Skip to content

fix(deps): update all non-major dependencies - #25

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#25
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
actions/setup-python (changelog) action digest 5fda3b9 → 6d4fd22
anyio (changelog) project.dependencies minor >=4.15.1 → >=4.16.0 age confidence
docker/login-action (changelog) action digest dbcb813 → 81c6f93
pre-commit dependency-groups minor >=4.6.2 → >=4.7.0 age confidence
pydantic (changelog) project.dependencies minor >=2.13.5 → >=2.14.2 age confidence
pydantic-settings (changelog) project.dependencies minor >=2.15.0 → >=2.16.2 age confidence
pytest (changelog) dependency-groups minor >=9.1.1 → >=9.2.0 age confidence
pytest-asyncio (changelog) dependency-groups patch >=1.4.0 → >=1.4.1.post1 age confidence
python (source) minor 3.14 → 3.15 age confidence
python (source) requires-python minor >=3.14.7 → >=3.15.2 age confidence
python (source) final minor 3.14-slim → 3.15-slim age confidence
python (source) stage minor 3.14-slim → 3.15-slim age confidence
ruff (source, changelog) dependency-groups minor >=0.16.9 → >=0.17.3 age confidence

Release Notes

agronholm/anyio (anyio)

v4.16.0

Compare Source

New features

  • Added BlockingPortal.call_async() for asynchronously calling into an event loop with optional abandonment on cancellation (#​1342; PR by @​davidbrochart)
  • Added SOCK_SEQPACKET support to connect_unix() and create_unix_listener() (#​1349; PR by @​theunkn0wn1)

Other changes

  • Changed UDP sockets on the asyncio backend to make send() wait until the datagram has been passed to the operating system (#​1294; PR by @​graingert)

Bug fixes

  • Fixed documentation implying that use_uvloop=True falls back to the standard event loop when uvloop (winloop on Windows) is not installed, and showed how to skip the corresponding pytest backend variant when the dependency is missing (#​645; PR by @​GruffElixir)
  • Fixed get_current_task() on the asyncio backend raising an opaque TypeError: cannot create weak reference to 'NoneType' object instead of a clear error when called from a callback scheduled via loop.call_soon_threadsafe() (e.g. from within from_thread.run_sync()), where asyncio.current_task() is legitimately None (#​773; PR by @​AmirF194)
  • Fixed CancelScope on the asyncio backend swallowing a native Task.cancel() that was delivered in the same event loop iteration as the scope's own cancellation (such as a move_on_after() deadline expiring), which left the host task with a pending cancellation request that never raised CancelledError (#​1214)
  • Fixed UDP socket closing hanging if a datagram send was still in flight (#​1237; PR by @​graingert)
  • Fixed concurrent aclose_forcefully() calls on asyncio socket streams returning before the underlying socket was closed (#​1273; PR by @​graingert)
  • Fixed aclose() on sockets not checkpointing, and thus failing to raise a cancellation exception when called inside a cancelled scope (affected UNIX socket streams and UNIX datagram sockets on asyncio, and all sockets on Trio) (#​1288; PR by @​graingert)
  • Fixed aclose() on asyncio TCP socket listeners not checkpointing, and leaking the listening socket if cancelled while another task was waiting in accept() (#​1289; PR by @​graingert)
  • Fixed accept() on asyncio UNIX socket listeners hanging forever, and leaving the listening socket registered with the event loop, when the listener was closed by another task (#​1289; PR by @​graingert)
  • Fixed send() on asyncio TCP and UDP sockets returning normally, despite the data being discarded, when the socket was closed by another task (or, for TCP, the connection was lost) while send() was waiting for the operating system to accept the data (#​1289; PR by @​graingert)
  • Fixed SocketStream.send() on the asyncio backend handing its data to a paused transport after a previous send() was cancelled (#​1299; PR by @​graingert)
  • Fixed sleep() treating a negative delay (including -inf) inconsistently across backends (asyncio returned immediately; Trio raised ValueError) by raising ValueError on all backends (#​1306; PR by @​BetterAndBetterII)
  • Fixed create_tcp_listener() occasionally failing with a message like Could not create 2 listeners with a consistent port when an ephemeral port is requested and IPv6 is enabled and the dual-stack path is not available or a specific local host name was given (#​1313)
  • Fixed AsyncFile not shielding against cancellation while closing (#​1314)
  • Fixed TemporaryDirectory.cleanup() reacting to cancellation prematurely when the host task was already cancelled, causing the actual cleanup operation to be skipped (#​1316; PR by @​Yasser-Ameur)
  • Fixed a NaN deadline being accepted on asyncio while Trio raised ValueError, which silently disabled the timeout (fail_after(math.nan) returned instead of raising TimeoutError); CancelScope now rejects it on both backends (#​1317; PR by @​dylanpulver)
  • Fixed FileReadStream and FileWriteStream leaving files open when cancelled during context manager exit, including unflushed writes (#​1318; PR by @​Kuang-xianxin)
  • Fixed Condition.notify() and Condition.notify_all() failing when the underlying lock was acquired directly rather than through the condition (#​1319; PR by @​GruffElixir)
  • Fixed importing AnyIO with loaders that do not provide __file__, such as PyOxidizer, raising TypeError instead of falling back to eager imports (#​1322; PR by @​skulitom)
  • Fixed text receive streams silently discarding incomplete characters at end-of-file instead of applying the configured decoding error handler (#​1339; PR by @​Aurelucien)
  • Fixed Semaphore(fast_acquire=True) losing its fast-acquire behavior when instantiated outside a running event loop (#​1348; PR by @​feiiiiii5)
  • Fixed BlockingPortalProvider permanently failing with an AttributeError on every subsequent use if the first attempt to start its blocking portal failed (#​1350; PR by @​Yasser-Ameur)
  • Fixed create_udp_socket() silently ignoring the local_port argument when local_host was omitted, making the socket bind to a random ephemeral port instead of the requested one (#​1351; PR by @​januththedev)
  • Fixed worker threads on the asyncio backend never returning to the idle pool (and thus never being reused or pruned) when a to_thread.run_sync() call was cancelled after it had been queued for the worker but before the worker thread had picked it up (#​1352; PR by @​Zac-HD)
  • Fixed pytest plugin running Hypothesis async tests only on the first parametrized backend instead of each backend (#​1353; PR by @​DYNOSuprovo)
  • Fixed TypeError when subclassing an existing TypedAttributeSet subclass, and this subclass contains type annotations (#​1358; PR by @​pasmud)
  • Fixed Lock.locked() (and Condition.locked()) raising NoEventLoopError when the lock was created outside a running event loop (#​1362; PR by @​00200200)
  • Fixed connect_tcp() leaking a connected socket when an enclosing cancel scope was cancelled before the connection attempt task group exited (#​1364; PR by @​charan-rathore)
  • Fixed create_connected_udp_socket() silently ignoring local_port when local_host was not given: the local address was left unset, so the OS picked an ephemeral port instead of the requested one (#​1365; PR by @​feiiiiii5)
  • Fixed BlockingPortalProvider not passing the exception raised in its with block on to the start_blocking_portal() context manager it wraps (#​1366; PR by @​feiiiiii5)
  • Fixed anyio.itertools.islice() not consuming the first start items when stop <= start (#​1372; PR by @​Rodrigo-Palma)
  • Fixed BufferedByteReceiveStream.receive_exactly() and receive_until() returning buffered data after explicit closure instead of raising ClosedResourceError (#​1378; PR by @​kokotatan)
  • Fixed a TLS stream sending records the peer could no longer decrypt after a cancelled send() lost an already-encrypted record; the stream now raises BrokenResourceError on further use instead (#​1385; PR by @​Kayvan-Zahiri)
  • Fixed close() on memory object streams not waking up tasks blocked in send() or receive() on the same stream (#​1391)
  • Fixed anyio.itertools.product() acquiring and consuming unused input iterables when repeat=0 (#​1394; PR by @​sricharanreddycheruku)
  • Fixed SpooledTemporaryFile rolling over to disk on writes when max_size is zero (the default) (#​1397; PR by @​fhgffy)
  • Fixed Trio UDP sockets remaining open when initialization failed or was cancelled (#​1400; PR by @​adenzhou1350)
  • Fixed SpooledTemporaryFile.rollover() moving the current file position to the end of the file (#​1401; PR by @​fhgffy)
  • Fixed cancellation during temporary directory creation leaving the directory behind while its context manager is retained (#​1403; PR by @​adenzhou1350)
  • Fixed cancellation during SpooledTemporaryFile.rollover() losing buffered contents (#​1404; PR by @​adenzhou1350)
  • Fixed TextSendStream.send() re-emitting the byte order mark on every item with BOM-emitting encodings (utf-16, utf-32, utf-8-sig), which made the peer decode a stray \ufeff in front of every message after the first (#​1405; PR by @​feiiiiii5)
  • Fixed buffered byte streams returning empty bytes when a wrapped object stream received empty messages instead of waiting for data or raising EndOfStream (#​1409; PR by @​00200200)
  • Fixed BlockingPortal crashing with InvalidStateError when a future it returned was cancelled just as the callable was completing (#​1410; PR by @​adenzhou1350)
  • Fixed UNIXSocketStream.send_fds() silently truncating messages on short socket writes (#​1422; PR by @​AryanRG)
  • Fixed cancelled TCP receives on the asyncio backend leaving transport reads enabled, allowing incoming data to accumulate while the application was not receiving. (#​1423; PR by @​Master-Norna)
  • Fixed CapacityLimiter.acquire_on_behalf_of() on asyncio releasing the wrong borrower when the acquiring task was cancelled during the cancel-shielded checkpoint that runs after a non-blocking acquisition
pre-commit/pre-commit (pre-commit)

v4.7.0

Compare Source

==================

Fixes
pydantic/pydantic (pydantic)

v2.14.2: 2026-10-29

Compare Source

v2.14.2 (2026-10-29)

This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.

Packaging
Performance
Fixes

  • Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #​13275.

    JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an
    unused alias or field name are now treated as extra data, instead of being silently dropped:

    from pydantic import BaseModel, ConfigDict
from pydantic.alias_generators import to_camel

class Page(BaseModel):
    model_config = ConfigDict(extra='forbid', alias_generator=to_camel)

    page_size: int = 10

Page.model_validate_json('{"page_size": 50}')
# Before: Page(page_size=10)
# After: ValidationError (extra_forbidden)

    See the pull request for the full list of behavior changes.
    This change addresses GHSA-qpmf-fgh3-ff25.

  • Ignore extra data matching a field name in TypedDict and dataclasses with extra=allow by @​Viicos in #​14090. Addresses GHSA-3r8g-cqwr-jr29.

  • Fix unpickling of generic classes defined in separate module by @​Viicos in #​13994

  • Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #​13997

  • Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #​14027

  • Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #​14028

  • Implement recursion guard for validate_strings() by @​Viicos in #​14029

  • Support named tuples in Sequence serialization by @​Viicos in #​14033

  • Take preserve_empty_path into account in URL types equality by @​Viicos in #​14035

  • Fix pickling of PydanticCustomError and ValidationErrors containing custom errors by @​Viicos in #​14051

  • Do not extract attribute docstrings from nested classes and functions by @​Viicos in #​14052

  • Fix forward annotations evaluation and type variables substitution when rebuilding parametrized generic models by @​Viicos in #​14054

  • Fix Self resolution in parametrized generics by @​Viicos in #​14065

  • Check mapping max_length constraint during validation by @​Viicos in #​14092

  • Fix deep copy of self-referential models by @​Viicos in #​14116

Full Changelog: pydantic/pydantic@v2.14.1...v2.14.2

v2.14.1

Compare Source

GitHub release

The code released in v2.5.0 is functionally identical to that of v2.5.0b1.

What's Changed
Packaging
  • Update pydantic-core from 2.10.1 to 2.14.1, significant changes from these updates are described below, full changelog here
  • Update to pyright==1.1.335 by @​Viicos in #​8075
New Features
Changes
  • Significant Change: replace ultra_strict with new smart union implementation, the way unions are validated has changed significantly to improve performance and correctness, we have worked hard to absolutely minimise the number of cases where behaviour has changed, see the PR for details - by @​davidhewitt in pydantic/pydantic-core#867
  • Add support for instance method reassignment when extra='allow' by @​sydney-runkle in #​7683
  • Support JSON schema generation for Enum types with no cases by @​sydney-runkle in #​7927
  • Warn if a class inherits from Generic before BaseModel by @​alexmojaki in #​7891
Performance
Fixes
New Contributors
pydantic
pydantic-core

v2.14.0

Compare Source

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post.
Several minor changes (considered non-breaking changes according to our versioning policy)
are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features
Changes
Fixes
New Contributors
pydantic/pydantic-settings (pydantic-settings)

v2.16.2

Compare Source

v2.16.1

Compare Source

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

  • Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#​1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
  • A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#​1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.
All changes (including dependency bumps and internal maintenance)

What's Changed

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

v2.16.0

Compare Source

Highlights

Breaking changes and behavior changes
  • Python 3.10 is no longer supported (#​1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
  • python-dotenv>=1.2.2 is now required (#​971) to pick up the fix for CVE-2026-28684.
  • Aliases are ignored in every source when validate_by_alias=False (#​1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
  • validation_alias takes precedence over alias (#​1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
  • CLI case-insensitivity only lowercases registered options (#​1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
  • JSON and YAML config files are read as UTF-8 by default (#​955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
  • Discriminated union defaults are partially updated again (#​997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.
New features
  • Python 3.15 and pydantic 2.14 support (#​1026, #​1029, #​1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
  • Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#​952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
  • AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#​941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
  • env_file_depth (#​940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
  • CliVariadicArg for named variadic options (#​949, #​958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.
Bug fixes

CLI

  • CliApp.serialize output now round-trips through CliApp.run for enums, tuples, dates and Decimals (#​988), explicit None values (#​981), empty containers (#​1008), CliVariadicArg values (#​976) and populated CliUnknownArgs fields, which previously raised IndexError (#​992).
  • Empty JSON arrays (--items []) now give an empty list instead of [''] (#​994).
  • Tuples, frozenset, MutableSequence and other collection subtypes are now treated as repeatable/variadic options (#​972), and so are named collection type aliases such as TypeAliasType('Addrs', list[IPvAnyAddress]) (#​1032).
  • cli_exit_on_error=False is now honored in CliSubCommand parsers, which raise SettingsError instead of exiting ([#​977](https://redirect.github.com/pydantic/pydantic-settings/

[!IMPORTANT]
✂ PR body was truncated to here.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 19311ac to 099de91 Compare October 5, 2026 22:24
@renovate renovate Bot changed the title chore(deps): update all non-major dependencies chore(deps): update python to >=3.14.8 Oct 5, 2026
@renovate renovate Bot changed the title chore(deps): update python to >=3.14.8 chore(deps): update all non-major dependencies Oct 6, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 5771dd4 to 9e12d2b Compare October 8, 2026 17:42
@renovate renovate Bot changed the title chore(deps): update all non-major dependencies fix(deps): update all non-major dependencies Oct 8, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 3da8434 to 5af786d Compare October 16, 2026 02:40
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from fbe5e1f to e158029 Compare October 27, 2026 05:10
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 15999db to d5b116e Compare November 1, 2026 21:21
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from d5b116e to 0ed18ac Compare November 3, 2026 04:41
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 0ed18ac to 47cf347 Compare November 3, 2026 11:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants