chore(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 - #84
Closed
dependabot[bot] wants to merge 224 commits into
Closed
dependabot[bot] wants to merge 224 commits into
dependabot[bot] wants to merge 224 commits into
Conversation
Add the dependency-free semantic pseudonymization core, four transformation modes, explicit alias scopes, safe reversible mappings, release automation, and the local-first multimodal roadmap.
Keep strict documentation builds required while skipping Pages upload and deployment unless ENABLE_PAGES is explicitly enabled.
Pass the repository explicitly so release creation works in the minimal publish job without a checkout.
Make coverage retention and progressively meaningful, adversarial test depth part of every roadmap release gate.
Dependabot dependency update with passing repository checks.
Dependabot dependency update with passing repository checks.
Dependabot dependency update with passing repository checks.
Dependabot dependency update with passing repository checks.
Dependabot dependency update with passing repository checks.
Dependabot dependency update with passing refreshed repository checks.
Allow sentence punctuation after valid IP candidates while rejecting partial dotted matches, with detector and end-to-end regression coverage.
Add dependency-free built-in file adapters, safe file CLI workflows, semantic structured rendering, migration documentation, and a 99.36% branch-coverage floor.
## What changed - advance package metadata and release notes to `0.1.0b1` - freeze and document the dependency-free core API compatibility contract - add executable LLM gateway examples for prompts, retrieval, tool calls, and tool output - expand the threat model and production deployment guidance - publish reference latency, import-time, memory, and wheel-size measurements - harden release verification and correct the deterministic benchmark configuration ## Why `0.1.0b1` is the roadmap milestone that freezes the core API before release-candidate validation and the first stable release. ## Impact The package moves from alpha to beta without adding runtime dependencies or changing the documented core behavior. The public surface is frozen through `0.1.0`. ## Validation - Ruff format and lint - strict mypy - 164 passed, 1 Windows symlink test skipped, 99.51% branch coverage - 9,000 generated property examples across 35 independent seeds - 2,000-record JSONL stress test with 6,000 replacements - 1,000 deterministic aliases checked for stability and uniqueness - strict MkDocs build - benchmark suite with at least 20 rounds - Twine and release artifact verification - isolated install and smoke test of the exact 40,222-byte wheel
## What changed - advance package metadata and release notes to `0.1.0rc1` - freeze the `0.1.0b1` public API, model, enum, and deterministic-token contracts in compatibility tests - add portable BOM, newline, Unicode, JSONL, and CSV corpus fixtures - audit installed imports, metadata, bundled files, licence, and dependencies - install and smoke-test the built wheel on Linux, macOS, and Windows with Python 3.11 through 3.14 - make manual package runs build-only and production tags the sole Trusted Publishing path - add the rc validation issue form and link external validation issue #18 ## Why `0.1.0rc1` is the external-installation and release-validation milestone before the first stable release. It adds no product features or public API changes. ## Impact The dependency-free core remains behaviorally compatible with `0.1.0b1`. Release workflows become stricter and expand from one clean-wheel environment to the full 12-platform matrix. ## Validation - Ruff format and lint - strict mypy - 173 passed, 1 Windows symlink test skipped, 99.51% branch coverage - 4,000 generated property examples across 10 additional fixed seeds - strict MkDocs build - benchmark suite with at least 20 rounds - Twine and expanded release artifact verification - isolated import with network creation blocked - clean-wheel metadata, dependency, API, file, and CLI audit - 40,235-byte typed wheel with zero runtime dependencies Tracks external validation in #18.
## Summary - mark `0.1.0rc1` as published in the roadmap after successful production release verification ## Verification - production release workflow passed - public PyPI metadata verified - clean cache-bypassed PyPI install and wheel smoke test passed
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/download-artifact/releases">actions/download-artifact's releases</a>.</em></p> <blockquote> <h2>v8.0.1</h2> <h2>What's Changed</h2> <ul> <li>Support for CJK characters in the artifact name by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/471">actions/download-artifact#471</a></li> <li>Add a regression test for artifact name + content-type mismatches by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/472">actions/download-artifact#472</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v8...v8.0.1">https://github.com/actions/download-artifact/compare/v8...v8.0.1</a></p> <h2>v8.0.0</h2> <h2>v8 - What's new</h2> <blockquote> <p>[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.</p> </blockquote> <blockquote> <p>[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).</p> </blockquote> <h3>Direct downloads</h3> <p>To support direct uploads in <code>actions/upload-artifact</code>, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the <code>Content-Type</code> header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new <code>skip-decompress</code> parameter to <code>true</code>.</p> <h3>Enforced checks (breaking)</h3> <p>A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the <code>digest-mismatch</code> parameter. To be secure by default, we are now defaulting the behavior to <code>error</code> which will fail the workflow run.</p> <h3>ESM</h3> <p>To support new versions of the @actions/* packages, we've upgraded the package to ESM.</p> <h2>What's Changed</h2> <ul> <li>Don't attempt to un-zip non-zipped downloads by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/460">actions/download-artifact#460</a></li> <li>Add a setting to specify what to do on hash mismatch and default it to <code>error</code> by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/461">actions/download-artifact#461</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v7...v8.0.0">https://github.com/actions/download-artifact/compare/v7...v8.0.0</a></p> <h2>v7.0.0</h2> <h2>v7 - What's new</h2> <blockquote> <p>[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (<code>runs.using: node24</code>) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.</p> </blockquote> <h3>Node.js 24</h3> <p>This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.</p> <h2>What's Changed</h2> <ul> <li>Update GHES guidance to include reference to Node 20 version by <a href="https://github.com/patrikpolyak"><code>@patrikpolyak</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/440">actions/download-artifact#440</a></li> <li>Download Artifact Node24 support by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/415">actions/download-artifact#415</a></li> <li>fix: update <code>@actions/artifact</code> to fix Node.js 24 punycode deprecation by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/451">actions/download-artifact#451</a></li> <li>prepare release v7.0.0 for Node.js 24 support by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/download-artifact/pull/452">actions/download-artifact#452</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/download-artifact/commit/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"><code>3e5f45b</code></a> Add regression tests for CJK characters (<a href="https://redirect.github.com/actions/download-artifact/issues/471">#471</a>)</li> <li><a href="https://github.com/actions/download-artifact/commit/e6d03f67377d4412c7aa56a8e2e4988e6ec479dd"><code>e6d03f6</code></a> Add a regression test for artifact name + content-type mismatches (<a href="https://redirect.github.com/actions/download-artifact/issues/472">#472</a>)</li> <li><a href="https://github.com/actions/download-artifact/commit/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3"><code>70fc10c</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/461">#461</a> from actions/danwkennedy/digest-mismatch-behavior</li> <li><a href="https://github.com/actions/download-artifact/commit/f258da9a506b755b84a09a531814700b86ccfc62"><code>f258da9</code></a> Add change docs</li> <li><a href="https://github.com/actions/download-artifact/commit/ccc058e5fbb0bb2352213eaec3491e117cbc4a5c"><code>ccc058e</code></a> Fix linting issues</li> <li><a href="https://github.com/actions/download-artifact/commit/bd7976ba57ecea96e6f3df575eb922d11a12a9fd"><code>bd7976b</code></a> Add a setting to specify what to do on hash mismatch and default it to <code>error</code></li> <li><a href="https://github.com/actions/download-artifact/commit/ac21fcf45e0aaee541c0f7030558bdad38d77d6c"><code>ac21fcf</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/460">#460</a> from actions/danwkennedy/download-no-unzip</li> <li><a href="https://github.com/actions/download-artifact/commit/15999bff51058bc7c19b50ebbba518eaef7c26c0"><code>15999bf</code></a> Add note about package bumps</li> <li><a href="https://github.com/actions/download-artifact/commit/974686ed5098c7f9c9289ec946b9058e496a2561"><code>974686e</code></a> Bump the version to <code>v8</code> and add release notes</li> <li><a href="https://github.com/actions/download-artifact/commit/fbe48b1d2756394be4cd4358ed3bc1343b330e75"><code>fbe48b1</code></a> Update test names to make it clearer what they do</li> <li>Additional commits viewable in <a href="https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 8.3.2 to 9.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v9.0.0 🌈 Change <code>prune-cache</code> default to <code>false</code></h2> <h2>Changes</h2> <p>This release disables the default cache cache pruning to ease the load on the PyPi infrastructure. Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in <a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a></p> <p>Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.</p> <h2>🚨 Breaking changes</h2> <ul> <li>Change <code>prune-cache</code> default to <code>false</code> <a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a>)</li> </ul> <h2>🐛 Bug fixes</h2> <ul> <li>fix: fall back to distribution ID when os-release has no version field <a href="https://github.com/cxzhong"><code>@cxzhong</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/961">#961</a>)</li> </ul> <h2>🚀 Enhancements</h2> <ul> <li>Speed up version client by partial response reads <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/807">#807</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.11.30 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/968">#968</a>)</li> <li>chore: update known checksums for 0.11.29 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/960">#960</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v8.3.2 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/949">#949</a>)</li> </ul> <h2>⬆️ Dependency updates</h2> <ul> <li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/970">#970</a>)</li> <li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/962">#962</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/c771a70e6277c0a99b617c7a806ffedaca235ff9"><code>c771a70</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/970">#970</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/2f537ca87c1ffa233ca2a1b84815388e3e42d845"><code>2f537ca</code></a> chore: update known checksums for 0.11.30 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/968">#968</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/2269552d547df6f50e57442326930d30d943afe3"><code>2269552</code></a> Speed up version client by partial response reads (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/807">#807</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/47a7f4fb2e900d6c33a5b5f231fa21dbfaeba52f"><code>47a7f4f</code></a> Change <code>prune-cache</code> default to <code>false</code> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/967">#967</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/71966eff34a27b0a62ed4b9f6f6e383e071b1bb5"><code>71966ef</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/962">#962</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f12b1f0a84bd6dc2331b36b2bbdbb1d1e617dbcc"><code>f12b1f0</code></a> fix: fall back to distribution ID when os-release has no version field (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/961">#961</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ecd24dd710f2fb0dca1693a67af11fc4a5c5ec84"><code>ecd24dd</code></a> chore: update known checksums for 0.11.29 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/960">#960</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/6a191366842ac1502ba6c07e9b5acd5c2d9d8db3"><code>6a19136</code></a> docs: update version references to v8.3.2 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/949">#949</a>)</li> <li>See full diff in <a href="https://github.com/astral-sh/setup-uv/compare/11f9893b081a58869d3b5fccaea48c9e9e46f990...c771a70e6277c0a99b617c7a806ffedaca235ff9">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…es (#16) Bumps the development-dependencies group with 4 updates: [hypothesis](https://github.com/HypothesisWorks/hypothesis), [pre-commit](https://github.com/pre-commit/pre-commit), [ruff](https://github.com/astral-sh/ruff) and [twine](https://github.com/pypa/twine). Updates `hypothesis` from 6.158.0 to 6.161.8 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/ab93776277a3e2210566b96a856bf2f2c27077f5"><code>ab93776</code></a> Bump hypothesis version to 6.161.8 and update changelog</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/a685a97143204201ccafcd48004850646f76afe7"><code>a685a97</code></a> Merge pull request <a href="https://redirect.github.com/HypothesisWorks/hypothesis/issues/4825">#4825</a> from Zac-HD/claude/hypothesis-issue-4261-bci6bn</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/336621b400d022694565681e30ebb588358cfb21"><code>336621b</code></a> tweaks</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/1f8a20a768c467c80f94f2dbd390a55301410cd4"><code>1f8a20a</code></a> format</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/cbef62d25707da0e3d349992e2e91ec3633f820a"><code>cbef62d</code></a> vendor an equivalent to coverage_enable_subprocess</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/33910f1854d2a8087c82b4f78767fb52ee77fce7"><code>33910f1</code></a> Pin the actions we added, and don't persist credentials</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/9f17c8ae78aaef140c528e478076047e61b56e73"><code>9f17c8a</code></a> Drop a pragma which our exclude patterns already cover</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/755feb2239d987e58cf34151f38507bb7b8263bd"><code>755feb2</code></a> Combine coverage data across our CI jobs</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/7abed42671265e17e9ecd3c08d4cab84ee2e65cc"><code>7abed42</code></a> Point our coverage config references at pyproject.toml</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/e052dde689885bb9be499e1ddb1d092e00f90e35"><code>e052dde</code></a> Bump hypothesis version to 6.161.7 and update changelog</li> <li>Additional commits viewable in <a href="https://github.com/HypothesisWorks/hypothesis/compare/v6.158.0...v6.161.8">compare view</a></li> </ul> </details> <br /> Updates `pre-commit` from 4.6.0 to 4.6.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pre-commit/pre-commit/releases">pre-commit's releases</a>.</em></p> <blockquote> <h2>pre-commit v4.6.1</h2> <h3>Fixes</h3> <ul> <li>Install <code>language: node</code> hooks via <code>git</code>. <ul> <li>Fixes npm 12.x compatibility</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3719">#3719</a> PR by <a href="https://github.com/asottile"><code>@asottile</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3517">#3517</a> issue by <a href="https://github.com/ojob"><code>@ojob</code></a>.</li> </ul> </li> <li>Set <code>JULIA_DEPOT_PATH</code> for <code>language: julia</code>. <ul> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3711">#3711</a> PR by <a href="https://github.com/damonbayer"><code>@damonbayer</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit-ci/runner-image/issues/335">pre-commit-ci/runner-image#335</a> issue by <a href="https://github.com/damonbayer"><code>@damonbayer</code></a>.</li> </ul> </li> <li>Produce error on mistyped <code>--repo</code> for <code>pre-commit autoupdate</code>. <ul> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3701">#3701</a> PR by <a href="https://github.com/mxr"><code>@mxr</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3695">#3695</a> issue by <a href="https://github.com/mxr"><code>@mxr</code></a>.</li> </ul> </li> <li>Improve performance of commit existence check in <code>pre-push</code>. <ul> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3726">#3726</a> PR by <a href="https://github.com/asottile"><code>@asottile</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3604">#3604</a> issue by <a href="https://github.com/ptarjan"><code>@ptarjan</code></a>.</li> </ul> </li> <li>Avoid duplicating conflicted filenames during <code>pre-commit run --all-files</code>. <ul> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3727">#3727</a> PR by <a href="https://github.com/asottile"><code>@asottile</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3706">#3706</a> issue by <a href="https://github.com/RomanValov"><code>@RomanValov</code></a>.</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md">pre-commit's changelog</a>.</em></p> <blockquote> <h1>4.6.1 - 2026-07-21</h1> <h3>Fixes</h3> <ul> <li>Install <code>language: node</code> hooks via <code>git</code>. <ul> <li>Fixes npm 12.x compatibility</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3719">#3719</a> PR by <a href="https://github.com/asottile"><code>@asottile</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3517">#3517</a> issue by <a href="https://github.com/ojob"><code>@ojob</code></a>.</li> </ul> </li> <li>Set <code>JULIA_DEPOT_PATH</code> for <code>language: julia</code>. <ul> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3711">#3711</a> PR by <a href="https://github.com/damonbayer"><code>@damonbayer</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit-ci/runner-image/issues/335">pre-commit-ci/runner-image#335</a> issue by <a href="https://github.com/damonbayer"><code>@damonbayer</code></a>.</li> </ul> </li> <li>Produce error on mistyped <code>--repo</code> for <code>pre-commit autoupdate</code>. <ul> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3701">#3701</a> PR by <a href="https://github.com/mxr"><code>@mxr</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3695">#3695</a> issue by <a href="https://github.com/mxr"><code>@mxr</code></a>.</li> </ul> </li> <li>Improve performance of commit existence check in <code>pre-push</code>. <ul> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3726">#3726</a> PR by <a href="https://github.com/asottile"><code>@asottile</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3604">#3604</a> issue by <a href="https://github.com/ptarjan"><code>@ptarjan</code></a>.</li> </ul> </li> <li>Avoid duplicating conflicted filenames during <code>pre-commit run --all-files</code>. <ul> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3727">#3727</a> PR by <a href="https://github.com/asottile"><code>@asottile</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3706">#3706</a> issue by <a href="https://github.com/RomanValov"><code>@RomanValov</code></a>.</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pre-commit/pre-commit/commit/242ce8a25657be59f2770b50de41fe0fd508820d"><code>242ce8a</code></a> v4.6.1</li> <li><a href="https://github.com/pre-commit/pre-commit/commit/766e550cd31defcb6096a96735c9de299b0eb301"><code>766e550</code></a> Merge pull request <a href="https://redirect.github.com/pre-commit/pre-commit/issues/3727">#3727</a> from pre-commit/dedupe</li> <li><a href="https://github.com/pre-commit/pre-commit/commit/1558d06e3d9e5f495cd97ccaefe937b7c44ead70"><code>1558d06</code></a> Merge pull request <a href="https://redirect.github.com/pre-commit/pre-commit/issues/3726">#3726</a> from pre-commit/exists-faster</li> <li><a href="https://github.com/pre-commit/pre-commit/commit/8a1c47a2528419e41aadfcf8135926d68f7ffbbb"><code>8a1c47a</code></a> avoid duplicate files in --all-files during conflict</li> <li><a href="https://github.com/pre-commit/pre-commit/commit/2e01c999b2466ac7e14e1e4a57a04504bd6c1b28"><code>2e01c99</code></a> faster check of rev existing locally as a commit</li> <li><a href="https://github.com/pre-commit/pre-commit/commit/3613bf27f5500d327de70cd2fa68fa20c8975659"><code>3613bf2</code></a> Merge pull request <a href="https://redirect.github.com/pre-commit/pre-commit/issues/3701">#3701</a> from pre-commit/autoupdate-repos</li> <li><a href="https://github.com/pre-commit/pre-commit/commit/1d811d9b0b655fa648001ca479a0b7da9ebd7b8c"><code>1d811d9</code></a> Return an error for invalid --repo</li> <li><a href="https://github.com/pre-commit/pre-commit/commit/374d354c8be227db651ddd92d9499b87e2ca1ea1"><code>374d354</code></a> Merge pull request <a href="https://redirect.github.com/pre-commit/pre-commit/issues/3711">#3711</a> from damonbayer/dmb_JULIA_DEPOT_PATH</li> <li><a href="https://github.com/pre-commit/pre-commit/commit/1e7994fb1fddd31fb1998aa98f84fc43818d9485"><code>1e7994f</code></a> set JULIA_DEPOT_PATH</li> <li><a href="https://github.com/pre-commit/pre-commit/commit/b2b91195d7618d61d8973fefa4e5e084fc160d8d"><code>b2b9119</code></a> Merge pull request <a href="https://redirect.github.com/pre-commit/pre-commit/issues/3719">#3719</a> from pre-commit/npm-unknown-options</li> <li>Additional commits viewable in <a href="https://github.com/pre-commit/pre-commit/compare/v4.6.0...v4.6.1">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.15.22 to 0.16.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.0</h2> <h2>Release Notes</h2> <p>Released on 2026-07-23.</p> <p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0">blog post</a> for a migration guide and overview of the changes!</p> <h3>Breaking changes</h3> <ul> <li> <p>Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new <a href="https://docs.astral.sh/ruff/default-rules/">Default Rules</a> page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (<code>E</code>) and pyflakes (<code>F</code>) rules have been removed from the default set: <code>E401</code>, <code>E402</code>, <code>E701</code>, <code>E702</code>, <code>E703</code>, <code>E711</code>, <code>E712</code>, <code>E713</code>, <code>E714</code>, <code>E721</code>, <code>E731</code>, <code>E741</code>, <code>E742</code>, <code>E743</code>, <code>F403</code>, <code>F405</code>, <code>F406</code>, and <code>F722</code>.</p> </li> <li> <p>Ruff can now format Python code blocks in Markdown files and will do this by default. See the <a href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting">documentation</a> for more details.</p> </li> <li> <p>Ruff now supports <code>ruff: ignore</code> comments at the ends of lines, like <code>noqa</code> comments, or on the line preceding a diagnostic. For example, these both suppress an <a href="https://docs.astral.sh/ruff/rules/unused-import/"><code>unused-import</code></a> (<code>F401</code>) diagnostic:</p> <pre lang="py"><code>import math # ruff: ignore[F401] <h1>ruff: ignore[F401]</h1> <p>import os </code></pre></p> </li> <li> <p>Fixes are now shown in <code>check</code> and <code>format --check</code> output:</p> <pre lang="console"><code>❯ ruff format --check . unformatted: File would be reformatted --> try.md:1:1 | 1 | ```python - import math 2 + import math 3 | ``` | <p>1 file would be reformatted </code></pre></p> <p>This example also shows off the Markdown formatting.</p> </li> <li> <p><code>format --check</code> now supports the same output formats as the linter, including the <code>github</code> and <code>gitlab</code> outputs for rendering annotations in CI:</p> <pre lang="console"><code>❯ ruff format --check --output-format github . ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted </code></pre> <p>See the CLI help or <a href="https://docs.astral.sh/ruff/settings/#output-format">documentation</a> for the full list of supported formats.</p> </li> <li> <p>The <code>filename</code>, <code>location</code>, <code>end_location</code>, <code>fix.edits[].location</code>, and <code>fix.edits[].end_location</code> fields in the JSON output format may now be <code>null</code> rather than defaulting to the empty string and row 1, column 1, respectively.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.0</h2> <p>Released on 2026-07-23.</p> <p>Check out the <a href="https://astral.sh/blog/ruff-v0.16.0">blog post</a> for a migration guide and overview of the changes!</p> <h3>Breaking changes</h3> <ul> <li> <p>Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new <a href="https://docs.astral.sh/ruff/default-rules/">Default Rules</a> page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (<code>E</code>) and pyflakes (<code>F</code>) rules have been removed from the default set: <code>E401</code>, <code>E402</code>, <code>E701</code>, <code>E702</code>, <code>E703</code>, <code>E711</code>, <code>E712</code>, <code>E713</code>, <code>E714</code>, <code>E721</code>, <code>E731</code>, <code>E741</code>, <code>E742</code>, <code>E743</code>, <code>F403</code>, <code>F405</code>, <code>F406</code>, and <code>F722</code>.</p> </li> <li> <p>Ruff can now format Python code blocks in Markdown files and will do this by default. See the <a href="https://docs.astral.sh/ruff/formatter/#markdown-code-formatting">documentation</a> for more details.</p> </li> <li> <p>Ruff now supports <code>ruff: ignore</code> comments at the ends of lines, like <code>noqa</code> comments, or on the line preceding a diagnostic. For example, these both suppress an <a href="https://docs.astral.sh/ruff/rules/unused-import/"><code>unused-import</code></a> (<code>F401</code>) diagnostic:</p> <pre lang="py"><code>import math # ruff: ignore[F401] <h1>ruff: ignore[F401]</h1> <p>import os </code></pre></p> </li> <li> <p>Fixes are now shown in <code>check</code> and <code>format --check</code> output:</p> <pre lang="console"><code>❯ ruff format --check . unformatted: File would be reformatted --> try.md:1:1 | 1 | ```python - import math 2 + import math 3 | ``` | <p>1 file would be reformatted </code></pre></p> <p>This example also shows off the Markdown formatting.</p> </li> <li> <p><code>format --check</code> now supports the same output formats as the linter, including the <code>github</code> and <code>gitlab</code> outputs for rendering annotations in CI:</p> <pre lang="console"><code></code></pre> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/a2635fd8f39e1d34ce8074cb486809426148f3e9"><code>a2635fd</code></a> Bump 0.16.0 (<a href="https://redirect.github.com/astral-sh/ruff/issues/27136">#27136</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/34334491652f8ceca5246d15c5c5afe0d6bc77ae"><code>3433449</code></a> [ty] Reuse full call diagnostics for implicit setter calls (<a href="https://redirect.github.com/astral-sh/ruff/issues/27115">#27115</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/22400709220931375e072ad5d7460b9fc781af78"><code>2240070</code></a> Reflect <code>ruff: ignore</code> and <code>--add-ignore</code> stabilization in documentation (<a href="https://redirect.github.com/astral-sh/ruff/issues/27">#27</a>...</li> <li><a href="https://github.com/astral-sh/ruff/commit/17ef71142c52230b923dad46ee5554140fc3fd2e"><code>17ef711</code></a> Stabilize <code>--add-ignore</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/27125">#27125</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ef912bbbe466856aa4aac10ad2a8856eb3d5aef3"><code>ef912bb</code></a> Add newly stabilized rules to defaults (<a href="https://redirect.github.com/astral-sh/ruff/issues/27055">#27055</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/b30f04023281b46f12011f13ce6b45c247e0d2e3"><code>b30f040</code></a> Stabilize new default rules (<a href="https://redirect.github.com/astral-sh/ruff/issues/27035">#27035</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/bcd70c5f10ea97ed52a785d70e7f33b83b7c697a"><code>bcd70c5</code></a> Exclude Markdown files from <code>format-dev</code> runs (<a href="https://redirect.github.com/astral-sh/ruff/issues/27052">#27052</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/87e51e2cbbaed376fc13dead40fd772361fa07c0"><code>87e51e2</code></a> Fix <code>format --check</code> spans for syntax errors (<a href="https://redirect.github.com/astral-sh/ruff/issues/27045">#27045</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/afe2723a348364ac7f4b9abd76fc67779490c05e"><code>afe2723</code></a> [<code>flake8-gettext</code>] Stabilize qualified-name and built-in binding resolution (...</li> <li><a href="https://github.com/astral-sh/ruff/commit/a9702d8928344f77a41dbe535f655a69fb04e2df"><code>a9702d8</code></a> [<code>flake8-bandit</code>] Stabilize string literal binding resolution (<code>S310</code>) (<a href="https://redirect.github.com/astral-sh/ruff/issues/26944">#26944</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.15.22...0.16.0">compare view</a></li> </ul> </details> <br /> Updates `twine` from 6.2.0 to 7.0.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/twine/blob/main/docs/changelog.rst">twine's changelog</a>.</em></p> <blockquote> <h2>twine 7.0.0 (2026-07-27)</h2> <p>Bugfixes ^^^^^^^^</p> <ul> <li>Specify UTF-8 encoding when reading <code>.pypirc</code> files. (<code>[#1268](pypa/twine#1268) <https://github.com/pypa/twine/issues/1268></code>_)</li> <li>Add missing subdependencies to <code>--version</code> output. (<code>[#1275](pypa/twine#1275) <https://github.com/pypa/twine/issues/1275></code>_)</li> <li>The dependency on <code>rich</code> has been bumped to avoid a hang in some environments. (<code>[#1308](pypa/twine#1308) <https://github.com/pypa/twine/issues/1308></code>_)</li> <li>Indices that respond with non-standard HTTP codes are now handled more gracefully. (<code>[#1309](pypa/twine#1309) <https://github.com/pypa/twine/issues/1309></code>_)</li> </ul> <p>Deprecations and Removals ^^^^^^^^^^^^^^^^^^^^^^^^^</p> <ul> <li>Fix uploading packages with metadata version 2.5. The fix no longer allows metadata version 2.0, which was never officially standardised. (<code>[#1317](pypa/twine#1317) <https://github.com/pypa/twine/issues/1317></code>_)</li> </ul> <p>Misc ^^^^</p> <ul> <li><code>[#1298](pypa/twine#1298) <https://github.com/pypa/twine/issues/1298></code>_</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/twine/commit/fdb86cb45de11faeece9b274be6da7d275cdd4f9"><code>fdb86cb</code></a> Update changelog for 7.0.0 (<a href="https://redirect.github.com/pypa/twine/issues/1344">#1344</a>)</li> <li><a href="https://github.com/pypa/twine/commit/bfa7f7f037c6ba39e93813c6ad2537d13cf4b1e6"><code>bfa7f7f</code></a> changelog: backfill entries from PRs (<a href="https://redirect.github.com/pypa/twine/issues/1330">#1330</a>)</li> <li><a href="https://github.com/pypa/twine/commit/4f20c0dc374bbd54fe7cddc341e3c5ba7479917b"><code>4f20c0d</code></a> Remove monkeypatch allowing Metadata 2.0 (<a href="https://redirect.github.com/pypa/twine/issues/1317">#1317</a>)</li> <li><a href="https://github.com/pypa/twine/commit/1df249ecb442f5420d44c7782be11337daf83651"><code>1df249e</code></a> build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (<a href="https://redirect.github.com/pypa/twine/issues/1318">#1318</a>)</li> <li><a href="https://github.com/pypa/twine/commit/bea960757875c4e2800f82f95519aa0b4d9c3c04"><code>bea9607</code></a> fix: bump minimum rich dependency to 14.3.3 to prevent verbose hang (<a href="https://redirect.github.com/pypa/twine/issues/1308">#1308</a>)</li> <li><a href="https://github.com/pypa/twine/commit/ac17a17a9c01c5a2ba10f6ee142cef5aec6f56b0"><code>ac17a17</code></a> build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/pypa/twine/issues/1311">#1311</a>)</li> <li><a href="https://github.com/pypa/twine/commit/039cedfd9082b520dc37563dc0cf8a2d453a36e2"><code>039cedf</code></a> build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (<a href="https://redirect.github.com/pypa/twine/issues/1313">#1313</a>)</li> <li><a href="https://github.com/pypa/twine/commit/d465cb0930d3c6446d240902f6f782f8d5793288"><code>d465cb0</code></a> Handle non-standard HTTP status codes (<a href="https://redirect.github.com/pypa/twine/issues/1309">#1309</a>)</li> <li><a href="https://github.com/pypa/twine/commit/cab618fb122bb2d1e6c042f5bf0c5a8b8e2573bc"><code>cab618f</code></a> Bump <code>packaging >= 26.1</code> (<a href="https://redirect.github.com/pypa/twine/issues/1310">#1310</a>)</li> <li><a href="https://github.com/pypa/twine/commit/2d06e1177b1dcf94ae302e48f6fe6a4992fc89ae"><code>2d06e11</code></a> build(deps): bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 (<a href="https://redirect.github.com/pypa/twine/issues/1307">#1307</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pypa/twine/compare/6.2.0...7.0.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Paolo Mazza <59370937+ma2za@users.noreply.github.com>
## Summary - promote the validated dependency-free core from `0.1.0rc1` to stable `0.1.0` - publish the stable compatibility policy, release notes, roadmap state, and PyPI maturity metadata - update exact-version installed-wheel audits and reject prerelease maturity metadata - retire the one-off RC validation form ## Compatibility There are no public API, runtime behavior, or deterministic token changes from `0.1.0rc1`. ## Validation - 174 passed, 1 Windows symlink skip, 99.51% branch coverage - Ruff 0.16 format and lint, strict mypy - 10 additional Hypothesis seeds - 9 benchmarks with at least 20 rounds - strict MkDocs build - wheel and sdist build, Twine, metadata, contents, licence, dependency, and tag audits - isolated wheel audits on Python 3.11 and 3.14 ## Release decision The maintainer explicitly waived the planned seven-day observation window and directed immediate stable publication on 2026-08-02. No external reports or release-blocking defects had been filed. The waiver is recorded in the stable release notes and validation issue.
## Summary - mark the stable 0.1.0 roadmap milestone as published ## Verification - git diff --check - uv run mkdocs build --strict
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 9.0.0 to 10.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.0.1 🌈 Tolerate transient manifest timeouts</h2> <h2>Changes</h2> <p>Thank you <a href="https://github.com/arguile"><code>@arguile</code></a>- for making this action more resilient.</p> <h2>🐛 Bug fixes</h2> <ul> <li>Tolerate transient manifest timeouts <a href="https://github.com/arguile"><code>@arguile</code></a>- (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1016">#1016</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.12.4 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1017">#1017</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v10.0.0 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1014">#1014</a>)</li> </ul> <h2>v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features</h2> <h2>Changes</h2> <p>Another breaking release, directly after v9.0.0 but we think the added security justifies that.</p> <h3>Extra security by default</h3> <p>If you use the default <code>enable-cache: auto</code> this will now <strong>DISABLE THE CACHE</strong> to protect against cache poisoning for the following events:</p> <ul> <li><code>pull_request_target</code></li> <li><code>workflow_run</code></li> <li><code>release</code></li> </ul> <p>You can read the full reasoning in <a href="https://redirect.github.com/astral-sh/setup-uv/issues/984">astral-sh/setup-uv#984</a></p> <h3><code>version: latest-known</code></h3> <pre lang="yaml"><code>- name: Install the latest version of uv known to setup-uv uses: astral-sh/setup-uv@v10.0.0 with: version: "latest-known" </code></pre> <p>This will now install the latest version with a checksum that is known by this action. The <a href="https://github.com/astral-sh/setup-uv/blob/4f6036f71cec78afb113b323f220c9185d983c12/src/download/checksum/known-checksums.ts">known <code>uv</code> checksums</a> are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.</p> <h3>Read python version from <code>.tool-versions</code></h3> <pre lang="yaml"><code>- name: Install uv based on the version defined in .tool-versions and also set python uses: astral-sh/setup-uv@v10.0.0 with: version-file: "pyproject.toml" </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/20cfd1bf945f4377ade1205e4dbc17946fc9a30d"><code>20cfd1b</code></a> chore: update known checksums for 0.12.4 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1017">#1017</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/d73a0cab66a532d7afa440d9df4a67ea9fe65a30"><code>d73a0ca</code></a> Tolerate transient manifest timeouts (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1016">#1016</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ae3b92d1bdb308a10adfe7b8f408e5cc8c30f3f6"><code>ae3b92d</code></a> docs: update version references to v10.0.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1014">#1014</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d"><code>ae62891</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1013">#1013</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f9cdb47d487aee2be8925d1e57290177ad9e1ac2"><code>f9cdb47</code></a> Reject paths in .tool-versions (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1007">#1007</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/4f6036f71cec78afb113b323f220c9185d983c12"><code>4f6036f</code></a> Require pull requests for Dependabot rollups (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1005">#1005</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8d6402c9b71205b2d8d0b82de531d8fed8430182"><code>8d6402c</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1004">#1004</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/46f427bd47c794e99536b75ffaa9f27602425027"><code>46f427b</code></a> Read Python version from .tool-versions (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/996">#996</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8ed89c51143f65ea13eaba62db51dbb8ea52d0a3"><code>8ed89c5</code></a> ci: pin Alpine container image (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/995">#995</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8473c7fea42cdfd540f4b01317a17ac5f54126ae"><code>8473c7f</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/994">#994</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/setup-uv/compare/c771a70e6277c0a99b617c7a806ffedaca235ff9...20cfd1bf945f4377ade1205e4dbc17946fc9a30d">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ectory with 4 updates (#26) Bumps the development-dependencies group with 4 updates in the / directory: [hypothesis](https://github.com/HypothesisWorks/hypothesis), [mypy](https://github.com/python/mypy), [pre-commit](https://github.com/pre-commit/pre-commit) and [ruff](https://github.com/astral-sh/ruff). Updates `hypothesis` from 6.161.8 to 6.165.10 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/6384deef469a88c147dab205f093b2d16d652785"><code>6384dee</code></a> Bump hypothesis version to 6.165.10 and update changelog</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/c7ca59d673e674664a2ae1fdbd15316b3f38ec59"><code>c7ca59d</code></a> Merge pull request <a href="https://redirect.github.com/HypothesisWorks/hypothesis/issues/4864">#4864</a> from dgutson/claude-stateful-and-example</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/3fc38f1d6a6b1752bf5fad61d44ee79d31d35406"><code>3fc38f1</code></a> claude: teach /hypothesis about stateful tests and <a href="https://github.com/example"><code>@example</code></a></li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/16f24b76015dbaabca40608eb9e73b46ac64e249"><code>16f24b7</code></a> Merge pull request <a href="https://redirect.github.com/HypothesisWorks/hypothesis/issues/4862">#4862</a> from Zac-HD/claude/upstream-regex-issues-fkke9q</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/48ce4462047b2bd196208f1d55de6059de7941a9"><code>48ce446</code></a> Bump hypothesis version to 6.165.9 and update changelog</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/d559a694e1d1d7de60247749fd30075239d74b22"><code>d559a69</code></a> Merge pull request <a href="https://redirect.github.com/HypothesisWorks/hypothesis/issues/4860">#4860</a> from Liam-DeVoe/optimize-single-branch-one-of</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/3a19d890f5d42ebc432ffe7139e37985fd714ef6"><code>3a19d89</code></a> fix context flag restoration</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/2408c994e3265e2951f5b5fc8371f3ebb42ac814"><code>2408c99</code></a> drop unecessary empty check</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/3f9491236a2ffa319c02338d5276417e1e26031a"><code>3f94912</code></a> Clarify re.ASCII wording in changelog entry</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/9d0a9a80d0206a6c8f6ab2c05c935ada7de98c4a"><code>9d0a9a8</code></a> Fix from_regex handling of negative classes, re.ASCII, and zero-min repeats</li> <li>Additional commits viewable in <a href="https://github.com/HypothesisWorks/hypothesis/compare/v6.161.8...v6.165.10">compare view</a></li> </ul> </details> <br /> Updates `mypy` from 2.3.0 to 2.3.1 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's changelog</a>.</em></p> <blockquote> <h3>Mypy 2.3.1</h3> <ul> <li>Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR <a href="https://redirect.github.com/python/mypy/pull/21826">21826</a>)</li> <li>Fix mypyc <code>default_factory</code> for inherited dataclass (Daniël van Noord, PR <a href="https://redirect.github.com/python/mypy/pull/21785">21785</a>)</li> <li>Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21734">21734</a>)</li> <li>Fix crash when unpacking return value from overload (Shantanu, PR <a href="https://redirect.github.com/python/mypy/pull/21830">21830</a>)</li> </ul> <h3>Acknowledgements</h3> <p>Thanks to all mypy contributors who contributed to this release:</p> <ul> <li>Agriya Khetarpal</li> <li>Ethan Sarp</li> <li>Ivan Levkivskyi</li> <li>Jingchen Ye</li> <li>Jukka Lehtosalo</li> <li>Piotr Sawicki</li> <li>Shantanu</li> <li>Tom Bannink</li> <li>Viktor Szépe</li> <li>ygale</li> </ul> <p>I'd also like to thank my employer, Dropbox, for supporting mypy development.</p> <h2>Mypy 2.2</h2> <p>We've just uploaded mypy 2.2.0 to the Python Package Index (<a href="https://pypi.org/project/mypy/">PyPI</a>). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:</p> <pre><code>python3 -m pip install -U mypy </code></pre> <p>You can read the full documentation for this release on <a href="http://mypy.readthedocs.io">Read the Docs</a>.</p> <h3>Support for Closed TypedDicts (PEP 728)</h3> <p>Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.</p> <p>You can use the <code>closed</code> keyword argument with <code>TypedDict</code>:</p> <pre lang="python"><code>HasName = TypedDict("HasName", {"name": str}) HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True) Movie = TypedDict("Movie", {"name": str, "year": int}) <p>movie: Movie = {"name": "Nimona", "year": 2023} has_name: HasName = movie # OK: HasName is open (default) has_only_name: HasOnlyName = movie # Error: HasOnlyName is closed and Movie has extra "year" key </tr></table> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python/mypy/commit/d642c4478e9e3acbe9233edbe17ffc569a1a778c"><code>d642c44</code></a> Bump version to 2.3.1</li> <li><a href="https://github.com/python/mypy/commit/a39242983d3c2cb85886a1eb6d5869180672784c"><code>a392429</code></a> [mypyc] Fix crash on double yielding Iterators (<a href="https://redirect.github.com/python/mypy/issues/21826">#21826</a>)</li> <li><a href="https://github.com/python/mypy/commit/4843e7773e7dc8fe3f1fd1319277d6d11cd6cdb3"><code>4843e77</code></a> [mypyc] Fix <code>default_factory</code> for inherited dataclass (<a href="https://redirect.github.com/python/mypy/issues/21785">#21785</a>)</li> <li><a href="https://github.com/python/mypy/commit/14f5df93ed8d1be4f4cc9c447eb2e6e619362e05"><code>14f5df9</code></a> [mypyc] Clear coroutine env on coroutine completion (<a href="https://redirect.github.com/python/mypy/issues/21734">#21734</a>)</li> <li><a href="https://github.com/python/mypy/commit/6dfa06dda6e34912279e498d35a43ba6dc30bfee"><code>6dfa06d</code></a> Fix crash when unpacking return value from overload (<a href="https://redirect.github.com/python/mypy/issues/21830">#21830</a>)</li> <li><a href="https://github.com/python/mypy/commit/a3857467da126d28b55724e8bb682019df9a503e"><code>a385746</code></a> Bump version to 2.3.1+dev</li> <li>See full diff in <a href="https://github.com/python/mypy/compare/v2.3.0...v2.3.1">compare view</a></li> </ul> </details> <br /> Updates `pre-commit` from 4.6.1 to 4.6.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pre-commit/pre-commit/releases">pre-commit's releases</a>.</em></p> <blockquote> <h2>pre-commit v4.6.2</h2> <h3>Fixes</h3> <ul> <li>Fix <code>language: node</code> hooks that contain <code>"scripts": {"build": ...}</code> with npm 11.x. <ul> <li>Regressed in 4.6.1.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3737">#3737</a> issue by <a href="https://github.com/mheiges"><code>@mheiges</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3743">#3743</a> PR by <a href="https://github.com/asottile"><code>@asottile</code></a>.</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md">pre-commit's changelog</a>.</em></p> <blockquote> <h1>4.6.2 - 2026-08-10</h1> <h3>Fixes</h3> <ul> <li>Fix <code>language: node</code> hooks that contain <code>"scripts": {"build": ...}</code> with npm 11.x. <ul> <li>Regressed in 4.6.1.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3737">#3737</a> issue by <a href="https://github.com/mheiges"><code>@mheiges</code></a>.</li> <li><a href="https://redirect.github.com/pre-commit/pre-commit/issues/3743">#3743</a> PR by <a href="https://github.com/asottile"><code>@asottile</code></a>.</li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pre-commit/pre-commit/commit/9767b6c8211a6bf683875a0afcf2b390457a4b66"><code>9767b6c</code></a> v4.6.2</li> <li><a href="https://github.com/pre-commit/pre-commit/commit/42ee3ff5ac1cae639613c9ad002d0502ae82384f"><code>42ee3ff</code></a> Merge pull request <a href="https://redirect.github.com/pre-commit/pre-commit/issues/3743">#3743</a> from pre-commit/npm-build-scripts-11-x</li> <li><a href="https://github.com/pre-commit/pre-commit/commit/30566198cb2d05201625f92b660a34c38ffe2dc7"><code>3056619</code></a> fix <code>language: node</code> for hooks with build scripts and npm 11.x</li> <li>See full diff in <a href="https://github.com/pre-commit/pre-commit/compare/v4.6.1...v4.6.2">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.0 to 0.16.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.3</h2> <h2>Release Notes</h2> <p>Released on 2026-08-13.</p> <h3>Preview features</h3> <ul> <li>[<code>pylint</code>] Fix false negatives on negative numbers (<code>PLR6104</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li> <li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with <code>while True</code> (<code>UP048</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-bandit</code>] Also check keyword arguments (<code>S602</code>, <code>S603</code>, <code>S607</code>, <code>S609</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li> <li>[<code>pylint</code>] Allow <code>continue</code> in <code>finally</code> on Python 3.8 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li> <li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with bools (<a href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li> <li>[<code>pylint</code>] Fix false positives and negatives with <code>%b</code> format character (<code>PLE1300</code>, <code>PLE1307</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li> <li>[<code>pylint</code>] Improve handling of concatenated strings (<code>PLE1300</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>numpy</code>] Make <code>np.chararray</code> autofix backwards-compatible (<code>NPY201</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Enable PGO for Linux x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li> <li>Enable PGO for Linux ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li> <li>Enable PGO for Windows x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li> <li>Enable PGO for macOS ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li> <li>Reduce <code>Expr</code> size to 64 bytes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Hyperlink rule codes in <code>ruff check --statistics</code> output (<a href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code> (<code>RUF006</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Use mimalloc v3 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/Andrej730"><code>@Andrej730</code></a></li> <li><a href="https://github.com/alonfaraj"><code>@alonfaraj</code></a></li> <li><a href="https://github.com/romero-deshaw"><code>@romero-deshaw</code></a></li> <li><a href="https://github.com/Avasam"><code>@Avasam</code></a></li> <li><a href="https://github.com/tjkuson"><code>@tjkuson</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.3</h2> <p>Released on 2026-08-13.</p> <h3>Preview features</h3> <ul> <li>[<code>pylint</code>] Fix false negatives on negative numbers (<code>PLR6104</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li> <li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with <code>while True</code> (<code>UP048</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-bandit</code>] Also check keyword arguments (<code>S602</code>, <code>S603</code>, <code>S607</code>, <code>S609</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li> <li>[<code>pylint</code>] Allow <code>continue</code> in <code>finally</code> on Python 3.8 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li> <li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with bools (<a href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li> <li>[<code>pylint</code>] Fix false positives and negatives with <code>%b</code> format character (<code>PLE1300</code>, <code>PLE1307</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li> <li>[<code>pylint</code>] Improve handling of concatenated strings (<code>PLE1300</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>numpy</code>] Make <code>np.chararray</code> autofix backwards-compatible (<code>NPY201</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Enable PGO for Linux x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li> <li>Enable PGO for Linux ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li> <li>Enable PGO for Windows x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li> <li>Enable PGO for macOS ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li> <li>Reduce <code>Expr</code> size to 64 bytes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Hyperlink rule codes in <code>ruff check --statistics</code> output (<a href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code> (<code>RUF006</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Use mimalloc v3 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/Andrej730"><code>@Andrej730</code></a></li> <li><a href="https://github.com/alonfaraj"><code>@alonfaraj</code></a></li> <li><a href="https://github.com/romero-deshaw"><code>@romero-deshaw</code></a></li> <li><a href="https://github.com/Avasam"><code>@Avasam</code></a></li> <li><a href="https://github.com/tjkuson"><code>@tjkuson</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/chirizxc"><code>@chirizxc</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/b0e47022cfce4f3594aa26d15ea792681430b6f6"><code>b0e4702</code></a> Bump 0.16.3 (<a href="https://redirect.github.com/astral-sh/ruff/issues/27723">#27723</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ecdd401fdbc5b0b22e18759c8bd25cda452e8b32"><code>ecdd401</code></a> [ty] Separate script and uv modules from project metadata (<a href="https://redirect.github.com/astral-sh/ruff/issues/27720">#27720</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/126352467217bebfa4cb86fd3c4d20820322d9e3"><code>1263524</code></a> [ty] Simplify display implementations with std::fmt::from_fn (<a href="https://redirect.github.com/astral-sh/ruff/issues/27718">#27718</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/59196baedf23c9876d1fcf1fa2ae78f80d306f94"><code>59196ba</code></a> [ty] Unify polarity-aware relation construction (<a href="https://redirect.github.com/astral-sh/ruff/issues/27707">#27707</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/b8c5e73abe5b15a74fb066e474d30397d1421cfe"><code>b8c5e73</code></a> [ty] Disable CodSpeed cycle estimation for instrumented benchmarks (<a href="https://redirect.github.com/astral-sh/ruff/issues/27706">#27706</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/2b0d21094e2a55491bff60c07fd6f8803876cae5"><code>2b0d210</code></a> [ty] Centralize matched argument relations (<a href="https://redirect.github.com/astral-sh/ruff/issues/27705">#27705</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/a9130f3381fe137626d22288c0d45f996541ca7e"><code>a9130f3</code></a> [<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with <code>while True</code> (<code>while-one</code>, `...</li> <li><a href="https://github.com/astral-sh/ruff/commit/c64c7d6dad1e0a4966ce578b2c03af1e8e7673e1"><code>c64c7d6</code></a> [ty] Model try exception flow with operation checkpoints (<a href="https://redirect.github.com/astral-sh/ruff/issues/27471">#27471</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/9dea5ef180b3de748b5fe45787056716f235d11a"><code>9dea5ef</code></a> [ty] Avoid deriving sequents for typevars with concrete bounds (<a href="https://redirect.github.com/astral-sh/ruff/issues/27587">#27587</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/9798e88de673ec73051980ebd9aeb681161f3c27"><code>9798e88</code></a> [ty] Preserve enum exhaustiveness with custom <em>missing</em> methods (<a href="https://redirect.github.com/astral-sh/ruff/issues/27700">#27700</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.0...0.16.3">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Paolo Mazza <59370937+ma2za@users.noreply.github.com>
) Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.14.1 to 1.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/gh-action-pypi-publish/releases">pypa/gh-action-pypi-publish's releases</a>.</em></p> <blockquote> <h2>v1.14.2</h2> <!-- raw HTML omitted --> <h2>🛠️ Urgh… Another release!? Again? Explain yourself!</h2> <p>Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.</p> <blockquote> <p>[!tip] So what <em>most</em> people will find useful is <a href="https://github.com/takluyver"><code>@takluyver</code></a><a href="https://github.com/sponsors/takluyver">💰</a>'s update of Twine to v7 that we use internally (<a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416">#416</a>). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.</p> </blockquote> <h2>🧐 Tell me why..</h2> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <p>TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like <a href="https://redirect.github.com/aio-libs/aiohttp/pull/13226">aio-libs/aiohttp#13226</a> around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.</p> <p>I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.</p> <p>Over the course of investigation, <a href="https://github.com/facutuesca"><code>@facutuesca</code></a><a href="https://github.com/sponsors/facutuesca">💰</a> found and fixed a related underlying cache invalidation bug in <a href="https://redirect.github.com/sigstore/sigstore-python/pull/1838">sigstore/sigstore-python#1838</a>, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.</p> <p>Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: <a href="https://publishing-five-minute-timeout.tiiny.site">https://publishing-five-minute-timeout.tiiny.site</a>.</p> <!-- raw HTML omitted --> <!-- raw HTML omitted --> <h2>🫶 New Contributors</h2> <ul> <li><a href="https://github.com/davidbrochart"><code>@davidbrochart</code></a> made their first contribution in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415">#415</a></li> <li><a href="https://github.com/takluyver"><code>@takluyver</code></a> made their first contribution in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416">#416</a></li> </ul> <p><strong>🪞 Full Diff</strong>: <a href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2">https://github.com/pypa/gh-action-pypi-publish/compare/v1.14.1...v1.14.2</a></p> <p><strong>🧔♂️ Release Manager:</strong> <a href="https://github.com/sponsors/webknjaz"><code>@webknjaz</code></a> <a href="https://stand-with-ukraine.pp.ua">🇺🇦</a></p> <p><strong>🙏 Special Thanks</strong> to <a href="https://github.com/davidbrochart"><code>@davidbrochart</code></a><a href="https://github.com/sponsors/davidbrochart">💰</a> and <a href="https://github.com/Dreamsorcerer"><code>@Dreamsorcerer</code></a><a href="https://github.com/sponsors/Dreamsorcerer">💰</a> for turning my attention (in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/415">#415</a> and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. <a href="https://github.com/bdraco"><code>@bdraco</code></a><a href="https://github.com/sponsors/bdraco">💰</a> came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. <a href="https://github.com/miketheman"><code>@miketheman</code></a><a href="https://github.com/sponsors/miketheman">💰</a> confirmed the Warehouse-side details. Also, <a href="https://github.com/jku"><code>@jku</code></a><a href="https://github.com/sponsors/jku">💰</a> and <a href="https://github.com/woodruffw"><code>@woodruffw</code></a><a href="https://github.com/sponsors/woodruffw">💰</a> helped work through, review and release the Sigstore ecosystem upstream libs.</p> <p><strong>💬 Discuss</strong> <a href="https://bsky.app/profile/did:plc:ve6s3mxkefjaxty3m4fdqumn/post/3mrsqy2xba22j">on Bluesky 🦋</a>, <a href="https://mastodon.social/@webknjaz/117005132816750073">on Mastodon 🐘</a> and [on GitHub][release discussion].</p> <p>[![GH Sponsors badge]][GH Sponsors URL]</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/dc37677b2e1c63e2034f94d8a5b11f265b73ba33"><code>dc37677</code></a> Merge pull request <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/417">#417</a> from trail-of-forks/ft/bump-deps</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/8b2f23418f024937cf97f77534a597947105e772"><code>8b2f234</code></a> Bump <code>pypi-attestations</code> and <code>sigstore</code></li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/78b72dbfed6e025eb89577c059edc936f8a2df14"><code>78b72db</code></a> Merge pull request <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/416">#416</a> from takluyver/twine-v7</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/92f4d2a159875dd135a7e56b7b3262f502b23a13"><code>92f4d2a</code></a> Update twine to v7</li> <li>See full diff in <a href="https://github.com/pypa/gh-action-pypi-publish/compare/ba38be9e461d3875417946c167d0b5f3d385a247...dc37677b2e1c63e2034f94d8a5b11f265b73ba33">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Paolo Mazza <59370937+ma2za@users.noreply.github.com>
- Restrict \ci.yml\ push triggers to \main\ and tags to avoid duplicate runs on PR branches. - Add \concurrency\ groups to both \ci.yml\ and \docs.yml\ to cancel in-progress redundant runs. - Make heavy testing, property-testing, and packaging jobs depend on the \quality\ job so they fail fast without spinning up runners if linting or formatting fails.
- Introduces \pseudonymize[ner]\ optional dependency (tokenizers, onnxruntime, huggingface-hub). - Adds \LocalONNXNERBackend\ implementing the block-aware detection protocol without fetching at runtime. - Implements test coverage and updates the private release plan.
… clipping truncation
… output" This reverts commit 1249aaf.
Replaced verbose entity placeholders with short 3-letter codes.
…ing for precise redaction overlay
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.0.1 to 10.1.0. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@20cfd1b...bec219d) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/astral-sh/setup-uv-10.1.0
branch
September 18, 2026 05:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps astral-sh/setup-uv from 10.0.1 to 10.1.0.
Release notes
Sourced from astral-sh/setup-uv's releases.
Commits
bec219dchore(deps-dev): roll up Dependabot updates (#1043)b90ec40fix: respect no proxy directive (#1037)421feb6chore: update known checksums for 0.12.12 (#1041)f634bf4Expose a Python "identity" output (#1036)a6772c8chore: update known checksums for 0.12.10/0.12.11 (#1038)e105c8fchore: update known checksums for 0.12.9 (#1035)cd13f92Verify downloads with astral-sh/versions checksums (#1033)3aef7b9chore: update known checksums for 0.12.7/0.12.8 (#1031)d08d816chore: update known checksums for 0.12.6 (#1030)19b4d1eHarden npm install defaults (#1026)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)