Skip to content

build(deps): bump the compatible-updates group across 1 directory with 10 updates - #168

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/compatible-updates-f14089fe86
Open

build(deps): bump the compatible-updates group across 1 directory with 10 updates#168
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/compatible-updates-f14089fe86

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the compatible-updates group with 10 updates in the / directory:

Package From To
dbos 2.29.0 2.31.1
filelock 3.32.2 3.32.6
packaging 26.2 26.3
platformdirs 4.11.0 4.11.8
pydantic 2.13.4 2.13.5
pydantic-settings 2.14.2 2.15.0
pyjwt 2.13.0 2.14.0
sqlalchemy 2.0.51 2.0.52
typer 0.27.0 0.27.2
build 1.5.0 1.6.1

Updates dbos from 2.29.0 to 2.31.1

Release notes

Sourced from dbos's releases.

2.31.1

What's Changed

Full Changelog: dbos-inc/dbos-transact-py@2.31.0...2.31.1

2.31.0

What's Changed

Full Changelog: dbos-inc/dbos-transact-py@2.30.0...2.31.0

2.30.0

What's Changed

New Contributors

Full Changelog: dbos-inc/dbos-transact-py@2.29.0...2.30.0

Commits

Updates filelock from 3.32.2 to 3.32.6

Release notes

Sourced from filelock's releases.

3.32.6

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.5...3.32.6

3.32.5

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.4...3.32.5

3.32.4

What's Changed

Full Changelog: tox-dev/filelock@3.32.3...3.32.4

3.32.3

What's Changed

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.6 (2026-09-08)

  • SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
  • Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724
  • Honor acquisition timeouts and blocking=False during SoftReadWriteLock state-mutex contention, including failed writer cleanup. Cross-host recovery of an abandoned .state marker remains unsupported. :pr:726
  • Allow acquiring existing lock files that grant write access through group permissions or an ACL even when their owner-write mode bit is unset. :pr:728
  • Preserve exception notes and custom attributes when copying or pickling Timeout and SoftFileLockProtocolError. :pr:729

3.32.5 (2026-08-31)

  • SoftFileLease.token and AsyncSoftFileLease.token now read None after a failed acquisition, so a contender turned away by a live holder no longer reports a token for a claim it never published. :pr:721
  • Document that mode has no setter: unlike poll_interval, timeout, blocking and lifetime, it is fixed at construction and lock.mode = ... raises AttributeError. :pr:716

3.32.4 (2026-08-23)

  • StrictSoftFileLock always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:705
  • WindowsFileLock waits out a transient STATUS_ACCESS_DENIED from NtCreateFile for up to half a second before raising PermissionError, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:705
  • Every lock class now escapes the hostname it publishes, so a host whose socket.gethostname() carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held SoftReadWriteLock read slot to a peer and could not take a write slot or a StrictSoftFileLock at all. :pr:709

3.32.3 (2026-08-13)

  • The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

... (truncated)

Commits
  • 4efd93e Release 3.32.6
  • 7b7b7a8 Fix SoftReadWriteLock state lock timeout (#726)
  • f2f7b86 fix: respect ACL write access when the owner write bit is absent (#728)
  • e947a69 test(soft-rw): reuse existing test module (#730)
  • da3ae2b fix: preserve exception notes when copying and pickling (#729)
  • ae9cb5b 🐛 fix(soft-rw): reject non-finite timing options (#724)
  • d00f9bb [pre-commit.ci] pre-commit autoupdate (#727)
  • 82f66d7 🐛 fix(lease): reject a duration no marker can carry (#723)
  • 1d9e9e7 [pre-commit.ci] pre-commit autoupdate (#722)
  • 1585dfe Release 3.32.5
  • Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

    

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
    • 

  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
    • 

  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
    • 

  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
    • 

  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
    • 

  • Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
    • 



Behavior adaptations:


    

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
    • 

  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
    • 



Fixes for versions and specifiers:


    

  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
    • 

  • Raise InvalidVersion for non-string pre-release letters passed to
    
Version.from_parts. (:pull:1241)
    • 

  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
    • 

  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
    • 



Fixes for requirements and markers:


    

  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    
foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates platformdirs from 4.11.0 to 4.11.8

Release notes

Sourced from platformdirs's releases.

4.11.8

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.11.7...4.11.8

4.11.7

Full Changelog: tox-dev/platformdirs@4.11.6...4.11.7

4.11.6

What's Changed

Full Changelog: tox-dev/platformdirs@4.11.5...4.11.6

4.11.5

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.11.4...4.11.5

4.11.4

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.8 (2026-09-08)

  • Make :func:~platformdirs.user_data_path, :func:~platformdirs.user_config_path, :func:~platformdirs.user_preference_path and :func:~platformdirs.user_applications_path return the first site entry when root is redirected by use_site_for_root under multipath, matching their site_*_path twins. They passed the whole joined list to :class:~pathlib.Path, giving one unusable path such as /xdg/a/foo:/xdg/b/foo - by :user:darrenhuai. :pr:538
  • Ignore relative paths in XDG Base Directory environment variables and use the existing platform fallback. Relative entries in $XDG_DATA_DIRS and $XDG_CONFIG_DIRS are skipped. :pr:540
  • Preserve literal percent signs in Unix user-dirs.dirs paths, including 100% complete, 100%% and %(XDG_DESKTOP_DIR)s. Continue to expand $HOME. :pr:542
  • Use the base Python installation to locate Homebrew site directories on macOS, preserving shared data, config, cache and state paths inside virtual environments. :pr:543

4.11.7 (2026-09-01)

4.11.6 (2026-09-01)

  • Give :func:~platformdirs.user_bin_dir and :func:~platformdirs.user_bin_path the use_site_for_root argument. They took none, so neither could reach the Unix redirect of root to :func:~platformdirs.site_bin_dir. :pr:537

4.11.5 (2026-08-27)

  • Give :func:~platformdirs.user_preference_dir and :func:~platformdirs.user_preference_path the same arguments as :func:~platformdirs.user_config_dir. Added without arguments in :pr:491, they could only return the unscoped base directory even though the property they wrap appends the app name and version. :pr:531
  • Make :func:~platformdirs.site_applications_path return the first entry when multipath=True, matching :func:~platformdirs.site_data_path. On Unix and macOS it passed the whole $XDG_DATA_DIRS list to :class:~pathlib.Path, giving one unusable path such as /first/applications:/second/applications. :pr:532
  • Give :func:~platformdirs.user_applications_dir, :func:~platformdirs.user_applications_path, :func:~platformdirs.site_applications_dir and :func:~platformdirs.site_applications_path the app arguments. Android scopes both applications directories to the app, so without them the functions could only return the unscoped base directory there. On the two site functions they are keyword-only, keeping multipath first positional as it has been since 4.9.0; the two user functions take their boolean options keyword-only. :pr:534

... (truncated)

Commits
  • c5ef1ed Release 4.11.8
  • 0e85d6f fix: retain Homebrew site directories inside virtual environments (#543)
  • b86a670 fix: preserve literal percent signs in user-dirs paths (#542)
  • a6791c8 fix: return one user path for root under multipath (#538)
  • 5550385 fix: ignore relative XDG base directory paths (#540)
  • a209bf8 [pre-commit.ci] pre-commit autoupdate (#541)
  • e0847a6 Release 4.11.7
  • cf226ab Release 4.11.6
  • c22544b fix: accept use_site_for_root in the bin functions (#537)
  • 7499756 [pre-commit.ci] pre-commit autoupdate (#536)
  • Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates pydantic-settings from 2.14.2 to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

Highlights

Behavior changes

  • case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
  • Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
  • Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.

New features

  • Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
  • PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
  • toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
  • Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
  • GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.

Bug fixes

  • Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
  • Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
  • Fix AliasPath on nested model fields not JSON-decoding env values (#898).
  • Fix case-insensitive matching for optional nested models (#905).
  • Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
  • Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
  • Fix Secret subclasses crashing when loaded from the environment (#920).
  • Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
  • An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
  • NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
  • GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
  • AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).

Documentation

  • Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
  • Recommend an async settings loading pattern (#908).
  • Clarify behavior when an unprefixed value is present in a dotenv file (#895).
  • Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).

What's Changed

... (truncated)

Commits
  • f725ca1 Prepare release 2.15.0 (#930)
  • 28f35c2 Bump the python-packages group with 4 updates (#929)
  • 9056db0 test: move function-local imports to the top of test modules (#927)
  • f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
  • ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
  • 798dcea Bump the python-packages group with 4 updates (#924)
  • a190041 Bump the github-actions group with 4 updates (#925)
  • 5d93332 Bump the python-packages group with 4 updates (#921)
  • d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
  • 2256a4e Bump the python-packages group with 3 updates (#915)
  • Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt's releases.

PyJWT 2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security


- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.

Fixed



- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.

Fixed




    

  • Raise the documented PyJWTError subclass instead of leaking a
    
TypeError when the exp, nbf, or iat claim decodes to a
    
non-numeric, non-string value such as a list, dict, or null.
Commits
  • c6fe464 release: prepare v2.14.0
  • f541302 style: apply Ruff formatting
  • 801cd12 fix: reject public JWK container HMAC keys
  • af8181c fix: reject empty HMAC keys from JWKs
  • ba4853a Throttle repeated PyJWKClient refreshes
  • 2798504 fix: reject DER public keys as HMAC secrets
  • 8b4e233 fix: reject loader-accepted PEM variants
  • 1f8180a fix: format JWS tests
  • cff1ac5 Fix redirect handler return annotation
  • 0a795b8 Reject redirects in PyJWKClient fetches
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.52

Release notes

Sourced from

@dependabot
build(deps): bump the compatible-updates group across 1 directory wit…
4e20004 
…h 10 updates

Bumps the compatible-updates group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [dbos](https://github.com/dbos-inc/dbos-transact-py) | `2.29.0` | `2.31.1` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.2` | `3.32.6` |
| [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.0` | `4.11.8` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.14.0` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.51` | `2.0.52` |
| [typer](https://github.com/fastapi/typer) | `0.27.0` | `0.27.2` |
| [build](https://github.com/pypa/build) | `1.5.0` | `1.6.1` |



Updates `dbos` from 2.29.0 to 2.31.1
- [Release notes](https://github.com/dbos-inc/dbos-transact-py/releases)
- [Commits](dbos-inc/dbos-transact-py@2.29.0...2.31.1)

Updates `filelock` from 3.32.2 to 3.32.6
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.2...3.32.6)

Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.2...26.3)

Updates `platformdirs` from 4.11.0 to 4.11.8
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.0...4.11.8)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `pydantic-settings` from 2.14.2 to 2.15.0
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0)

Updates `pyjwt` from 2.13.0 to 2.14.0
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.13.0...2.14.0)

Updates `sqlalchemy` from 2.0.51 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `typer` from 0.27.0 to 0.27.2
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.0...0.27.2)

Updates `build` from 1.5.0 to 1.6.1
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.5.0...1.6.1)

---
updated-dependencies:
- dependency-name: dbos
  dependency-version: 2.31.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: compatible-updates
- dependency-name: filelock
  dependency-version: 3.32.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible-updates
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: compatible-updates
- dependency-name: platformdirs
  dependency-version: 4.11.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible-updates
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible-updates
- dependency-name: pydantic-settings
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: compatible-updates
- dependency-name: pyjwt
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: compatible-updates
- dependency-name: sqlalchemy
  dependency-version: 2.0.52
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible-updates
- dependency-name: typer
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: compatible-updates
- dependency-name: build
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: compatible-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants