Skip to content

Bump the python group with 3 updates - #105

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-15b645b1b5
Open

Bump the python group with 3 updates#105
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-15b645b1b5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the python group with 3 updates: ruff, ty and openapi-python-client.

Updates ruff from 0.16.5 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

Commits

Updates ty from 0.0.75 to 0.0.78

Release notes

Sourced from ty's releases.

0.0.78

Release Notes

Released on 2026-09-02.

Bug fixes

  • Defer decorator-call diagnostics to avoid recursive-default cycles (#28226)
  • Make cyclic intersection simplification deterministic (#28156)
  • Stabilize cyclic terminal-call reachability (#28216)

Preview features

  • Refresh uv workspace metadata when dependencies change (#28224)

Diagnostics

  • Add a new disjoint-cast rule (#28129)
  • Report deprecated property accessors on intersections (#28250)
  • Report deprecations for implicit constructor calls (#28251)
  • Report deprecations for overloads, operators, and properties (#28134)
  • Respect overload selection in deprecation diagnostics (#28148)

Core type checking

  • Fix negative narrowing for protocols with gradual members (#28198)
  • Preserve ParamSpec bindings inferred against type context (#28084)
  • Preserve generic protocol materialization relations (#28246)
  • Preserve uncertain branches during quantification (#28211)
  • Respect type variables in top/bottom materializations of invariant generics (#28072)
  • Sync vendored typeshed stubs (#28217). Typeshed diff
  • Treat captured bound-method receivers covariantly (#28180)
  • Unsound intersection simplification for generic iterables (#28068)
  • Validate type variable scopes in constructors and aliases (#28130)
  • lambda functions are always truthy (#28254)

Performance

  • Optimize materialized recursive protocol comparisons (#28079)
  • Optimize recursive protocol checks for nested type variables (#28257)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.78

Released on 2026-09-02.

Bug fixes

  • Defer decorator-call diagnostics to avoid recursive-default cycles (#28226)
  • Make cyclic intersection simplification deterministic (#28156)
  • Stabilize cyclic terminal-call reachability (#28216)

Preview features

  • Refresh uv workspace metadata when dependencies change (#28224)

Diagnostics

  • Add a new disjoint-cast rule (#28129)
  • Report deprecated property accessors on intersections (#28250)
  • Report deprecations for implicit constructor calls (#28251)
  • Report deprecations for overloads, operators, and properties (#28134)
  • Respect overload selection in deprecation diagnostics (#28148)

Core type checking

  • Fix negative narrowing for protocols with gradual members (#28198)
  • Preserve ParamSpec bindings inferred against type context (#28084)
  • Preserve generic protocol materialization relations (#28246)
  • Preserve uncertain branches during quantification (#28211)
  • Respect type variables in top/bottom materializations of invariant generics (#28072)
  • Sync vendored typeshed stubs (#28217). Typeshed diff
  • Treat captured bound-method receivers covariantly (#28180)
  • Unsound intersection simplification for generic iterables (#28068)
  • Validate type variable scopes in constructors and aliases (#28130)
  • lambda functions are always truthy (#28254)

Performance

  • Optimize materialized recursive protocol comparisons (#28079)
  • Optimize recursive protocol checks for nested type variables (#28257)

Contributors

0.0.77

... (truncated)

Commits

Updates openapi-python-client from 0.29.0 to 0.29.1

Release notes

Sourced from openapi-python-client's releases.

0.29.1 (2026-08-30)

🚨Security

Arbitrary code generation vulnerability

Prior to this release, malicious OpenAPI documents could cause openapi-python-client to generate arbitrary code, which would then be executed by consumers of the generated client.

If you generate code from OpenAPI documents you don't control, you should upgrade to this release as soon as possible and validate any previously-generated code.

See the GitHub advisory for more details.

🚀 Features

  • Update uv_build to 0.12 when using --meta=uv (#1473)

🐛 Fixes

  • Apply PEP 639 for improved license metadata (#1459)
  • update generated code to use StrEnum and -> Self (#1474)
  • Remove trailing spaces in README example code (#1475)
  • Stopped generating empty docstrings for models with no description

Fixed invalid Python identifiers when resolving naming conflicts

When two property or parameter names conflicted after conversion to snake_case (e.g. foo-bar and fooBar), the conflict-resolution path preserved delimiters like -, ., and spaces in the generated Python identifiers, producing invalid code which failed generation. Conflicting names now keep their original casing but have any characters which are invalid in Python identifiers stripped (e.g. foobar and fooBar).

Improve readability of error messages

Errors and warnings which include a snippet of your OpenAPI document now render that snippet as JSON, making them much easier to read.

📝Notes

Breaking changes for all custom templates

ALL custom templates are expected to break with this version as a result of the security fix.

  1. The utils global has been renamed to strings
  2. Most string values can no longer be rendered directly into templates, you must describe how the value is being used so it can be properly escaped using either a Python function or Jinja filter:
    1. strings.snake_case() / | snakecase (existing)
    2. strings.kebab_case() / | kebabcase (existing)
    3. strings.pascal_case() / | pascalcase (existing)
    4. python_identifier() (existing)
    5. class_name() (existing)
    6. strings.safe_for_docstring() / | safe_for_docstring for values which get injected into a """ docstring
    7. strings.in_f_string_literal() / | in_f_string_literal for values that go into f"" f-strings
    8. strings.in_double_quote_literal() / | in_double_quote_literal for values that go into non-f-string "" literals
    9. .as_unembedded_code() / | as_unembedded_code ONLY for PythonCode values—those that are intended to be Python code which is not embedded into any string/docstring. Examples include usages of .python_code, .get_type_string(), .get_instance_type_string(), .get_type_strings_in_union(). You should not assume these values are safe to put in docstrings, string literals, or f-string literals. Use the dedicated helpers for those.

... (truncated)

Changelog

Sourced from openapi-python-client's changelog.

0.29.1 (2026-08-30)

🚨Security

Arbitrary code generation vulnerability

Prior to this release, malicious OpenAPI documents could cause openapi-python-client to generate arbitrary code, which would then be executed by consumers of the generated client.

If you generate code from OpenAPI documents you don't control, you should upgrade to this release as soon as possible and validate any previously-generated code.

See the GitHub advisory for more details.

🚀 Features

  • Update uv_build to 0.12 when using --meta=uv (#1473)

🐛 Fixes

  • Apply PEP 639 for improved license metadata (#1459)
  • update generated code to use StrEnum and -> Self (#1474)
  • Remove trailing spaces in README example code (#1475)
  • Stopped generating empty docstrings for models with no description

Fixed invalid Python identifiers when resolving naming conflicts

When two property or parameter names conflicted after conversion to snake_case (e.g. foo-bar and fooBar), the conflict-resolution path preserved delimiters like -, ., and spaces in the generated Python identifiers, producing invalid code which failed generation. Conflicting names now keep their original casing but have any characters which are invalid in Python identifiers stripped (e.g. foobar and fooBar).

Improve readability of error messages

Errors and warnings which include a snippet of your OpenAPI document now render that snippet as JSON, making them much easier to read.

📝Notes

Breaking changes for all custom templates

ALL custom templates are expected to break with this version as a result of the security fix.

  1. The utils global has been renamed to strings
  2. Most string values can no longer be rendered directly into templates, you must describe how the value is being used so it can be properly escaped using either a Python function or Jinja filter:
    1. strings.snake_case() / | snakecase (existing)
    2. strings.kebab_case() / | kebabcase (existing)
    3. strings.pascal_case() / | pascalcase (existing)
    4. python_identifier() (existing)
    5. class_name() (existing)
    6. strings.safe_for_docstring() / | safe_for_docstring for values which get injected into a """ docstring
    7. strings.in_f_string_literal() / | in_f_string_literal for values that go into f"" f-strings
    8. strings.in_double_quote_literal() / | in_double_quote_literal for values that go into non-f-string "" literals

... (truncated)

Commits
  • 4a2f3db Release 0.29.1 (#1460)
  • 1c99af4 Comprehensive string handling rewrite (#1483)
  • ee9a8c4 chore(deps): update pypa/gh-action-pypi-publish action to v1.14.2 (#1476)
  • edaae66 fix: Remove trailing spaces in README example code (#1475)
  • 2216c15 feat: Update uv_build to 0.12 when using --meta=uv (#1473)
  • 2aae596 fix: update generated code to use StrEnum and -> Self (#1474)
  • 468cfda chore(deps): update actions/checkout action to v7.0.1 (#1470)
  • 852116c chore(deps): pin dependencies (#1467)
  • d5c5367 chore(deps): update actions/cache action to v6.1.0 (#1468)
  • 0414726 Update Renovate configuration
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python group with 3 updates
86b603f 
Bumps the python group with 3 updates: [ruff](https://github.com/astral-sh/ruff), [ty](https://github.com/astral-sh/ty) and [openapi-python-client](https://github.com/openapi-generators/openapi-python-client).


Updates `ruff` from 0.16.5 to 0.16.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.5...0.16.6)

Updates `ty` from 0.0.75 to 0.0.78
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.75...0.0.78)

Updates `openapi-python-client` from 0.29.0 to 0.29.1
- [Release notes](https://github.com/openapi-generators/openapi-python-client/releases)
- [Changelog](https://github.com/openapi-generators/openapi-python-client/blob/main/CHANGELOG.md)
- [Commits](openapi-generators/openapi-python-client@v0.29.0...v0.29.1)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: ty
  dependency-version: 0.0.78
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: openapi-python-client
  dependency-version: 0.29.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner September 7, 2026 01:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants