chore(deps): bump the python-minor-and-patch group across 1 directory with 16 updates

[dependabot]

Bumps the python-minor-and-patch group with 16 updates in the /shifter/engine/provisioner directory:

Package	From	To
asgiref	3.11.1	3.12.1
boto3	1.43.12	1.43.98
botocore	1.43.12	1.43.99
cffi	2.0.0	2.1.1
debugpy	1.8.20	1.8.22
grpcio	1.80.0	1.84.0
protobuf	7.34.1	7.36.2
psycopg	3.3.4	3.3.6
psycopg-binary	3.3.4	3.3.6
pydantic	2.13.4	2.13.5
s3transfer	0.17.0	0.19.2
semver	3.0.4	3.1.0
typing-extensions	4.15.0	4.16.0
urllib3	2.7.0	2.8.0
pytest	9.0.3	9.1.1
ruff	0.15.12	0.16.8

Updates asgiref from 3.11.1 to 3.12.1

Changelog

Sourced from asgiref's changelog.

3.12.1 (2026-07-14)

• Restored the previous SyncToAsync.call internal code shape, which was relied on by some APM services. (#572)

  Note, this change was available whilst maintaining the underlying fix (from #564). It does not constitute an API stability promise. Ideally APMs are not monkey patching internal APIs, and future changes will be made here if needed.

3.12.0 (2026-07-14)

• AsyncToSync no longer captures the running event loop on instantiation. (#562)

  This resolves a series of deadlocks that users experienced after asgiref 3.9.0, particularly with pytest-asyncio. pytest-asyncio stops the event loop between tests, and long-running unawaited futures could find themselves trying to schedule work onto a stopped loop, and so would never complete. Ideally, code should be structured to await long-running futures before returning, but this change should help users experiencing issues here.

  The loop is now resolved when the callable is invoked rather than when it is created. If async_to_sync is called from within sync_to_async, the parent event loop is still used, as before.

  The possibility of deadlock therefore remains in some nested patterns. For example, an async function may call a long-running sync_to_async function that itself uses async_to_sync; if the outer function returns before the sync future completes, the parent event loop may already be stopped, and the nested calls cannot be driven to completion.

  This is not a bug in asgiref — the same patterns deadlock in plain asyncio. As above, restructure your code to await the sync_to_async future before exiting the driving coroutine.

• Fixed an event loop deadlock when exiting ThreadSensitiveContext while its executor thread was still blocked waiting on the event loop. (#535)

• Dropped support for EOL Python 3.9.

• Fixed StatelessServer.run() failing on Python 3.14, where asyncio.get_event_loop() no longer creates an event loop if none exists. It now uses asyncio.run(). (#559)

• Fixed Local leaking data between unrelated sync threads when sys.flags.thread_inherit_context is enabled (Python 3.14+), so a newly

... (truncated)

Commits

• ef9d4b8 Releasing 3.12.1
• 34fba63 Restore previous SyncToAsync.call internal code shape.
• a43900c Separate mypy from tests extra.
• 1b7c338 Releasing 3.12.0
• 157d9d4 Renovate precommit (#552)
• deda0d4 Test free-threading builds and fix Local data leak for thread_inherit_context...
• a54250a Don’t capture the event loop in AsyncToSync.__init__ (#562)
• 836356a Use asyncio.run in StatelessServer.run (#561)
• e04afd5 Dropped support for Python 3.9. (#543)
• 95d2430 Fixed #535: ThreadSensitiveContext.aexit blocking the event loop. (#563)
• Additional commits viewable in compare view

Updates boto3 from 1.43.12 to 1.43.98

Commits

• 3314d84 Merge branch 'release-1.43.98'
• 3a3637f Bumping version to 1.43.98
• d802350 Add changelog entries from botocore
• ed7de96 Merge branch 'release-1.43.97'
• fba1e41 Merge branch 'release-1.43.97' into develop
• 275709c Bumping version to 1.43.97
• a5c0088 Add changelog entries from botocore
• 2be9967 Merge branch 'release-1.43.96'
• bc62489 Merge branch 'release-1.43.96' into develop
• 6e1774a Bumping version to 1.43.96
• Additional commits viewable in compare view

Updates botocore from 1.43.12 to 1.43.99

Commits

• 85e265b Merge branch 'release-1.43.99'
• 0e8a5de Bumping version to 1.43.99
• 3cb0216 Update to latest models
• cfdf905 Merge branch 'release-1.43.98'
• f9195c7 Merge branch 'release-1.43.98' into develop
• dfc704e Bumping version to 1.43.98
• 676af09 Update to latest models
• 7ffc568 Merge branch 'release-1.43.97'
• 2891dd4 Merge branch 'release-1.43.97' into develop
• fbb8f49 Bumping version to 1.43.97
• Additional commits viewable in compare view

Updates cffi from 2.0.0 to 2.1.1

Release notes

Sourced from cffi's releases.

v2.1.1

What's Changed

• Minimize internal Python API usage for interpreter and thread state sampling where possible. Avoids breaking ABI change in Python >= 3.15.0b4 (python-cffi/cffi#269).

Full Changelog: python-cffi/cffi@v2.1.0...v2.1.1

v2.1.0

• Added support for Python 3.15 and support for C extensions generated by CFFI to target the new abi3t free-threaded ABI.
• Dropped support for Python 3.9.
• Added cffi-gen-src CLI to generate CFFI C extension source for alternate build backend support.
• Fixed crashes inside __delitem__.
• Fixed "string too big" error under MSVC.
• Fixed mingw builds.
• Added support for arm64 iOS wheels.

Commits

• fd33e77 New release 2.1.1
• 56a7876 Use PyGILState_Ensure to avoid accessing CPython internals (#269) (#270)
• d9f6f70 New release 2.1.0
• 02a7b0e Misc pre-2.1 release/packaging cleanup (#253)
• 1362e5d Move cffi-gen-src release note to 2.1.0 notes
• a797055 Make error message when embedding version test fails more friendly
• f1f40a8 Update changelog
• dc62c93 Delete missed cp39 Windows builds
• a341180 Update version numbers to prepare for v2.1 release
• 9f04d85 Mark test using inet_ntoa as thread-unsafe
• Additional commits viewable in compare view

Updates debugpy from 1.8.20 to 1.8.22

Release notes

Sourced from debugpy's releases.

debugpy v1.8.22

Fixes

• Fix invalid type annotation in test_pydev_monkey comprehension by @​pdepetro in microsoft/debugpy#2033
• Fix PEP 768 code injection SyntaxError when temp path contains backslashes by @​rchiodo with @​Copilot in microsoft/debugpy#2038
• Fix race between adapter connection publication and session attachment by @​aperez in microsoft/debugpy#2049
• Fix debugger hang when expanding objects with blocking property getters (#2053) by @​rchiodo in microsoft/debugpy#2055
• Fix duplicate stopped event when two threads hit a breakpoint at once by @​aperez in microsoft/debugpy#2056
• Avoid exceptions in environment diagnostics by @​rchiodo in microsoft/debugpy#2059
• Fix thread identity when the first traced call is another thread's is_alive() by @​aperez in microsoft/debugpy#2061
• Respect isolated mode when patching sys.path by @​karandhaodiyal28-hash in microsoft/debugpy#2050

Enhancements

• Add trigger_exception_handler() for post-mortem debugging of caught exceptions by @​nshepperd in microsoft/debugpy#1996
• Add lldb attach-to-PID option for debugpy on Linux by @​pdepetro in microsoft/debugpy#2052
• Populate hitBreakpointIds in the DAP stopped event by @​aperez in microsoft/debugpy#2060
• Return the endpoint from listen() with the in-process adapter by @​karandhaodiyal28-hash in microsoft/debugpy#2051

Infrastructure work

• Add Dependabot configuration for pip and GitHub Actions by @​rchiodo in microsoft/debugpy#2041
• Update vendored pydevd 3.4.1 -> 3.5.0 (maintenance refresh) by @​rchiodo in microsoft/debugpy#2044
• Pin secure test dependency floors and drop EOL Python 3.9/3.8 by @​rchiodo in microsoft/debugpy#2045
• Add more typing to debugpy and switch to 'standard' type checking mode by @​rchiodo in microsoft/debugpy#1637
• Add debugpy release agent by @​rchiodo in microsoft/debugpy#2062
• Pin GitHub Actions to full-length commit SHAs by @​danfiedler-msft in microsoft/debugpy#2063
• Add python 3.15 to tests by @​finnagin in microsoft/debugpy#2069

Thanks to @​pdepetro, @​rchiodo, @​nshepperd, @​aperez, @​karandhaodiyal28-hash, @​danfiedler-msft, and @​finnagin for the commits.

Full Changelog: microsoft/debugpy@v1.8.21...v1.8.22

debugpy v1.8.21

Fixes for:

• Return evaluate result in DAP response body instead of writing to stdout: #2027
• Prevent invalid scopes request from crashing debug session: #2026
• Skip uninitialized __slots__ in variable resolver: #2024
• Handle -c arguments that are bytes instead of str: #2021
• Fix evaluation of variables from chained exception frames: #2018
• ContinueRequest with a specific threadId no longer resumes all threads (in-process adapter): #2012
• Avoid strong reference to exceptions during unwind: #2008
• Show error message on evaluate failures in the hover context: #2006
• Display dlerror output when dlopen fails: #2000
• Replace removed pkgutil.get_loader with importlib.util.find_spec in get_fullname: #1998

Enhancements:

• Add option to ignore all system exit codes: #2017
• Pull changes from pydevd up to March 2026: #2010

Infrastructure work:

... (truncated)

Commits

• e220805 Add python 3.15 to tests (#2069)
• e5743d3 Pin GitHub Actions to full-length commit SHAs (#2063)
• 7959635 Respect isolated mode when patching sys.path (#2050)
• 6dd019a Add debugpy release agent (#2062)
• d98001c Fix thread identity when the first traced call is another thread's is_alive()...
• 7ca4578 Return the endpoint from listen() with the in-process adapter (#2051)
• 9832f3f Add more typing to debugpy and switch to 'standard' type checking mode (#1637)
• 2f73444 Populate hitBreakpointIds in the DAP stopped event (#2060)
• 7d3f861 Avoid exceptions in environment diagnostics (#2059)
• f77d448 Fix duplicate stopped event when two threads hit a breakpoint at once (#2056)
• Additional commits viewable in compare view

Updates grpcio from 1.80.0 to 1.84.0

Release notes

Sourced from grpcio's releases.

Release v1.84.0

This is release 1.84.0 (gimbal) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [promise_based_filter] enable v2_non_owning_waker_implementation experiment. (#43253)
• [xDS] allow server listener address to match wildcard port. (#43247)
• [WRR] remove env var guard for custom backend metrics. (#43198)
• [subchannel] enable connection scaling service config fields. (#43116)
• [subchannel] add metrics as per A94. (#43140)
• Fix incorrect hostname suffix matching in no_proxy handling (prevents proxy bypass). (#41915)

C#

• [C# Grpc.Tools] Add native macOS ARM64 support via universal binaries. (#41222)

Python

• [Python] Fix -Werror=unused-result error triggered by Cythonized code. (#43313)
• [Python] Release Python 3.15 wheels publicly. (#43259)
• [Python][AsyncIO] Fixed reference cycles. (#43121)
• [Python] fix: remove ghost key in grpc.aio.Metadata.delitem when last value is deleted. (#42974)
• [Python] Fix the StatusCode Enums to be int. (#43167)
• [Python] Fixed the parenthesis placement. (#43111)
• [Python] Removed UsageError exception from registered method. (#43086)
• [Python] Added registered methods support in AsyncIO stack . (#41796)
• [Python] AIO Part 4 - Typehints fixes and add Pyright for aio/_channel.py. (#42736)
• [Python] grpc-status: Relax protobuf dependency lower bound to allow 6.x. (#43000)
• [Python] Observability plugin fixes. (#42785)

Ruby

• [Ruby] Fix: Addressed Array of strings passed as metadata. (#42827)

Release v1.84.0-pre2

This is a prerelease of gRPC Core 1.84.0 (gimbal).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This is a Python-only pre-release that introduces pre-built wheels for Python 3.15.

... (truncated)

Commits

• 3252a89 Bump release version to 1.84.0 on v1.84.x branch (#43405)
• c633e39 [Release] Bump version to 1.84.0-pre2 (on v1.84.x branch) (#43401)
• 12cafee [Backport][v1.84.x] Revert "[Python] Revert Python 3.15 changes due to sanity...
• 56e86cb Bump release version to 1.84.0-pre1 on v1.84.x branch (#43327)
• 7ef6a9e [build] Source reflection and channelz v1 schemas from BCR (@​grpc_proto) (#43...
• c337c3e [core][filters] Unit test framework for v3 filter (#42969)
• ce22bb4 [PH2][CHTTP2] Retire stream flow control delta early to avoid data race
• 25c16f9 [PH2][Test] Add destructor tests for the Seq promise combinator.
• a7fabec [Python] Fix -Werror=unused-result error triggered by Cythonized code (#43313)
• d92ee43 [util] remove LoadFile() option to append null byte (#41478)
• Additional commits viewable in compare view

Updates protobuf from 7.34.1 to 7.36.2

Commits

• See full diff in compare view

Updates psycopg from 3.3.4 to 3.3.6

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).
• Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).
• Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).
• Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).
• Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).
• Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).
• Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).
• Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).

Psycopg 3.3.5 ^^^^^^^^^^^^^

• Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
• Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
• Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).
• Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).
• Raise !DataError instead of !ValueError when ~psycopg.rows.namedtuple_row receives duplicate column names (:ticket:[#1348](https://github.com/psycopg/psycopg/issues/1348)).
• Raise !DataError on inconsistent copy data (:tickets:[#1359](https://github.com/psycopg/psycopg/issues/1359), [#1360](https://github.com/psycopg/psycopg/issues/1360)).
• Handle client encodings aliases (:ticket:[#1363](https://github.com/psycopg/psycopg/issues/1363)).
• Fix building C extension with Cython 3.3.

Psycopg 3.3.4

... (truncated)

Commits

• a67654d chore: bump psycopg package version to 3.3.6
• 443814b Merge pull request #1416 from dvarrazzo/wait-async-perf
• 42966e9 test: add helpful comments to some tests
• 5e8797f test: add reasonable connect_timeout to most tests
• c81ba62 perf: reduce the overhead of wait_async()
• d2bbfe4 refactor: use get_running_loop() in the async wait functions
• 2b1484a test: add a script to measure the async wait functions
• 573cf4a test: fix incorrect wait timing test
• 2b68990 refactor: drop leftovers of waiting with inf interval in wait_conn_async
• 60765dd Merge pull request #1414 from dvarrazzo/fix-decimal-overflow
• Additional commits viewable in compare view

Updates psycopg-binary from 3.3.4 to 3.3.6

Changelog

Sourced from psycopg-binary's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).
• Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).
• Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).
• Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).
• Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).
• Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).
• Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).
• Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).

Psycopg 3.3.5 ^^^^^^^^^^^^^

• Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
• Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
• Fix !wait_selector wait function to not raise !KeyError (:ticket:[#1327](https://github.com/psycopg/psycopg/issues/1327)).
• Fix !DataError messages leaking the literal {...} placeholder instead of the offending value when loading a pre-year-1 :sql:timestamp or a malformed binary :sql:jsonb value (:ticket:[#1372](https://github.com/psycopg/psycopg/issues/1372)).
• Raise !DataError instead of !ValueError when ~psycopg.rows.namedtuple_row receives duplicate column names (:ticket:[#1348](https://github.com/psycopg/psycopg/issues/1348)).
• Raise !DataError on inconsistent copy data (:tickets:[#1359](https://github.com/psycopg/psycopg/issues/1359), [#1360](https://github.com/psycopg/psycopg/issues/1360)).
• Handle client encodings aliases (:ticket:[#1363](https://github.com/psycopg/psycopg/issues/1363)).
• Fix building C extension with Cython 3.3.

Psycopg 3.3.4

... (truncated)

Commits

• a67654d chore: bump psycopg package version to 3.3.6
• 443814b Merge pull request #1416 from dvarrazzo/wait-async-perf
• 42966e9 test: add helpful comments to some tests
• 5e8797f test: add reasonable connect_timeout to most tests
• c81ba62 perf: reduce the overhead of wait_async()
• d2bbfe4 refactor: use get_running_loop() in the async wait functions
• 2b1484a test: add a script to measure the async wait functions
• 573cf4a test: fix incorrect wait timing test
• 2b68990 refactor: drop leftovers of waiting with inf interval in wait_conn_async
• 60765dd Merge pull request #1414 from dvarrazzo/fix-decimal-overflow
• Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

Commits

• 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
• 558379f Bump twine to v7.0.0
• 2cfd5d3 Do not check for docs build
• a735bee Fix more Clippy lints
• 7eed4a1 Fix Clippy 0.1.95 warnings
• b353bbb Prepare release v2.13.5
• 63d2ccc Count validated model fields once in smart unions
• a53ec2e Speed up PyPy CI tests
• d65e0f9 Workaround circular import error in Mypy
• 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
• Additional commits viewable in compare view

Updates s3transfer from 0.17.0 to 0.19.2

Changelog

Sourced from s3transfer's changelog.

0.19.2

• bugfix:TLS: Return a configuration error when the CA bundle value (ca_bundle, AWS_CA_BUNDLE, REQUESTS_CA_BUNDLE, or verify) resolves to an empty or whitespace-only string.

0.19.1

• bugfix:s3: Only pin VersionId if supplied by caller instead of automatically using value from HeadObject response

0.19.0

• feature:s3: Update multi-part copy logic to match single-part behavior for TaggingDirective and AnnotationDirective
• enhancement:s3: Warn when Metadata or Tagging is supplied to a copy without the corresponding directive set to REPLACE, in which case the supplied value is silently ignored. This matches the CopyObject behavior.

0.18.0

• feature:Copy: By default, preserve source object metadata during multipart copies to match single CopyObject behavior.

0.17.1

• enhancement:s3: Skip the HEAD request during S3 downloads when the client is configured with response_checksum_validation='when_required', reducing latency for small-object transfers. The HEAD request remains in place by default to enable full-object checksum validation.

Commits

• 467a752 Merge branch 'release-0.19.2'
• 3c4a70b Bumping version to 0.19.2
• 43e2978 Raise error on empty CA bundle value (#410)
• 992085b Bump the github-actions group with 3 updates (#409)
• 70d5f8b Bump https://github.com/astral-sh/ruff-pre-commit (#408)
• 71bdbb7 Merge branch 'release-0.19.1'
• 30b8295 Merge branch 'release-0.19.1' into develop
• b51243d Bumping version to 0.19.1
• 9be530d Don't use VersionId from HeadObject for multipart copies (#407)
• 314b559 Bump https://github.com/astral-sh/ruff-pre-commit (#404)
• Additional commits viewable in compare view

Updates semver from 3.0.4 to 3.1.0

Release notes

Sourced from semver's releases.

3.1.0

What's Changed

• Fix #463: Remove duplicate code Version.bump_build by @​tomschr in python-semver/python-semver#464
• Fix #460 Improve bump_prerelease to alway get a newer version by @​Learloj in python-semver/python-semver#462
• 441 update pydantic section of docs by @​jbkroner in python-semver/python-semver#442
• Fix #448: Remove Python 3.7-3.9 (EOL) by @​tomschr in python-semver/python-semver#470
• fix: replace semver.parse() with semver.Version.parse() in docstrings by @​koteshyelamati in python-semver/python-semver#471
• fix: next_version should bump version for build-only versions by @​binggao1230 in python-semver/python-semver#469
• fix(next_version): reset prerelease when token changes (#339) by @​Mukller in python-semver/python-semver#472
• Bump cryptography from 49.0.0 to 50.0.0 by @​dependabot[bot] in python-semver/python-semver#473
• Declare support for Python 3.15 by @​edgarrmondragon in python-semver/python-semver#475
• Add optional native parser backend (minimal adapter) by @​lowmiaq-gmail in python-semver/python-semver#476
• Reject non-ASCII digits and trailing newlines in version parsing by @​Str0k in python-semver/python-semver#478
• Fix bump_build() silently returning an unchanged version for digitless build metadata by @​Str0k in python-semver/python-semver#480
• Handle malformed collection operands in Version comparisons by @​Str0k in python-semver/python-semver#479
• Change version to 3.1.0 by @​tomschr in python-semver/python-semver#481

New Contributors

• @​Learloj made their first contribution in python-semver/python-semver#462
• @​jbkroner made their first contribution in python-semver/python-semver#442
• @​koteshyelamati made their first contribution in python-semver/python-semver#471
• @​binggao1230 made their first contribution in python-semver/python-semver#469
• @​Mukller made their first contribution in python-semver/python-semver#472
• @​dependabot[bot] made their first contribution in python-semver/python-semver#473
• @​edgarrmondragon made their first contribution in python-semver/python-semver#475
• @​lowmiaq-gmail made their first contribution in python-semver/python-semver#476
• @​Str0k made their first contribution in python-semver/python-semver#478

Full Changelog: python-semver/python-semver@3.0.4...3.1.0 Documentation: https://python-semver.readthedocs.io/en/latest/

Changelog

Sourced from semver's changelog.

Version 3.1.0

:Released: 2026-09-12 :Maintainer: Tom Schraitle

Bug Fixes

• :pr:478: Version.parse() and Version.is_valid() now reject non-ASCII digits and trailing newlines, in accordance with the SemVer grammar. Optional minor and patch parsing applies the same character restrictions.

• :pr:479: Comparing a :class:~semver.Version with a dict, tuple, or list that cannot construct a valid version (for example, an empty collection, wrong number of parts, non-numeric parts, or unknown keys) no longer raises internal errors from Version.__init__. The comparison operators now return :py:const:NotImplemented for such operands, following the general rule for invalid comparison operand types: equality evaluates to False and ordering raises Python's standard :py:exc:TypeError (for example, '>' not supported between instances of 'Version' and 'dict').

• :pr:480: (:meth:~semver.version.Version.bump_build) will now add .0 to an existing build when the last segment of the current build metadata, split by dots (.), is not numeric. This is to ensure the bumped version contains a raised build instead of silently returning an unchanged version. For example, 1.2.3+alpha is bumped to 1.2.3+alpha.0. This mirrors the corresponding fix for the prerelease part (:gh:460). Related to :gh:466.

• :gh:460: :meth:~semver.version.Version.bump_prerelease will now add .0 to an existing prerelease when the last segment of the current prerelease, split by dots (.), is not numeric. This is to ensure the new prerelease is considered higher than the previous one.

  :meth:~semver.version.Version.bump_prerelease now also support an argument bump_when_empty which will bump the patch version if there is no existing prerelease, to ensure the resulting version is considered a higher version than the previous one.

Features

• :pr:476: Added optional [native] extra to accelerate parsing on CPython via the fast-semver-rs-backend package. The pure-Python parser remains the default; the native backend is opt-in and only available on CPython.

Internal Changes

: Update GitHub Actions for astral-sh/setup-uv (version 0.10.1), github/codeql-action (version 4)

Trivial Changes

• :gh:463: Remove double code in :meth:Version.bump_build

... (truncated)

Commits

• 642d1bc Change version to 3.1.0 (#481)
• 2a2cf63 Suppress deprecation warnings in test suite
• a62477b Improve comparisons and fix test coverage.
• 0aa17a3 Handle malformed collection operands in Version comparisons (#479)
• 1b7350c Improve test coverage to 100% (Rust backend)
• ea2524a Fix bump_build() silently returning an unchanged version for digitless build ...
• 1e87579 Reject non-ASCII digits and trailing newlines in version parsing (#478)
• 0f18aa0 Add optional native parser backend (minimal adapter) (#476)
• 873a675 Declare support for Python 3.15 (#475)
• 99d2032 Bump cryptography from 49.0.0 to 50.0.0 (#473)
• Additional commits viewable in compare view

Updates typing-extensions from 4.15.0 to 4.16.0

Release notes

Sourced from typing-extensions's releases.

4.16.0

No changes since 4.16.0rc2.

Changes since 4.15.0:

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
• Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
• Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
• Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
• Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
• Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
• Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
• Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
• Add support for pickling sentinels.
• Sentinels now preserve their identity when copied or deep-copied.
• Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
• The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
• Deprecate arbit...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.