Skip to content

chore(deps-dev): Bump the python group with 6 updates - #55

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-bd5c5bd0a7
Open

chore(deps-dev): Bump the python group with 6 updates#55
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-bd5c5bd0a7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026 •
edited by blacksmith-sh Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the python group with 6 updates:

Package From To
starlette 1.9.0 1.10.0
httpx2 2.14.0 2.16.0
hypothesis 6.170.2 6.170.12
pytest-asyncio 1.4.0 1.4.1
ruff 0.17.1 0.17.2
ty 0.0.89 0.0.92

Updates starlette from 1.9.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0
  • Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
  • The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
  • FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

  • Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
  • starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

  • Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
  • Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
  • WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
  • FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

  • Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
  • Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
  • FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
  • Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

  • Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
  • Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
  • Compare Match members by identity during routing #3665 and #3722.

Deprecated

  • Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

  • Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.
  • Keep path parameter values that look like another placeholder in url_path_for() #3725.
  • Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.
  • Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.
  • Strip only one pair of matching outer quotes from Config env file values #3720.
  • Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.
  • Report NaN and infinity correctly in FloatConvertor.to_string() #3716.
  • Ignore Range on requests other than GET and HEAD in FileResponse #3679.
Commits
  • 8aa828c Version 1.10.0 (#3728)
  • a85a5c3 Substitute URL path parameters in a single pass (#3725)
  • 6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
  • b973efd Build URL-encoded form fields in parser callbacks (#3724)
  • d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
  • fb3e818 Compare remaining Match members by identity in routing (#3722)
  • fc23aa1 Compare Match members by identity in Router.app (#3665)
  • fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
  • 4114432 Default omitted http.response.start headers in middlewares (#3721)
  • 1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
  • Additional commits viewable in compare view

Updates httpx2 from 2.14.0 to 2.16.0

Release notes

Sourced from httpx2's releases.

v2.16.0

Highlights

🍪 Faster requests with large cookie jars

Building the Cookie header no longer scans every cookie in the jar. The client reuses its jar instead of copying it on every request and redirect (#1284), only looks up the domains that can match the request host, and skips the expired cookie sweep until a cookie is due (#1285). With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster.

Cookies from different domains are now sent from the least to the most specific domain, for example .example.org before sub.example.org, instead of in the order the domains were added. Cookies with longer paths still come first.

httpx2

Changed

  • Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain (#1285).

Fixed

  • Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests (#1284).

httpcore2

No changes since 2.15.1. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.15.1...v2.16.0

v2.15.1

Highlights

🔒 Flat CPU usage for long-lived clients on Linux

On Linux, the default SSL context is now configured once instead of on every handshake (#1253). With OpenSSL older than 3.4, each handshake added a duplicate certificate lookup path, so CPU usage per request grew over the lifetime of a reused client. Certificate verification is unchanged, and Windows and macOS still use truststore.

httpx2

Fixed

  • Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

httpcore2

Fixed

  • Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

Full Changelog: pydantic/httpx2@v2.15.0...v2.15.1

v2.15.0

Highlights

🐍 Python 3.11+ required

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.16.0 (October 21st, 2026)

Changed

  • Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain. (#1285)

Fixed

  • Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests. (#1284)

2.15.1 (October 19th, 2026)

Fixed

  • Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client. (#1253)

2.15.0 (October 19th, 2026)

Removed

  • Drop support for Python 3.10. (#1274)
Commits

Updates hypothesis from 6.170.2 to 6.170.12

Commits
  • 8fca8fd Bump hypothesis version to 6.170.12 and update changelog
  • df163ff Merge pull request #4939 from Zac-HD/claude/bold-lovelace-1y9hgb
  • 7851beb Make the branch-check description stack thread-local
  • e2c5e71 Lazily import unittest.mock and urllib.request
  • eaf0827 Defer traceback formatting for failing examples
  • d863d2c Cheaper choices_key and boolean constraint keys
  • e00d20e Add fast paths for is_empty and unwrap_strategies
  • 4918dcf Accumulate ConjectureData nodes in a list
  • a7415b3 Compute choice sizes without serializing
  • ac78b73 Reuse a single branch sampler in OneOfStrategy
  • Additional commits viewable in compare view

Updates pytest-asyncio from 1.4.0 to 1.4.1

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio v1.4.1

1.4.1 - 2026-10-25

Added

  • Declared support for Python 3.15 (#1588)

Fixed

  • Allow AsyncIterable as a return type for asynchronous generator fixtures decorated with pytest_asyncio.fixture (#1090)

Notes for Downstream Packagers

  • Source-tree development dependencies now use PEP 735 dependency groups and uv.lock. (#1518)
Commits
  • 6af7f5c chore: Prepare release of v1.4.1.
  • 32ccf64 Support 3.15 (#1588)
  • 9830071 Build(deps): Bump certifi from 2026.6.17 to 2026.10.19 (#1590)
  • 0238023 Build(deps): Bump virtualenv from 21.7.13 to 21.14.13 (#1589)
  • 93893ec Build(deps): Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#1583)
  • f287e5e Build(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (#1581)
  • b71da4f Build(deps-dev): Bump hypothesis from 6.168.3 to 6.168.5 (#1582)
  • d8c51d8 Build(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#1580)
  • b12808b Build(deps): Bump virtualenv from 21.7.12 to 21.7.13 (#1578)
  • e0601f0 Build(deps-dev): Bump coverage from 7.16.1 to 7.16.2 (#1577)
  • Additional commits viewable in compare view

Updates ruff from 0.17.1 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

Commits
  • 30516b4 Bump version to 0.17.2 (#29637)
  • 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
  • 0d562aa [ty] Check inherited attribute conflicts (#28559)
  • 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
  • 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
  • b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
  • 32869b4 Avoid creating deployments for automation jobs (#29626)
  • ec891ba Link the commit in pull request report footers (#29621)
  • 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
  • 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
  • Additional commits viewable in compare view

Updates ty from 0.0.89 to 0.0.92

Release notes

Sourced from ty's releases.

0.0.92

Release Notes

Released on 2026-10-26.

Core type checking

  • Infer the types of Django model primary keys (pk and the automatic id) with django-types (#29642)
  • Infer Django foreign key <field>_id types from the referenced field (#29664)
  • Recognize get_<field>_display() on Django model fields with choices (#29651)
  • Recognize get_next_by_<field>() and get_previous_by_<field>() on non-nullable Django date and datetime fields (#29653)

Bug fixes

  • Preserve generic callback parameters when forwarding overloaded functions through a ParamSpec (#29649)
  • Check implicit and PEP 613 type aliases as type expressions at their definitions (#29200)

CLI

  • Emit SARIF reports with ty check --output-format sarif (#29635)

LSP server

  • Skip scanning for scripts at startup and reload when uv script environments are disabled (#29697)

Diagnostic improvements

  • Abbreviate large nested tuple types in diagnostics and inlay hints (#29691)
  • Point to the expression that makes a type alias invalid, even when the alias is imported (#29654)

Performance

  • Avoid redundant work when checking inherited attributes (#29699)
  • Check for instance storage without inferring method assignments (#29709)
  • Collect receiver annotations once per class (#29703)
  • Check non-recursive protocol members before recursive ones (#29542)
  • Reuse class member lookups when checking overrides (#29716)
  • Reuse each generic context's inferable type variables (#29700)
  • Short-circuit comparisons involving top and bottom callable signatures (#29537)
  • Skip inferred writes when a declaration determines an instance member (#29702)
  • Skip method signature inference for concrete decorator results (#29708)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.92

Released on 2026-10-26.

Core type checking

  • Infer the types of Django model primary keys (pk and the automatic id) with django-types (#29642)
  • Infer Django foreign key <field>_id types from the referenced field (#29664)
  • Recognize get_<field>_display() on Django model fields with choices (#29651)
  • Recognize get_next_by_<field>() and get_previous_by_<field>() on non-nullable Django date and datetime fields (#29653)

Bug fixes

  • Preserve generic callback parameters when forwarding overloaded functions through a ParamSpec (#29649)
  • Check implicit and PEP 613 type aliases as type expressions at their definitions (#29200)

CLI

  • Emit SARIF reports with ty check --output-format sarif (#29635)

LSP server

  • Skip scanning for scripts at startup and reload when uv script environments are disabled (#29697)

Diagnostic improvements

  • Abbreviate large nested tuple types in diagnostics and inlay hints (#29691)
  • Point to the expression that makes a type alias invalid, even when the alias is imported (#29654)

Performance

  • Avoid redundant work when checking inherited attributes (#29699)
  • Check for instance storage without inferring method assignments (#29709)
  • Collect receiver annotations once per class (#29703)
  • Check non-recursive protocol members before recursive ones (#29542)
  • Reuse class member lookups when checking overrides (#29716)
  • Reuse each generic context's inferable type variables (#29700)
  • Short-circuit comparisons involving top and bottom callable signatures (#29537)
  • Skip inferred writes when a declaration determines an instance member (#29702)
  • Skip method signature inference for concrete decorator results (#29708)

Contributors

0.0.91

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

@dependabot
chore(deps-dev): Bump the python group with 6 updates
6eb2e03 
Bumps the python group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [starlette](https://github.com/Kludex/starlette) | `1.9.0` | `1.10.0` |
| [httpx2](https://github.com/pydantic/httpx2) | `2.14.0` | `2.16.0` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.170.2` | `6.170.12` |
| [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) | `1.4.0` | `1.4.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.1` | `0.17.2` |
| [ty](https://github.com/astral-sh/ty) | `0.0.89` | `0.0.92` |


Updates `starlette` from 1.9.0 to 1.10.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.9.0...1.10.0)

Updates `httpx2` from 2.14.0 to 2.16.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.14.0...v2.16.0)

Updates `hypothesis` from 6.170.2 to 6.170.12
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.170.2...v6.170.12)

Updates `pytest-asyncio` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases)
- [Commits](pytest-dev/pytest-asyncio@v1.4.0...v1.4.1)

Updates `ruff` from 0.17.1 to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.1...0.17.2)

Updates `ty` from 0.0.89 to 0.0.92
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.89...0.0.92)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: httpx2
  dependency-version: 2.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: hypothesis
  dependency-version: 6.170.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: pytest-asyncio
  dependency-version: 1.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.17.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: ty
  dependency-version: 0.0.92
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 29, 2026
@dependabot
dependabot Bot requested a review from jnsdls as a code owner October 29, 2026 19:46
@dependabot dependabot Bot added the python:uv Pull requests that update python:uv code label Oct 29, 2026
@socket-security

socket-security Bot commented Oct 29, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​hypothesis@​6.170.2 ⏵ 6.170.1298 +110010010070
Updatedpypi/​starlette@​1.9.0 ⏵ 1.10.0100100100100100
Updatedpypi/​ty@​0.0.89 ⏵ 0.0.92100 +1100100100100
Updatedpypi/​ruff@​0.17.1 ⏵ 0.17.2100 +1100100100100
Updatedpypi/​httpx2@​2.14.0 ⏵ 2.16.0100100100100100
Updatedpypi/​pytest-asyncio@​1.4.0 ⏵ 1.4.1100 +1100100100100

View full report

@codspeed

codspeed Bot commented Oct 29, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 46 untouched benchmarks

Comparing dependabot/uv/python-bd5c5bd0a7 (6eb2e03) with main (9da5a8d)

Open in CodSpeed

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jnsdls jnsdls jnsdls approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jnsdls