Bump the python-packages group with 4 updates

[dependabot]

Bumps the python-packages group with 4 updates: httpx2, faker, ruff and pymdown-extensions.

Updates httpx2 from 2.10.0 to 2.12.0

Release notes

Sourced from httpx2's releases.

v2.12.0

Highlights

🛡️ Bounded response decompression

httpx2 now decodes gzip, deflate, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (pydantic/httpx2#1126).

📦 Shared Zstandard API

Python 3.13 and earlier now use backports.zstd, which provides the same bounded incremental decompression API as compression.zstd on Python 3.14 and later (pydantic/httpx2#1146).

httpx2

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier by @​Kludex in pydantic/httpx2#1146

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails by @​Kludex in pydantic/httpx2#1126

httpcore2

No changes since 2.11.0. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.11.0...v2.12.0

v2.11.0

Highlights

🌐 Public origin API

httpx2 now includes an immutable and hashable Origin value object, available through URL.origin. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (pydantic/httpx2#1134).

🛠️ Request compatibility and validation

• Explicit Transfer-Encoding headers now take precedence over body-derived Content-Length headers (pydantic/httpx2#1137).
• Deprecated status code aliases are available again (pydantic/httpx2#1135).
• Multipart part headers are validated before serialization (pydantic/httpx2#1142).

httpx2

Added

• Add the public Origin value object and URL.origin property by @​Kludex in pydantic/httpx2#1134

Changed

• Require Brotli 1.2.0 or later for the brotli extra by @​Kludex in pydantic/httpx2#1141

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.12.0 (August 18th, 2026)

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier. (#1146)

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails. (#1126)

2.11.0 (August 18th, 2026)

Added

• Add the public Origin value object and URL.origin property for normalized, hashable origin comparisons. (#1134)

Changed

• Require Brotli 1.2.0 or later for the brotli extra. (#1141)

Fixed

• Restore deprecated status code aliases. (#1135)
• Extract HTTP/2 release notes from changelog headings correctly. (#1136)
• Respect explicit Transfer-Encoding headers and expose buffered request body lengths to WSGI applications. (#1137)
• Validate multipart part header names and values before serialization. (#1142)

Commits

• 71ae23b Version 2.12.0 (#1147)
• 4fd0c70 Decode compressed response bodies incrementally (#1126)
• d588e52 Use backports.zstd on Python 3.13 and earlier (#1146)
• 344589d Version 2.11.0 (#1143)
• de96d81 Validate multipart part headers (#1142)
• 51c3269 Require brotli 1.2.0 in the brotli extra (#1141)
• 829b93a Respect explicit Transfer-Encoding headers (#1137)
• 4fa6c8e Fix changelog extraction regex for H2 release headings (#1136)
• 8a6f370 Restore deprecated status code aliases (#1135)
• d03f1ec Add public Origin API (#1134)
• See full diff in compare view

Updates faker from 40.36.0 to 40.37.0

Release notes

Sourced from faker's releases.

Release v40.37.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.37.0 - 2026-08-20

• Fix: generate structurally valid Irish IBANs for en_IE (#2411). Thanks @​CedricConday.
• Add Pillow as an optional dependency (#2442). Thanks @​suliuzh.

Commits

• 4a464c8 Bump version: 40.36.0 → 40.37.0
• f33e820 📝 Update CHANGELOG.md
• 74efb07 fix(en_IE): generate structurally valid Irish IBANs (#2411)
• d80d125 add Pillow as an optional dependency (#2442)
• 4eced9f Bump actions/stale from 10 to 11 (#2440)
• de212b1 Bump actions/setup-python from 6 to 7 (#2437)
• 56748a2 exclude .agents from manifest
• d42d42d refine skill
• 2d0e534 Add skills for agents
• See full diff in compare view

Updates ruff from 0.16.3 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot

... (truncated)

Commits

• 11c76bf Bump 0.16.4 (#27937)
• d53c8c5 Isolate playground builds from deployment credentials (#27839)
• cab001e Disable uv preview for releases and pre-commit hooks (#27939)
• f8d575f [ty] Clarify writing guidance for human readers (#27912)
• ca45fae Set --preview and --default-index for the uv-lock hook (#27935)
• 4827bf7 Export UV_DEFAULT_INDEX in release.sh (#27934)
• d1087a4 [ty] Handle assignment expressions in string annotations (#27921)
• 680cce4 [ty] Optimize inherited recursive protocol comparisons (#27922)
• 974d3cb Upgrade ecosystem-analyzer and mypy_primer to the latest upstream pins (#27932)
• b169b40 Install cargo tools locked (#27929)
• Additional commits viewable in compare view

Updates pymdown-extensions from 11.0.1 to 11.0.2

Release notes

Sourced from pymdown-extensions's releases.

11.0.2

• FIX: InlineHilite: Improve performance of inline code matching.
• FIX: Keys: Fix regex pattern inefficiencies.
• FIX: Blocks.HTML: Fix backtracking in HTML extension.

Commits

• b8996d7 Docs: Update JS deps
• 3a190d9 Fix backtracking in HTML blocks extension
• 819f2f8 Keys: Fix regex pattern inefficiencies.
• 34fc8e2 Improve InlineHilite pattern parsing
• 5dfef3f Fix lint
• f263972 Update tests to match latest Pygments
• 6d3688e Make a note about symlinks and snippets
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage Report •

File	Stmts	Miss	Branch	BrPart	Cover	Missing
TOTAL	5403	654	838	177	87%

report-only-changed-files is enabled. No changed files were found in the coverage report :)