)

Security

  • prevent trust bypass via encoded URL traversal for alias and SCP-style URLs
Commits
  • 217e4f8 bump: version 9.18.1 → 9.18.2
  • 50b1927 fix: prevent trust bypass via ambiguous URL characters
  • bfa05c1 fix: allow overwriting destination symlinks when preserve_symlinks: false
  • 68c8aa2 fix(cache): resolve submodules from the current checkout's .gitmodules (#2767)
  • 03c95e2 bump: version 9.18.0 → 9.18.1
  • 2a3e140 fix: disambiguate Windows paths from SCP URLs in trust check
  • b65cd70 bump: version 9.17.2 → 9.18.0
  • dcae663 fix: prevent trust bypass via encoded URL traversal for alias and SCP-style URLs
  • bb956bb build(deps): update dependency ruff to v0.16.5
  • 27d3629 build(deps): lock file maintenance
  • Additional commits viewable in compare view

Updates pandas from 3.0.5 to 3.0.6

Release notes

Sourced from pandas's releases.

pandas 3.0.6

We are pleased to announce the release of pandas 3.0.6. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits
  • 2905718 RLS: 3.0.6
  • 3188ced [backport 3.0.x] BUG: read_csv(sep=None) raised TypeError instead of falling...
  • f097905 DOC: cleanup 3.0.6 whatsnew + mention Python 3.15 support (#68965) (#68969)
  • 4f68223 [backport 3.0.x] BUG: fix setting with bool column mask into 1-column DataFra...
  • e3df0e8 [backport 3.0.x] BUG: full-slice setitem into a pyarrow-backed array shared m...
  • b7735f6 Backport PR #66117 on branch 3.0.x (BUG: interpolate leaving NAs unfilled for...
  • bca0b77 [backport 3.0.x] BUG: read_csv leaked the string-intern table when a column f...
  • bca1e5d [backport 3.0.x] BUG: prevent external mutation of RangeIndex._data (CoW) (#6...
  • c95b42c [3.0.x] CI: skip cython-lint on pre-commit.ci (#68910)
  • 9cbd884 [backport 3.0.x] Backport of some already merged regression fixes (#68447)
  • Additional commits viewable in compare view

Updates prek from 0.4.14 to 0.5.3

Release notes

Sourced from prek's releases.

0.5.3

Release Notes

Released on 2026-09-13.

Enhancements

  • Add PEP 740 attestations for PyPI releases (#2705)
  • Add a check-jsonc builtin hook (#2682)
  • Allow disabling automatic uv installation (#2702)

Bug fixes

  • Fix Julia additional dependency specifiers (#2703)
  • Update granit-parser to fix YAML flow indentation (#2707)

Contributors

Install prek 0.5.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.3

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.3

Released on 2026-09-13.

Enhancements

  • Add PEP 740 attestations for PyPI releases (#2705)
  • Add a check-jsonc builtin hook (#2682)
  • Allow disabling automatic uv installation (#2702)

Bug fixes

  • Fix Julia additional dependency specifiers (#2703)
  • Update granit-parser to fix YAML flow indentation (#2707)

Contributors

0.5.2

Released on 2026-09-03.

Enhancements

  • Allow unknown tags by default in check-yaml (#2678)

Contributors

0.5.1

Released on 2026-09-01.

Enhancements

  • Add --hide-status <passed|failed|skipped> for hook reports (#2644)
  • Add prek init for repository setup (#2636)
  • Apply hook env during environment creation (#2650)
  • Disable error snippets in check-yaml diagnostics (#2664)
  • Show hooks excluded by skip selectors (#2645)
  • Support Pixi for Conda environments (#2667)
  • Support cargo-binstall for Rust CLI dependencies (#2658)
  • Warn about unused keys in user settings (#2665)

Bug fixes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python-packages group with 3 updates
54c9cc2 
Bumps the python-packages group with 3 updates: [copier](https://github.com/copier-org/copier), [pandas](https://github.com/pandas-dev/pandas) and [prek](https://github.com/j178/prek).


Updates `copier` from 9.17.2 to 9.18.2
- [Release notes](https://github.com/copier-org/copier/releases)
- [Changelog](https://github.com/copier-org/copier/blob/master/CHANGELOG.md)
- [Commits](copier-org/copier@v9.17.2...v9.18.2)

Updates `pandas` from 3.0.5 to 3.0.6
- [Release notes](https://github.com/pandas-dev/pandas/releases)
- [Commits](pandas-dev/pandas@v3.0.5...v3.0.6)

Updates `prek` from 0.4.14 to 0.5.3
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.14...v0.5.3)

---
updated-dependencies:
- dependency-name: copier
  dependency-version: 9.18.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: pandas
  dependency-version: 3.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: prek
  dependency-version: 0.5.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 1, 2026
@dependabot
dependabot Bot requested a review from d33bs as a code owner October 1, 2026 13:20
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 1, 2026
d33bs
d33bs approved these changes Oct 1, 2026
View reviewed changes

@d33bs d33bs left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI checks pass.

@d33bs
d33bs merged commit 092e641 into main Oct 1, 2026
9 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/python-packages-705cf304c2 branch October 1, 2026 15:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@d33bs d33bs d33bs approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@d33bs