Skip to content

Bump the all-minor-and-patch-dependency-updates group across 1 directory with 11 updates#326

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/all-minor-and-patch-dependency-updates-4485ca7a8a
Closed

Bump the all-minor-and-patch-dependency-updates group across 1 directory with 11 updates#326
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/all-minor-and-patch-dependency-updates-4485ca7a8a

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Dec 1, 2025 •
edited
Loading

Bumps the all-minor-and-patch-dependency-updates group with 11 updates in the / directory:

Package From To
bandit 1.8.6 1.9.2
setuptools-scm[toml] 9.2.0 9.2.2
ruff 0.12.11 0.14.7
fastapi 0.116.1 0.123.0
numpy 2.3.2 2.3.5
duckdb 1.3.2 1.4.2
pydantic-settings 2.10.1 2.12.0
uvicorn[standard] 0.35.0 0.38.0
scipy 1.16.1 1.16.3
tox 4.29.0 4.32.0
nbsphinx 0.9.7 0.9.8

Updates bandit from 1.8.6 to 1.9.2

Release notes

Sourced from bandit's releases.

1.9.2

What's Changed

Full Changelog: PyCQA/bandit@1.9.1...1.9.2

1.9.1

What's Changed

Full Changelog: PyCQA/bandit@1.9.0...1.9.1

1.9.0

What's Changed

New Contributors

Full Changelog: PyCQA/bandit@1.8.6...1.9.0

Commits

Updates setuptools-scm[toml] from 9.2.0 to 9.2.2

Release notes

Sourced from setuptools-scm[toml]'s releases.

v9.2.2

What's Changed

Full Changelog: pypa/setuptools-scm@v9.2.1...v9.2.2

v9.2.1

What's Changed

New Contributors

Full Changelog: pypa/setuptools-scm@v9.2.0...v9.2.1

Changelog

Sourced from setuptools-scm[toml]'s changelog.

v9.2.2

Fixed

  • fix #1231: don't warn about tool.setuptools.dynamic.version when only using file finder. The warning about combining version guessing with setuptools dynamic versions should only be issued when setuptools-scm is performing version inference, not when it's only being used for its file finder functionality.

v9.2.1

Fixed

  • fix #1216: accept and create a warning for usages of version = attr: in setuptools config. unfortunately dozens of projects cargo-culted that antipattern
Commits
  • e56b78f Merge pull request #1232 from RonnyPfannschmidt/fix-1231-dont-warn-when-no-guess
  • 4f55e95 docs: update changelog for v9.2.2 patch release
  • 95a0c47 fix: don't warn about tool.setuptools.dynamic.version when only using file fi...
  • 338f562 Merge pull request #1226 from RonnyPfannschmidt/prepare-release
  • a893634 Prepare release v9.2.1
  • ad83282 Merge pull request #1225 from pypa/pre-commit-ci-update-config
  • 20a4464 [pre-commit.ci] pre-commit autoupdate
  • 70f6942 Merge pull request #1219 from RonnyPfannschmidt/fix-1216-explicitly-deprecate...
  • 14d85c0 Install Mercurial on Windows runners via Chocolatey
  • 8c5cec9 Fix API stability check workflow to install griffe and improve reporting
  • Additional commits viewable in compare view

Updates ruff from 0.12.11 to 0.14.7

Release notes

Sourced from ruff's releases.

0.14.7

Release Notes

Released on 2025-11-28.

Preview features

  • [flake8-bandit] Handle string literal bindings in suspicious-url-open-usage (S310) (#21469)
  • [pylint] Fix PLR1708 false positives on nested functions (#21177)
  • [pylint] Fix suppression for empty dict without tuple key annotation (PLE1141) (#21290)
  • [ruff] Add rule RUF066 to detect unnecessary class properties (#21535)
  • [ruff] Catch more dummy variable uses (RUF052) (#19799)

Bug fixes

  • [server] Set severity for non-rule diagnostics (#21559)
  • [flake8-implicit-str-concat] Avoid invalid fix in (ISC003) (#21517)
  • [parser] Fix panic when parsing IPython escape command expressions (#21480)

CLI

  • Show partial fixability indicator in statistics output (#21513)

Contributors

Install ruff 0.14.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/ruff/releases/download/0.14.7/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/astral-sh/ruff/releases/download/0.14.7/ruff-installer.ps1 | iex"

... (truncated)

Changelog

Sourced from ruff's changelog.

0.14.7

Released on 2025-11-28.

Preview features

  • [flake8-bandit] Handle string literal bindings in suspicious-url-open-usage (S310) (#21469)
  • [pylint] Fix PLR1708 false positives on nested functions (#21177)
  • [pylint] Fix suppression for empty dict without tuple key annotation (PLE1141) (#21290)
  • [ruff] Add rule RUF066 to detect unnecessary class properties (#21535)
  • [ruff] Catch more dummy variable uses (RUF052) (#19799)

Bug fixes

  • [server] Set severity for non-rule diagnostics (#21559)
  • [flake8-implicit-str-concat] Avoid invalid fix in (ISC003) (#21517)
  • [parser] Fix panic when parsing IPython escape command expressions (#21480)

CLI

  • Show partial fixability indicator in statistics output (#21513)

Contributors

0.14.6

Released on 2025-11-21.

Preview features

  • [flake8-bandit] Support new PySNMP API paths (S508, S509) (#21374)

Bug fixes

  • Adjust own-line comment placement between branches (#21185)
  • Avoid syntax error when formatting attribute expressions with outer parentheses, parenthesized value, and trailing comment on value (#20418)
  • Fix panic when formatting comments in unary expressions (#21501)
  • Respect fmt: skip for compound statements on a single line (#20633)
  • [refurb] Fix FURB103 autofix (#21454)

... (truncated)

Commits

Updates fastapi from 0.116.1 to 0.123.0

Release notes

Sourced from fastapi's releases.

0.123.0

Fixes

  • 🐛 Cache dependencies that don't use scopes and don't have sub-dependencies with scopes. PR #14419 by @​tiangolo.

0.122.1

Fixes

Docs

Internal

0.122.0

Fixes

Internal

0.121.3

Refactors

  • ♻️ Make the result of Depends() and Security() hashable, as a workaround for other tools interacting with these internal parts. PR #14372 by @​tiangolo.

Upgrades

Docs

... (truncated)

Commits
  • f2bab95 🔖 Release version 0.123.0
  • c38e3e0 📝 Update release notes
  • 7fbd304 🐛 Cache dependencies that don't use scopes and don't have sub-dependencies wi...
  • 63d7a2b 🔖 Release version 0.122.1
  • 7681f29 📝 Update release notes
  • 378ad68 🐛 Fix hierarchical security scope propagation (#5624)
  • c6487ed 📝 Update release notes
  • 62a6974 ⬆ Bump markdown-include-variants from 0.0.5 to 0.0.6 (#14418)
  • 9982882 📝 Update release notes
  • 8ab7167 💅 Update CSS to explicitly use emoji font (#14415)
  • Additional commits viewable in compare view

Updates numpy from 2.3.2 to 2.3.5

Release notes

Sourced from numpy's releases.

2.3.5 (Nov 16, 2025)

NumPy 2.3.5 Release Notes

The NumPy 2.3.5 release is a patch release split between a number of maintenance updates and bug fixes. This release supports Python versions 3.11-3.14.

Contributors

A total of 10 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Aaron Kollasch +
  • Charles Harris
  • Joren Hammudoglu
  • Matti Picus
  • Nathan Goldbaum
  • Rafael Laboissière +
  • Sayed Awad
  • Sebastian Berg
  • Warren Weckesser
  • Yasir Ashfaq +

Pull requests merged

A total of 16 pull requests were merged for this release.

  • #29979: MAINT: Prepare 2.3.x for further development
  • #30026: SIMD, BLD: Backport FPMATH mode on x86-32 and filter successor...
  • #30029: MAINT: Backport write_release.py
  • #30041: TYP: Various typing updates
  • #30059: BUG: Fix np.strings.slice if stop=None or start and stop >= len...
  • #30063: BUG: Fix np.strings.slice if start > stop
  • #30076: BUG: avoid negating INT_MIN in PyArray_Round implementation (#30071)
  • #30090: BUG: Fix resize when it contains references (#29970)
  • #30129: BLD: update scipy-openblas, use -Dpkg_config_path (#30049)
  • #30130: BUG: Avoid compilation error of wrapper file generated with SWIG...
  • #30157: BLD: use scipy-openblas 0.3.30.7 (#30132)
  • #30158: DOC: Remove nonexistent order parameter docs of ma.asanyarray...
  • #30185: BUG: Fix check of PyMem_Calloc return value. (#30176)
  • #30217: DOC: fix links for newly rebuilt numpy-tutorials site
  • #30218: BUG: Fix build on s390x with clang (#30214)
  • #30237: ENH: Make FPE blas check a runtime check for all apple arm systems

v2.3.4 (Oct 15, 2025)

NumPy 2.3.4 Release Notes

The NumPy 2.3.4 release is a patch release split between a number of maintenance updates and bug fixes. This release supports Python versions 3.11-3.14. This release is based on Python 3.14.0 final.

... (truncated)

Commits
  • c3d60fc Merge pull request #30238 from charris/prepare-2.3.5
  • 11451fa REL: Prepare for the NumPy 2.3.5 release
  • eab5bd4 Merge pull request #30237 from charris/backport-30102
  • 7cea31a Fixup merge of multiarraymodule.c
  • b898173 Update numpy/_core/src/common/blas_utils.h
  • f755483 Report FPE ignoring in matmul in show_runtime()
  • c47116f Move test to Python
  • bd7b93f ooops, needs to be a calloc of course.
  • 83a1517 Guard for HAVE_CBLAS and always compile the helpers
  • ab680ef ENH: Make FPE blas check a runtime check for all arm systems
  • Additional commits viewable in compare view

Updates duckdb from 1.3.2 to 1.4.2

Release notes

Sourced from duckdb's releases.

Python DuckDB v1.4.2

This is a bug fix release for various issues discovered after we released v1.4.1.

Also see the DuckDB v1.4.2 Changelog.

What's Changed

Full Changelog: duckdb/duckdb-python@v1.4.1...v1.4.2

Changelog

Sourced from duckdb's changelog.

Changelog

v1.4.1

DuckDB Core: v1.4.1

Bug Fixes

  • ADBC Driver: Fixed ADBC driver implementation (#81)
  • SQLAlchemy compatibility: Added __hash__ method overload (#61)
  • Error Handling: Reset PyErr before throwing Python exceptions (#69)
  • Polars Lazyframes: Fixed Polars expression pushdown (#102)

Code Quality Improvements & Developer Experience

  • MyPy Support: MyPy is functional again and better integrated with the dev workflow
  • Stubs: Re-created and manually curated stubs for the binary extension
  • Type Shadowing: Deprecated typing and functional modules
  • Linting & Formatting: Comprehensive code quality improvements with Ruff
  • Type Annotations: Added missing overloads and improved type coverage
  • Pre-commit Integration: Added ruff, clang-format, cmake-format and mypy configs
  • CI/CD: Added code quality workflow
Commits
  • 70380a1 Submodule at 68d7555 for 1.4.2 release
  • 13827e7 Fix InsertRelation on attached database (#155)
  • 7ccc8e9 Add explicit .pl(lazy=True) overload (#172)
  • 20bfd52 review feedback
  • 10e0ef3 Add explicit polars overloads
  • 95a9968 Fix InsertRelation on attached database
  • f3b8c8a Bumped submodule
  • f5618a3 Bumped submodule
  • 17a0cad remove experimental import because of the transitive dependencies that requires
  • e35a2ce mypy shouldn't check experimental.spark
  • Additional commits viewable in compare view

Updates pydantic-settings from 2.10.1 to 2.12.0

Release notes

Sourced from pydantic-settings's releases.

v2.12.0

What's Changed

New Contributors

Full Changelog: pydantic/pydantic-settings@v2.11.0...v2.12.0

v2.11.0

What's Changed

New Contributors

Full Changelog: pydantic/pydantic-settings@2.10.1...v2.11.0

Commits

Updates uvicorn[standard] from 0.35.0 to 0.38.0

Release notes

Sourced from uvicorn[standard]'s releases.

Version 0.38.0

What's Changed

New Contributors

Full Changelog: Kludex/uvicorn@0.37.0...0.38.0

Version 0.37.0

What's Changed

New Contributors

Full Changelog: Kludex/uvicorn@0.36.1...0.37.0

Version 0.36.1

What's Changed

Full Changelog: Kludex/uvicorn@0.36.0...0.36.1

Version 0.36.0

Added

New Contributors

Full Changelog: Kludex/uvicorn@0.35.0...0.36.0

Changelog

Sourced from uvicorn[standard]'s changelog.

0.38.0 (October 18, 2025)

Added

  • Support Python 3.14 (#2723)

0.37.0 (September 23, 2025)

Added

  • Add --timeout-worker-healthcheck option (#2711)
  • Add os.PathLike[str] type to ssl_ca_certs (#2676)

0.36.1 (September 23, 2025)

Fixed

  • Raise an exception when calling removed Config.setup_event_loop() (#2709)

0.36.0 (September 20, 2025)

Added

  • Support custom IOLOOPs (#2435)
  • Allow to provide importable string in --http, --ws and --loop (#2658)
Commits

Updates scipy from 1.16.1 to 1.16.3

Release notes

Sourced from scipy's releases.

SciPy 1.16.3 Release Notes

SciPy 1.16.3 is a bug-fix release with no new features compared to 1.16.2.

Authors

  • Name (commits)
  • ChrisAB (1) +
  • Lucas Colley (1)
  • Ralf Gommers (3)
  • Matt Haberland (8)
  • Nick ODell (2)
  • Ilhan Polat (1)
  • Tyler Reddy (28)
  • Lucas Roberts (2)

A total of 8 people contributed to this release. People with a "+" by their names contributed a patch for the first time. This list of names is automatically generated, and may not be fully complete.

The full issue and pull request lists, and the release asset hashes are available in the associated README.txt file.

SciPy 1.16.2 Release Notes

SciPy 1.16.2 is a bug-fix release with no new features compared to 1.16.1. This is the first stable release of SciPy to provide Windows on ARM wheels on PyPI.

Authors

  • Name (commits)
  • Dietrich Brunn (1)
  • Ralf Gommers (6)
  • Adam Jones (1)
  • Gleb Khmyznikov (1) +
  • Jost Migenda (1) +
  • newyork_loki (1)
  • Nick ODell (3)
  • Dimitri Papadopoulos Orfanos (1)
  • Ilhan Polat (2)
  • Tyler Reddy (26)
  • Mugunthan Selvanayagam (1) +
  • Shuhei Watanabe (1) +

A total of 12 people contributed to this release.

... (truncated)

Commits
  • b9105cc REL: 1.16.3 rel commit [wheel build]
  • 4b7699c Merge pull request #23805 from tylerjereddy/treddy_backports_...

    Description has been truncated

@dependabot
Bump the all-minor-and-patch-dependency-updates group across 1 direct…
931817c 
…ory with 11 updates

Bumps the all-minor-and-patch-dependency-updates group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bandit](https://github.com/PyCQA/bandit) | `1.8.6` | `1.9.2` |
| [setuptools-scm[toml]](https://github.com/pypa/setuptools-scm) | `9.2.0` | `9.2.2` |
| [ruff](https://github.com/astral-sh/ruff) | `0.12.11` | `0.14.7` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.116.1` | `0.123.0` |
| [numpy](https://github.com/numpy/numpy) | `2.3.2` | `2.3.5` |
| [duckdb](https://github.com/duckdb/duckdb-python) | `1.3.2` | `1.4.2` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.10.1` | `2.12.0` |
| [uvicorn[standard]](https://github.com/Kludex/uvicorn) | `0.35.0` | `0.38.0` |
| [scipy](https://github.com/scipy/scipy) | `1.16.1` | `1.16.3` |
| [tox](https://github.com/tox-dev/tox) | `4.29.0` | `4.32.0` |
| [nbsphinx](https://github.com/spatialaudio/nbsphinx) | `0.9.7` | `0.9.8` |



Updates `bandit` from 1.8.6 to 1.9.2
- [Release notes](https://github.com/PyCQA/bandit/releases)
- [Commits](PyCQA/bandit@1.8.6...1.9.2)

Updates `setuptools-scm[toml]` from 9.2.0 to 9.2.2
- [Release notes](https://github.com/pypa/setuptools-scm/releases)
- [Changelog](https://github.com/pypa/setuptools-scm/blob/main/CHANGELOG.md)
- [Commits](pypa/setuptools-scm@v9.2.0...v9.2.2)

Updates `ruff` from 0.12.11 to 0.14.7
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.12.11...0.14.7)

Updates `fastapi` from 0.116.1 to 0.123.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.116.1...0.123.0)

Updates `numpy` from 2.3.2 to 2.3.5
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.3.2...v2.3.5)

Updates `duckdb` from 1.3.2 to 1.4.2
- [Release notes](https://github.com/duckdb/duckdb-python/releases)
- [Changelog](https://github.com/duckdb/duckdb-python/blob/main/CHANGELOG.md)
- [Commits](duckdb/duckdb-python@v1.3.2...v1.4.2)

Updates `pydantic-settings` from 2.10.1 to 2.12.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@2.10.1...v2.12.0)

Updates `uvicorn[standard]` from 0.35.0 to 0.38.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.35.0...0.38.0)

Updates `scipy` from 1.16.1 to 1.16.3
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](scipy/scipy@v1.16.1...v1.16.3)

Updates `tox` from 4.29.0 to 4.32.0
- [Release notes](https://github.com/tox-dev/tox/releases)
- [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst)
- [Commits](tox-dev/tox@4.29.0...4.32.0)

Updates `nbsphinx` from 0.9.7 to 0.9.8
- [Release notes](https://github.com/spatialaudio/nbsphinx/releases)
- [Changelog](https://github.com/spatialaudio/nbsphinx/blob/master/NEWS.rst)
- [Commits](spatialaudio/nbsphinx@0.9.7...0.9.8)

---
updated-dependencies:
- dependency-name: bandit
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: setuptools-scm[toml]
  dependency-version: 9.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: ruff
  dependency-version: 0.14.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: fastapi
  dependency-version: 0.123.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: numpy
  dependency-version: 2.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: duckdb
  dependency-version: 1.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: pydantic-settings
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: uvicorn[standard]
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: scipy
  dependency-version: 1.16.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: tox
  dependency-version: 4.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: nbsphinx
  dependency-version: 0.9.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-minor-and-patch-dependency-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Dec 1, 2025
@dependabot dependabot Bot requested a review from a team as a code owner December 1, 2025 02:21
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Dec 1, 2025
@codecov
Copy link
Copy Markdown

codecov Bot commented Dec 1, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Jan 1, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jan 1, 2026
@dependabot dependabot Bot deleted the dependabot/pip/all-minor-and-patch-dependency-updates-4485ca7a8a branch January 1, 2026 02:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants