Skip to content

build(deps): bump the python-minor group across 1 directory with 6 updates - #11

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-1929b61776
Open

build(deps): bump the python-minor group across 1 directory with 6 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-1929b61776

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor group with 6 updates in the / directory:

Package From To
joserfc 1.7.5 1.7.7
ruff 0.17.0 0.17.2
asgiref 3.12.1 3.13.0
ast-serialize 0.13.0 0.13.1
coverage 7.16.2 7.17.0
pycparser 3.11 3.12

Updates joserfc from 1.7.5 to 1.7.7

Release notes

Sourced from joserfc's releases.

1.7.7

   🐞 Bug Fixes

    View changes on GitHub

1.7.6

   🐞 Bug Fixes

    View changes on GitHub
Changelog

Sourced from joserfc's changelog.

1.7.7

Released on October 19, 2026

  • JWK: Reject recognized DER, PEM, and SSH asymmetric public keys when importing oct keys, including public key bytes embedded in an oct JWK. Preserve warnings for input that only resembles an asymmetric key.
  • Replace legacy union type hints with | syntax.

1.7.6

Released on October 19, 2026

  • JWE: Limit base64url-encoded additional authenticated data to 65,536 bytes before copying or decoding it in JSON serialization. Configure the limit with JWERegistry(max_aad_length=...).
  • JWT: Reject non-string jti claims, including arrays containing an expected token ID, even when no claim options are configured.
  • JWT: Report the correct claim name for invalid iss values.
  • JWS & JWE: Validate compact token size before splitting it into segments.
  • JWK: Handle key set equality comparisons with unrelated types.
Commits
  • 43af5af chore: release 1.7.7
  • 0bd4c41 fix: improve typing use | as union
  • 4fb465e fix(jwk): reject asymmetric public keys in oct imports
  • c54d9cc chore: release 1.7.6
  • d060c2e fix(ci): restrict default workflow token permissions
  • e93fd2b fix(jwt): require string values for jti claims
  • 25e9526 fix(jwe): limit additional authenticated data size
  • 27d7c8a fix(jwk): handle KeySet equality with unrelated types (#106)
  • 397e04f fix: validate compact value size before split
  • 8074dc7 Merge pull request #105 from janmrow/fix/jwt-iss-claim-name
  • Additional commits viewable in compare view

Updates ruff from 0.17.0 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

... (truncated)

Commits
  • 30516b4 Bump version to 0.17.2 (#29637)
  • 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
  • 0d562aa [ty] Check inherited attribute conflicts (#28559)
  • 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
  • 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
  • b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
  • 32869b4 Avoid creating deployments for automation jobs (#29626)
  • ec891ba Link the commit in pull request report footers (#29621)
  • 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
  • 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
  • Additional commits viewable in compare view

Updates asgiref from 3.12.1 to 3.13.0

Changelog

Sourced from asgiref's changelog.

3.13.0 (2026-10-23)

  • It is now possible to nest ThreadSensitiveContext by providing an explicit executor for thread-sensitive tasks. This enables moving a block of such work away from the parent context's shared worker. (#596)

    The provided executor must run work sequentially and on a single thread, as per ThreadPoolExecutor(max_workers=1), and the calling code is responsible for managing the executor's lifecycle.

    See the README for more details.

  • Local attribute access is now 2-3x faster. Local(...) now uses one of two internal specialisations, selected by thread_critical, instead of checking the mode on every access. (#551)

    As a result Local is now marked @final and raises TypeError if subclassed. Subclassing was never supported, and could not have worked correctly with the specialised implementations.

  • asgiref.timeout.timeout is deprecated, and will be removed in a future release. Move to use asyncio.timeout() instead.

  • Added support for Python 3.15.

  • Dropped support for EOL Python 3.10.

Commits

Updates ast-serialize from 0.13.0 to 0.13.1

Commits

Updates coverage from 7.16.2 to 7.17.0

Release notes

Sourced from coverage's releases.

7.17.0

Version 7.17.0 — 2026-10-22

  • Dropped support for Python 3.10.
  • Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.
  • Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.
  • Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.
  • Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.
  • Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.
  • Fix: The “Can’t combine statement coverage data with branch data” error now names the two data files it couldn’t combine. The error description in the docs now lists common causes and how to find the process that wrote the file.
  • Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293 and issue 2294.
  • Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338.
  • Fixes for obscure but legal file names:
    • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and coverage debug data replace non-printable characters in names. Printable names are unchanged.
    • A file pattern (from include, omit, or a [paths] alias) containing a newline sent the glob-to-regex translation into an infinite loop, hanging the process. Newlines in patterns are now handled like any other character.
  • Fixes in the implementation of the C tracer:
    • If a plugin’s dynamic_source_filename method raised an exception, lines in that function could be recorded as belonging to a different file. Also fixed some minor memory leaks in the C tracer.
    • The refcount of None was mismanaged during function calls, including comprehensions. This was unlikely to cause an actual problem, but is now fixed. Thanks, Andrew Dalke.
    • The C tracer held borrowed references to dictionary values, which was unsafe on free-threaded Python. Now it takes its own references.
    • An internal error while recording a new file could be reported as a confusing SystemError instead of the actual exception.
  • Performance: the text summary report (coverage report) held on to every file’s parsed source until it finished, so its memory use grew with the size of the project: ten times or more what 7.14 used on large projects. Now it keeps only what it needs to print. Fixes issue 2277.
  • Performance: HTML reports should be about 5% faster to produce.
  • Kept the political banner in the README. Closes issue 2344.

➡️  PyPI page: coverage 7.17.0. :arrow_right:  To install: python3 -m pip install coverage==7.17.0

Changelog

Sourced from coverage's changelog.

Version 7.17.0 — 2026-10-22

  • Dropped support for Python 3.10.

  • Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.

  • Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987_.

  • Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314_.

  • Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.

  • Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.

  • Fix: The "Can't combine statement coverage data with branch data" error now names the two data files it couldn't combine. The :ref:error description <error_cant_combine> in the docs now lists common causes and how to find the process that wrote the file.

  • Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293_ and issue 2294_.

  • Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338_.

  • Fixes for obscure but legal file names:

    • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and ``coverage debug

... (truncated)

Commits
  • 393ac71 docs: prep for 7.17.0
  • 14257d3 test: check that 100% files haven't lost coverage
  • db056ac docs: keep the ukraine banner #2344
  • 6033660 fix: update the data file hash when a parallel data file is saved again (#2339)
  • 99024b5 fix: clamp rate in XML report to prevent false 1.0/0.0 rounding and scientifi...
  • ff62a02 refactor: remove unused caching branches
  • 24d0b67 fix: KeyError for a with statement at the end of a finally clause (#2336)
  • 934f5b8 chore: upgrade pip==26.2.2 certifi==2026.10.19
  • f95c980 fix: triply nested with statements don't cause false branch misses #1987
  • 6aaa858 docs: more changelog gardening
  • Additional commits viewable in compare view

Updates pycparser from 3.11 to 3.12

Release notes

Sourced from pycparser's releases.

release_v3.12

What's Changed

Full Changelog: eliben/pycparser@release_v3.11...release_v3.12

Commits
  • 3ec766b Tweak build
  • 1771cbf Prepare to release 3.12
  • 51715bf Add documentation on using methods of ast node
  • 878c289 Support va_arg properly
  • 840fe55 Add some Linux kernel headers to benchmark
  • 8fd2299 Add ArrayDesignator AST node to distinguish array indices in designators
  • aa32af5 Fix crashes in generator with empty case bodies
  • f29e8ef Regression test for #215
  • a74aa74 Support form feed and vertical tabs as whitespace
  • 02380d0 Comment fixes
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the python-minor group across 1 directory with 6 up…
5b5c404 
…dates

Bumps the python-minor group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [joserfc](https://github.com/authlib/joserfc) | `1.7.5` | `1.7.7` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.0` | `0.17.2` |
| [asgiref](https://github.com/django/asgiref) | `3.12.1` | `3.13.0` |
| [ast-serialize](https://github.com/mypyc/ast_serialize) | `0.13.0` | `0.13.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.16.2` | `7.17.0` |
| [pycparser](https://github.com/eliben/pycparser) | `3.11` | `3.12` |



Updates `joserfc` from 1.7.5 to 1.7.7
- [Release notes](https://github.com/authlib/joserfc/releases)
- [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst)
- [Commits](authlib/joserfc@1.7.5...1.7.7)

Updates `ruff` from 0.17.0 to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.0...0.17.2)

Updates `asgiref` from 3.12.1 to 3.13.0
- [Changelog](https://github.com/django/asgiref/blob/main/CHANGELOG.txt)
- [Commits](django/asgiref@3.12.1...3.13.0)

Updates `ast-serialize` from 0.13.0 to 0.13.1
- [Commits](mypyc/ast_serialize@v0.13.0...v0.13.1)

Updates `coverage` from 7.16.2 to 7.17.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.16.2...7.17.0)

Updates `pycparser` from 3.11 to 3.12
- [Release notes](https://github.com/eliben/pycparser/releases)
- [Commits](eliben/pycparser@release_v3.11...release_v3.12)

---
updated-dependencies:
- dependency-name: joserfc
  dependency-version: 1.7.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: ruff
  dependency-version: 0.17.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: asgiref
  dependency-version: 3.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: ast-serialize
  dependency-version: 0.13.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: coverage
  dependency-version: 7.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: pycparser
  dependency-version: '3.12'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants