Skip to content

chore(deps): Bump the python group across 1 directory with 8 updates - #13

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-ade08a5a50
Open

chore(deps): Bump the python group across 1 directory with 8 updates#13
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-ade08a5a50

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 15, 2026

Copy link
Copy Markdown

Bumps the python group with 8 updates in the / directory:

Package From To
fastapi 0.162.0 0.162.5
sqlalchemy 2.1.6 2.1.8
hypothesis 6.170.14 6.170.15
mkdocs-material 9.8.0 9.8.1
ruff 0.17.3 0.17.4
schemathesis 4.32.7 4.33.2
zizmor 1.31.1 1.32.0
uv-build 0.13.6 0.13.7

Updates fastapi from 0.162.0 to 0.162.5

Release notes

Sourced from fastapi's releases.

0.162.5

FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Fixes

Internal

  • ➖ Drop pydantic-ai dependency, use pydantic-ai-slim[openai] instead. PR #16526 by @​YuriiMotov.

0.162.4

FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Fixes

0.162.3

FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Upgrades

Docs

Translations

... (truncated)

Commits

Updates sqlalchemy from 2.1.6 to 2.1.8

Release notes

Sourced from sqlalchemy's releases.

2.1.8

Released: November 3, 2026

general

  • [general] [change] All files published to PyPI for a release, including the source distribution as well as all wheels, are now uploaded using PyPI's trusted publishing mechanism from SQLAlchemy's GitHub Actions workflow, and include a PEP 740 attestation, so that every file in a release carries provenance information. Previously, the source distribution and some wheels were uploaded without an attestation, which caused PyPI to display provenance warnings for recent releases.

    This change is also backported to: 2.0.57

    References: #13759

2.1.7

Released: November 3, 2026

orm

  • [orm] [feature] Added _orm.SessionTransaction.connections and _orm.SessionTransaction.bound_connection(), which return the connections a _orm.SessionTransaction has already acquired, without acquiring a new one. This allows, for example, checking whether any connection in the transaction has been invalidated before emitting further SQL. A SAVEPOINT transaction returned by _orm.Session.begin_nested() reports only the connections used within that SAVEPOINT; the root transaction returned by _orm.Session.get_transaction() reports all connections. The same accessors are available on _asyncio.AsyncSessionTransaction, returning _asyncio.AsyncConnection objects. Pull request courtesy Artur Shiriev.

    References: #13685

  • [orm] [bug] An informative InvalidRequestError is now raised when more than one PropComparator.of_type() loader option is applied along the same relationship using targets of differing classes, such as two _orm.aliased() constructs against different subclasses, which previously failed with a bare AssertionError during compilation. These options can't be combined since each target brings its own aliased copy of the base table; to load multiple subclasses along a single relationship, a single _orm.with_polymorphic() object that includes all of the target classes should be used.

... (truncated)

Commits

Updates hypothesis from 6.170.14 to 6.170.15

Commits
  • 9ab0be6 Bump hypothesis version to 6.170.15 and update changelog
  • 460d72f Merge pull request #4946 from jorenham/typing/errors/coverage
  • 26f1634 Enfore 100% public type coverage in CI with pyrefly coverage check
  • fb08018 version: fill in the missing type annotation
  • 7af7891 Rephrase release note as suggested in review
  • 95e0906 Add release notes
  • b7d5433 extra.ghostwriter: fill in the missing type annotations
  • 3537278 extra.codemods: fill in the missing type annotations
  • bd1a894 extra.dpcontracts: fill in the missing type annotation
  • 4bb761e errors: remove spurious blank line
  • Additional commits viewable in compare view

Updates mkdocs-material from 9.8.0 to 9.8.1

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.8.1

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

  • Updated Docker base image to Alpine 3.24
  • Updated Docker image dependencies to fix vulnerabilities
  • Updated Node build-time dependencies to fix vulnerabilities
Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.1 (2026-11-07)

  • Updated Docker base image to Alpine 3.24
  • Updated Docker image dependencies to fix vulnerabilities
  • Updated Node build-time dependencies to fix vulnerabilities

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

... (truncated)

Commits
  • 16c95ad Prepare 9.8.1 release
  • b3fe832 Fixed documentation workflow
  • 004d29e Updated dependencies to fix vulnerabilities
  • 7590e14 Documentation
  • 0f044db Updated documentation build to use public Material
  • dc38d1e Documentation
  • ebbfb46 Updated Docker base image to Alpine 3.24
  • 624aff1 Updated build and documentation workflows
  • See full diff in compare view

Updates ruff from 0.17.3 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

  • [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
  • [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

  • Accept a bare raise before a semicolon (#29761)
  • Allow match identifiers after a semicolon (#29760)
  • Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
  • [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

  • Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

  • Coalesce source slices when formatting attributes (#29841)
  • Collect return statements with a statement-only visitor (#29911)
  • [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
  • Format node fields directly when comment handling is unnecessary (#29853)
  • Reduce formatter source-slice overhead (#29855)
  • Reuse a callee's qualified name across lint rules (#29916)
  • Skip invalid string character checks when the source contains none (#29883)
  • Use a Bloom filter for formatter comment lookups (#29852)
  • Use a concrete buffer for ordinary writes (#29819)

CLI

  • Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
  • Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

  • Correct the documented version and src defaults for ruff-action (#29880)
  • [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
  • [flake8-no-pep420] Document preview behavior (INP001) (#29764)
  • [isort] Expand I001 documentation (#29843)

Other changes

  • [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

  • [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
  • [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

  • Accept a bare raise before a semicolon (#29761)
  • Allow match identifiers after a semicolon (#29760)
  • Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
  • [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

  • Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

  • Coalesce source slices when formatting attributes (#29841)
  • Collect return statements with a statement-only visitor (#29911)
  • [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
  • Format node fields directly when comment handling is unnecessary (#29853)
  • Reduce formatter source-slice overhead (#29855)
  • Reuse a callee's qualified name across lint rules (#29916)
  • Skip invalid string character checks when the source contains none (#29883)
  • Use a Bloom filter for formatter comment lookups (#29852)
  • Use a concrete buffer for ordinary writes (#29819)

CLI

  • Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
  • Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

  • Correct the documented version and src defaults for ruff-action (#29880)
  • [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
  • [flake8-no-pep420] Document preview behavior (INP001) (#29764)
  • [isort] Expand I001 documentation (#29843)

Other changes

  • [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits
  • 05cdc36 Bump version to 0.17.4 (#30073)
  • c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
  • 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
  • 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
  • 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
  • 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
  • c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
  • c9150f0 Add project walltime benchmarks for Ruff (#30061)
  • 64989ec [ty] Report invalid module globs once per override pattern (#30031)
  • 367a563 [ty] Fix conditional type and tuple annotations (#29987)
  • Additional commits viewable in compare view

Updates schemathesis from 4.32.7 to 4.33.2

Release notes

Sourced from schemathesis's releases.

Release 4.33.2

🐛 Fixed

Inferred links

  • Links sending a scalar identifier into array fields like customer_ids.
  • Missing links for fields inside nullable request body arrays, e.g. type: [array, null].
  • Missing links for fields inherited through allOf chains reusing a schema name across files.
  • Links treating PUT updaters as creators when the collection's POST is a path item $ref.
  • Links passing ids between unrelated resources whose $ref ends in items or schema.
  • Links using HTML, PDF or application/sdp response bodies as the created resource id.
  • Missing links for fields inside request body arrays behind components that only reference another.
  • Links copying a related resource's field into a request body field whose enum rejects it.
  • Links treating array fields named like customer_id as a single identifier.
  • Links filling a parent's {id} with a nested item's id, e.g. in /options/{id}/entry/{entrypk}.
  • No inferred links for responses whose schema lives in another file and references its siblings.
  • Links filling *_name header parameters with an unrelated name field.
  • Missing links and an internal error for response schemas with their own $id and $defs.
  • Links passing values from collections like /managed/devices into unrelated operations like /devices/{serial}.
  • Missing links for body fields and query filters named after a resource, e.g. part, ?company=.
  • Links filling path parameters from writeOnly response fields behind $ref or marked x-writeOnly.
  • Missing links for responses naming the resource id pk, as in Django REST Framework.
  • Links sending a whole list or an unrelated object as an array request body item.
  • Links passing path parameters like {id} between unrelated resources, e.g. a customer id into /orders/{id}.
  • Links reading values from fields no oneOf branch declares, e.g. checkID for /checks/{checkID}.
  • Links copying a fetched value into an update body field whose $ref enum rejects it.
  • Links reading values from map properties named after the path, e.g. tags in PATCH /orders/{id}/tags.
  • Missing links for nested body fields and response fields named like part_pk or customer-id.
  • Links filling format: uuid parameters with the resource's integer id.

Stateful testing and fuzzing

  • Links learned from Location headers or body URLs reaching other operations sharing a $ref response.
  • Stateful testing failing when operations share a response defined in another file.
  • Resource pool forgetting live ids after a DELETE, e.g. the org after DELETE /orgs/1/users/7.
  • Captured ids sent to the wrong resource when an operation documents several 2xx responses.
  • Fuzzing not reusing ids returned next to the resource, e.g. {bookingid, booking}.
  • st fuzz dropping generated request body fields next to the ones a link sets.

Data generation

  • Schema-level examples reached through $ref chains ignored in the examples phase.
  • Send content parameters with +json or charset JSON media types as JSON text.
  • Coverage phase generating invalid or missing positive cases behind components that only reference another.
  • Internal error during generation for string schemas with a pattern and a huge maxLength.
  • Coverage phase sending request bodies of tens of megabytes for arrays with a large maxItems.
  • Strings skipping an optional pattern group never generated when minLength is set.
  • Stale constants recorded for form fields with a custom encoding.
  • Optional multipart fields with a custom encoding never generated.

... (truncated)

Changelog

Sourced from schemathesis's changelog.

4.33.2 - 2026-11-11

🐛 Fixed

Inferred links

  • Links sending a scalar identifier into array fields like customer_ids.
  • Missing links for fields inside nullable request body arrays, e.g. type: [array, null].
  • Missing links for fields inherited through allOf chains reusing a schema name across files.
  • Links treating PUT updaters as creators when the collection's POST is a path item $ref.
  • Links passing ids between unrelated resources whose $ref ends in items or schema.
  • Links using HTML, PDF or application/sdp response bodies as the created resource id.
  • Missing links for fields inside request body arrays behind components that only reference another.
  • Links copying a related resource's field into a request body field whose enum rejects it.
  • Links treating array fields named like customer_id as a single identifier.
  • Links filling a parent's {id} with a nested item's id, e.g. in /options/{id}/entry/{entrypk}.
  • No inferred links for responses whose schema lives in another file and references its siblings.
  • Links filling *_name header parameters with an unrelated name field.
  • Missing links and an internal error for response schemas with their own $id and $defs.
  • Links passing values from collections like /managed/devices into unrelated operations like /devices/{serial}.
  • Missing links for body fields and query filters named after a resource, e.g. part, ?company=.
  • Links filling path parameters from writeOnly response fields behind $ref or marked x-writeOnly.
  • Missing links for responses naming the resource id pk, as in Django REST Framework.
  • Links sending a whole list or an unrelated object as an array request body item.
  • Links passing path parameters like {id} between unrelated resources, e.g. a customer id into /orders/{id}.
  • Links reading values from fields no oneOf branch declares, e.g. checkID for /checks/{checkID}.
  • Links copying a fetched value into an update body field whose $ref enum rejects it.
  • Links reading values from map properties named after the path, e.g. tags in PATCH /orders/{id}/tags.
  • Missing links for nested body fields and response fields named like part_pk or customer-id.
  • Links filling format: uuid parameters with the resource's integer id.

Stateful testing and fuzzing

  • Links learned from Location headers or body URLs reaching other operations sharing a $ref response.
  • Stateful testing failing when operations share a response defined in another file.
  • Resource pool forgetting live ids after a DELETE, e.g. the org after DELETE /orgs/1/users/7.
  • Captured ids sent to the wrong resource when an operation documents several 2xx responses.
  • Fuzzing not reusing ids returned next to the resource, e.g. {bookingid, booking}.
  • st fuzz dropping generated request body fields next to the ones a link sets.

Data generation

  • Schema-level examples reached through $ref chains ignored in the examples phase.
  • Send content parameters with +json or charset JSON media types as JSON text.
  • Coverage phase generating invalid or missing positive cases behind components that only reference another.
  • Internal error during generation for string schemas with a pattern and a huge maxLength.
  • Coverage phase sending request bodies of tens of megabytes for arrays with a large maxItems.
  • Strings skipping an optional pattern group never generated when minLength is set.
  • Stale constants recorded for form fields with a custom encoding.
  • Optional multipart fields with a custom encoding never generated.

... (truncated)

Commits
  • ca86c12 chore: Release 4.33.2
  • 6b011b7 docs: Update changelog
  • 949535b fix: Missing links for fields inside nullable request body arrays, e.g. `type...
  • bacf9fc fix: Links using HTML, PDF or application/sdp response bodies as the create...
  • 38db64d fix: Links filling a parent's {id} with a nested item's id, e.g. in `/optio...
  • a2583c1 fix: Links passing values from collections like /managed/devices into unrel...
  • 14731f6 fix: Links reading values from fields no oneOf branch declares, e.g. `check...
  • c92824d fix: Links sending a scalar identifier into array fields like customer_ids
  • 0cf637e fix: Links copying a related resource's field into a request body field whose...
  • 3a38568 fix: Links filling *_name header parameters with an unrelated name field
  • Additional commits viewable in compare view

Updates zizmor from 1.31.1 to 1.32.0

Release notes

Sourced from zizmor's releases.

v1.32.0

Sponsorship is appreciated!

New Features 🌈🔗

  • zizmor now has experimental support for GitHub Actions workflow lockfiles. Please see the limitations documentation for more information about the current implementation and its limitations (#2463)

Enhancements 🌱🔗

  • zizmor's input collection is now "root-aware" by default, meaning that invocations like zizmor . will no longer collect inputs unless they would actually be used by GitHub Actions, etc. This should eliminate spurious findings from (e.g.) workflow definitions in vendored directories. See the input collection documentation for more information. (#2454)

  • zizmor's LSP now honors the didChangeWorkspaceFolders event (#2461)

  • zizmor's LSP now audits pre-commit inputs (#2485)

  • zizmor now provides Windows ARM64 wheels on PyPI (#2424)

    Many thanks to @​ndabas for proposing and implementing this improvement!

Bug Fixes 🐛🔗

  • Fixed a bug where the bot-conditions audit did not properly flag if: condition of jobs that call a reusable workflow (#2457)

  • Fixed a bug where the obfuscation audit would incorrectly flag (and suggest an incorrect auto-fix for) expressions that constant-reduce to other expressions (#2483)

  • Fixed a bug where the template-injection audit did not flag attacker-controllable contexts wrapped in fromJSON(...), such as fromJSON(toJSON(github.event.issue.title)) (#2495)

  • Fixed a bug where the template-injection audit did not flag attacker-controllable contexts in the values of case(...), such as case(cond, github.event.issue.title, 'x') (#2504)

  • Fixed a class of bugs in the obfuscation audit where a constant-reducible subexpression would not be replaced with a contextually correct form (#2483)

  • Fixed a bug where zizmor would incorrectly audit pre-commit inputs that ended with .yml, despite pre-commit requiring the .yaml suffix (#2485)

  • Fixed a bug where zizmor would not honor some ignore comments for the stale-action-refs audit (#2494)

  • Fixed a bug where zizmor would not honor some ignore comments for the ref-version-mismatch audit (#2494)

Changelog

Sourced from zizmor's changelog.

1.32.0

New Features 🌈

  • zizmor now has experimental support for GitHub Actions workflow lockfiles. Please see the limitations documentation for more information about the current implementation and its limitations (#2463)

Enhancements 🌱

  • zizmor's input collection is now "root-aware" by default, meaning that invocations like zizmor . will no longer collect inputs unless they would actually be used by GitHub Actions, etc. This should eliminate spurious findings from (e.g.) workflow definitions in vendored directories. See the [input collection] documentation for more information. (#2454)

  • zizmor's LSP now honors the didChangeWorkspaceFolders event (#2461)

  • zizmor's LSP now audits pre-commit inputs (#2485)

  • zizmor now provides Windows ARM64 wheels on PyPI (#2424)

    Many thanks to @​ndabas for proposing and implementing this improvement!

Bug Fixes 🐛

  • Fixed a bug where the [bot-conditions] audit did not properly flag if: condition of jobs that call a reusable workflow (#2457)

  • Fixed a bug where the [obfuscation] audit would incorrectly flag (and suggest an incorrect auto-fix for) expressions that constant-reduce to other expressions (#2483)

  • Fixed a bug where the [template-injection] audit did not flag attacker-controllable contexts wrapped in fromJSON(...), such as fromJSON(toJSON(github.event.issue.title)) (#2495)

  • Fixed a bug where the [template-injection] audit did not flag attacker-controllable contexts in the values of case(...), such as case(cond, github.event.issue.title, 'x') (#2504)

  • Fixed a class of bugs in the [obfuscation] audit where a constant-reducible subexpression would not be replaced with a contextually correct form (#2483)

  • Fixed a bug where zizmor would incorrectly audit pre-commit inputs that ended with .yml, despite pre-commit requiring the .yaml suffix (#2485)

  • Fixed a bug where zizmor would not honor some ignore comments for

... (truncated)

Commits

Updates uv-build from 0.13.6 to 0.13.7

Release notes

Sourced from uv-build's releases.

0.13.7

Release Notes

Released on 2026-11-03.

Preview features

  • Add --output-version to uv workspace metadata for requesting a specific schema version (#22958)
  • Report aliased OSV records as a single vulnerability in uv audit (#22990)

Bug fixes

  • Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#23008)
  • Prevent uv's Windows trampolines from closing handles they did not inherit (#22977)
  • Allow uvx to run tools with CPython builds whose versions contain local identifiers (#23013)
  • Generate valid module names when uv init creates packaged projects whose names start with a digit (#23022)
  • Preserve comments around existing inline dependency groups when uv add updates a group (#23017)
  • Allow uv remove with an empty inline tool.uv.sources table (#23012)

Documentation

  • Correct the cache-keys inline table example (#22984)

Install uv 0.13.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.ps1 | iex"

Download uv 0.13.7

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
uv-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum

... (truncated)

Changelog

Sourced from uv-build's changelog.

0.13.7

Released on 2026-11-03.

Preview features

  • Add --output-version to uv workspace metadata for requesting a specific schema version (#22958)
  • Report aliased OSV records as a single vulnerability in uv audit (#22990)

Bug fixes

  • Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#23008)
  • Prevent uv's Windows trampolines from closing handles they did not inherit (#22977)
  • Allow uvx to run tools with CPython builds whose versions contain local identifiers (#23013)
  • Generate valid module names when uv init creates packaged projects whose names start with a digit (#23022)
  • Preserve comments around existing inline dependency groups when uv add updates a group (#23017)
  • Allow uv remove with an empty inline tool.uv.sources table (#23012)

Documentation

  • Correct the cache-keys inline table example (#22984)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the python group across 1 directory with 8 updates
ab5b4fe 
Bumps the python group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.162.0` | `0.162.5` |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.1.6` | `2.1.8` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.170.14` | `6.170.15` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.8.0` | `9.8.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.3` | `0.17.4` |
| [schemathesis](https://github.com/schemathesis/schemathesis) | `4.32.7` | `4.33.2` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.31.1` | `1.32.0` |
| [uv-build](https://github.com/astral-sh/uv) | `0.13.6` | `0.13.7` |



Updates `fastapi` from 0.162.0 to 0.162.5
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.162.0...0.162.5)

Updates `sqlalchemy` from 2.1.6 to 2.1.8
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `hypothesis` from 6.170.14 to 6.170.15
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.170.14...v6.170.15)

Updates `mkdocs-material` from 9.8.0 to 9.8.1
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.8.0...9.8.1)

Updates `ruff` from 0.17.3 to 0.17.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.3...0.17.4)

Updates `schemathesis` from 4.32.7 to 4.33.2
- [Release notes](https://github.com/schemathesis/schemathesis/releases)
- [Changelog](https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md)
- [Commits](schemathesis/schemathesis@v4.32.7...v4.33.2)

Updates `zizmor` from 1.31.1 to 1.32.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.31.1...v1.32.0)

Updates `uv-build` from 0.13.6 to 0.13.7
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.13.6...0.13.7)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.162.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: sqlalchemy
  dependency-version: 2.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: hypothesis
  dependency-version: 6.170.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: mkdocs-material
  dependency-version: 9.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.17.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: schemathesis
  dependency-version: 4.33.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: zizmor
  dependency-version: 1.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: uv-build
  dependency-version: 0.13.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from nkboedecker as a code owner November 15, 2026 03:15
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nkboedecker nkboedecker Awaiting requested review from nkboedecker nkboedecker is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants