Skip to content

chore(deps): Bump the python group with 4 updates - #11

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-4bad9f41dd
Closed

chore(deps): Bump the python group with 4 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-4bad9f41dd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the python group with 4 updates: sqlalchemy, schemathesis, zizmor and uv-build.

Updates sqlalchemy from 2.1.6 to 2.1.8

Release notes

Sourced from sqlalchemy's releases.

2.1.8

Released: November 3, 2026

general

  • [general] [change] All files published to PyPI for a release, including the source distribution as well as all wheels, are now uploaded using PyPI's trusted publishing mechanism from SQLAlchemy's GitHub Actions workflow, and include a PEP 740 attestation, so that every file in a release carries provenance information. Previously, the source distribution and some wheels were uploaded without an attestation, which caused PyPI to display provenance warnings for recent releases.

    This change is also backported to: 2.0.57

    References: #13759

2.1.7

Released: November 3, 2026

orm

  • [orm] [feature] Added _orm.SessionTransaction.connections and _orm.SessionTransaction.bound_connection(), which return the connections a _orm.SessionTransaction has already acquired, without acquiring a new one. This allows, for example, checking whether any connection in the transaction has been invalidated before emitting further SQL. A SAVEPOINT transaction returned by _orm.Session.begin_nested() reports only the connections used within that SAVEPOINT; the root transaction returned by _orm.Session.get_transaction() reports all connections. The same accessors are available on _asyncio.AsyncSessionTransaction, returning _asyncio.AsyncConnection objects. Pull request courtesy Artur Shiriev.

    References: #13685

  • [orm] [bug] An informative InvalidRequestError is now raised when more than one PropComparator.of_type() loader option is applied along the same relationship using targets of differing classes, such as two _orm.aliased() constructs against different subclasses, which previously failed with a bare AssertionError during compilation. These options can't be combined since each target brings its own aliased copy of the base table; to load multiple subclasses along a single relationship, a single _orm.with_polymorphic() object that includes all of the target classes should be used.

... (truncated)

Commits

Updates schemathesis from 4.32.7 to 4.33.1

Release notes

Sourced from schemathesis's releases.

Release 4.33.1

🐛 Fixed

gRPC

  • Raw ModuleNotFoundError from schemathesis.grpc.from_path and the pytest plugin without the grpc extra.
  • gRPC services in files another package imports skipped silently and unselectable with --include-name.
  • expected-statuses rejecting gRPC status names such as UNAVAILABLE.
  • gRPC responses, output and reports showing HTTP status codes instead of gRPC statuses.
  • response.json() failing on gRPC responses in custom checks.
  • Unclear errors from case.as_curl_command() and case.as_transport_kwargs() on gRPC cases.
  • --auth-wfc and --report wfc silently misbehaving with gRPC schemas.
  • connect-go request decoding failures not reported as ST119.
  • gRPC Channelz, CSDS and health services tested as part of the API.
  • Coverage phase for gRPC skipping later oneof branches, non-finite floats and length boundaries.
  • gRPC values violating empty protovalidate ranges such as gt: 5, lt: 5.
  • Coverage phase crash on gRPC messages whose required oneof refers to itself.
  • gRPC UNAVAILABLE response times inflated by a server reachability check.
  • gRPC connection errors hiding details for HTTP/1 servers and missing client certificates.
  • gRPC TLS failures reported as connection failures on grpcio 1.72 to 1.76.
  • Misleading gRPC reflection errors for rejected credentials, timeouts and servers without user services.

st replay

  • st replay resending recorded ids for inferred links that pick an item from a list response.
  • st replay resending recorded GraphQL ids instead of taking them again from earlier responses.
  • st replay resending recorded gRPC values instead of taking them again from earlier responses.
  • st replay sending masked gRPC metadata instead of credentials from -H or config.

Stateful testing

  • Missing inferred stateful links for resources whose schemas reference $defs under a nested $id.
  • Explicit links in path items from external files not selected and duplicated by inference.
  • Stateful reproductions omitting earlier writes to the same resource, such as a preceding DELETE.
  • st fuzz and stateful testing counting requests unanswered after an API outage as errored.

Schema loading

  • Schema error for security schemes defined through a chain of $refs.
  • Missing parameters when a cross-file $ref chain repeats the same pointer in different files.
  • No API operations found when a path item $ref points to another $ref.
  • Traceback when loading descriptor sets with other extensions, or non-UTF-8 schema files.

Data generation

  • Crash in the examples phase on $ref Example Objects inside a schema's examples map.
  • Fuzzing failing the filter_too_much health check when ids reused from responses contain /.
  • RecursionError during generation for self-referencing arrays with prefixItems or contains.
  • False positive positive_data_acceptance for dependentRequired objects behind $ref in coverage. #5898

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.33.1 - 2026-11-04

🐛 Fixed

gRPC

  • Raw ModuleNotFoundError from schemathesis.grpc.from_path and the pytest plugin without the grpc extra.
  • gRPC services in files another package imports skipped silently and unselectable with --include-name.
  • expected-statuses rejecting gRPC status names such as UNAVAILABLE.
  • gRPC responses, output and reports showing HTTP status codes instead of gRPC statuses.
  • response.json() failing on gRPC responses in custom checks.
  • Unclear errors from case.as_curl_command() and case.as_transport_kwargs() on gRPC cases.
  • --auth-wfc and --report wfc silently misbehaving with gRPC schemas.
  • connect-go request decoding failures not reported as ST119.
  • gRPC Channelz, CSDS and health services tested as part of the API.
  • Coverage phase for gRPC skipping later oneof branches, non-finite floats and length boundaries.
  • gRPC values violating empty protovalidate ranges such as gt: 5, lt: 5.
  • Coverage phase crash on gRPC messages whose required oneof refers to itself.
  • gRPC UNAVAILABLE response times inflated by a server reachability check.
  • gRPC connection errors hiding details for HTTP/1 servers and missing client certificates.
  • gRPC TLS failures reported as connection failures on grpcio 1.72 to 1.76.
  • Misleading gRPC reflection errors for rejected credentials, timeouts and servers without user services.

st replay

  • st replay resending recorded ids for inferred links that pick an item from a list response.
  • st replay resending recorded GraphQL ids instead of taking them again from earlier responses.
  • st replay resending recorded gRPC values instead of taking them again from earlier responses.
  • st replay sending masked gRPC metadata instead of credentials from -H or config.

Stateful testing

  • Missing inferred stateful links for resources whose schemas reference $defs under a nested $id.
  • Explicit links in path items from external files not selected and duplicated by inference.
  • Stateful reproductions omitting earlier writes to the same resource, such as a preceding DELETE.
  • st fuzz and stateful testing counting requests unanswered after an API outage as errored.

Schema loading

  • Schema error for security schemes defined through a chain of $refs.
  • Missing parameters when a cross-file $ref chain repeats the same pointer in different files.
  • No API operations found when a path item $ref points to another $ref.
  • Traceback when loading descriptor sets with other extensions, or non-UTF-8 schema files.

Data generation

  • Crash in the examples phase on $ref Example Objects inside a schema's examples map.
  • Fuzzing failing the filter_too_much health check when ids reused from responses contain /.
  • RecursionError during generation for self-referencing arrays with prefixItems or contains.
  • False positive positive_data_acceptance for dependentRequired objects behind $ref in coverage. #5898

... (truncated)

Commits
  • 2454421 chore: Release 4.33.1
  • 123d51e docs: Update changelog
  • 67f62d3 fix: st replay resending recorded GraphQL ids instead of taking them again ...
  • 8d3dd9d fix: st fuzz and stateful testing counting requests unanswered after an API...
  • 0c832ca fix: False positive positive_data_acceptance for dependentRequired object...
  • 986fb8d refactor: Share test catalog helpers and drop duplicate tests and redundant g...
  • 4190f7d fix: st replay resending recorded gRPC values instead of taking them again ...
  • d54ab19 fix: Crash writing the HAR report for Cookie headers the cookie parser rejects
  • b9a2855 fix: st replay resending recorded ids for inferred links that pick an item ...
  • 8033ef4 fix: st replay sending masked gRPC metadata instead of credentials from `-H...
  • Additional commits viewable in compare view

Updates zizmor from 1.31.1 to 1.32.0

Release notes

Sourced from zizmor's releases.

v1.32.0

Sponsorship is appreciated!

New Features 🌈🔗

  • zizmor now has experimental support for GitHub Actions workflow lockfiles. Please see the limitations documentation for more information about the current implementation and its limitations (#2463)

Enhancements 🌱🔗

  • zizmor's input collection is now "root-aware" by default, meaning that invocations like zizmor . will no longer collect inputs unless they would actually be used by GitHub Actions, etc. This should eliminate spurious findings from (e.g.) workflow definitions in vendored directories. See the input collection documentation for more information. (#2454)

  • zizmor's LSP now honors the didChangeWorkspaceFolders event (#2461)

  • zizmor's LSP now audits pre-commit inputs (#2485)

  • zizmor now provides Windows ARM64 wheels on PyPI (#2424)

    Many thanks to @​ndabas for proposing and implementing this improvement!

Bug Fixes 🐛🔗

  • Fixed a bug where the bot-conditions audit did not properly flag if: condition of jobs that call a reusable workflow (#2457)

  • Fixed a bug where the obfuscation audit would incorrectly flag (and suggest an incorrect auto-fix for) expressions that constant-reduce to other expressions (#2483)

  • Fixed a bug where the template-injection audit did not flag attacker-controllable contexts wrapped in fromJSON(...), such as fromJSON(toJSON(github.event.issue.title)) (#2495)

  • Fixed a bug where the template-injection audit did not flag attacker-controllable contexts in the values of case(...), such as case(cond, github.event.issue.title, 'x') (#2504)

  • Fixed a class of bugs in the obfuscation audit where a constant-reducible subexpression would not be replaced with a contextually correct form (#2483)

  • Fixed a bug where zizmor would incorrectly audit pre-commit inputs that ended with .yml, despite pre-commit requiring the .yaml suffix (#2485)

  • Fixed a bug where zizmor would not honor some ignore comments for the stale-action-refs audit (#2494)

  • Fixed a bug where zizmor would not honor some ignore comments for the ref-version-mismatch audit (#2494)

Changelog

Sourced from zizmor's changelog.

1.32.0

New Features 🌈

  • zizmor now has experimental support for GitHub Actions workflow lockfiles. Please see the limitations documentation for more information about the current implementation and its limitations (#2463)

Enhancements 🌱

  • zizmor's input collection is now "root-aware" by default, meaning that invocations like zizmor . will no longer collect inputs unless they would actually be used by GitHub Actions, etc. This should eliminate spurious findings from (e.g.) workflow definitions in vendored directories. See the [input collection] documentation for more information. (#2454)

  • zizmor's LSP now honors the didChangeWorkspaceFolders event (#2461)

  • zizmor's LSP now audits pre-commit inputs (#2485)

  • zizmor now provides Windows ARM64 wheels on PyPI (#2424)

    Many thanks to @​ndabas for proposing and implementing this improvement!

Bug Fixes 🐛

  • Fixed a bug where the [bot-conditions] audit did not properly flag if: condition of jobs that call a reusable workflow (#2457)

  • Fixed a bug where the [obfuscation] audit would incorrectly flag (and suggest an incorrect auto-fix for) expressions that constant-reduce to other expressions (#2483)

  • Fixed a bug where the [template-injection] audit did not flag attacker-controllable contexts wrapped in fromJSON(...), such as fromJSON(toJSON(github.event.issue.title)) (#2495)

  • Fixed a bug where the [template-injection] audit did not flag attacker-controllable contexts in the values of case(...), such as case(cond, github.event.issue.title, 'x') (#2504)

  • Fixed a class of bugs in the [obfuscation] audit where a constant-reducible subexpression would not be replaced with a contextually correct form (#2483)

  • Fixed a bug where zizmor would incorrectly audit pre-commit inputs that ended with .yml, despite pre-commit requiring the .yaml suffix (#2485)

  • Fixed a bug where zizmor would not honor some ignore comments for

... (truncated)

Commits

Updates uv-build from 0.13.6 to 0.13.7

Release notes

Sourced from uv-build's releases.

0.13.7

Release Notes

Released on 2026-11-03.

Preview features

  • Add --output-version to uv workspace metadata for requesting a specific schema version (#22958)
  • Report aliased OSV records as a single vulnerability in uv audit (#22990)

Bug fixes

  • Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#23008)
  • Prevent uv's Windows trampolines from closing handles they did not inherit (#22977)
  • Allow uvx to run tools with CPython builds whose versions contain local identifiers (#23013)
  • Generate valid module names when uv init creates packaged projects whose names start with a digit (#23022)
  • Preserve comments around existing inline dependency groups when uv add updates a group (#23017)
  • Allow uv remove with an empty inline tool.uv.sources table (#23012)

Documentation

  • Correct the cache-keys inline table example (#22984)

Install uv 0.13.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.ps1 | iex"

Download uv 0.13.7

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
uv-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.13.7

Released on 2026-11-03.

Preview features

  • Add --output-version to uv workspace metadata for requesting a specific schema version (#22958)
  • Report aliased OSV records as a single vulnerability in uv audit (#22990)

Bug fixes

  • Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#23008)
  • Prevent uv's Windows trampolines from closing handles they did not inherit (#22977)
  • Allow uvx to run tools with CPython builds whose versions contain local identifiers (#23013)
  • Generate valid module names when uv init creates packaged projects whose names start with a digit (#23022)
  • Preserve comments around existing inline dependency groups when uv add updates a group (#23017)
  • Allow uv remove with an empty inline tool.uv.sources table (#23012)

Documentation

  • Correct the cache-keys inline table example (#22984)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the python group with 4 updates
bc68167 
Bumps the python group with 4 updates: [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy), [schemathesis](https://github.com/schemathesis/schemathesis), [zizmor](https://github.com/zizmorcore/zizmor) and [uv-build](https://github.com/astral-sh/uv).


Updates `sqlalchemy` from 2.1.6 to 2.1.8
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `schemathesis` from 4.32.7 to 4.33.1
- [Release notes](https://github.com/schemathesis/schemathesis/releases)
- [Changelog](https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md)
- [Commits](schemathesis/schemathesis@v4.32.7...v4.33.1)

Updates `zizmor` from 1.31.1 to 1.32.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.31.1...v1.32.0)

Updates `uv-build` from 0.13.6 to 0.13.7
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.13.6...0.13.7)

---
updated-dependencies:
- dependency-name: sqlalchemy
  dependency-version: 2.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: schemathesis
  dependency-version: 4.33.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: zizmor
  dependency-version: 1.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: uv-build
  dependency-version: 0.13.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from nkboedecker as a code owner November 8, 2026 03:14
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 8, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 15, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 15, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python-4bad9f41dd branch November 15, 2026 03:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nkboedecker nkboedecker Awaiting requested review from nkboedecker nkboedecker is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants