Skip to content

build(deps): bump the production-minor-patch group across 1 directory with 7 updates - #65

Merged
haasonsaas merged 2 commits into
mainfrom
dependabot/pip/production-minor-patch-90e425746e
Sep 2, 2026
Merged

build(deps): bump the production-minor-patch group across 1 directory with 7 updates#65
haasonsaas merged 2 commits into
mainfrom
dependabot/pip/production-minor-patch-90e425746e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-minor-patch group with 7 updates in the / directory:

Package From To
typer 0.26.8 0.27.2
pydantic 2.13.4 2.13.5
python-dotenv 1.2.2 1.2.3
twilio 9.10.9 9.11.0
gunicorn 26.0.0 26.2.0
ruff 0.15.21 0.16.5
mypy 2.3.0 2.3.1

Updates typer from 0.26.8 to 0.27.2

Release notes

Sourced from typer's releases.

0.27.2

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

0.27.0

Breaking Changes

Internal

... (truncated)

Changelog

Sourced from typer's changelog.

0.27.2 (2026-08-28)

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1 (2026-08-03)

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

0.27.0 (2026-07-15)

Breaking Changes

Internal

... (truncated)

Commits

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • f7b18d9 fix: round-trip backslashes through set_key (#680)
  • 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
  • f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
  • 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
  • 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
  • 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
  • 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
  • Additional commits viewable in compare view

Updates twilio from 9.10.9 to 9.11.0

Release notes

Sourced from twilio's releases.

9.11.0

Release Notes

Library - Fix

Twiml

  • Remove <Assistant> noun from <Connect> verb as part of the AI Assistants deprecation (breaking change)
  • Add passports attribute to <Dial> verb for SHAKEN/STIR passport passthrough

Accounts

  • Add SuppressEmailNotification parameter to the Secondary Auth Token and Auth Token promotion endpoints. Set it to true to suppress the email notification sent to account owners and administrators. Defaults to false, preserving existing behavior.
  • Add SMS Pumping Protection GET and POST API

Ai

  • Removing ai workbench apis

Api

  • Add missing uri property to the twiml_session resource

Data-ingress

  • 2026-08-07

  • Removed 1 API path:
  • /v1/DataQuery (Realtime DataQuery)

  • 2026-07-07

  • Added 1 new API path (data plane):
  • /v1/DataQuery (Realtime DataQuery)

  • 2026-06-17

  • Content updates:
  • Added properties to OAuthJWTBearerCredentials: privateKey, privateKeyPassphrase

  • 2026-06-12

  • Added 16 new path(s):
  • /v1/DataSyncs/{syncId} (FetchDataSync)
  • /v1/CloudAppSources/{sourceId}/Objects (ListCloudAppObjects)
  • /v1/WarehouseSources/{sourceId}/Preview (CreateWarehousePreview)
  • /v1/WarehouseSources/{sourceId}/Preview/{operationId} (FetchWarehousePreview)
  • /v1/DataSample/{operationId} (FetchDataSample)
  • /v1/ControlPlane/CloudAppSources/{sourceId} (FetchCloudAppSource, PatchCloudAppSource, DeleteCloudAppSource)
  • /v1/ControlPlane/CloudAppSources/{sourceId}/Datasets (ListCloudAppDatasets, CreateCloudAppDataset)
  • /v1/ControlPlane/CloudAppSources/{sourceId}/Datasets/{datasetId} (FetchCloudAppDataset, PatchCloudAppDataset, DeleteCloudAppDataset)
  • /v1/ControlPlane/WarehouseSources/{sourceId} (FetchWarehouseSource, PatchWarehouseSource, DeleteWarehouseSource)
  • /v1/ControlPlane/WarehouseSources/{sourceId}/Datasets (ListWarehouseDatasets, CreateWarehouseDataset)
  • ...and 6 more paths
  • Removed 16 path(s):
  • /v1/DataSyncs/{SyncId} (FetchDataSync)
  • /v1/CloudAppSources/{SourceId}/Objects (ListCloudAppObjects)
  • /v1/WarehouseSources/{SourceId}/Preview (CreateWarehousePreview)
  • /v1/WarehouseSources/{SourceId}/Preview/{OperationId} (FetchWarehousePreview)
  • /v1/DataSample/{OperationId} (FetchDataSample)
  • /v1/ControlPlane/CloudAppSources/{SourceId} (FetchCloudAppSource, PatchCloudAppSource, DeleteCloudAppSource)

... (truncated)

Changelog

Sourced from twilio's changelog.

[2026-08-11] Version 9.11.0

Library - Fix

Twiml

  • Remove <Assistant> noun from <Connect> verb as part of the AI Assistants deprecation (breaking change)
  • Add passports attribute to <Dial> verb for SHAKEN/STIR passport passthrough

Accounts

  • Add SuppressEmailNotification parameter to the Secondary Auth Token and Auth Token promotion endpoints. Set it to true to suppress the email notification sent to account owners and administrators. Defaults to false, preserving existing behavior.
  • Add SMS Pumping Protection GET and POST API

Ai

  • Removing ai workbench apis

Api

  • Add missing uri property to the twiml_session resource

Data-ingress

  • 2026-08-07

  • Removed 1 API path:
  • /v1/DataQuery (Realtime DataQuery)

  • 2026-07-07

  • Added 1 new API path (data plane):
  • /v1/DataQuery (Realtime DataQuery)

  • 2026-06-17

  • Content updates:
  • Added properties to OAuthJWTBearerCredentials: privateKey, privateKeyPassphrase

  • 2026-06-12

  • Added 16 new path(s):
  • /v1/DataSyncs/{syncId} (FetchDataSync)
  • /v1/CloudAppSources/{sourceId}/Objects (ListCloudAppObjects)
  • /v1/WarehouseSources/{sourceId}/Preview (CreateWarehousePreview)
  • /v1/WarehouseSources/{sourceId}/Preview/{operationId} (FetchWarehousePreview)
  • /v1/DataSample/{operationId} (FetchDataSample)
  • /v1/ControlPlane/CloudAppSources/{sourceId} (FetchCloudAppSource, PatchCloudAppSource, DeleteCloudAppSource)
  • /v1/ControlPlane/CloudAppSources/{sourceId}/Datasets (ListCloudAppDatasets, CreateCloudAppDataset)
  • /v1/ControlPlane/CloudAppSources/{sourceId}/Datasets/{datasetId} (FetchCloudAppDataset, PatchCloudAppDataset, DeleteCloudAppDataset)
  • /v1/ControlPlane/WarehouseSources/{sourceId} (FetchWarehouseSource, PatchWarehouseSource, DeleteWarehouseSource)
  • /v1/ControlPlane/WarehouseSources/{sourceId}/Datasets (ListWarehouseDatasets, CreateWarehouseDataset)
  • ...and 6 more paths
  • Removed 16 path(s):
  • /v1/DataSyncs/{SyncId} (FetchDataSync)
  • /v1/CloudAppSources/{SourceId}/Objects (ListCloudAppObjects)
  • /v1/WarehouseSources/{SourceId}/Preview (CreateWarehousePreview)
  • /v1/WarehouseSources/{SourceId}/Preview/{OperationId} (FetchWarehousePreview)
  • /v1/DataSample/{OperationId} (FetchDataSample)
  • /v1/ControlPlane/CloudAppSources/{SourceId} (FetchCloudAppSource, PatchCloudAppSource, DeleteCloudAppSource)
  • /v1/ControlPlane/CloudAppSources/{SourceId}/Datasets (ListCloudAppDatasets, CreateCloudAppDataset)

... (truncated)

Commits
  • 306691e Fix tag validation regex in deploy.yml (#954)
  • a7c1450 Update Python version matrix in deploy.yml (#953)
  • eba3466 [Librarian] Regenerated @ f443c9dfa233e41d0e61c9ed6ca2b162467a08b5 89762bc866...
  • fbdfe4e Update deployment trigger to all tags (#950)
  • 3a5e24d Comment out docs generation verification step (#952)
  • 89689b2 handle-blank-response-202 (#949)
  • 3b82ae1 Remove assistant apis cluster test (#948)
  • 184b583 fix: updates to release process (#941)
  • becbfc5 removed oauth beta maturity from readme (#943)
  • ecf51ac Add test and release gate workflow (#940)
  • Additional commits viewable in compare view

Updates gunicorn from 26.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

  • Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits
  • 36f2a3c gunicorn 26.2.0
  • cbba350 test: cover the h2c edge paths that had none
  • 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
  • 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
  • 5853551 Merge pull request #3712 from Rotzbua/patch-1
  • 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
  • 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
  • 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
  • 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
  • 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
  • Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

  • Allow rules without codes (#28049)
  • Introduce category selectors (#27666)
  • Update preview default rules and categories (#27877)

Bug fixes

  • [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
  • [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
  • [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

  • Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

  • Document rule acceptance guidelines (#27910)
  • Document the new category selectors (#27906)

Contributors

0.16.4

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

... (truncated)

Commits

Updates mypy from 2.3.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 2, 2026
@socket-security

socket-security Bot commented Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedmypy@​2.3.0 ⏵ 2.3.175 +1100100100100
Updatedgunicorn@​26.0.0 ⏵ 26.2.096 +1100100100100
Updatedtyper@​0.26.8 ⏵ 0.27.297 +1100100100100
Updatedpython-dotenv@​1.2.2 ⏵ 1.2.399 +1100100100100
Updatedtwilio@​9.10.9 ⏵ 9.11.0100100100100100
Updatedpydantic@​2.13.4 ⏵ 2.13.5100 +1100100100100
Updatedruff@​0.15.21 ⏵ 0.16.5100 +1100100100100
Updatedpydantic-core@​2.46.4 ⏵ 2.46.5100100100100100

View full report

@haasonsaas

haasonsaas commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Merging with smoke still queued. That job is .github/workflows/bazel-rbe.yml, which targets the self-hosted evalops-orbit-agent-rbe + bazel-rbe lane. That lane has not produced a completed run since 2026-08-11: every run since is queued or cancelled, including the run on main from 2026-09-02T00:59:58Z. It is not a required status check and it is not gating anything today.

What did run and pass on this PR's head commit:

  • Refresh compiled lock files — recompiled requirements.lock and requirements-dev.lock, installed from the recompiled dev lock, then black --check ., ruff check . and pytest -q, all green.
  • test (3.11) and test (3.12) — green.

The stuck Bazel lane is a runner-capacity item for the repository owner, tracked separately.

@haasonsaas

haasonsaas commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@haasonsaas

haasonsaas commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

This branch went to DIRTY when #59 merged, because both PRs carry recompiled requirements.lock and requirements-dev.lock. A rebase will re-run .github/workflows/dependabot-lockfiles.yml, which recompiles both locks against the new base and pushes them back.

@dependabot @github

dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@haasonsaas

haasonsaas commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

The rebase request did not take and the branch is still DIRTY against main: #59 merged its own recompiled requirements.lock and requirements-dev.lock, which conflicts with this branch's copies of the same two files. Recreating against current main is cleaner than resolving that by hand.

The underlying gate is fixed and proven on this very branch: .github/workflows/dependabot-lockfiles.yml ran here as Refresh compiled lock files, recompiled both locks, installed from the recompiled dev lock, ran black --check ., ruff check . and pytest -q green, and pushed commit bca43d06 build(deps): recompile requirements lock files back to this branch. test (3.11) and test (3.12) then passed on that commit.

@dependabot
build(deps): bump the production-minor-patch group across 1 directory…
169c121 
… with 7 updates

Bumps the production-minor-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [typer](https://github.com/fastapi/typer) | `0.26.8` | `0.27.2` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.3` |
| [twilio](https://github.com/twilio/twilio-python) | `9.10.9` | `9.11.0` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `26.0.0` | `26.2.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.16.5` |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.3.1` |



Updates `typer` from 0.26.8 to 0.27.2
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.26.8...0.27.2)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `python-dotenv` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3)

Updates `twilio` from 9.10.9 to 9.11.0
- [Release notes](https://github.com/twilio/twilio-python/releases)
- [Changelog](https://github.com/twilio/twilio-python/blob/main/CHANGES.md)
- [Commits](twilio/twilio-python@9.10.9...9.11.0)

Updates `gunicorn` from 26.0.0 to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@26.0.0...26.2.0)

Updates `ruff` from 0.15.21 to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.21...0.16.5)

Updates `mypy` from 2.3.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.3.1)

---
updated-dependencies:
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: mypy
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: twilio
  dependency-version: 9.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
- dependency-name: typer
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/production-minor-patch-90e425746e branch from bca43d0 to 169c121 Compare September 2, 2026 04:31
@haasonsaas

haasonsaas commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Merging on the same basis as #59. Green on this head:

Job Result
Refresh compiled lock files pass
test (3.11) pass
test (3.12) pass

Refresh compiled lock files is the workflow added in #64: it recompiled requirements.lock and requirements-dev.lock, installed from the recompiled dev lock, then ran black --check ., ruff check . and pytest -q, all green, and pushed the locks back to this branch. This PR now changes all four files, which is what the CI lock-sync gate always wanted and what Dependabot could not produce on its own.

smoke is .github/workflows/bazel-rbe.yml on the self-hosted evalops-orbit-agent-rbe + bazel-rbe lane. That lane has produced no completed run since 2026-08-11; every run since is queued or cancelled, including the one on main from 2026-09-02T02:17:47Z. It is not a required status check. Runner capacity there is an owner item.

@haasonsaas
haasonsaas merged commit 4e58f03 into main Sep 2, 2026
5 of 6 checks passed
@haasonsaas
haasonsaas deleted the dependabot/pip/production-minor-patch-90e425746e branch September 2, 2026 04:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@haasonsaas