Skip to content

Bump the all-minor-and-patch-dependency-updates group across 1 directory with 7 updates#137

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/uv/all-minor-and-patch-dependency-updates-0b0680dd28
Open

Bump the all-minor-and-patch-dependency-updates group across 1 directory with 7 updates#137
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/uv/all-minor-and-patch-dependency-updates-0b0680dd28

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 1, 2026

Bumps the all-minor-and-patch-dependency-updates group with 7 updates in the / directory:

Package From To
cbor2 5.8.0 5.9.0
click 8.1.8 8.3.1
pillow 12.1.1 12.2.0
ray 2.53.0 2.54.1
bandit 1.9.3 1.9.4
build 1.4.0 1.4.2
pytest-cov 7.0.0 7.1.0

Updates cbor2 from 5.8.0 to 5.9.0

Release notes

Sourced from cbor2's releases.

5.9.0

  • Added the max_depth decoder parameter to limit the maximum allowed nesting level of containers, with a default value of 400 levels (CVE-2026-26209)
  • Changed the default read_size from 4096 to 1 for backwards compatibility. The buffered reads introduced in 5.8.0 could cause issues when code needs to access the stream position after decoding. Users can opt-in to faster decoding by passing read_size=4096 when they don't need to access the stream directly after decoding. Added a direct read path for read_size=1 to avoid buffer management overhead. (#275; PR by @​andreer)
  • Fixed C encoder not respecting string referencing when encoding string-type datetimes (tag 0) (#254)
  • Fixed a missed check for an exception in the C implementation of CBOREncoder.encode_shared() (#287)
  • Fixed two reference/memory leaks in the C extension's long string decoder (#290 PR by @​killiancowan82)
  • Fixed C decoder ignoring the str_errors setting when decoding strings, and improved string decoding performance by using stack allocation for small strings and eliminating unnecessary conditionals. Benchmarks show 9-17% faster deserialization. (#255; PR by @​andreer)
Commits
  • 93c5988 Bumped up the version
  • d903d62 Updated the max_depth default value in the C function signature
  • 2b53b28 Stack allocate small strings (#270)
  • a7ac10d Upped the max_depth value to 400
  • 54c8ed5 Fixed reference/memory leaks in decode_definite_long_string (#290)
  • a8d92dc [pre-commit.ci] pre-commit autoupdate (#289)
  • c91aa00 [pre-commit.ci] pre-commit autoupdate (#288)
  • 53521e7 Fixed ssize_t to Py_ssize_t
  • 94e0d21 Added missing Python counterpart for max_depth
  • bcb6cea Added the max_depth decoder parameter
  • Additional commits viewable in compare view

Updates click from 8.1.8 to 8.3.1

Release notes

Sourced from click's releases.

8.3.1

This is the Click 8.3.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.3.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-3-1 Milestone: https://github.com/pallets/click/milestone/28

  • Don't discard pager arguments by correctly using subprocess.Popen. #3039 #3055
  • Replace Sentinel.UNSET default values by None as they're passed through the Context.invoke() method. #3066 #3065 #3068
  • Fix conversion of Sentinel.UNSET happening too early, which caused incorrect behavior for multiple parameters using the same name. #3071 #3079
  • Fix rendering when prompt and confirm parameter prompt_suffix is empty. #3019 #3021
  • When Sentinel.UNSET is found during parsing, it will skip calls to type_cast_value. #3069 #3090
  • Hide Sentinel.UNSET values as None when looking up for other parameters through the context inside parameter callbacks. #3136 #3137

8.3.0

This is the Click 8.3.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.3.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-3-0 Milestone https://github.com/pallets/click/milestone/27

  • Improved flag option handling: Reworked the relationship between flag_value and default parameters for better consistency:

    • The default parameter value is now preserved as-is and passed directly to CLI functions (no more unexpected transformations)
    • Exception: flag options with default=True maintain backward compatibility by defaulting to their flag_value
    • The default parameter can now be any type (bool, None, etc.)
    • Fixes inconsistencies reported in: #1992 #2514 #2610 #3024 #3030

  • Allow default to be set on Argument for nargs = -1. #2164 #3030

  • Show correct auto complete value for nargs option in combination with flag option #2813

  • Show correct auto complete value for nargs option in combination with flag option #2813

  • Fix handling of quoted and escaped parameters in Fish autocompletion. #2995 #3013

  • Lazily import shutil. #3023

  • Properly forward exception information to resources registered with click.core.Context.with_resource(). #2447 #3058

  • Fix regression related to EOF handling in CliRunner. #2939 #2940

8.2.2

This is the Click 8.2.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.2.2/

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.3.1

Released 2025-11-15

  • Don't discard pager arguments by correctly using subprocess.Popen. :issue:3039 :pr:3055
  • Replace Sentinel.UNSET default values by None as they're passed through the Context.invoke() method. :issue:3066 :issue:3065 :pr:3068
  • Fix conversion of Sentinel.UNSET happening too early, which caused incorrect behavior for multiple parameters using the same name. :issue:3071 :pr:3079
  • Hide Sentinel.UNSET values as None when looking up for other parameters through the context inside parameter callbacks. :issue:3136 :pr:3137
  • Fix rendering when prompt and confirm parameter prompt_suffix is empty. :issue:3019 :pr:3021
  • When Sentinel.UNSET is found during parsing, it will skip calls to type_cast_value. :issue:3069 :pr:3090

Version 8.3.0

Released 2025-09-17

  • Improved flag option handling: Reworked the relationship between flag_value and default parameters for better consistency:

    • The default parameter value is now preserved as-is and passed directly to CLI functions (no more unexpected transformations)
    • Exception: flag options with default=True maintain backward compatibility by defaulting to their flag_value
    • The default parameter can now be any type (bool, None, etc.)
    • Fixes inconsistencies reported in: :issue:1992 :issue:2514 :issue:2610 :issue:3024 :pr:3030

  • Allow default to be set on Argument for nargs = -1. :issue:2164 :pr:3030

  • Show correct auto complete value for nargs option in combination with flag option :issue:2813

  • Fix handling of quoted and escaped parameters in Fish autocompletion. :issue:2995 :pr:3013

  • Lazily import shutil. :pr:3023

  • Properly forward exception information to resources registered with click.core.Context.with_resource(). :issue:2447 :pr:3058

  • Fix regression related to EOF handling in CliRunner. :issue:2939 :pr:2940

Version 8.2.2

Released 2025-07-31

  • Fix reconciliation of default, flag_value and type parameters for flag options, as well as parsing and normalization of environment variables.

... (truncated)

Commits
  • 1d038f2 release version 8.3.1
  • 03f3889 Fix Ruff UP038 warning (#3141)
  • 3867781 Fix Ruff UP038 warning
  • b91bb95 Provide altered context to callbacks to hide UNSET values as None (#3137)
  • 437e1e3 Temporarily provide a fake context to the callback to hide UNSET values as ...
  • ea70da4 Don't test using a file in docs/ (#3102)
  • e27b307 Make uv run --all-extras pyright --verifytypes click pass (#3072)
  • a92c573 Fix test_edit to work with BSD sed (#3129)
  • bd131e1 Fix test_edit to work with BSD sed
  • 0b5c6b7 Add Best practices section (#3127)
  • Additional commits viewable in compare view

Updates pillow from 12.1.1 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Dependencies

Testing

Other changes

... (truncated)

Commits

Updates ray from 2.53.0 to 2.54.1

Release notes

Sourced from ray's releases.

Ray-2.54.1

Ray Data

🔨 Fixes

  • Disable hanging issue detection (#61895) — The hanging issue detector was making blocking calls to the Ray State API, which could cause the scheduling loop to block and severely degrade pipeline performance. The detector is disabled in this patch release until the blocking calls are fixed.

Ray-2.54.0

Ray Data

🎉 New Features

  • Add checkpointing support to Ray Data (#59409)
  • Compute Expressions: list operations (#59346), fixed-size arrays (#58741), string padding (#59552), logarithmic (#59549), trigonometric (#59712), arithmetic (#59678), and rounding (#59295)
  • Add sql_params support to read_sql (#60030)
  • Add AsList aggregation (#59920)
  • Support CountDistinct aggregate (#59030)
  • Add credential provider abstraction for Databricks UC datasource (#60457)
  • Support callable classes for UDFExpr (#56725)
  • Add autoscaler metrics to Data Dashboard (#60472)
  • Add optional filesystem parameter to download expression (#60677)
  • Allow specifying partitioning style or flavor in write_parquet() (#59102)
  • New cluster autoscaler enabled by default (#60474)

💫 Enhancements

  • Improve numerical stability in scalers by handling near-zero values (#60488)
  • Export dataset operator output schema to event logger (#60086)
  • Iceberg: add retry policy for Storage + Catalog writes (#60620)
  • Iceberg: remove calls to Catalog Table in write tasks (#60476)
  • Expose logical operators and rules via package exports (#60297, #60296)
  • Demote Sort from requiring preserve_order (#60555)
  • Improve appearance of repr(dataset) (#59631)
  • Allow configuring DefaultClusterAutoscalerV2 thresholds via env vars (#60133)
  • Use Arrow IPC for Arrow Schema serialization/deserialization (#60195)
  • Store _source_paths in object store to prevent excessive spilling during read task serialization (#59999)
  • Add more shuffle fusion rules (#59985)
  • Enable and tune DownstreamCapacityBackpressurePolicy (#59753)
  • Enable concurrency cap backpressure with tuning (#59392)
  • Set default actor pool scale up threshold to 1.75 (#59512)
  • Don't downscale actors if the operator hasn't received any inputs (#59883)
  • Don't reserve GPU budget for non-GPU tasks (#59789)
  • Only return selected data columns in hive-partitioned Parquet files (#60236)
  • Ordered + FIFO bundle queue (#60228)
  • Add node_id, pid, attempt number for hanging tasks (#59793)
  • Revise resource allocator task scheduling to factor in pending task outputs (#60639)
  • Track block serialization time (#60574)
  • Use metrics from OpRuntimeMetrics for progress (#60304)
  • Tabular form for streaming executor op metrics (#59774)
  • Info-log cluster scale-up decisions (#60357)

... (truncated)

Commits

Updates bandit from 1.9.3 to 1.9.4

Release notes

Sourced from bandit's releases.

1.9.4

What's Changed

New Contributors

Full Changelog: PyCQA/bandit@1.9.3...1.9.4

Commits
  • 92ae8b8 Fix B106 reporting wrong line number on multiline function calls (#1360)
  • c8c8a55 Lower version guard in check_ast_node to Python 3.12 (#1355)
  • 8f2f928 Fix B615 false positive when revision is set via variable (#1358)
  • e27493f Include filename in nosec 'no failed test' warning (#1363)
  • b69b336 Fix B613 crash when reading from stdin (#1361)
  • e418b79 Bump docker/build-push-action from 6.18.0 to 6.19.2 (#1357)
  • ff646fd Bump docker/login-action from 3.6.0 to 3.7.0 (#1353)
  • c0def6c chore: fixed some typos in comments (#1351)
  • See full diff in compare view

Updates build from 1.4.0 to 1.4.2

Release notes

Sourced from build's releases.

1.4.2

What's Changed

New Contributors

Full Changelog: pypa/build@1.4.1...1.4.2

1.4.1

What's Changed

Full Changelog: pypa/build@1.4.0...1.4.1

Changelog

Sourced from build's changelog.

#################### 1.4.2 (2026-03-25) ####################

Bugfixes

  • Ensure the uv installer uses the current version of Python, avoiding an issue if UV_PYTHON is set, for example. (:issue:977)
  • Fix _has_valid_outer_pip returning True when pip is missing, causing build to try using a non-existent pip instead of falling back to virtualenv. (:issue:1003)

#################### 1.4.1 (2026-03-24) ####################

Features

  • Allow setting build constraints - by :user:gaborbernat (:issue:963)
  • Automate releases with pre-release workflow and trusted publishing - by :user:gaborbernat (:issue:991)

Documentation

  • Fix documentation grammar and typos (:issue:979)
  • Reorganize documentation using Diataxis framework - by :user:gaborbernat (:issue:988)
  • Document release process and workflow security practices in contributing guide (:issue:991)

Miscellaneous

  • :issue:991

Bugfixes

  • Fix pip hack workaround - by :user:gaborbernat (:issue:980)

#################### 1.4.0 (2026-01-08) ####################

  • Add --quiet flag (:pr:947)
  • Add option to dump PEP 517 metadata with --metadata (:pr:940, :pr:943)

... (truncated)

Commits
  • 7b7ae07 chore: prepare for 1.4.2
  • 17f3b57 fix: release changelog issue (#1006)
  • b945752 fix: _has_valid_outer_pip when pip is missing (#1003)
  • 74ae997 🔧 fix(towncrier): match docstrfmt RST formatting expectations (#1002)
  • 3786929 🐛 fix(release): detect pre-commit environment inconsistencies (#1001)
  • 737bdb7 fix(uv): always pass the python to use (#996)
  • bd88956 chore: prepare for 1.4.1
  • 062e7e2 🐛 fix(deps): add pre-commit to release dependency group (#1000)
  • 3d8e260 🐛 fix(ci): resolve pre-release auth failure and change detection (#999)
  • f2a2610 chore: fix fix job (#997)
  • Additional commits viewable in compare view

Updates pytest-cov from 7.0.0 to 7.1.0

Changelog

Sourced from pytest-cov's changelog.

7.1.0 (2026-03-21)

  • Fixed total coverage computation to always be consistent, regardless of reporting settings. Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on reporting options. See [#641](https://github.com/pytest-dev/pytest-cov/issues/641) <https://github.com/pytest-dev/pytest-cov/issues/641>_.

  • Improve handling of ResourceWarning from sqlite3.

    The plugin adds warning filter for sqlite3 ResourceWarning unclosed database (since 6.2.0). It checks if there is already existing plugin for this message by comparing filter regular expression. When filter is specified on command line the message is escaped and does not match an expected message. A check for an escaped regular expression is added to handle this case.

    With this fix one can suppress ResourceWarning from sqlite3 from command line::

    pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...

  • Various improvements to documentation. Contributed by Art Pelling in [#718](https://github.com/pytest-dev/pytest-cov/issues/718) <https://github.com/pytest-dev/pytest-cov/pull/718>_ and "vivodi" in [#738](https://github.com/pytest-dev/pytest-cov/issues/738) <https://github.com/pytest-dev/pytest-cov/pull/738>. Also closed [#736](https://github.com/pytest-dev/pytest-cov/issues/736) <https://github.com/pytest-dev/pytest-cov/issues/736>.

  • Fixed some assertions in tests. Contributed by in Markéta Machová in [#722](https://github.com/pytest-dev/pytest-cov/issues/722) <https://github.com/pytest-dev/pytest-cov/pull/722>_.

  • Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

Commits
  • 66c8a52 Bump version: 7.0.0 → 7.1.0
  • f707662 Make the examples use pypy 3.11.
  • 6049a78 Make context test use the old ctracer (seems the new sysmon tracer behaves di...
  • 8ebf20b Update changelog.
  • 861d30e Remove the backup context manager - shouldn't be needed since coverage 5.0, ...
  • fd4c956 Pass the precision on the nulled total (seems that there's some caching goion...
  • 78c9c4e Only run the 3.9 on older deps.
  • 4849a92 Punctuation.
  • 197c35e Update changelog and hopefully I don't forget to publish release again :))
  • 14dc1c9 Update examples to use 3.11 and make the adhoc layout example look a bit more...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the all-minor-and-patch-dependency-updates group across 1 direct…
669fdf5 
…ory with 7 updates

Bumps the all-minor-and-patch-dependency-updates group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cbor2](https://github.com/agronholm/cbor2) | `5.8.0` | `5.9.0` |
| [click](https://github.com/pallets/click) | `8.1.8` | `8.3.1` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.1.1` | `12.2.0` |
| [ray](https://github.com/ray-project/ray) | `2.53.0` | `2.54.1` |
| [bandit](https://github.com/PyCQA/bandit) | `1.9.3` | `1.9.4` |
| [build](https://github.com/pypa/build) | `1.4.0` | `1.4.2` |
| [pytest-cov](https://github.com/pytest-dev/pytest-cov) | `7.0.0` | `7.1.0` |



Updates `cbor2` from 5.8.0 to 5.9.0
- [Release notes](https://github.com/agronholm/cbor2/releases)
- [Commits](agronholm/cbor2@5.8.0...5.9.0)

Updates `click` from 8.1.8 to 8.3.1
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.rst)
- [Commits](pallets/click@8.1.8...8.3.1)

Updates `pillow` from 12.1.1 to 12.2.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.1.1...12.2.0)

Updates `ray` from 2.53.0 to 2.54.1
- [Release notes](https://github.com/ray-project/ray/releases)
- [Commits](ray-project/ray@ray-2.53.0...ray-2.54.1)

Updates `bandit` from 1.9.3 to 1.9.4
- [Release notes](https://github.com/PyCQA/bandit/releases)
- [Commits](PyCQA/bandit@1.9.3...1.9.4)

Updates `build` from 1.4.0 to 1.4.2
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.4.0...1.4.2)

Updates `pytest-cov` from 7.0.0 to 7.1.0
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v7.0.0...v7.1.0)

---
updated-dependencies:
- dependency-name: cbor2
  dependency-version: 5.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: click
  dependency-version: 8.3.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: pillow
  dependency-version: 12.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: ray
  dependency-version: 2.54.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: bandit
  dependency-version: 1.9.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: build
  dependency-version: 1.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-minor-and-patch-dependency-updates
- dependency-name: pytest-cov
  dependency-version: 7.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-minor-and-patch-dependency-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Apr 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants