Skip to content

chore(deps): bump the python-deps group across 1 directory with 9 updates - #659

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-deps-f0489ab78f
Open

chore(deps): bump the python-deps group across 1 directory with 9 updates#659
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-deps-f0489ab78f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-deps group with 9 updates in the / directory:

Package From To
kgx 2.3.2 2.8.0
pandas 3.1.0 3.1.1
pytest 9.1.1 9.2.0
vcrpy 8.3.0 9.4.2
openai 3.37.0 3.46.0
ruff 0.17.2 0.17.4
mypy 2.4.0 2.4.1
types-pyyaml 6.0.12.20260906 6.0.12.20261103
types-requests 2.33.0.20261006 2.33.0.20261030

Updates kgx from 2.3.2 to 2.8.0

Release notes

Sourced from kgx's releases.

v2.8.0

What's Changed

New Contributors

Full Changelog: biolink/kgx@v2.7.0...v2.8.0

v2.8.0-rc2

What's Changed

Full Changelog: biolink/kgx@v2.8.0-rc1...v2.8.0-rc2

v2.8.0-rc1

What's Changed

New Contributors

Full Changelog: biolink/kgx@v2.7.0...v2.8.0-rc1

v2.7.0

What's Changed

... (truncated)

Commits
  • 3e470f0 Merge pull request #570 from biolink/fix/pypi-publish-metadata-2.5
  • b4815b5 Bump gh-action-pypi-publish to v1.14.3 for metadata 2.5 support
  • 03565fe Merge pull request #566 from biolink/transform-config-property-exclusion
  • df9e87a Update merged KGX schema [skip ci]
  • 5096ef1 Automatically rebuild KGX schema [skip ci]
  • 8d34cb6 Merge pull request #569 from biolink/fix/obograph-fbbt-prefix-expectation
  • f1a1856 Fix obograph test expectation for FBbt prefix contraction
  • 12ff8f1 Merge pull request #563 from rogermyung/fix/neo4j5-constraint-syntax-upstream
  • 6a95f36 Merge pull request #561 from biolink/obograph-edge-annotations
  • ad2008d Merge pull request #559 from biolink/fix/catch-all-prefix-shadowing
  • Additional commits viewable in compare view

Updates pandas from 3.1.0 to 3.1.1

Release notes

Sourced from pandas's releases.

pandas 3.1.1

We are pleased to announce the release of pandas 3.1.1. This is a patch release in the 3.1.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.1.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.1.*

Or from conda-forge

conda install -c conda-forge pandas=3.1

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits
  • 3dcc6fb RLS: 3.1.1
  • 01560e3 Backport PR #71896 on branch 3.1.x (DOC: cleanup 3.1.1 whatsnew) (#71898)
  • 49709c4 [backport 3.1.x] BUG: ffill/bfill on Arrow arrays without NA returns a view o...
  • 55089f8 Backport PR #71025 on branch 3.1.x (BUG: \s and \S in str regex methods missi...
  • eea23d0 Backport PR #71782 on branch 3.1.x (BUG: py.path.local treated as an open buf...
  • e427eb5 [backport 3.1.x] DOC: avoid system-ui in default font-family for the docs (re...
  • 3120a57 Backport PR #71572 on branch 3.1.x (BLD: don't include moments_simd.hpp in mo...
  • 378620e Backport PR #71865 on branch 3.1.x (REGR: ensure map() with datetime-like dty...
  • ceca8cb Backport PR #71495 on branch 3.1.x (BUG: support python-dateutil 3.0 tzfile (...
  • 68fc76e Backport PR #71661 on branch 3.1.x (CI: Remove install requirement-dev.txt sm...
  • Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

  • #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

  • #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

    Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

  • #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

    • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
    • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

    pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

  • #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

  • #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

  • #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

    They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

  • #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

  • #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

  • #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
  • #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
  • #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

  • #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits
  • ae1d0ff Prepare release version 9.2.0
  • 143ce31 pre-commit: exclude codespell on generated release announcements
  • 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
  • a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
  • 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
  • 41d12cd docs: clarify typing for yield fixtures
  • b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
  • 16f87a7 docs: improve getting-started.rst test execution description
  • 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
  • ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
  • Additional commits viewable in compare view

Updates vcrpy from 8.3.0 to 9.4.2

Release notes

Sourced from vcrpy's releases.

v9.4.2

What's Changed

  • Fix urllib3 pools with block=True, e.g. a requests session with HTTPAdapter(pool_block=True), waiting forever for a free connection in a cassette, or when used before, after or across cassettes. A response now returns its connection to the pool once its body has been read, as in urllib3, and vcrpy keeps a pool's free slots when it takes connections out of it as a cassette starts or stops using the pool. A response finished after its cassette has exited gives back only the slot, not the cassette's connection (#949, #1094) - thanks @​nk-batman21

Full Changelog: kevin1024/vcrpy@v9.4.1...v9.4.2

v9.4.1

What's Changed

  • Don't fail with ImportError: cannot import name 'HTTPHeaderDict' on urllib3 1.x, such as the 1.26 that Debian oldstable ships. The urllib3 stub imported HTTPHeaderDict from the top level of urllib3, which only exports it from 2.0 on, so use_cassette() raised while building its patchers and nothing could be recorded (#1092, #1093) - thanks @​inchang-ing

Full Changelog: kevin1024/vcrpy@v9.4.0...v9.4.1

v9.4.0

What's Changed

SOCKS proxies

Requests made through SOCKS proxies with requests and urllib3 (socks5:// and socks5h://, with PySocks installed) are now recorded and played back. urllib3 uses its own connection classes for them, which vcrpy didn't patch, so these requests skipped the cassette entirely (#547, #548, #1087).

Multipart form filtering

filter_post_data_parameters now filters the fields of multipart/form-data request bodies, e.g. requests.post(url, data={"api_key": ...}, files=...). Before, it treated them as urlencoded forms and didn't find their fields, so their values were recorded (#521, #1090).

If you match on body: requests are filtered before they're matched, so cassettes recorded with unfiltered multipart bodies need re-recording.

Fixes

  • Fix requests escaping a cassette, e.g. a write-protected one not raising CannotOverwriteExistingCassetteException, when a vcr.patch.force_reset() window opened elsewhere is closed late by the garbage collector while the cassette is in use (#979, #1051, #1088) - thanks @​yeion7, from #1052
  • Fix AttributeError: 'str' object has no attribute 'get_all' when requests builds a response from a urllib.request response, e.g. with HTTPAdapter.build_response() (#956, #1089)

Full Changelog: kevin1024/vcrpy@v9.3.2...v9.4.0

v9.3.2

What's Changed

  • Don't open a real connection for HTTPS requests played back from a cassette in the new_episodes record mode. urllib3 connects before sending a request, before vcrpy knows whether it will be played back, so every such request made a TLS handshake, and failed without network access (#515, #1086)
  • Raise a clear TypeError when use_cassette() without a path is used as a context manager, instead of KeyError: 'path'. A path can be left out only when decorating a function (#570)
  • Fix filter_post_data_parameters crashing with AttributeError on iterator request bodies, e.g. a generator passed as data. Like file bodies, they're left unfiltered (#814)
  • Docs: document inject_cassette, which passes the cassette to a decorated function, e.g. to rewind it or make assertions (#207, #493)

Full Changelog: kevin1024/vcrpy@v9.3.1...v9.3.2

v9.3.1

What's Changed

  • Log a warning when a cassette file exists but can't be decoded, instead of silently treating it as empty, where recording could overwrite it (#501, #1022) - thanks @​agu2347, and @​philsong4-ai for #1023
  • Request can be imported from vcr, e.g. vcr.Request("GET", uri, body, headers), as the docs already called it (#759) - thanks @​lewisdawson

... (truncated)

Changelog

Sourced from vcrpy's changelog.

Changelog

All help in providing PRs to close out bug issues is appreciated. Even if that is providing a repo that fully replicates issues. We have very generous contributors that have added these to bug issues which meant another contributor picked up the bug and closed it out.

  • Unreleased

    • CI: also test with urllib3 1.26, which vcrpy supports but CI didn't test, so #1092 wasn't caught

  • 9.4.2

    • Fix urllib3 pools with block=True, e.g. a requests session with HTTPAdapter(pool_block=True), waiting forever for a free connection in a cassette, or when used before, after or across cassettes. A response now returns its connection to the pool once its body has been read, as in urllib3, and vcrpy keeps a pool's free slots when it takes connections out of it as a cassette starts or stops using the pool. A response finished after its cassette has exited gives back only the slot, not the cassette's connection (#949) - thanks @​nk-batman21

  • 9.4.1

    • Don't fail with ImportError: cannot import name 'HTTPHeaderDict' on urllib3 1.x, such as the 1.26 that Debian oldstable ships. The urllib3 stub imported HTTPHeaderDict from the top level of urllib3, which only exports it from 2.0 on, so use_cassette() raised while building its patchers and nothing could be recorded (#1092) - thanks @​inchang-ing

  • 9.4.0

    • Record and play back requests made through SOCKS proxies with requests and urllib3 (socks5:// and socks5h:// proxies, with PySocks installed). urllib3 uses its own connection classes for them, which weren't patched, so these requests skipped the cassette (#547, #548)
    • Fix requests escaping a cassette, e.g. a write-protected one not raising CannotOverwriteExistingCassetteException, when a vcr.patch.force_reset() window opened elsewhere is closed late by the garbage collector while the cassette is in use (#979, #1051) - thanks @​yeion7, from #1052
    • Fix AttributeError: 'str' object has no attribute 'get_all' when requests builds a response from a urllib.request response, e.g. with HTTPAdapter.build_response(). urllib.request replaces the response's msg with the reason phrase, and requests then read it as headers to extract cookies from (#956)
    • filter_post_data_parameters filters the fields of multipart/form-data request bodies, e.g. requests.post(url, data=..., files=...). Before, it treated them as urlencoded forms and didn't find their fields, so their values were recorded. Requests are filtered before they're matched, so if you match on body, re-record cassettes that have unfiltered multipart bodies (#521, #561)

  • 9.3.2

    • Don't open a real connection for HTTPS requests that are played back from a cassette in the new_episodes record mode. urllib3 connects before sending a request, before vcrpy knows whether it will be played back, so every such request made a TLS handshake, and failed without network access (#515)
    • Raise a clear TypeError when use_cassette() without a path is used as a context manager, instead of KeyError: 'path'. A path can be left out only when decorating a function (#570)
    • Fix filter_post_data_parameters crashing with AttributeError on iterator request bodies, e.g. a generator passed as data. Like file bodies, they're left unfiltered (#814)
    • Docs: document inject_cassette, which passes the cassette to a decorated function (#207, #493)

  • 9.3.1

    • Log a warning when a cassette file exists but can't be decoded, instead of silently treating it as empty (#501, #1022) - thanks @​agu2347, and @​philsong4-ai for #1023
    • Request can be imported from vcr, e.g. vcr.Request("GET", uri, body, headers), as the docs already called it (#759) - thanks @​lewisdawson

  • 9.3.0

    • New Cassette.get_metadata(key, default): store values that aren't part of an interaction in the cassette, such as a seed for random values a test sends, so they're the same when the cassette is recorded and played back. Cassettes with metadata have a metadata key, and custom persisters' load_cassette can return it as a third value (#934) - thanks @​hasier
    • New skip_patchers option to leave some HTTP libraries unpatched, e.g. skip_patchers=["httpx"] when an httpx client uses an aiohttp transport (httpx-aiohttp), so requests aren't recorded twice (#944, #1070) - thanks @​smoltafet
    • New filter_nested_post_data_parameters option: make filter_post_data_parameters also filter keys in nested objects of JSON request bodies, such as JSON-RPC params. vcr.filters.replace_body_parameters and replace_post_data_parameters take a matching recursive argument (#936, #937) - thanks @​tighwm and @​JargeZ
    • ignore_hosts also accepts compiled regular expressions, which match whole host names, e.g. re.compile(r".*\.example\.com") (#779) - thanks @​silviumarcu
    • allow_playback_repeats now also applies while recording: a request that matches one already recorded in the cassette gets the recorded response, instead of being sent again and recorded a second time. When played back, such requests got the first response anyway (#878, #879) - thanks @​pyoor
    • Fix drop_unused_requests saving an interaction once per playback when allow_playback_repeats is set
    • Fix use_cassette crashing with TypeError: 'NoneType' object is not subscriptable (or JSONDecodeError with the JSON serializer) when the cassette file is empty, e.g. after emptying it to record it again. An empty cassette is now recorded like a missing one, as in Ruby VCR (#579) - thanks @​nk-batman21
    • Don't read aiohttp response bodies for requests that aren't recorded, e.g. with ignore_localhost or ignore_hosts, so they can be streamed as usual (#978) - thanks @​AronsonDan
    • Return leased urllib3 connections to their pool when release_conn() is called on a streamed response, during recording and playback (#949) - thanks @​edsonsims
    • Docs: note that before_record_response also runs when a cassette is loaded, so it should be idempotent (#1042, #1044) - thanks @​ciastek
    • Docs: replace Python 2's urllib2 with urllib.request in the examples - thanks @​TejasAmle
    • CI: run pre-commit's steps directly, with actions/cache@v6 on Node.js 24 (#1072) - thanks @​pylaterreur
    • CI: bump ruff to 0.17.2 (#1083), and allow Sphinx 9 for the docs (#1082)

  • 9.2.0

    • New before_save_interaction and after_load_interaction options: hooks that get each interaction's request and response (and the cassette, if they take a third argument) when a cassette is saved and loaded, and can change them or leave the interaction out. Cassettes also get a public path. Like Ruby VCR's before_record and before_playback hooks (#527, #556) - thanks @​tzturner and co-authors for #679, and @​akaihola for #594, which explored this
    • New filter_sensitive_data option: replace secrets with placeholders everywhere in recorded interactions (URL, headers and bodies), and put the real values back when a cassette is loaded, built on the new hooks, so requests still match and your code sees the same responses whether they're recorded or played back. Inspired by Ruby VCR's option of the same name (#527, #544, #912)

  • 9.1.0

... (truncated)

Commits
  • 86e22b4 Release v9.4.2
  • f86e65f Merge pull request #1094 from nk-batman21/fix/949-release-conn-after-read
  • b784286 Merge remote-tracking branch 'origin/master' into HEAD
  • b9061a6 Release v9.4.1
  • 6224432 Merge pull request #1093 from inchang-ing/fix/urllib3-1x-httpheaderdict
  • 169cd4b Fix blocking urllib3 pools hanging in and around cassettes
  • 4eb08d2 Import HTTPHeaderDict from urllib3._collections on urllib3 1.x (#1092)
  • 7aaaefe Release v9.4.0
  • d3bb531 Merge pull request #1090 from kevin1024/filter-multipart
  • 7eabb26 Merge pull request #1089 from kevin1024/fix-original-response
  • Additional commits viewable in compare view

Updates openai from 3.37.0 to 3.46.0

Release notes

Sourced from openai's releases.

v3.46.0

3.46.0 (2026-11-05)

Features

  • api: add Australia, India, and Japan residency options (#4246) (2634b87)
  • api: add GPT-6 Rosalind to the model catalog (#4243) (0f8e5f3)
  • api: add image complexity and GIF and SVG output controls (#4247) (0152e3a)
  • api: expand agent turn errors and image and audio options (#4245) (1b2fb74)

Chores

  • deps: bump github/codeql-action/init from 4.39.0 to 4.39.1 (#4230) (c9fe335)

v3.45.0

3.45.0 (2026-11-03)

Features

  • api: add 12-hour Responses caching and cache-write usage (#4240) (5f717b5)
  • api: add project service tier settings (#4239) (1a2a3d0)

Documentation

v3.44.0

3.44.0 (2026-11-03)

Features

  • api: add workload identity providers and federation rules (#4237) (12709d7)

v3.43.0

3.43.0 (2026-11-03)

Features

  • api: expand Live Responses delegation tools (#4233) (f6e8480)
  • responses: accumulate rich WebSocket progress (#4224) (48cdad3)
  • responses: add WebSocket lane overflow isolation (#4225) (16bdad1)

Chores

... (truncated)

Changelog

Sourced from openai's changelog.

3.46.0 (2026-11-05)

Features

  • api: add Australia, India, and Japan residency options (#4246) (2634b87)
  • api: add GPT-6 Rosalind to the model catalog (#4243) (0f8e5f3)
  • api: add image complexity and GIF and SVG output controls (#4247) (0152e3a)
  • api: expand agent turn errors and image and audio options (#4245) (1b2fb74)

Chores

  • deps: bump github/codeql-action/init from 4.39.0 to 4.39.1 (#4230) (c9fe335)

3.45.0 (2026-11-03)

Features

  • api: add 12-hour Responses caching and cache-write usage (#4240) (5f717b5)
  • api: add project service tier settings (#4239) (1a2a3d0)

Documentation

3.44.0 (2026-11-03)

Features

  • api: add workload identity providers and federation rules (#4237) (12709d7)

3.43.0 (2026-11-03)

Features

  • api: expand Live Responses delegation tools (#4233) (f6e8480)
  • responses: accumulate rich WebSocket progress (#4224) (48cdad3)
  • responses: add WebSocket lane overflow isolation (#4225) (16bdad1)

Chores

  • deps: bump actions/setup-node from 4.4.0 to 7.1.0 (#4229) (abbfb27)
  • deps: bump actions/setup-python from 7.0.0 to 7.1.0 (#4232) (49f9a59)
  • deps: bump pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3 (#4228) (f43f29b)

... (truncated)

Commits
  • ea5d160 release: 3.46.0 (#4244)
  • 0152e3a feat(api): add image complexity and GIF and SVG output controls (#4247)
  • 2634b87 feat(api): add Australia, India, and Japan residency options (#4246)
  • b4aee4c chore(deps): bump the python-maintenance group across 1 directory with 11 upd...
  • c9fe335 chore(deps): bump github/codeql-action/init from 4.39.0 to 4.39.1 (#4230)
  • d59f414 chore(deps): update aiohttp, multidict, PyJWT, and required yarl security flo...
  • 1b2fb74 feat(api): expand agent turn errors and image and audio options (#4245)
  • 0f8e5f3 feat(api): add GPT-6 Rosalind to the model catalog (#4243)
  • 9b3458a release: 3.45.0 (#4242)
  • 0309a8c docs: clarify generated-file ownership (#4241)
  • Additional commits viewable in compare view

Updates ruff from 0.17.2 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

  • [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
  • [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

  • Accept a bare raise before a semicolon (#29761)
  • Allow match identifiers after a semicolon (#29760)
  • Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
  • [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

  • Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

  • Coalesce source slices when formatting attributes (#29841)
  • Collect return statements with a statement-only visitor (#29911)
  • [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
  • Format node fields directly when comment handling is unnecessary (#29853)
  • Reduce formatter source-slice overhead (#29855)
  • Reuse a callee's qualified name across lint rules (#29916)
  • Skip invalid string character checks when the source contains none (#29883)
  • Use a Bloom filter for formatter comment lookups (#29852)
  • Use a concrete buffer for ordinary writes (#29819)

CLI

  • Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
  • Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

  • Correct the documented version and src defaults for ruff-action (#29880)
  • [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
  • [flake8-no-pep420] Document preview behavior (INP001) (#29764)
  • [isort] Expand I001 documentation (#29843)

Other changes

  • [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

  • [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
  • [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

  • Accept a bare raise before a semicolon (#29761)
  • Allow match identifiers after a semicolon (#29760)
  • Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
  • [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

  • Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

  • Coalesce source slices when formatting attributes (#29841)
  • Collect return statements with a statement-only visitor (#29911)
  • [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
  • Format node fields directly when comment handling is unnecessary (#29853)
  • Reduce formatter source-slice overhead (#29855)
  • Reuse a callee's qualified name across lint rules (#29916)
  • Skip invalid string character checks when the source contains none (#29883)
  • Use a Bloom filter for formatter comment lookups (#29852)
  • Use a concrete buffer for ordinary writes (#29819)

CLI

  • Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
  • Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

  • Correct the documented version and src defaults for ruff-action (#29880)
  • [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
  • [flake8-no-pep420] Document preview behavior (INP001) (#29764)
  • [isort] Expand I001 documentation (#29843)

Other changes

  • [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits

@dependabot
chore(deps): bump the python-deps group across 1 directory with 9 upd…
26b5991 
…ates

Bumps the python-deps group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [kgx](https://github.com/biolink/kgx) | `2.3.2` | `2.8.0` |
| [pandas](https://github.com/pandas-dev/pandas) | `3.1.0` | `3.1.1` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` |
| [vcrpy](https://github.com/kevin1024/vcrpy) | `8.3.0` | `9.4.2` |
| [openai](https://github.com/openai/openai-python) | `3.37.0` | `3.46.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.2` | `0.17.4` |
| [mypy](https://github.com/python/mypy) | `2.4.0` | `2.4.1` |
| [types-pyyaml](https://github.com/python/typeshed) | `6.0.12.20260906` | `6.0.12.20261103` |
| [types-requests](https://github.com/python/typeshed) | `2.33.0.20261006` | `2.33.0.20261030` |



Updates `kgx` from 2.3.2 to 2.8.0
- [Release notes](https://github.com/biolink/kgx/releases)
- [Changelog](https://github.com/biolink/kgx/blob/master/CHANGELOG.md)
- [Commits](biolink/kgx@v2.3.2...v2.8.0)

Updates `pandas` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/pandas-dev/pandas/releases)
- [Commits](pandas-dev/pandas@v3.1.0...v3.1.1)

Updates `pytest` from 9.1.1 to 9.2.0
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.1.1...9.2.0)

Updates `vcrpy` from 8.3.0 to 9.4.2
- [Release notes](https://github.com/kevin1024/vcrpy/releases)
- [Changelog](https://github.com/kevin1024/vcrpy/blob/master/docs/changelog.rst)
- [Commits](kevin1024/vcrpy@v8.3.0...v9.4.2)

Updates `openai` from 3.37.0 to 3.46.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v3.37.0...v3.46.0)

Updates `ruff` from 0.17.2 to 0.17.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.2...0.17.4)

Updates `mypy` from 2.4.0 to 2.4.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.4.0...v2.4.1)

Updates `types-pyyaml` from 6.0.12.20260906 to 6.0.12.20261103
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-requests` from 2.33.0.20261006 to 2.33.0.20261030
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: kgx
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: pandas
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: vcrpy
  dependency-version: 9.4.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-deps
- dependency-name: openai
  dependency-version: 3.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: ruff
  dependency-version: 0.17.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: mypy
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20261103
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: types-requests
  dependency-version: 2.33.0.20261030
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from turbomam as a code owner November 13, 2026 15:17
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@turbomam turbomam Awaiting requested review from turbomam turbomam is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants