[dependabot]

Bumps the python-minor-and-patch group with 12 updates in the / directory:

Package	From	To
numpy	2.5.3	2.5.4
sphinx-autodoc-typehints	3.13.7	3.13.9
ruff	0.16.9	0.17.0
pydoclint	0.10.1	0.11.1
charset-normalizer	3.5.1	3.5.2
fonttools	4.66.0	4.66.1
iniconfig	2.3.0	2.3.1
markupsafe	3.0.3	3.0.4
narwhals	2.26.0	2.27.1
platformdirs	4.12.1	4.13.0
python-discovery	1.6.1	1.6.2
virtualenv	21.13.0	21.14.7

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

• Many typing fixes and improvements,
• A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

• numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

• Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

• numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits

• a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
• 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
• 91acd87 REL: Prepare for the NumPy 2.5.4 release.
• 9cc555b Merge pull request #32956 from charris/backport-typing-1
• e04b972 TYP: dtype[void].names: allow setting with list (#32943)
• d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
• 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
• 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
• 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
• c7bcd2c TYP: place: widen mask (#32926)
• Additional commits viewable in compare view

Updates sphinx-autodoc-typehints from 3.13.7 to 3.13.9

Release notes

Sourced from sphinx-autodoc-typehints's releases.

3.13.9

• Fix the forward-reference warning when documenting NumPy's clip by resolving generic parameters declared in stub signatures. #780

PyPI release

Full Changelog: tox-dev/sphinx-autodoc-typehints@3.13.8...3.13.9

3.13.8

• Resolve field types of a NamedTuple imported under TYPE_CHECKING when Sphinx documents the class before any function from its module, removing a forward-reference warning. #775

PyPI release

Full Changelog: tox-dev/sphinx-autodoc-typehints@3.13.7...3.13.8

Changelog

Sourced from sphinx-autodoc-typehints's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

3.17.2 (2026-10-17)

---

• Link an overridden method to a documented public owner when its defining class is private and absent from the intersphinx inventory. :pr:1090

---

3.17.1 (2026-10-17)

---

• Describe the package as rendering Python type hints in Sphinx autodoc documentation. :pr:1089

---

3.17.0 (2026-10-17)

---

• Add typehints_modernize_annotations to render legacy typing aliases with current Python spelling. :pr:1085
• Add an "optional" default style that marks parameters callers may omit without printing their default values. :pr:1086
• Allow a callback to read descriptions from Annotated metadata classes other than Doc. :pr:1088
• Explain how Sphinx's autodoc_preserve_defaults applies to default values in parameter descriptions. :pr:1087

---

3.16.0 (2026-10-17)

---

• Read Doc descriptions from annotated-doc as well as typing_extensions. :pr:1083
• Register the value stylesheet through Sphinx's static-directory API, so loading the extension does not change html_static_path. :pr:1079
• Honor autodoc_use_type_comments = False when reading types from a function's # type: comment. :pr:1080
• Use the build platform and false constants when choosing a TYPE_CHECKING guard's branch; skip guards whose other conditions cannot be determined without running code. :pr:1081
• Keep single-word prose in hand-written :Returns: fields, and recognize numpydoc return types containing spaces. :pr:1082
• Document support for both Sphinx autodoc implementations and cover re-exported types and NamedTuple references in both modes. :pr:1084

---

3.15.0 (2026-10-16)

---

• Allow projects to show selected Annotated metadata in rendered types with typehints_annotated_metadata. :pr:1071
• Process method signatures of classes defined inside functions when the module exports the class under a name autodoc can import. :pr:1072

... (truncated)

Commits

• 789861f fix: resolve generic parameters in stubs
• 83d5565 [pre-commit.ci] pre-commit autoupdate (#778)
• 3805fbf 👷 ci: pin ubuntu-26.04 and bump dependencies (#777)
• 0a96a6c 🐛 fix(resolver): resolve guarded class imports (#775)
• d794732 build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
• 6dc6c4e [pre-commit.ci] pre-commit autoupdate (#773)
• 9627932 build(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
• bd00366 [pre-commit.ci] pre-commit autoupdate (#771)
• See full diff in compare view

Updates ruff from 0.16.9 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

  The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

• Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

  The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

• Remove support for ruff-lsp (#28750)

  Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

• lazy-import-mismatch (TID254)
• lazy-import-immediately-resolved (TID255)
• os-path-commonprefix (RUF071)

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits

• 5b27c1c Bump version to 0.17.0 (#29259)
• 8f362bf Integrate vendored Unicode names into Ruff
• 88a50d6 Revert upstream Unicode loose matching
• 276832a Revert upstream Unicode alias normalization
• 26911ca Vendor unicode_names2 from upstream
• 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
• bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
• 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
• dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
• ef23c9c Update default and latest Python versions for 3.15 (#28792)
• Additional commits viewable in compare view

Updates pydoclint from 0.10.1 to 0.11.1

Release notes

Sourced from pydoclint's releases.

0.11.1

What's Changed

• Fix empty exclude pattern excluding all files instead of none by @​jsh9 in jsh9/pydoclint#319

Full Changelog: jsh9/pydoclint@0.11.0...0.11.1

0.11.0

What's Changed

• Support checking stub (.pyi) files by @​jsh9 in jsh9/pydoclint#310

Full Changelog: jsh9/pydoclint@0.10.1...0.11.0

Changelog

Sourced from pydoclint's changelog.

[0.11.1] - 2026-10-11

• Fixed
  • An empty --exclude pattern (such as --exclude='' or exclude = '' in the config file) excluded every file, so nothing was checked and the run passed. Now an empty pattern means "don't exclude any files", so every file gets checked (#311)
• Changed
  • An --exclude value that isn't a valid regular expression is now rejected with a clear error message instead of a traceback
• Full diff
  • jsh9/pydoclint@0.11.0...0.11.1

[0.11.0] - 2026-10-02

• Added
  • A new config option --include-stub-files (shortform: -isf, default: False), so that scanning a folder also checks stub (.pyi) files (#303)
• Fixed
  • False-positive DOC403 and DOC502 violations in stub (.pyi) files, whose function bodies are placeholders, in both the native mode and flake8 (#303). DOC403 is still reported in stub files when the return annotation isn't a Generator/Iterator/Iterable (or is missing), because then the function can't yield anything
  • False-positive DOC105 and DOC605 violations in stub files when --check-arg-defaults is True: an argument or class attribute whose default is the ... placeholder can now be documented with any default value or none
  • False-positive DOC201 violations for abstract methods and stub functions annotated with Iterator[...] or Iterable[...] whose docstrings have a "Yields" section (and no "return" statements in the body). Their bodies are placeholders, so the "Yields" section is what shows that they yield, and they don't need a "Returns" section
  • False-positive DOC203 violations for abstract methods and stub functions annotated with Generator[YieldType, SendType, ReturnType] whose "Returns" section documents ReturnType, as for a generator that both yields and returns
  • False-positive DOC202 violations for abstract methods and stub functions that have a "Returns" section but no return annotation. (DOC203 still reports the missing annotation when return types are checked.)
  • A crash (IndexError) when --check-arg-defaults is True and positional-only arguments (the ones before /) have default values. When it didn't crash, the defaults of positional-only arguments were ignored
• Full diff
  • jsh9/pydoclint@0.10.1...0.11.0

Commits

• 8717514 Fix empty exclude pattern excluding all files instead of none (#319)
• 24412c5 Support checking stub (.pyi) files (#310)
• See full diff in compare view

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates fonttools from 4.66.0 to 4.66.1

Release notes

Sourced from fonttools's releases.

4.66.1

• [designspaceLib] When splitting a DesignSpace v5 document with makeNames=True (as varLib.build_many does), family and style names set explicitly on an instance now take precedence over the ones computed from the STAT labels, in all languages, and a PostScript name is no longer made up from the labels for an instance that has its own style name (#3131, #4206, #4208).
• [cmap] Decompiling a format 4 subtable whose idRangeOffset points outside glyphIndexArray now raises TTLibError. A negative index used to silently map the code point to the wrong glyph, and one past the end raised a bare AssertionError (#4209).
• [cmap] Fix compiling a format 2 subtable when the lowest glyph ID in a lead-byte row is 32768 or higher, which failed with struct.error (#4210).

Changelog

Sourced from fonttools's changelog.

4.66.1 (released 2026-09-29)

• [designspaceLib] When splitting a DesignSpace v5 document with makeNames=True (as varLib.build_many does), family and style names set explicitly on an instance now take precedence over the ones computed from the STAT labels, in all languages, and a PostScript name is no longer made up from the labels for an instance that has its own style name (#3131, #4206, #4208).
• [cmap] Decompiling a format 4 subtable whose idRangeOffset points outside glyphIndexArray now raises TTLibError. A negative index used to silently map the code point to the wrong glyph, and one past the end raised a bare AssertionError (#4209).
• [cmap] Fix compiling a format 2 subtable when the lowest glyph ID in a lead-byte row is 32768 or higher, which failed with struct.error (#4210).

Commits

• 9e95795 Release 4.66.1
• 8fc91fb Update NEWS.rst [skip ci]
• 82dc507 Merge pull request #4209 from insaf021/cmap4-idrangeoffset-bounds
• a83553e trim comments
• 85049d3 Merge pull request #4208 from fonttools/fix-split-stat-names-override
• 1ad111d Merge pull request #4210 from youdie006/cmap-format2-high-gids
• c9e9d68 [cmap] fix format 2 compile for glyph IDs above 32767
• 85625c5 raise TTLibError for out-of-range glyphIndexArray offset in cmap format 4
• 879173e [designspaceLib] Let explicit instance names win over STAT labels when splitting
• 718b61b Bump version: 4.66.0 → 4.66.1.dev0
• See full diff in compare view

Updates iniconfig from 2.3.0 to 2.3.1

Release notes

Sourced from iniconfig's releases.

Version 2.3.1

Fixes

• Parsing values with many continuation lines is now linear instead of quadratic in time (#78, regarding #77).
• A leading UTF-8 BOM is now stripped when reading INI files. Files saved by Windows editors used to fail with ParseError (#76, thanks @​Pitchfork-and-Torch).

Internal

• iniconfig._parse.ParsedLine.value is now a list of lines. This is private API.

Docs

• The README example now uses IniConfig.parse() (#79, thanks @​MbappeWU).
• Fixed the issue tracker link (#74, thanks @​stefan6419846).

Full diff: pytest-dev/iniconfig@v2.3.0...v2.3.1

What's Changed

• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#71
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#72
• Fix link to issues by @​stefan6419846 in pytest-dev/iniconfig#74
• parse_lines: keep values as list of lines, join once by @​RonnyPfannschmidt in pytest-dev/iniconfig#78
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#73
• test: expect sorted all after ruff autofix by @​RonnyPfannschmidt in pytest-dev/iniconfig#80
• docs: use parse API in the README example by @​MbappeWU in pytest-dev/iniconfig#79
• Strip leading UTF-8 BOM when reading INI files by @​Pitchfork-and-Torch in pytest-dev/iniconfig#76
• changelog: add BOM stripping (#76) to 2.3.1 by @​RonnyPfannschmidt in pytest-dev/iniconfig#81

New Contributors

• @​stefan6419846 made their first contribution in pytest-dev/iniconfig#74
• @​MbappeWU made their first contribution in pytest-dev/iniconfig#79
• @​Pitchfork-and-Torch made their first contribution in pytest-dev/iniconfig#76

Full Changelog: pytest-dev/iniconfig@v2.3.0...v2.3.1

Changelog

Sourced from iniconfig's changelog.

2.3.1

• fix quadratic parse time for values with many continuation lines (#78, regarding #77)
• strip a leading UTF-8 BOM when reading INI files, which previously raised ParseError (#76)
• internal: iniconfig._parse.ParsedLine.value is now a list of lines

Commits

• 316fbfa changelog: add BOM stripping (#76) to 2.3.1 (#81)
• d2dcb72 Strip leading UTF-8 BOM when reading INI files (#76)
• 40d8c03 Merge pull request #79 from MbappeWU/codex/docs-parse-inline-comments
• 48359c3 Merge pull request #80 from pytest-dev/claude/fix-iniconfig-test-eukh2n
• b153213 test: expect sorted all after ruff RUF022 autofix
• 4fddfab Merge pull request #73 from pytest-dev/pre-commit-ci-update-config
• 15852c2 [pre-commit.ci] auto fixes from pre-commit.com hooks
• 2e68639 [pre-commit.ci] pre-commit autoupdate
• 23c9e08 docs: use parse API in the README example
• e038536 Merge pull request #78 from RonnyPfannschmidt/claude/dazzling-einstein-h8zq7m
• Additional commits viewable in compare view

Updates markupsafe from 3.0.3 to 3.0.4

Release notes

Sourced from markupsafe's releases.

3.0.4

This is the MarkupSafe 3.0.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.4/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-4 Milestone: https://github.com/pallets/markupsafe/milestone/17?closed=1

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. #521

Changelog

Sourced from markupsafe's changelog.

Version 3.0.4

Released 2026-10-02

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. :issue:521

Commits

• ece2607 release version 3.0.4
• 620bc80 split archs
• 73c3be1 fix wheel builds (#536)
• d8ae19e fix wheel builds
• ff1eaff Build Android and iOS wheels (#516)
• 87e64f9 build Android and iOS wheels
• bc33c55 Build ppc64le wheels (#518)
• 0ddd6ea build ppc64le wheels
• 3e07758 Build armv7l wheels (#514)
• 39b9aae build armv7l wheels
• Additional commits viewable in compare view

Updates narwhals from 2.26.0 to 2.27.1

Release notes

Sourced from narwhals's releases.

Narwhals v2.27.1

What's Changed

• fix: return a numeric dtype from str.len_chars on all-null object columns by @​FBruzzesi in narwhals-dev/narwhals#4031
• fix: count characters, not bytes, in str.zfill on Polars < 2.0 by @​FBruzzesi in narwhals-dev/narwhals#4040

Full Changelog: narwhals-dev/narwhals@v2.27.0...v2.27.1

Narwhals v2.27.0

Changes

• test: cover concat_str single expression and null inputs (#3978)
• test: cover corr and cov constant, stability and group_by cases (#3917)
• fix(tests): PySpark tests fixup (#3940)
• test: test cover quantile boundaries, invalid raises, median over (#3919)

✨ Enhancements

• feat: Add {DataFrame, LazyFrame}.cast (#3815)
• feat: support list.contains for PyArrow, pandas and Dask (#4001)
• feat: accept file-like objects in {read,scan}_* (#3956)
• feat: hint at narwhals-datafusion plugin for datafusion.DataFrame (#3937)

🐞 Bug fixes

• fix: avoid LazyFrame.cast from resolving the full schema to check column names (#4016)
• fix: return null for floor division by zero on pandas-like backends (#4011)
• fix: upcast {Int8,Int16,UInt8,UInt16} to Int64 in pyarrow cum_sum (#3995)
• fix: align scalar operands before fill_null and horizontal reductions in Dask (#3972)
• fix: use relations' own connection for concat(how="diagonal") on DuckDB (#3998)
• fix: align list.contains null handling with Polars on lazy backends (#3996)
• fix: cum_count(reverse=True) counts non-null values on pandas-like backends (#3991)
• fix: align pandas-like and Dask concat_str boolean rendering (#3979)
• fix: match Polars in str.slice for negative offset, raise on negative length (#3969)
• fix: correct str.zfill for +-prefixed strings on polars<=1.30 and support polars 0.20.4 (#3958)
• fix: align concat_str behavior for polars<0.20.6 (#3981)
• fix: broadcast scalar-only concat_str for sql-like backends (#3980)
• fix: avoid DIVIDE_BY_ZERO in PySpark corr on constant columns (#3960)
• fix: preserve all-null rows in concat_str for pyarrow backend (#3966)
• fix: align series before fillna and isna in dask mean_horizontal (#3968)
• fix: drop trailing separator in concat_str(..., ignore_nulls=True) for pandas-like and Dask backends (#3967)
• fix: broadcast literals in pandas-like and PyArrow horizontal functions (#3941)
• fix: preserve nulls when casting to String on pandas pre v3.0.0 (#3939)
• fix: reject a negative width in str.zfill consistently across backends (#3770)
• fix: align __mod__ and __rmod__ behavior with negative operands across backends (#3929)
• fix: raise DuplicateError on duplicate struct field names; cover nested struct schema round trip in tests (#3918)
• fix: reject invalid str.{pad_start,pad_end} arguments consistently; cover pad length-zero and unicode edge cases in tests (#3910)
• fix: str.replace(n=0) on pandas-like backends; cover replace regex and n edge cases in tests (#3911)
• fix(pyarrow): use native {starts,ends}_with kernels, fixing empty-suffix ends_with; cover empty-pattern and null expr-pattern search in tests (#3912)

... (truncated)

Commits

• 185de76 release: Bump version to 2.27.1
• 67a2cff chore(deps): lock file maintenance (#4049)
• a295df1 chore(deps): lock file maintenance (#4035)
• 19ad1eb chore: prek autoupdate (#4039)
• 2b2521b fix: count characters, not bytes, in str.zfill on Polars < 2.0 (#4040)
• b89e14a skip changelog(deps): Update github/codeql-action action to v4.38.2 (#4034)
• faf5bde fix: return a numeric dtype from str.len_chars on all-null object columns...
• 1acc082 release: Bump version to 2.27.0 (#4028)
• b8dd014 fix: avoid LazyFrame.cast from resolving the full schema to check column na...
• cc2b466 fix: return null for floor division by zero on pandas-like backends (#4011)
• Additional commits viewable in compare view

Updates platformdirs from 4.12.1 to 4.13.0

Release notes

Sourced from platformdirs's releases.

4.13.0

• Detect Homebrew Python for the MacOS site directories under python:-S, which leaves base_prefix on the Cellar keg, and for the python-freethreading formula - by sricharanreddycheruku. #612
• Use Python 3.15 for development and automation. #613

PyPI release

Full Changelog: tox-dev/platformdirs@4.12.4...4.13.0

4.12.4

• Keep site directories readable by other users when root calls place_config_file or another place_*_file method with use_site_for_root - by darrenhuai. #610
• Make user_runtime_dir warn and fall back from an unreachable XDG_RUNTIME_DIR under ensure_exists instead of raising. #611

PyPI release

Full Changelog: tox-dev/platformdirs@4.12.3...4.12.4

4.12.3

• Place files from place_config_file and place_data_file in the first site directory for root on Unix with use_site_for_root=True and multipath=True, where find_config_file and find_data_file look for them. #607

PyPI release

Full Changelog: tox-dev/platformdirs@4.12.2...4.12.3

4.12.2

• Keep os.pathsep in site_applications_path under multipath=True on platforms with one applications directory. #604

PyPI release

Full Changelog: tox-dev/platformdirs@4.12.1...4.12.2

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.13.5 (2026-10-19)

---

• Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. :pr:631

---

4.13.4 (2026-10-17)

---

• Require a complete files path segment when locating Android app directories from sys.path. :pr:621
• Keep root directory tests independent of inherited XDG environment variables. :pr:622
• Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. :pr:624
• Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. :pr:625
• Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. :pr:627
• Correct the contributor guide to name ty as the type checker used by the type environment. :pr:623

---

4.13.3 (2026-10-16)

---

---

4.13.2 (2026-10-16)

---

• Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. :pr:619

Description has been truncated