Skip to content

build(deps): bump the pip group across 1 directory with 4 updates - #40

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/pip-077aea0914
Closed

build(deps): bump the pip group across 1 directory with 4 updates#40
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/pip-077aea0914

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pip group with 4 updates in the / directory: asyncpg, ruff, semgrep and prek.

Updates asyncpg from 0.31.0 to 0.32.0

Release notes

Sourced from asyncpg's releases.

v0.32.0

Improvements

  • Support Python 3.15 (#1367, #1378) (by @​elprans in 1b118464 and 58c0c595)

  • Support PostgreSQL 19 (#1379) (by @​elprans in 8d2a5aed)

  • Make pool min_size a maintained connection floor and add init_size to control the number of connections opened at startup (#1323). Idle connections at or below min_size are retained, and closed connections are replaced in the background. init_size defaults to min_size. To preserve the previous behavior, where the pool could drain to zero, replace min_size=N with init_size=N, min_size=0. (by @​shatilov-diman in 67a1cbc5)

  • Use hashlib.pbkdf2_hmac() for faster SCRAM password derivation (#1359) (by @​twelfthlabor in 00319a9b)

  • Use the statement cache for copy_records_to_table() introspection (#1360) (by @​matemax in dd058652)

Fixes

  • Clean up connections rejected by target_session_attrs immediately so an unresponsive rejected host cannot delay the selected connection, and cleanup tasks cannot outlive the event loop. Rejected connections are aborted without waiting for a graceful disconnect; servers may log "unexpected EOF on client connection" if the Terminate message is not delivered before the transport closes.

  • Fix a connection pool deadlock when releasing a connection after a protocol abort (#1324) (by @​pchaseh in 4a83cc2f)

  • Honor Connection.close(timeout=...) while waiting for a pending cancellation (#1361) (by @​gyanu2507 in c06bcb4d)

  • Prevent stuck cancellation from blocking connection teardown or pool release by bounding cancellation with the command or release timeout (#1370) (by @​elprans in 4cf02203)

  • Preserve the server error when the connection closes mid-operation (#1369) (by @​RitiGrover in 6c8f1a7a)

  • Fix COPY cleanup when a records generator raises, preserving the original exception and avoiding protocol desynchronization and stalled rollback (#1358) (by @​CodingCossack in fdc6bc8f)

... (truncated)

Commits
  • d701e11 asyncpg v0.32.0
  • b04f8f2 Bump to macOS 26 in runners, set deployment target to 11 (#1384)
  • 3934d77 tests: Capture expected pool retry warnings during role changes (#1383)
  • 2c37501 tests: Avoid DeprecationWarning when settings up uvloop (#1382)
  • b7eea79 Test pool min_size backoff on target attribute mismatch (#1381)
  • 46dda91 Terminate rejected target_session_attrs candidates before returning (#1380)
  • 8d2a5ae Support PostgreSQL 19 (#1379)
  • 58c0c59 Bump uvloop (#1378)
  • 67a1cbc Make pool min_size a maintained connection floor (#1323)
  • 25aaaf5 fix: allow cursors in external transactions (#1350)
  • Additional commits viewable in compare view

Updates ruff from 0.16.10 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15

... (truncated)

Commits
  • 4683270 Bump version to 0.17.1 (#29420)
  • 3514027 [ty] Update typing conformance suite pin (#29417)
  • 8294556 Update referenced PR security-review workflow (#29237)
  • d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
  • 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
  • 83a3afc Fix dedent with multiple leading comments (#29382)
  • b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
  • d01678e [ty] Clarify object attribute write-contract rationale (#29384)
  • 355b42a [ty] Avoid writable override contracts from object (#29373)
  • e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
  • Additional commits viewable in compare view

Updates semgrep from 1.179.0 to 1.181.0

Release notes

Sourced from semgrep's releases.

Release v1.181.0

1.181.0 - 2026-10-14

### Changed

  • semgrep scan now uses the same asynchronous configuration generation and retries as semgrep ci when fetching platform scan configurations. (CODE-9930)

  • Python only: Supply Chain now reports every package declared in a requirements.txt, not only the ones pinned with ==. A requirement with a version range (requests>=2.0, numpy~=1.26, django==2.2.*, requests (>=2.0)) is reported with the declared specifier as its version, and a bare name (flask) is reported with an empty version, so they appear in the dependency inventory and SBOM instead of being dropped with a "not pinned to an exact version" parse error. These dependencies have no definitive installed version, so for now they produce no Supply Chain findings. When there is no requirements.in manifest to consult, a range or bare-name line is reported as a direct dependency, since it was declared by hand rather than written by a resolver; exact pins keep their previous unknown transitivity. Local path and URL lines are no longer reported as parse errors, while a line whose leading token is not a valid package name (requests$foo>=1) is now reported as a parse error instead of being dropped silently. Other ecosystems and other Python manifest formats are unchanged. (SC-3487)

  • pro: Various performance improvements for historical secrets scanning. (SCRT-983-historical-performance)

  • go grammar update (v0.23.4):

    • Go target parsing now supports composite type-set constraints and shorthand union constraints on type parameters, preserving underlying-type markers and all union members. Literal generic rule-pattern syntax remains unchanged.
    • Go target parsing now supports embedded generic struct fields, including pointer and package-qualified embeddings, while retaining their type arguments.
    • Go target parsing now supports standalone generic function instantiations with multiple or composite type arguments, such as Pair[int, string] and Identity[[]int], including qualified function names.
    • Go target parsing now accepts Unicode decimal digits after the first character of an identifier, including Arabic-Indic and Devanagari digits.

    (go-v0.23.4)

  • Hack grammar update:

    • Hack target parsing now supports capability lists on functions, methods, function types, lambdas, and anonymous functions, including empty lists and context-dependent capabilities.
    • Hack target parsing now supports context constants with capability bounds or initializers, preserving the distinction between super bounds, as bounds, and assigned capabilities. Unbounded abstract context constants retain their existing representation limitation.
    • Hack target parsing now supports concrete and abstract enum classes with typed members, plus qualified and unqualified enum class labels.
    • Hack target parsing now supports function and static-method references with empty or explicit type arguments, such as foo<> and MyClass::bar.
    • Hack target parsing now preserves type arguments on calls and constructors such as foo(), $obj->bar(...), and new MyClass(...), matching other languages' typed-call representation.
    • Hack target parsing now supports expression-tree literals such as Example1 + 2, preserving the visitor and body text. Embedded DSL bodies remain opaque rather than being parsed as Hack expressions.
    • Hack target parsing now supports file-level attributes such as <<file: SomeAttribute(...)>>, preserving attribute names and arguments.
    • Hack target parsing now supports internal visibility on methods and properties, keeping it distinct from public, protected, and private visibility.
    • Hack target parsing now accepts namespace-relative names such as namespace\run() and include/require member names in piped expressions.

    (hack-1a7ded90288189746c54861ac144ede97df95081)

### Fixed

  • pro: Historical secrets scanning no longer aborts when preparatory git gc fails. (SCRT-982-historical-gc-nonfatal)
  • Supply Chain: lockfileless Gradle resolution now tells the dependency graph plugin where to write its report, so builds that relocate their build directory resolve instead of failing. When the plugin writes no report, the scan reports a resolution error that includes the Gradle log instead of crashing on the missing file. (code-9953)
  • Supply Chain: lockfileless Gradle and Maven scans now report incomplete dependency resolution when dependencies or transitive metadata cannot be resolved. Registry HTTP failures include the affected URL when available. (sc-3358)

### Infra/Release Changes

  • Forward optional job context when registering CLI scans. (SMS-3333)

Release v1.180.0

1.180.0 - 2026-10-07

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.181.0 - 2026-10-14

### Changed

  • semgrep scan now uses the same asynchronous configuration generation and retries as semgrep ci when fetching platform scan configurations. (CODE-9930)

  • Python only: Supply Chain now reports every package declared in a requirements.txt, not only the ones pinned with ==. A requirement with a version range (requests>=2.0, numpy~=1.26, django==2.2.*, requests (>=2.0)) is reported with the declared specifier as its version, and a bare name (flask) is reported with an empty version, so they appear in the dependency inventory and SBOM instead of being dropped with a "not pinned to an exact version" parse error. These dependencies have no definitive installed version, so for now they produce no Supply Chain findings. When there is no requirements.in manifest to consult, a range or bare-name line is reported as a direct dependency, since it was declared by hand rather than written by a resolver; exact pins keep their previous unknown transitivity. Local path and URL lines are no longer reported as parse errors, while a line whose leading token is not a valid package name (requests$foo>=1) is now reported as a parse error instead of being dropped silently. Other ecosystems and other Python manifest formats are unchanged. (SC-3487)

  • pro: Various performance improvements for historical secrets scanning. (SCRT-983-historical-performance)

  • go grammar update (v0.23.4):

    • Go target parsing now supports composite type-set constraints and shorthand union constraints on type parameters, preserving underlying-type markers and all union members. Literal generic rule-pattern syntax remains unchanged.
    • Go target parsing now supports embedded generic struct fields, including pointer and package-qualified embeddings, while retaining their type arguments.
    • Go target parsing now supports standalone generic function instantiations with multiple or composite type arguments, such as Pair[int, string] and Identity[[]int], including qualified function names.
    • Go target parsing now accepts Unicode decimal digits after the first character of an identifier, including Arabic-Indic and Devanagari digits.

    (go-v0.23.4)

  • Hack grammar update:

    • Hack target parsing now supports capability lists on functions, methods, function types, lambdas, and anonymous functions, including empty lists and context-dependent capabilities.
    • Hack target parsing now supports context constants with capability bounds or initializers, preserving the distinction between super bounds, as bounds, and assigned capabilities. Unbounded abstract context constants retain their existing representation limitation.
    • Hack target parsing now supports concrete and abstract enum classes with typed members, plus qualified and unqualified enum class labels.
    • Hack target parsing now supports function and static-method references with empty or explicit type arguments, such as foo<> and MyClass::bar.
    • Hack target parsing now preserves type arguments on calls and constructors such as foo(), $obj->bar(...), and new MyClass(...), matching other languages' typed-call representation.
    • Hack target parsing now supports expression-tree literals such as Example1 + 2, preserving the visitor and body text. Embedded DSL bodies remain opaque rather than being parsed as Hack expressions.
    • Hack target parsing now supports file-level attributes such as <<file: SomeAttribute(...)>>, preserving attribute names and arguments.
    • Hack target parsing now supports internal visibility on methods and properties, keeping it distinct from public, protected, and private visibility.
    • Hack target parsing now accepts namespace-relative names such as namespace\run() and include/require member names in piped expressions.

    (hack-1a7ded90288189746c54861ac144ede97df95081)

### Fixed

  • pro: Historical secrets scanning no longer aborts when preparatory git gc fails. (SCRT-982-historical-gc-nonfatal)
  • Supply Chain: lockfileless Gradle resolution now tells the dependency graph plugin where to write its report, so builds that relocate their build directory resolve instead of failing. When the plugin writes no report, the scan reports a resolution error that includes the Gradle log instead of crashing on the missing file. (code-9953)
  • Supply Chain: lockfileless Gradle and Maven scans now report incomplete dependency resolution when dependencies or transitive metadata cannot be resolved. Registry HTTP failures include the affected URL when available. (sc-3358)

### Infra/Release Changes

  • Forward optional job context when registering CLI scans. (SMS-3333)

1.180.0 - 2026-10-07

### Added

... (truncated)

Commits
  • 72d3525 chore: release 1.181.0
  • 51602ad feat(sca): Report unpinned requirements.txt dependencies instead of skipping ...
  • 3be31edsemgrep/semgrep-proprietary#7161
  • 460ef57 fix(sca): Pin the Gradle dependency graph report dir and report a missing gra...
  • 945793a fix(ci): unlink openssl@3 before brew installs on macOS jobs (CODE-10023) (se...
  • 2c029cd feat(cli): Share async config fetching between scan and ci (semgrep/semgrep-p...
  • 7cae498 feat(cli): forward opaque job context at scan registration (semgrep/semgrep-p...
  • d8345fd fix(grammar-update): Claude output budget and c-sharp-pro fyi.list (semgrep/s...
  • 14a2d04semgrep/semgrep-proprietary#7199
  • ad19937 chore: regenerate parsers with tree-sitter 0.26.3 where possible (semgrep/sem...
  • Additional commits viewable in compare view

Updates prek from 0.5.5 to 0.5.6

Release notes

Sourced from prek's releases.

0.5.6

Release Notes

Released on 2026-10-19.

Enhancements

  • Add builtin hook check-commit-trailers (#2885)
  • Add builtin hook check-signed-commit (#2725)

Performance

  • Enable PGO for native release builds (#2890)
  • Reduce hook process launches with balanced batches (#2907)
  • Resolve hook commands before batching (#2840)

Bug fixes

  • Accept UTF-8 BOM in check-json (#2879)
  • Preserve unquoted dotted revisions in prek update (#2853)

Documentation

  • Document standalone installer options (#2859)
  • Update benchmarks for prek 0.5.5 (#2786)

Other changes

  • Enable ICF for release builds (#2891)
  • Update uv to 0.13.0 (#2856)

Contributors

Install prek 0.5.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex"

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.6

Released on 2026-10-19.

Enhancements

  • Add builtin hook check-commit-trailers (#2885)
  • Add builtin hook check-signed-commit (#2725)

Performance

  • Enable PGO for native release builds (#2890)
  • Reduce hook process launches with balanced batches (#2907)
  • Resolve hook commands before batching (#2840)

Bug fixes

  • Accept UTF-8 BOM in check-json (#2879)
  • Preserve unquoted dotted revisions in prek update (#2853)

Documentation

  • Document standalone installer options (#2859)
  • Update benchmarks for prek 0.5.5 (#2786)

Other changes

  • Enable ICF for release builds (#2891)
  • Update uv to 0.13.0 (#2856)

Contributors

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the pip group across 1 directory with 4 updates
1f89627 
Bumps the pip group with 4 updates in the / directory: [asyncpg](https://github.com/MagicStack/asyncpg), [ruff](https://github.com/astral-sh/ruff), [semgrep](https://github.com/semgrep/semgrep) and [prek](https://github.com/j178/prek).


Updates `asyncpg` from 0.31.0 to 0.32.0
- [Release notes](https://github.com/MagicStack/asyncpg/releases)
- [Commits](MagicStack/asyncpg@v0.31.0...v0.32.0)

Updates `ruff` from 0.16.10 to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.10...0.17.1)

Updates `semgrep` from 1.179.0 to 1.181.0
- [Release notes](https://github.com/semgrep/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md)
- [Commits](semgrep/semgrep@v1.179.0...v1.181.0)

Updates `prek` from 0.5.5 to 0.5.6
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/main/CHANGELOG.md)
- [Commits](j178/prek@v0.5.5...v0.5.6)

---
updated-dependencies:
- dependency-name: asyncpg
  dependency-version: 0.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: semgrep
  dependency-version: 1.181.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: prek
  dependency-version: 0.5.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 26, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/pip-077aea0914 branch November 2, 2026 09:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants