Skip to content

MAINT: Bump the minor-and-patch group with 8 updates - #2424

Merged
Roman Lutz (romanlutz) merged 4 commits into
mainfrom
dependabot/uv/minor-and-patch-ce3ad753b6
Aug 19, 2026
Merged

MAINT: Bump the minor-and-patch group with 8 updates#2424
Roman Lutz (romanlutz) merged 4 commits into
mainfrom
dependabot/uv/minor-and-patch-ce3ad753b6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 8 updates:

Package From To
azure-keyvault-secrets 4.11.0 4.11.1
pypdf 6.15.0 6.16.1
sqlalchemy 2.0.51 2.0.52
transformers 5.14.1 5.15.0
pyarrow 25.0.0 25.0.1
pre-commit 4.6.1 4.6.2
pytest-rerunfailures 16.4 16.5
ruff 0.16.2 0.16.3

Note

ty remains below 0.0.70 because newer releases enable unsound-return-statement under the repository's strict configuration. The typing findings will be fixed and the upper bound removed in a follow-up change.

Updates azure-keyvault-secrets from 4.11.0 to 4.11.1

Release notes

Sourced from azure-keyvault-secrets's releases.

azure-keyvault-secrets_4.11.1

4.11.1 (2026-08-12)

Bugs Fixed

  • Fixed a replay bug in the challenge authentication policy where a request copy stashed on the shared policy instance was never cleared, allowing one request's method, URL, and body to leak into a later, unrelated request made by the same client (for example, after an Entra ID Continuous Access Evaluation challenge). The original request is now stored per-request instead of on the policy instance. This mirrors the fix already applied to azure-keyvault-keys and azure-keyvault-administration in #47742.
Commits
  • 63f9d76 [KeyVault] Fix Challenge Auth replay bug in secrets, certificates (#48537)
  • 8050793 Don't use sparse chekout for private repos (#47776)
  • 19001b1 Update helper function to print nested exception details. (#48520)
  • c9e6a74 Enable CFSClean network isolation for Python pipelines (#48483)
  • 23a9d53 [Storage] Bump versions after STG 104 beta release (#48528)
  • 0c2dca4 Sync eng/common directory with azure-sdk-tools for PR 16685 (#48522)
  • fab4548 [AutoPR azure-mgmt-fabric]-generated-from-SDK Generation - Python-6671798 (#4...
  • 833b8c5 [AutoPR azure-mgmt-netapp]-generated-from-SDK Generation - Python-6620664 (#4...
  • 529ae05 [AgentServer] Set StateStore release dates (#48532)
  • 9a7a054 Reapply "[AgentServer] Remove task metadata in favor of State Store (#48416)"...
  • Additional commits viewable in compare view

Updates pypdf from 6.15.0 to 6.16.1

Release notes

Sourced from pypdf's releases.

Version 6.16.1, 2026-08-14

What's new

Security (SEC)

Full Changelog

Version 6.16.0, 2026-08-13

What's new

Security (SEC)

New Features (ENH)

  • AppearanceStream: Allow arbitrary rotations and apply rotations for annotation appearance streams (#3917) by @​PJBrs
  • AppearanceStream: Consider more encodings for Type1 core fonts (#3905) by @​PJBrs

Performance Improvements (PI)

  • Build /ToUnicode source-code bytes directly in parse_bfrange (#3952) by @​Anai-Guo

Bug Fixes (BUG)

Robustness (ROB)

  • AppearanceStream: Only escape parentheses for 8-bit fonts (#3961) by @​PJBrs
  • Recover the trailer from a cross-reference stream when rebuilding the xref (#3950) by @​Anai-Guo

Maintenance (MAINT)

  • Deduplicate CatalogAttributes and CatalogDictionary (#3940) by @​j-t-1

Code Style (STY)

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.16.1, 2026-08-14

Security (SEC)

  • Limit iterations for outline retrieval and XForm text extraction (#3966)

Full Changelog

Version 6.16.0, 2026-08-13

Security (SEC)

  • Detect cycles in TreeObject.insert_child (#3964)

New Features (ENH)

  • AppearanceStream: Allow arbitrary rotations and apply rotations for annotation appearance streams (#3917)
  • AppearanceStream: Consider more encodings for Type1 core fonts (#3905)

Performance Improvements (PI)

  • Build /ToUnicode source-code bytes directly in parse_bfrange (#3952)

Bug Fixes (BUG)

  • Preserve internal Link annotations when appending/merging (#3953) (#3954)
  • Fix false inline image end markers (#3922)
  • Reject typeless non-page /Kids entries in strict mode (#3955)
  • Apply character spacing (Tc) per glyph in layout-mode extraction (#3951)
  • Keep the Adobe CMYK inversion when an explicit /Decode is present (#3943)

Robustness (ROB)

  • AppearanceStream: Only escape parentheses for 8-bit fonts (#3961)
  • Recover the trailer from a cross-reference stream when rebuilding the xref (#3950)

Maintenance (MAINT)

  • Deduplicate CatalogAttributes and CatalogDictionary (#3940)

Code Style (STY)

  • Type pages as a Sequence rather than a list (#3957)

Full Changelog

Commits
  • 1bce7a7 REL: 6.16.1
  • d91ab70 SEC: Limit iterations for outline retrieval and XForm text extraction (#3966)
  • 2b60c99 REL: 6.16.0
  • c9ba557 SEC: Detect cycles in TreeObject.insert_child (#3964)
  • c8e1c72 BUG: Always define PdfWriter._reader (#3960)
  • 3a0f355 ROB: Detect cyclic pages in _get_page_in_node (#3962)
  • 20512f4 ROB: AppearanceStream: Only escape parentheses for 8-bit fonts (#3961)
  • 34ccd14 MAINT: Deduplicate CatalogAttributes and CatalogDictionary (#3940)
  • 5b8f19e ENH: AppearanceStream: Allow arbitrary rotations and apply rotations for anno...
  • 53bfbc6 PI: Build /ToUnicode source-code bytes directly in parse_bfrange (#3952)
  • Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

  • [platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

    References: #13477

orm

  • [orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

    References: #13439

  • [orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

    References: #13485

  • [orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

Updates transformers from 5.14.1 to 5.15.0

Release notes

Sourced from transformers's releases.

Release: v5.15.0

Release v5.15.0

New Model additions

Meta Muse Glimmer

Muse Glimmer, released today, is Meta’s new multimodal model, especially designed for agentic use cases. Distilled from Muse to 30B parameters, and released under the Apache 2.0 license, it can be deployed to local setups for privacy-aware applications such as coding, document analysis, personal assistants, Claw- or Hermes-like setups.

Muse Glimmer is a dense 30B parameter model consisting of:

  • 2B ViT-style encoder for vision (Perception Encoder)
  • 28B parameter text decoder

We're covering it in the following blogpost: http://hf.co/blog/muse-glimmer


GraniteMoeSWA & GraniteSWA

Links: Documentation

Links: Documentation


A.X-K1 & A.X-K2

Links: Documentation

Links: Documentation


Cosmos3 Edge

Links: Documentation

... (truncated)

Commits
  • 5eddc12 Release: v5.15.0
  • 7bfaf47 Add MuseGlimmer (#47867)
  • 4bd3150 Revert "Fix CodeLlama tokenizer dropping leading whitespace on decode (#47488...
  • fd12552 Fix cached_files silently returning stale file on read-only filesystem (EROFS...
  • e8ea728 Fix PhimoeIntegrationTest (#46539)
  • 9436284 make examples under doc device agnostic (#47812)
  • 87b0711 cancel deterministic for XPU in gemma4 tests (#47790)
  • 5d6dff8 Serialize post-mlinter-review after post-link to avoid PR description race (#...
  • 96869d7 Use content hash for mlinter review deduplication (#47830)
  • e1d50b2 Add new args in auto-docstring (#47737)
  • Additional commits viewable in compare view

Updates pyarrow from 25.0.0 to 25.0.1

Release notes

Sourced from pyarrow's releases.

Apache Arrow 25.0.1

Release Notes URL: https://arrow.apache.org/release/25.0.1.html

Apache Arrow 25.0.1 RC1

Release Notes: Release Candidate: 25.0.1 RC1

Apache Arrow 25.0.1 RC0

Release Notes: Release Candidate: 25.0.1 RC0

Commits

Updates pre-commit from 4.6.1 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

Commits

Updates pytest-rerunfailures from 16.4 to 16.5

Changelog

Sourced from pytest-rerunfailures's changelog.

16.5 (2026-08-13)

Features ++++++++

  • Add --max-suite-reruns option to cap the total number of reruns across the entire test suite. Once the limit is reached, no further reruns occur regardless of per-test --reruns or @pytest.mark.flaky settings. ([#298](https://github.com/pytest-dev/pytest-rerunfailures/issues/298) <https://github.com/pytest-dev/pytest-rerunfailures/issues/298>_)

Bug Fixes +++++++++

  • Create a new test class instance for each rerun. Previously the instance of the failed attempt was reused, so state stored on self leaked into the rerun and broke test isolation. Fixtures cached at class scope or higher are still not re-executed. ([#268](https://github.com/pytest-dev/pytest-rerunfailures/issues/268) <https://github.com/pytest-dev/pytest-rerunfailures/issues/268>_)
  • Prevent a rerun when a fixture teardown raises an error matching --rerun-except. Previously only the error from the current test stage was considered, so a --rerun-except-matching error raised during teardown was ignored and the test was rerun anyway. ([#270](https://github.com/pytest-dev/pytest-rerunfailures/issues/270) <https://github.com/pytest-dev/pytest-rerunfailures/issues/270>_)
Commits
  • 88291f7 Preparing release 16.5
  • 81141e0 Switch change log management to towncrier (#341)
  • 6df6fb5 Create a fresh test class instance for each rerun (#340)
  • 0440e21 fix: prevent rerun when teardown error matches --rerun-except (#338)
  • 5fc2d79 feat: add --max-suite-reruns option to cap total reruns across suite (#332)
  • 5fc495a Bump actions/setup-python from 6 to 7 in the actions group (#339)
  • 1087cc2 Back to development: 16.5
  • See full diff in compare view

Updates ruff from 0.16.2 to 0.16.3

Release notes

Sourced from ruff's releases.

0.16.3

Release Notes

Released on 2026-08-13.

Preview features

  • [pylint] Fix false negatives on negative numbers (PLR6104) (#27251)
  • [pyupgrade] Add rule to replace while 1 with while True (UP048) (#27190)

Bug fixes

  • [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#27687)
  • [pylint] Allow continue in finally on Python 3.8 (#27626)
  • [pylint] Fix PLE1307 false positive with bools (#27651)
  • [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#27560)
  • [pylint] Improve handling of concatenated strings (PLE1300) (#27659)

Rule changes

  • [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#27527)

Performance

  • Enable PGO for Linux x86-64 Ruff releases (#27570)
  • Enable PGO for Linux ARM64 Ruff releases (#27574)
  • Enable PGO for Windows x86-64 Ruff releases (#27573)
  • Enable PGO for macOS ARM64 Ruff releases (#27572)
  • Reduce Expr size to 64 bytes (#27591)

CLI

  • Hyperlink rule codes in ruff check --statistics output (#27646)

Documentation

  • [ruff] Also suggest asyncio.TaskGroup (RUF006) (#27461)

Other changes

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.3

Released on 2026-08-13.

Preview features

  • [pylint] Fix false negatives on negative numbers (PLR6104) (#27251)
  • [pyupgrade] Add rule to replace while 1 with while True (UP048) (#27190)

Bug fixes

  • [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#27687)
  • [pylint] Allow continue in finally on Python 3.8 (#27626)
  • [pylint] Fix PLE1307 false positive with bools (#27651)
  • [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#27560)
  • [pylint] Improve handling of concatenated strings (PLE1300) (#27659)

Rule changes

  • [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#27527)

Performance

  • Enable PGO for Linux x86-64 Ruff releases (#27570)
  • Enable PGO for Linux ARM64 Ruff releases (#27574)
  • Enable PGO for Windows x86-64 Ruff releases (#27573)
  • Enable PGO for macOS ARM64 Ruff releases (#27572)
  • Reduce Expr size to 64 bytes (#27591)

CLI

  • Hyperlink rule codes in ruff check --statistics output (#27646)

Documentation

  • [ruff] Also suggest asyncio.TaskGroup (RUF006) (#27461)

Other changes

Contributors

... (truncated)

Commits
  • b0e4702 Bump 0.16.3 (#27723)
  • ecdd401 [ty] Separate script and uv modules from project metadata (#27720)
  • 1263524 [ty] Simplify display implementations with std::fmt::from_fn (#27718)
  • 59196ba [ty] Unify polarity-aware relation construction (#27707)
  • b8c5e73 [ty] Disable CodSpeed cycle estimation for instrumented benchmarks (#27706)
  • 2b0d210 [ty] Centralize matched argument relations (#27705)
  • a9130f3 [pyupgrade] Add rule to replace while 1 with while True (while-one, `...
  • c64c7d6 [ty] Model try exception flow with operation checkpoints (#27471)
  • 9dea5ef [ty] Avoid deriving sequents for typevars with concrete bounds (#27587)
  • 9798e88 [ty] Preserve enum exhaustiveness with custom missing methods (#27700)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [azure-keyvault-secrets](https://github.com/Azure/azure-sdk-for-python) | `4.11.0` | `4.11.1` |
| [pypdf](https://github.com/py-pdf/pypdf) | `6.15.0` | `6.16.1` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.51` | `2.0.52` |
| [transformers](https://github.com/huggingface/transformers) | `5.14.1` | `5.15.0` |
| [pyarrow](https://github.com/apache/arrow) | `25.0.0` | `25.0.1` |
| [litellm](https://github.com/BerriAI/litellm) | `1.91.5` | `1.97.0` |
| [ty](https://github.com/astral-sh/ty) | `0.0.69` | `0.0.72` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.1` | `4.6.2` |
| [pytest-rerunfailures](https://github.com/pytest-dev/pytest-rerunfailures) | `16.4` | `16.5` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.2` | `0.16.3` |


Updates `azure-keyvault-secrets` from 4.11.0 to 4.11.1
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](Azure/azure-sdk-for-python@azure-keyvault-secrets_4.11.0...azure-keyvault-secrets_4.11.1)

Updates `pypdf` from 6.15.0 to 6.16.1
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.15.0...6.16.1)

Updates `sqlalchemy` from 2.0.51 to 2.0.52
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `transformers` from 5.14.1 to 5.15.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.14.1...v5.15.0)

Updates `pyarrow` from 25.0.0 to 25.0.1
- [Release notes](https://github.com/apache/arrow/releases)
- [Commits](apache/arrow@apache-arrow-25.0.0...apache-arrow-25.0.1)

Updates `litellm` from 1.91.5 to 1.97.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.91.5...v1.97.0)

Updates `ty` from 0.0.69 to 0.0.72
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.69...0.0.72)

Updates `pre-commit` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.1...v4.6.2)

Updates `pytest-rerunfailures` from 16.4 to 16.5
- [Changelog](https://github.com/pytest-dev/pytest-rerunfailures/blob/master/CHANGES.rst)
- [Commits](pytest-dev/pytest-rerunfailures@16.4...16.5)

Updates `ruff` from 0.16.2 to 0.16.3
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.2...0.16.3)

---
updated-dependencies:
- dependency-name: azure-keyvault-secrets
  dependency-version: 4.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pypdf
  dependency-version: 6.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sqlalchemy
  dependency-version: 2.0.52
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: transformers
  dependency-version: 5.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pyarrow
  dependency-version: 25.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: litellm
  dependency-version: 1.97.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ty
  dependency-version: 0.0.72
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pytest-rerunfailures
  dependency-version: '16.5'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ruff
  dependency-version: 0.16.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 19, 2026
Preserve the universal wheel required by the supported platforms while retaining the other dependency updates.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@romanlutz Roman Lutz (romanlutz) changed the title MAINT: Bump the minor-and-patch group with 10 updates MAINT: Bump the minor-and-patch group with 9 updates Aug 19, 2026
Copilot AI and others added 2 commits August 19, 2026 10:31
Avoid enabling the new unsound-return-statement rule until the existing typing findings can be addressed separately.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@romanlutz Roman Lutz (romanlutz) changed the title MAINT: Bump the minor-and-patch group with 9 updates MAINT: Bump the minor-and-patch group with 8 updates Aug 19, 2026
@romanlutz
Roman Lutz (romanlutz) added this pull request to the merge queue Aug 19, 2026
Merged via the queue into main with commit b99d9ec Aug 19, 2026
49 checks passed
@romanlutz
Roman Lutz (romanlutz) deleted the dependabot/uv/minor-and-patch-ce3ad753b6 branch August 19, 2026 19:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants