[dependabot]

Bumps the uv-minor-patch group with 19 updates in the / directory:

Package	From	To
certifi	2026.10.19	2026.10.23
fastapi	0.143.3	0.162.0
pandas	3.0.6	3.1.0
pycparser	3.11	3.12
reportlab	5.0.1	5.1.0
sqlalchemy	2.1.5	2.1.6
starlette	1.8.0	1.9.0
snowflake-connector-python	5.0.0	5.1.0
sentence-transformers	6.1.0	6.2.0
streamlit	1.66.0	1.66.1
hypothesis	6.170.5	6.170.8
httpx2	2.13.1	2.16.0
markdown	3.11.1	3.11.2
ruff	0.17.1	0.17.2
coverage	7.16.2	7.17.0
filelock	4.2.1	4.2.4
httpcore2	2.13.1	2.16.0
soupsieve	3.0.3	3.0.4
tzlocal	5.4.4	5.4.5

Updates certifi from 2026.10.19 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• See full diff in compare view

Updates fastapi from 0.143.3 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

• 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

0.161.1

Fixes

• 🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @​tiangolo.

0.161.0

Features

• ✨ Add support for combining unions of form models. PR #16596 by @​tiangolo.

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

• 🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @​tiangolo.

Internal

• ⬆ Bump certifi from 2026.1.4 to 2026.10.19. PR #16571 by @​dependabot[bot].

0.159.1

Features

• ✨ Add support for optional unions of form models. PR #16586 by @​tiangolo.

0.159.0

Features

• ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

• ✨ Add support for optional form models. PR #16582 by @​tiangolo.

0.158.1

... (truncated)

Commits

• 7a0a3f0 🔖 Release version 0.162.0 (#16606)
• b56f7c6 📝 Update release notes
• f02ef49 🐛 Restore default handling for omitted boolean form fields (#16605)
• 69ddc2b 🔖 Release version 0.161.1 (#16599)
• 0cafa07 📝 Update release notes
• f90d036 🐛 Fix OpenAPI schemas for standalone nullable form unions (#16598)
• 80c8742 🔖 Release version 0.161.0 (#16597)
• b105209 📝 Update release notes
• e42ac0a ✨ Add support for combining unions of form models (#16596)
• addd077 🔖 Release version 0.160.0 (#16595)
• Additional commits viewable in compare view

Updates pandas from 3.0.6 to 3.1.0

Release notes

Sourced from pandas's releases.

pandas 3.1.0

We are pleased to announce the release of pandas 3.1.0. This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

• New DataFrame.select() and updated DataFrame.filter() method
• Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas

Or from conda-forge

conda install -c conda-forge pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.1.0rc0

We are pleased to announce a release candidate for pandas 3.1.0.

See the whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade --pre pandas==3.1.0rc0

Or from conda-forge

conda install -c conda-forge/label/pandas_rc pandas==3.1.0rc0

Please report any issues with the release candidate on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• c6f4676 RLS: 3.1.0
• dd69475 Backport PR #71468 on branch 3.1.x (DOC: 3.1 whatsnew: add some structure to ...
• 4ccc19a Backport PR #71465 on branch 3.1.x (DOC: update announce (contributor listing...
• 24dae63 [backport 3.1.x] DOC: cleanup 3.1.0 whatsnew (#71408) (#71466)
• 8519ca6 [backport 3.1.x] CI: temporary pin dateutil to <3 (#71461) (#71464)
• 2126193 Backport PR #71387 on branch 3.1.x (BUG: fix string regex operations with $ e...
• 4700f5d Backport PR #71442 on branch 3.1.x (BUG: parallel read_csv raising released m...
• 08efb14 Backport PR #71456 on branch 3.1.x (TST: Fix test_reduce_array until reduct...
• ee8dcb7 Backport PR #71429 on branch 3.1.x (DOC: add dedicated 3.1 whatsnew section f...
• d93e32c Backport PR #71383 on branch 3.1.x (BUG: fix string regex operations with Pyt...
• Additional commits viewable in compare view

Updates pycparser from 3.11 to 3.12

Release notes

Sourced from pycparser's releases.

release_v3.12

What's Changed

• Emit one type definition for declarators that share it by @​Cherith1222 in eliben/pycparser#621
• raise ParseError for _Atomic applied to array or function type by @​arfa-21 in eliben/pycparser#623
• Fix code generation for the _Pragma operator by @​hulkbig in eliben/pycparser#625
• Parse GNU statement expressions as primary expressions by @​hulkbig in eliben/pycparser#628
• Fix shared type declarations in switch cases by @​hulkbig in eliben/pycparser#630
• raise ParseError for typedef in a parameter declaration by @​arfa-21 in eliben/pycparser#631
• Scope for loop init declarations to the loop by @​arfa-21 in eliben/pycparser#634

Full Changelog: eliben/pycparser@release_v3.11...release_v3.12

Commits

• 3ec766b Tweak build
• 1771cbf Prepare to release 3.12
• 51715bf Add documentation on using methods of ast node
• 878c289 Support va_arg properly
• 840fe55 Add some Linux kernel headers to benchmark
• 8fd2299 Add ArrayDesignator AST node to distinguish array indices in designators
• aa32af5 Fix crashes in generator with empty case bodies
• f29e8ef Regression test for #215
• a74aa74 Support form feed and vertical tabs as whitespace
• 02380d0 Comment fixes
• Additional commits viewable in compare view

Updates reportlab from 5.0.1 to 5.1.0

Updates sqlalchemy from 2.1.5 to 2.1.6

Release notes

Sourced from sqlalchemy's releases.

2.1.6

Released: October 21, 2026

orm

• [orm] [bug] Fixed issue where a Session flush that replaced an expired object in the identity map with a newly flushed object of the same primary key would emit a SELECT to refresh the expired object, solely in order to determine whether to emit an "Identity map already had an identity" warning. This could occur when a row loaded within a transaction is rolled back and its primary key value is subsequently reused, and could lead to an AttributeError if the expired object were garbage collected during that load. The check now emits no SQL, and an expired object that is replaced in this way no longer causes the warning to be emitted.

  This change is also backported to: 2.0.56

  References: #13711

• [orm] [bug] [regression] Fixed regression caused by #13070 where using more than one orm.with_loader_criteria() option for the same entity, where the criteria made use of correlated subqueries referring to that entity, would fail with a RecursionError when compiling.

  References: #13701

• [orm] [bug] [regression] Fixed regression caused by the new implementation of .params() for statements introduced in #7066, where parameter values passed to the .params() method of an ORM statement created using Select.from_statement() would not be applied when the statement was compiled without the compiled statement cache, such as when the cache was disabled or when the statement was stringified directly, leading to an error that a value is required for the bound parameter.

  References: #13709

orm extensions

• [bug] [orm extensions] Fixed an issue in the instrumentation_toplevel extension where unrelated classes inheriting from typing.Generic could incorrectly raise a TypeError when using different instrumentation implementations. Pull request courtesy TomasCaruso10.

  This change is also backported to: 2.0.56

  References: #13680

... (truncated)

Commits

• See full diff in compare view

Updates starlette from 1.8.0 to 1.9.0

Release notes

Sourced from starlette's releases.

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Changelog

Sourced from starlette's changelog.

1.9.0 (October 18, 2026)

Changed

• Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

• Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
• Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
• Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
• Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
• Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Commits

• 1840c9d Version 1.9.0 (#3676)
• 750dc33 Preserve all Vary headers in MutableHeaders.add_vary_header (#3675)
• 414af4f Remove unmaintained packages from the third-party packages page (#3674)
• d4df01a Add adminsite to the third-party packages (#3654)
• 1766228 Match host names case-insensitively in Host routing and `TrustedHostMiddlew...
• a579222 Include HEAD in the Allow header of HTTPEndpoint 405 responses (#3585)
• 6b11cd7 Honor streaming responses in TestClient (#3491)
• b7901fb Use byte length for typed memoryview response bodies (#3622)
• 3214cd0 Escape path delimiters and leading // when building URLs (#3671)
• See full diff in compare view

Updates snowflake-connector-python from 5.0.0 to 5.1.0

Release notes

Sourced from snowflake-connector-python's releases.

snowflake-connector-python v5.1.0

5.1.0 (October 21, 2026)

New features:

• Added support for Python 3.14t (free-threaded CPython).

Bug fixes:

• Fixed statement-level TIMEZONE overrides so a registered TIMEZONE can be set on a statement and is sent on the query request.
• Fixed stage uploads and downloads so a failed system certificate load is retried, instead of failing the storage client or skipping the operating-system trust store.
• Changed TLS certificate checks for RUSTSEC-2026-0382 by updating bundled root certificates and distrusting compromised intermediate Certificate Authority (CA) certificates.

Changes:

• Changed login to omit CLIENT_SESSION_KEEP_ALIVE and CLIENT_PREFETCH_THREADS unless the caller sets them.
• Changed login to send CLIENT_SESSION_KEEP_ALIVE, CLIENT_PREFETCH_THREADS, QUERY_TAG, and a heartbeat frequency clamped to 900–3600 seconds as session parameters, and to send a set validate_default_parameters value, true or false, as CLIENT_VALIDATE_DEFAULT_PARAMETERS, leaving that parameter off the login request when it is unset.
• Changed login to send TIMEZONE, AUTOCOMMIT, CLIENT_TIMESTAMP_TYPE_MAPPING, CLIENT_METADATA_REQUEST_USE_CONNECTION_CTX, SERVICE_NAME, GCS_USE_DOWNSCOPED_CREDENTIAL, and CLIENT_OUT_OF_BAND_TELEMETRY_ENABLED as session parameters when they are set.
• Removed disable_console_login and oauth_disable_console_login. Passing either connection parameter warns and has no effect, and external browser login always requests the SSO URL from Snowflake.
• Removed OCSP_MODE from the login client environment and from connection diagnostics. The driver does not perform OCSP; certificate revocation continues to be reported as CERT_REVOCATION_CHECK_MODE.
• Changed GCS PUT to omit the Content-Encoding header.

Commits

• 17dda9d NO-SNOW: Remove empty line from README
• 907bc75 [Node] bump version to 4.0.0-alpha.1
• 0812fec NO-SNOW: Cut off the ODBC changelog at v4.2.0
• fd60f7c SNOW-3894967: nodejs - add logger, configure with logLevel, logFilePath, addi...
• 3345a2f NO-SNOW: Bump python driver to 5.1.0
• 04d7dca NO-SNOW: Prepare JDBC PrPr release 0.0.6
• c194627 Bump bundled TLS roots and certificate path checks
• 3a55025 SNOW-3894966: [Node] Report chunk download failures as 402001 and 402002
• 5103d92 NO-SNOW: Keep Node e2e on 22 and auth and WIF on 24
• 48929db SNOW-4300587: Tableau/generic replay navigate and load
• Additional commits viewable in compare view

Updates sentence-transformers from 6.1.0 to 6.2.0

Release notes

Sourced from sentence-transformers's releases.

v6.2.0 - Model merging, faster loading, and distributed evaluation

This release adds model merging for all four model types, reduces redundant Hub requests when loading models, and distributes evaluator inference across DDP ranks. It also includes lower-memory training losses, more flexible multi-vector compression, and fixes throughout inference, training, and evaluation.

Install this version with

# Inference only, use one of:
pip install sentence-transformers==6.2.0
pip install sentence-transformers[openvino]==6.2.0
Multimodal dependencies (optional):
pip install sentence-transformers[image]==6.2.0
pip install sentence-transformers[audio]==6.2.0
pip install sentence-transformers[video]==6.2.0
Training + Inference
pip install sentence-transformers[train]==6.2.0
pip install sentence-transformers[merge]==6.2.0
Or combine as needed:
pip install sentence-transformers[train,image]==6.2.0

Model merging for all four model types (#3776)

Combine compatible fine-tuned checkpoints without another training run using SentenceTransformer.merge, SparseEncoder.merge, CrossEncoder.merge, or MultiVectorEncoder.merge. The integration uses Arcee AI's mergekit and supports well over a dozen methods such as Linear, SLERP, TIES, and DARE.

Install the merge extra with pip install "sentence-transformers[merge]". For example, take a weighted average of two compatible MiniLM models:

from sentence_transformers import SentenceTransformer
models = [
"sentence-transformers/all-MiniLM-L6-v2",
"sentence-transformers/multi-qa-MiniLM-L6-cos-v1",
]
merged = SentenceTransformer.merge(
models,
method="linear",
parameters={"weight": [0.6, 0.4]},
)
merged.save_pretrained("merged-MiniLM-L6")
embeddings = merged.encode(["Combining compatible model weights."])

Or interpolate between the same inputs with SLERP:

</tr></table> 

... (truncated)

Commits

• 0b6937d Release v6.2.0
• 45682ed Update documentation announcement for v6.2 (#4243)
• aed573b Forward gradient checkpointing options to Transformers (#4241)
• c7adf47 Skip bfloat16 transformer head tests on affected Windows runners (#4242)
• 1b4b624 Fix blank rows in CrossEncoder and RRF evaluator CSVs on Windows (#4077)
• ea5435c Treat a string positive or negative as one document in RerankingEvaluator (#4...
• 3a5232b Follow only duplicate pairs in the paraphrase mining transitive closure (#4120)
• 7d64d3b Keep the RRF fusion order the same from run to run (#4067)
• 67f11a3 Evaluate the main similarity function in TripletEvaluator (#4088)
• fd6b188 Accept a string main_score_function in NanoBEIREvaluator (#4034)
• Additional commits viewable in compare view

Updates streamlit from 1.66.0 to 1.66.1

Release notes

Sourced from streamlit's releases.

1.66.1

Full Changelog: streamlit/streamlit@1.66.0...1.66.1

Commits

• ca6718b [chore] Update map and pydeck snapshots from 1.66.1 CI
• 1359d6e [fix] Use canonical timezone names in Python unit tests (#17567)
• 7526d1b [chore] Allow Pillow 13 (#17589)
• c706d9a Up version to 1.66.1
• See full diff in compare view

Updates hypothesis from 6.170.5 to 6.170.8

Commits

• f0764a4 Bump hypothesis version to 6.170.8 and update changelog
• c134e15 Merge pull request #4936 from Zac-HD/claude/affectionate-pascal-e8sqgn
• a2406ed Bump hypothesis version to 6.170.7 and update changelog
• ecbcafa Don't enumerate collection "continue" draws in simplest probes
• 416fd28 Merge pull request #4916 from jorenham/typing/stateful/coverage
• d6dc78d Bump hypothesis version to 6.170.6 and update changelog
• d01ccc3 Merge pull request #4935 from Zac-HD/claude/gallant-meitner-6blj9q
• a511216 Skip zizmor in Claude Code remote environments
• 2e8c012 Ignore dateutil.zoneinfo deprecation warning in tests
• 1485498 Merge pull request #4907 from MarcoGorelli/pyrefly-cleanups
• Additional commits viewable in compare view

Updates httpx2 from 2.13.1 to 2.16.0

Release notes

Sourced from httpx2's releases.

v2.16.0

Highlights

🍪 Faster requests with large cookie jars

Building the Cookie header no longer scans every cookie in the jar. The client reuses its jar instead of copying it on every request and redirect (#1284), only looks up the domains that can match the request host, and skips the expired cookie sweep until a cookie is due (#1285). With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster.

Cookies from different domains are now sent from the least to the most specific domain, for example .example.org before sub.example.org, instead of in the order the domains were added. Cookies with longer paths still come first.

httpx2

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain (#1285).

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests (#1284).

httpcore2

No changes since 2.15.1. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.15.1...v2.16.0

v2.15.1

Highlights

🔒 Flat CPU usage for long-lived clients on Linux

On Linux, the default SSL context is now configured once instead of on every handshake (#1253). With OpenSSL older than 3.4, each handshake added a duplicate certificate lookup path, so CPU usage per request grew over the lifetime of a reused client. Certificate verification is unchanged, and Windows and macOS still use truststore.

httpx2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

httpcore2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

Full Changelog: pydantic/httpx2@v2.15.0...v2.15.1

v2.15.0

Highlights

🐍 Python 3.11+ required

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.16.0 (October 21st, 2026)

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain. (#1285)

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests. (#1284)

2.15.1 (October 19th, 2026)

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client. (#1253)

2.15.0 (October 19th, 2026)

Removed

• Drop support for Python 3.10. (#1274)

2.14.0 (October 18th, 2026)

Added

• Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did. (#1165)
• Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY. (#1267)

Changed

• Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33. (#1165)

Fixed

• Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created. (#1267)
• Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm. (#1130)
• Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions. (#1233)
• Stop the sync WebSocket session from hanging on exit when its event queue is full. (#1123)

Commits

• 6bfbf29 Prepare version 2.16.0 (#1286)
• a1e461e Look up only matching cookie domains when building the Cookie header (#1285)
• fc6ff89 Reuse the client cookie jar instead of copying it per request (#1284)
• 6dd59b9 Prepare version 2.15.1 (#1279)
• 7715bf0 Configure the default Linux SSL context once instead of per handshake (#1253)
• 6078596 Prepare version 2.15.0 (#1278)
• 5b26c25 Drop support for Python 3.10 (#1274)
• 4fa853a Prepare version 2.14.0 (#1271)
• dd7701a Support IP CIDR ranges in NO_PROXY (#1165)
• cd50836 Accept bracketed IPv6 and skip unparseable entries in NO_PROXY (#1267)
• Additional commits viewable in compare view

Updates markdown from 3.11.1 to 3.11.2

Release notes

Sourced from markdown's releases.

Release 3.11.2

Fixed

• Sanitize attribute names in the fenced_code and legacy_attrs extensions so an attribute name cannot break out of its tag and inject markup (#1663).
• For backwards compatibility, revert the enforcement of CommonMark style punctuation rules (#1657).

Changelog

Sourced from markdown's changelog.

[3.11.2] - 2026-10-19

Fixed

• Sanitize attribute names in the fenced_code and legacy_attrs extensions so an attribute name cannot break out of its tag and inject markup (#1663).
• For backwards compatibility, revert the enforcement of CommonMark style punctuation rules (#1657).

Commits

• b41e0aa Bump version to 3.11.2
• 934c53e Add checklist of parts to PR template
• 2249ffd Update AI Policy
• a27428b Sanitize attribute names in fenced_code and legacy_attrs
• 90cdcf5 Add fixed category to changelog
• 97233ef Revert enforcement of CommonMark punctuation rules
• See full diff in compare view

Updates ruff from 0.17.1 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

• Avoid intermediate names in lint name resolution (#29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
• Share postfix parsing and reduce expression copies (#29480)

Configuration

• [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

• Clarify documentation and correct stale guidance (#29374)
• [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

• @​fixfon
• @​MichaReiser
• @​zaniebot
• @​FrancescoPezzella
• @​anishgirianish
• @​rajveer3x
• @​charliermarsh
• @​LckyLike
• @​DaniBodor

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

• Avoid intermediate names in lint name resolution (#29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
• Share postfix parsing and reduce expression copies (#29480)

Configuration

• [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

• Clarify documentation and correct stale guidance (#29374)
• [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

• @​fixfon
• @​MichaReiser
• @​zaniebot
• @​FrancescoPezzella
• @​anishgirianish
• @​rajveer3x
• @​charliermarsh
• @​LckyLike
• @​DaniBodor

Commits

• 30516b4 Bump version to 0.17.2 (#29637)
• 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
• 0d562aa [ty] Check inherited attribute conflicts (#28559)
• 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
• 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
• b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
• 32869b4 Avoid creating deployments for automation jobs (#29626)
• ec891ba Link the commit in pull request report footers (#29621)
• 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
• 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
• Additional commits viewable in compare view

Updates coverage from 7.16.2 to 7.17.0

Release notes

Sourced from coverage's releases.

7.17.0

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.
• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.
• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.
• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.
• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.
• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.
• Fix: The “Can’t combine statement coverage data with branch data” error now names the two data files it couldn’t combine. The error description in the docs now lists common causes and how to find the process that wrote the file.
• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293 and issue 2294.
• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of...

  Description has been truncated

[github-actions]

requirements.txt / pylock.toml drift (unsigned push blocked)

uv.lock / pyproject.toml changed but GitHub Actions cannot push an unsigned commit under the required_signatures ruleset (#1419).

Option A — signed commit on this Dependabot branch:

git fetch origin pull/2148/head:dependabot-review
git checkout dependabot-review
uv export --frozen --no-emit-project -o requirements.txt
uv export --format pylock.toml --frozen --all-extras --all-groups --output-file pylock.toml
git add requirements.txt pylock.toml
git commit -S -m "chore(deps): regenerate requirements.txt and pylock.toml after uv.lock update"
git push origin "HEAD:<dependabot-branch-name>"

Option B — supersede PR: apply the bump + export locally with signed commits (see CONTRIBUTING.md).

Download the CI-generated requirements.txt and pylock.toml from the workflow artifact on this run when present.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.