Skip to content

build(deps): bump the actions group across 1 directory with 6 updates - #99

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/actions-d280093e1c
Closed

build(deps): bump the actions group across 1 directory with 6 updates#99
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/actions-d280093e1c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 6 updates in the / directory:

Package From To
nltk 3.9.4 3.10.0
stanza 1.13.0 1.14.0
python-semantic-release 10.6.0 10.6.1
ruff 0.15.20 0.15.22
hypothesis 6.156.1 6.157.0
mypy 2.1.0 2.3.0

Updates nltk from 3.9.4 to 3.10.0

Release notes

Sourced from nltk's releases.

v3.10.0-rc1

What's Changed

... (truncated)

Changelog

Sourced from nltk's changelog.

Version 3.10.0 2026-06-11

  • Enforce the stricter nltk.pathsec security policy by default
  • Document the new security model and migration guidance
  • Harden resource loading against path traversal and SSRF/DNS-rebinding
  • Harden downloader path handling and block XML entity expansion
  • Close remaining corpus-reader security edge cases
  • Replace unsafe exec() usage in the utility CLI
  • Warn on unpickling user-provided pickles
  • Add HuggingFace datasets integration (nltk.huggingface)
  • Align TnT with Brants (2000) specifications
  • Fix PorterStemmer irregular-form lowercasing in NLTK mode
  • Fix TransitionParser sparse index dtype for scikit-learn 1.9
  • Fix TextCat tie handling
  • Fix WordNet object comparisons for incompatible types
  • Cache WordNet max depth lazily for lch_similarity()
  • Fix CCG variable direction, substitution, and type-raising bugs
  • Fix Jaro similarity for single-character and empty-string cases
  • Improve CI and release-maintenance workflows

Thanks to the following contributors to 3.10.0: 13rac1, alvations, bowiechen, devesh-2002, ekaf, elias-ba, haosenwang1018, HyperPS, ihitamandal, jancallewaert, jhnwnstd, JuanIMartinezB, Lemm1, LinZiyuu, Mr-Neutr0n, PastelStorm, scruge1, Syzygy2048, ylwango613, yzhaoinuw

Version 3.9.4 2026-03-24

  • Support Python 3.14
  • Fix bug in Levenshtein distance when substitution_cost > 2
  • Fix bug in Treebank detokeniser re quote ordering
  • Fix bug in Jaro similarity for empty strings
  • Several security enhancements
  • Fix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder
  • Implement TextTiling vocabulary introduction method (Hearst 1997)
  • Fix ALINE feature matrix errors and add comprehensive tests
  • Support multiple VerbNet versions, fix longid/shortid regex for VerbNet ids
  • Let downloader fallback to md5 when sha256 is unavailable
  • Several other minor bugfixes and code cleanups

Thanks to the following contributors to 3.9.4: Min-Yen Kan, Eric Kafe, Emily Voss, bowiechen, Hrudhai01, jancallewaert, Mr-Neutr0n, pollak.peter89, ylwango613,

Version 3.9.3 2026-02-21

  • Fix CVE-2025-14009: secure ZIP extraction in nltk.downloader (#3468)
  • Block path traversal/arbitrary reads in nltk.data for protocol-less refs (#3467)
  • Block path traversal/abs paths in corpus readers and FS pointers (#3479, #3480)
  • Validate external StanfordSegmenter JARs using SHA256 (#3477)

... (truncated)

Commits
  • bd49f90 allow escaped brackets in Tree.fromstring (#3694)
  • 27b8ad6 don't crash chomsky_normal_form on terminals with siblings (#3693)
  • 52227d2 Use os.name for Windows path handling (#3605)
  • 06c0e2c Avoid RIBES zero division on empty inputs (#3604)
  • a167389 Treat missing unzip output as stale (#3607)
  • c94c967 Fix EOF empty document bug in IEER corpus reader (#3648)
  • 94a259c Enforce restrictive primitive type checking in pathsec wrappers (#3692)
  • 5ac475d fix(security): isolate Stanford Java options and clean temp files (#3683)
  • 986f26e ci(deps): bump the github-actions group with 3 updates (#3691)
  • f26b375 fix(security): prevent pickle RCE in TransitionParser model loading (CWE-502)...
  • Additional commits viewable in compare view

Updates stanza from 1.13.0 to 1.14.0

Release notes

Sourced from stanza's releases.

v1.14.0 - Security fixes and Lemmatizer efficiency updates

Stanza v1.14.0 Release Notes

Security Fixes

  • Fix a potential zip slip vulnerability when extracting downloaded model archives. While low-risk given that Stanza controls the resources being downloaded, extraction now validates that no file paths escape the target directory. See GHSA-2fwf-f686-7p34. #1621

  • Restrict the unpickler used when deserializing annotated Documents, and add a deprecation warning: in a future release, Document serialization will move to JSON entirely, removing the pickle dependency. See GHSA-487q-m798-cp85. #1626

  • Remove shell subprocess calls from make_lm_data.py, addressing GHSA-c9h2-qmqw-qf6h. As a side benefit, the charlm data preparation script is now fully portable to Windows. #1623

Bugfixes

  • Fix a bug where coreference chain annotations were written under the ner= MISC key instead of coref_chains= when serializing a Document to CoNLL-U, causing collision with real NER labels on the same token. Thank you @​devteamaegis! #1628

New / Updated Models

  • Substantially updated Slovenian models: the new default sl_combined package mixes the SSJ and SST treebanks (reported by Kaja Dobrovoljc to be highly compatible), augments lemma and POS training with SUK 1.1 data, builds a lemma dictionary from Sloleks 3.1, and adds contextual lemma classifiers for the ambiguous pairs del/delo and rok/roka. #1625

Lemmatizer Improvements

  • Reorganize the lemmatizer dictionary to use a pos → word → lemma layout and store it gzip-compressed. This dramatically reduces load time for large models — Slovenian drops from 30+ seconds to under 5 seconds — and shrinks model sizes considerably. A conversion script for updating locally trained 1.13.0 models is included.

    Note: lemmatizer models from v1.13.0 are not compatible with v1.14.0. Please re-download or convert existing models. #1627

  • Reduce the hidden dimension of the contextual lemma classifier, making models smaller and faster without hurting accuracy. #1629

Dependency Parser

  • Post-process dependency parses to enforce uniqueness constraints on nsubj/csubj and obj relations: if the graph parser produces a node with multiple subjects or direct objects, the parser now reruns Chu-Liu-Edmonds iteratively (reusing the original neural scores) to find the best-scoring repair. This is on by default in the Pipeline. Addresses #1340. #1638

Tokenizer

  • Move comma-transposition augmentations from the data preparation script into the DataLoader, so that augmentation is applied on-the-fly during training rather than being baked in once at preprocessing time. This produces more balanced training and avoids accidentally affecting other annotators' data files. #1624

  • Add new structural feature functions to the tokenizer to help distinguish address-line formatting from normal running text, laying groundwork for fixing sentence-splitting errors on non-prose inputs. Addresses #1640. #1642

Interface Improvements

  • Add a stanza.utils.list_installed script that lists all locally cached Stanza models and their versions, without modifying anything on disk. Addresses #1542. #1632

  • Add a tokenize_with_speakers() convenience function for processing transcript-style text where each line begins with a speaker label, automatically assigning speaker metadata to sentences before passing them to the coref annotator. #1631

CharLM Training Infrastructure

For researchers building character language models for new languages, this release includes updated tooling for collecting and deduplicating training data from OSCAR. The previous OSCAR 2023 source is no longer accessible to new users and is broken with datasets >= 4.0; the new scripts target the OSCAR Community Crawl instead. Addresses #1622.

  • Add a download script for the OSCAR Community Crawl that bypasses load_dataset (which has a known bug with OSCAR), along with an inventory script to inspect the language breakdown of downloaded chunks. Also adds OSCAR language codes to constant.py and fixes a bug where extra language name aliases were being silently clobbered. #1633

  • Switch the near-deduplication strategy from TLSH to MinHash LSH. MinHash is faster, retains more content, and still achieves satisfactory deduplication rates as verified by the diagnostic script included in this PR. #1639

... (truncated)

Commits
  • 1f4bfdd Further refactor features so that unit tests can pick up any updates going fo...
  • 8ad5178 Refactor the default feature funcs so that they can be reused instead of redu...
  • c3ad5aa Add some more doc
  • a441914 Add columns for some additional features we can use to distinguish address li...
  • 6970b28 Add a nickname for 'AI-Sweden-Models/roberta-large-1160k'
  • 090e50f Add a block of documentation with some results showing that using MinHash for...
  • c6766bf Add a method (from Claude) for tokenizing speakers as requested in https://gi...
  • 3cfaf24 Move the definition of the DEPREL constraints to the constraint fixer instead...
  • 9108c4d Connect the head-constraint fixing to the pipeline and the model eval with op...
  • 5c93c5b Repair broken constraints in the dependency parser - two nsubj/csubj or two d...
  • Additional commits viewable in compare view

Updates python-semantic-release from 10.6.0 to 10.6.1

Release notes

Sourced from python-semantic-release's releases.

v10.6.1 (2026-07-06)

This release is published under the MIT License.

🪲 Bug Fixes

  • changelog: Fix handling of whitespace commit bodies in changelog template filter (PR#1457, d95e46e)

  • cmd-version: Fix non-styled error msg when strict & no new version (PR#1437, 5e8f94c)

  • config: Eliminate .git/ in parent dir warnings for monorepos configured with .. (PR#1444, 7a1f822)

📖 Documentation

  • CHANGELOG: Add v9.21.2 changelog details for website (a4115cf)

  • configuration: Document repo_dir config option (PR#1444, 7a1f822)

⚙️ Build System

  • deps: Expand python-gitlab dependency range to include v8.0.0+ (PR#1451, a4b9a43)

  • deps: Expand tomlkit dependency range to include v0.14.0+ & v0.15.0+ (028d539)

  • deps: Extend click dependency range to include v8.2+ (01707ea)

✅ Resolved Issues

  • #1418: Extrenous "Found .git/ in higher parent directory" warning in monorepo setup

  • #1423: Misformated error message

Detailed Changes: v10.6.0...v10.6.1

Installable artifacts are available from:

Changelog

Sourced from python-semantic-release's changelog.

v10.6.1 (2026-07-06)

🪲 Bug Fixes

  • changelog: Fix handling of whitespace commit bodies in changelog template filter (PR#1457, d95e46e)

  • cmd-version: Fix non-styled error msg when strict & no new version, closes [#1423](https://github.com/python-semantic-release/python-semantic-release/issues/1423)_ (PR#1437, 5e8f94c)

  • config: Eliminate .git/ in parent dir warnings for monorepos configured with .., closes [#1418](https://github.com/python-semantic-release/python-semantic-release/issues/1418)_ (PR#1444, 7a1f822)

📖 Documentation

  • CHANGELOG: Add v9.21.2 changelog details for website (a4115cf_)

  • configuration: Document repo_dir config option (PR#1444, 7a1f822)

⚙️ Build System

  • deps: Expand python-gitlab dependency range to include v8.0.0+ (PR#1451, a4b9a43)

  • deps: Expand tomlkit dependency range to include v0.14.0+ & v0.15.0+ (028d539_)

  • deps: Extend click dependency range to include v8.2+ (01707ea_)

.. _#1418: python-semantic-release/python-semantic-release#1418 .. _#1423: python-semantic-release/python-semantic-release#1423 .. _01707ea: python-semantic-release/python-semantic-release@01707ea .. _028d539: python-semantic-release/python-semantic-release@028d539 .. _5e8f94c: python-semantic-release/python-semantic-release@5e8f94c .. _7a1f822: python-semantic-release/python-semantic-release@7a1f822 .. _a4115cf: python-semantic-release/python-semantic-release@a4115cf .. _a4b9a43: python-semantic-release/python-semantic-release@a4b9a43 .. _d95e46e: python-semantic-release/python-semantic-release@d95e46e .. _PR#1437: python-semantic-release/python-semantic-release#1437 .. _PR#1444: python-semantic-release/python-semantic-release#1444 .. _PR#1451: python-semantic-release/python-semantic-release#1451 .. _PR#1457: python-semantic-release/python-semantic-release#1457

.. _changelog-v10.6.0:

Commits

Updates ruff from 0.15.20 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Install ruff 0.15.22

Install prebuilt binaries via shell script

</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

0.15.21

Released on 2026-07-09.

Preview features

... (truncated)

Commits

Updates hypothesis from 6.156.1 to 6.157.0

Commits
  • 41e4ac5 Bump hypothesis version to 6.157.0 and update changelog
  • 86c9077 Merge pull request #4801 from Zac-HD/claude/annotated-type-bugs-9hez25
  • e6efa5d Merge remote-tracking branch 'upstream/create-pull-request/patch' into claude...
  • ae39383 Fix TypeAliasType backport resolution on Python 3.10
  • ad258f6 Cover the invalid-Timezone-value error path
  • c51e00b Simplify Timezone base-strategy construction
  • fe2cfe3 Resolve the typing-extensions TypeAliasType backport; shorter changelog
  • 03bbf8f Name the alias in nested-Annotated errors; validate Timezone base type
  • e670494 Support annotated-types Timezone; better nested-Annotated error
  • 0c49268 add type ignore for new mypy
  • Additional commits viewable in compare view

Updates mypy from 2.1.0 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

  • Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
  • Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
  • Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
  • Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
  • Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
  • 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
  • 24c237d [mypyc] Improve documentation of Final (#21713)
  • b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
  • cbcb51a Narrow for frozendict membership check (#21709)
  • af2bc0f Sync typeshed (#21707)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the actions group across 1 directory with 6 updates
e9bfea7 
Bumps the actions group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [nltk](https://github.com/nltk/nltk) | `3.9.4` | `3.10.0` |
| [stanza](https://github.com/stanfordnlp/stanza) | `1.13.0` | `1.14.0` |
| [python-semantic-release](https://github.com/python-semantic-release/python-semantic-release) | `10.6.0` | `10.6.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.15.22` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.156.1` | `6.157.0` |
| [mypy](https://github.com/python/mypy) | `2.1.0` | `2.3.0` |



Updates `nltk` from 3.9.4 to 3.10.0
- [Release notes](https://github.com/nltk/nltk/releases)
- [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog)
- [Commits](nltk/nltk@3.9.4...v3.10.0)

Updates `stanza` from 1.13.0 to 1.14.0
- [Release notes](https://github.com/stanfordnlp/stanza/releases)
- [Commits](stanfordnlp/stanza@v1.13.0...v1.14.0)

Updates `python-semantic-release` from 10.6.0 to 10.6.1
- [Release notes](https://github.com/python-semantic-release/python-semantic-release/releases)
- [Changelog](https://github.com/python-semantic-release/python-semantic-release/blob/master/CHANGELOG.rst)
- [Commits](python-semantic-release/python-semantic-release@v10.6...v10.6.1)

Updates `ruff` from 0.15.20 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.15.22)

Updates `hypothesis` from 6.156.1 to 6.157.0
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.156.1...v6.157.0)

Updates `mypy` from 2.1.0 to 2.3.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.1.0...v2.3.0)

---
updated-dependencies:
- dependency-name: nltk
  dependency-version: 3.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: stanza
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: python-semantic-release
  dependency-version: 10.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: ruff
  dependency-version: 0.15.22
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: hypothesis
  dependency-version: 6.157.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 19, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 26, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 26, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/actions-d280093e1c branch July 26, 2026 14:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants