Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 22 updates - #116

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/production-dependencies-7ce21a9937
Closed

chore(deps): bump the production-dependencies group across 1 directory with 22 updates#116
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/production-dependencies-7ce21a9937

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 22 updates in the / directory:

Package From To
ast-serialize 0.11.2 0.13.1
certifi 2026.7.22 2026.10.19
charset-normalizer 3.5.1 3.5.2
distlib 0.4.3 0.4.4
identify 2.6.19 2.6.20
iniconfig 2.3.0 2.3.1
librt 0.15.0 0.16.0
markupsafe 3.0.3 3.0.4
mypy 2.3.1 2.4.0
nodeenv 1.10.0 1.11.0
platformdirs 4.11.10 4.13.5
pluggy 1.6.0 1.7.0
pydantic 2.13.5 2.14.1
pydantic-core 2.46.5 2.50.1
python-dateutil 2.9.0.post0 3.0.0
python-discovery 1.6.1 1.6.4
python-gitlab 6.5.0 8.6.0
python-slugify 9.0.0 9.1.3
tomlkit 0.15.1 0.15.2
tzdata 2026.4 2026.5
virtualenv 21.7.14 21.14.13
wrapt 2.4.1 2.5.1

Updates ast-serialize from 0.11.2 to 0.13.1

Commits

Updates certifi from 2026.7.22 to 2026.10.19

Commits

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

  • Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

  • Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
  • Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)
Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

  • Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

  • Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
  • Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)
Commits
  • 935c29a Release 3.5.2 (#805)
  • 9d3238a test: disable traefik in downstream niquests
  • b4c0368 docs: write changelog entry for 3.5.2
  • 717da31 chore: bump version to 3.5.2
  • 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
  • 41e28b6 chore: raise Cython upper bound to 3.3
  • b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
  • f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
  • See full diff in compare view

Updates distlib from 0.4.3 to 0.4.4

Changelog

Sourced from distlib's changelog.

0.4.4


Released: 2026-10-16

    

  • 

    compat
    

      

    • Fixed a missing import. Thanks to Andrej730 for the patch.
      • 

    

    • 

  • 

    markers
    

      

    • Fixed #273: Enforce compatible-release bounds in environment markers.
Thanks to Luochenchen for the patch.
      • 

    

    • 

  • 

    metadata
    

      

    • Fix #194: Add an urls property to expose project and home URLs. Thanks to
Sinkleberg for the patch.
      • 

    

    • 

  • 

    scripts
    

      

    • 

      Raise the correct exception when a launcher can't be written. Thanks to
candygoogy for the patch.
      

      • 

    • 

      Fix #144: Detect shell-script Python executables in ScriptMaker shebangs.
Thanks to Alex Chen for the patch.
      

      • 

    

    • 

  • 

    util
    

      

    • 

      Improve performance of export entry search to take linear time. Thanks to
Brian Willows for the patch.
      

      • 

    • 

      Use tarfile.data_filter rather than tarfile.tar_filter in unarchive()
when extraction filters are available, matching the Python 3.14 default. Path and
link containment checks now use os.path.realpath and no longer fail with
IndexError for members such as . or ./. Thanks to Kobain for the patch.
      

      • 

    • 

      unarchive() now resolves member paths through symlinks seen earlier in the
same archive, so a chain of individually harmless-looking links cannot be used
to write outside the destination on Pythons without extraction filters. Thanks to
Kobain for the patch.
      

      • 

    

    • 

  • 

    version
    

      

    • 

      Improve NormalizedVersion by addressing correctness and performance gaps
found by comparison with packaging. Thanks to Damian Shaw for the patch.
      

      • 

    • 

      Improve SemanticVersion by comparing numeric prerelease identifiers,
including those longer than 8 digits. Thanks to Muneeb Sheikh for the
patch.

Commits
  • 25eed06 Changes for 0.4.4.
  • 8ffee6f Resolve member paths through earlier archive symlinks in unarchive()
  • ef4a390 Test that data_filter rejects absolute symlinks with check=False
  • 380b6a9 Use data_filter and realpath containment checks in unarchive()
  • 7b7c572 fix: enforce compatible-release bounds in markers (#274)
  • 38811dd Detect shell-script Python executables in ScriptMaker shebangs (#144) (#264)
  • 06ddb5d Compare numeric prerelease identifiers without a digit limit (#270)
  • e54dd8c Raise the original error when a launcher can't be written (#269)
  • c6270e3 Fix NormalizedVersion gaps found by comparison with packaging (#271)
  • 5b3092b Search export entries in linear time (#266)
  • Additional commits viewable in compare view

Updates identify from 2.6.19 to 2.6.20

Commits
  • aa34031 v2.6.20
  • 116099f Merge pull request #609 from Malix-Labs/feat/add-nushell
  • 971546c Merge pull request #610 from pre-commit/lock-file-tags
  • da45cb1 Add support for 'nu' extension and Nushell interpreters
  • a35b99b Merge pull request #608 from steovd/profile-sh
  • bd5cdb7 Merge pull request #601 from ngie-eign/issue-258
  • 66faf04 Merge pull request #597 from edgarrmondragon/patch-1
  • c75a0a2 Merge pull request #593 from NinjaMandalorian/main
  • ea6c9f9 Add support for 'luau' file extension
  • d28c571 Merge pull request #585 from Kvan7/patch-1
  • Additional commits viewable in compare view

Updates iniconfig from 2.3.0 to 2.3.1

Release notes

Sourced from iniconfig's releases.

Version 2.3.1

Fixes

  • Parsing values with many continuation lines is now linear instead of quadratic in time (#78, regarding #77).
  • A leading UTF-8 BOM is now stripped when reading INI files. Files saved by Windows editors used to fail with ParseError (#76, thanks @​Pitchfork-and-Torch).

Internal

  • iniconfig._parse.ParsedLine.value is now a list of lines. This is private API.

Docs

Full diff: pytest-dev/iniconfig@v2.3.0...v2.3.1

What's Changed

New Contributors

Full Changelog: pytest-dev/iniconfig@v2.3.0...v2.3.1

Changelog

Sourced from iniconfig's changelog.

2.3.1

  • fix quadratic parse time for values with many continuation lines (#78, regarding #77)
  • strip a leading UTF-8 BOM when reading INI files, which previously raised ParseError (#76)
  • internal: iniconfig._parse.ParsedLine.value is now a list of lines
Commits
  • 316fbfa changelog: add BOM stripping (#76) to 2.3.1 (#81)
  • d2dcb72 Strip leading UTF-8 BOM when reading INI files (#76)
  • 40d8c03 Merge pull request #79 from MbappeWU/codex/docs-parse-inline-comments
  • 48359c3 Merge pull request #80 from pytest-dev/claude/fix-iniconfig-test-eukh2n
  • b153213 test: expect sorted all after ruff RUF022 autofix
  • 4fddfab Merge pull request #73 from pytest-dev/pre-commit-ci-update-config
  • 15852c2 [pre-commit.ci] auto fixes from pre-commit.com hooks
  • 2e68639 [pre-commit.ci] pre-commit autoupdate
  • 23c9e08 docs: use parse API in the README example
  • e038536 Merge pull request #78 from RonnyPfannschmidt/claude/dazzling-einstein-h8zq7m
  • Additional commits viewable in compare view

Updates librt from 0.15.0 to 0.16.0

Commits

Updates markupsafe from 3.0.3 to 3.0.4

Release notes

Sourced from markupsafe's releases.

3.0.4

This is the MarkupSafe 3.0.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.4/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-4 Milestone: https://github.com/pallets/markupsafe/milestone/17?closed=1

  • Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
  • Improve performance of striptags. #521
Changelog

Sourced from markupsafe's changelog.

Version 3.0.4

Released 2026-10-02

  • Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
  • Improve performance of striptags. :issue:521
Commits

Updates mypy from 2.3.1 to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

  • You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
  • Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
  • Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

Updates nodeenv from 1.10.0 to 1.11.0

Release notes

Sourced from nodeenv's releases.

1.11.0

What's Changed

New Features 🎉

Fixed bugs 🐛

Improvements 🛠

Documentation 📄

Other Changes

New Contributors

Full Changelog: ekalinin/nodeenv@1.10.0...1.11.0

Changelog

Sourced from nodeenv's changelog.

Version 1.11.0

  • Fixed zsh source bin/activate aborting on the direct-call guard [#398](https://github.com/ekalinin/nodeenv/issues/398) <https://github.com/ekalinin/nodeenv/issues/398>_
  • Added check for how activate is called [#384](https://github.com/ekalinin/nodeenv/issues/384) <https://github.com/ekalinin/nodeenv/pull/384>_
  • Addressed the tarfile.extractall deprecation on Python >= 3.12 by setting filter='data', which also prevents writing files via ".." or absolute paths [#380](https://github.com/ekalinin/nodeenv/issues/380) <https://github.com/ekalinin/nodeenv/pull/380>_
  • Added support for Solaris/illumos [#360](https://github.com/ekalinin/nodeenv/issues/360) <https://github.com/ekalinin/nodeenv/issues/360>_
  • Added predeactivate hooks for Windows
  • Added error handling and tests for the node installation [#336](https://github.com/ekalinin/nodeenv/issues/336) <https://github.com/ekalinin/nodeenv/issues/336>_
  • Removed the leftover debug print that leaked a dict to stdout on every version detection [#390](https://github.com/ekalinin/nodeenv/issues/390) <https://github.com/ekalinin/nodeenv/issues/390>_
  • Added --with-certifi to download packages with the certifi certificate bundle [#388](https://github.com/ekalinin/nodeenv/issues/388) <https://github.com/ekalinin/nodeenv/pull/388>_
  • --node accepts npm-style semver ranges [#393](https://github.com/ekalinin/nodeenv/issues/393) <https://github.com/ekalinin/nodeenv/pull/393>_
  • Added --prefer-system to use system-wide node.js when available and install one otherwise [#153](https://github.com/ekalinin/nodeenv/issues/153) <https://github.com/ekalinin/nodeenv/issues/153>_
  • Added --isolate-npm to keep npm cache, userconfig and init-module inside the environment [#154](https://github.com/ekalinin/nodeenv/issues/154) <https://github.com/ekalinin/nodeenv/issues/154>_
  • Added tests that run the activation scripts in sh, dash, bash, zsh and fish.
  • -p no longer reinstalls node when the requested version is already in the virtualenv [#159](https://github.com/ekalinin/nodeenv/issues/159) <https://github.com/ekalinin/nodeenv/issues/159>_
  • Repeated -p runs no longer duplicate the predeactivate hook [#159](https://github.com/ekalinin/nodeenv/issues/159) <https://github.com/ekalinin/nodeenv/issues/159>_
  • -p accepts an optional virtualenv directory and prefers the activated VIRTUAL_ENV over the virtualenv nodeenv itself is installed in [#156](https://github.com/ekalinin/nodeenv/issues/156) <https://github.com/ekalinin/nodeenv/issues/156>_
  • -r/--requirements may now be given more than once, and the new --local-requirements installs the packages of a file locally, into "node_modules" of the current directory, which is what freeze -l writes. Under npm < 1.0.0, which has no -g, a local file is still installed the old way [#206](https://github.com/ekalinin/nodeenv/issues/206) <https://github.com/ekalinin/nodeenv/issues/206>_
  • The "src" directory is now removed after installation by default, which halves the size of an environment. Added --no-clean-src to keep it: with --source that is what lets a repeated --force build reuse the downloaded source tree [#205](https://github.com/ekalinin/nodeenv/issues/205) <https://github.com/ekalinin/nodeenv/issues/205>_
  • Documented that --mirror takes a file:// URL, so a local directory can serve as the download source [#193](https://github.com/ekalinin/nodeenv/issues/193) <https://github.com/ekalinin/nodeenv/issues/193>_
  • The posix activate is now written on Windows too, into "Scripts", so git-bash and the other posix shells there can activate an environment [#226](https://github.com/ekalinin/nodeenv/issues/226) <https://github.com/ekalinin/nodeenv/issues/226>_
  • A download that reaches nothing at all, which a broken http_proxy or https_proxy usually causes, now reports the url and the proxy settings instead of a traceback

... (truncated)

Commits
  • e745358 Merge pull request #418 from ekalinin/chore/release-1.11.0
  • fd19956 chore(release): bump nodeenv version to 1.11.0
  • 1767015 Merge pull request #415 from ekalinin/fix/nodejs-exe-link
  • 55df3ce Merge pull request #417 from r3wretrhy/fix/zsh-activate-source-guard
  • bb15c5c fix: allow zsh to source bin/activate
  • 152cd3d fix(nodeenv): link nodejs.exe without mklink
  • d163302 Merge pull request #414 from ekalinin/fix/freeze-requirements
  • ef5ec35 fix(nodeenv): read npm's parseable listing in freeze
  • b1f0c54 Merge pull request #413 from ekalinin/fix/musl-vendor-detection
  • aadf307 fix(nodeenv): detect musl regardless of the host triplet vendor
  • Additional commits viewable in compare view

Updates platformdirs from 4.11.10 to 4.13.5

Release notes

Sourced from platformdirs's releases.

4.13.5

  • Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. #631

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.4...4.13.5

4.13.4

  • Require a complete files path segment when locating Android app directories from sys.path. #621
  • Keep root directory tests independent of inherited XDG environment variables. #622
  • Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. #624
  • Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. #625
  • Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. #627
  • Correct the contributor guide to name ty as the type checker used by the type environment. #623

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.3...4.13.4

4.13.3

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.2...4.13.3

4.13.2

  • Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. #619

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.1...4.13.2

4.13.1

  • Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. #618
  • Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

PyPI release

Full Changelog: tox-dev/platformdirs@4.13.0...4.13.1

4.13.0

  • Detect Homebrew Python for the MacOS site directories under python:-S, which leaves base_prefix on the Cellar keg, and for the python-freethreading formula - by sricharanreddycheruku. #612
  • Use Python 3.15 for development and automation. #613

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.13.5 (2026-10-19)

  • Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. :pr:631

4.13.4 (2026-10-17)

  • Require a complete files path segment when locating Android app directories from sys.path. :pr:621
  • Keep root directory tests independent of inherited XDG environment variables. :pr:622
  • Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. :pr:624
  • Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. :pr:625
  • Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. :pr:627
  • Correct the contributor guide to name ty as the type checker used by the type environment. :pr:623

4.13.3 (2026-10-16)

4.13.2 (2026-10-16)

  • Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. :pr:619

4.13.1 (2026-10-15)

  • Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. :pr:618
  • Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

4.13.0 (2026-10-10)

... (truncated)

Commits
  • 5702904 Release 4.13.5
  • 4b2b6a5 🐛 fix(release): trim GitHub release notes (#631)
  • 6f7e3e2 👷 ci: collect required checks (#628)
  • caa5626 Release 4.13.4
  • 9b5c0fd fix(windows): raise when no home directory resolves (#627)
  • da72995 fix: require a complete files segment when finding Android app folders (#621)
  • da89726 test: isolate root directory checks from inherited XDG settings (#622)
  • fb0b1a9 fix: keep root directory accessors consistent during isolation (#625)
  • 91f7775 fix(ios): raise when no home directory resolves (#624)
  • ed9f25f ci: rerun news check on label changes (#626)
  • Additional commits viewable in compare view

Updates pluggy from 1.6.0 to 1.7.0

Changelog

Sourced from pluggy's changelog.

pluggy 1.7.0 (2026-10-14)

Deprecations and Removals

  • [#632](https://github.com/pytest-dev/pluggy/issues/632) <https://github.com/pytest-dev/pluggy/issues/632>_: Hookspec methods defined without self as the first parameter now emit a :class:DeprecationWarning. Add self as the first parameter or use @staticmethod.

Features

  • [#170](https://github.com/pytest-dev/pluggy/issues/170) <https://github.com/pytest-dev/pluggy/issues/170>_: Hookspecs can now declare default values for arguments, using the usual def myhook(myarg="default") syntax. This is mainly a backward compatibility feature, to allow a hookspec to add new parameters to an existing hook without breaking existing callers. See :ref:hookspec_arg_default for details.

  • [#729](https://github.com/pytest-dev/pluggy/issues/729) <https://github.com/pytest-dev/pluggy/issues/729>_: Tracing now adds detail where str() is ambiguous: empty strings and strings containing whitespace are quoted, and enums and paths show their repr().

    A value spanning several lines is now displayed as a block instead of running into the surrounding trace.

Bug Fixes

  • [#629](https://github.com/pytest-dev/pluggy/issues/629) <https://github.com/pytest-dev/pluggy/issues/629>_: Fix hooks failing to register on Python 3.14+ when type annotations use forward references.

  • [#315](https://github.com/pytest-dev/pluggy/issues/315) <https://github.com/pytest-dev/pluggy/issues/315>_: Source archives created by git archive (including GitHub's "Source code" downloads) now carry version information, so building pluggy from them no longer fails with a missing version.

  • [#442](https://github.com/pytest-dev/pluggy/issues/442) <https://github.com/pytest-dev/pluggy/issues/442>_: With the addition of default values for hookspec arguments, we also changed the precedence of default values for hookimpl arguments. Previously, if a hookimpl function declared a default for an argument, it was always used, even if the hook call passed an explicit value. Now the precedence is changed to: hook call passed value > hookspec default value > hookimpl default value. See :ref:hookimpl_arg_defaults.

  • [#701](https://github.com/pytest-dev/pluggy/issues/701) <https://github.com/pytest-dev/pluggy/issues/701>_: Hookimpls and hookspecs are now discovered via :func:inspect.getattr_static, so properties, cached_property and other descriptors are no longer executed while scanning a plugin. Hooks declared through such a descriptor are not supported.

    As a side effect, @hookimpl/@hookspec applied above @classmethod or @staticmethod is now picked up; previously the marker sat on the wrapper where getattr() never saw it. Callables stored directly on a plugin instance -- in its __dict__ or in a __slots__ slot -- keep being called exactly as getattr() returned them, i.e. without an implicit self.

... (truncated)

Commits
  • 4c7f636 Preparing release 1.7.0
  • 21c7e16 Merge pull request #787 from pytest-dev/rm-outdated-doc
  • 628959b docs: remove outdated hookimpl default args paragraph
  • 2edab5e Merge pull request #752 from bluetech/register-none-allow
  • 6995073 Merge pull request #776 from RonnyPfannschmidt/fix/uv-lock-pytest-downgrade
  • 50c1ac9 [pre-commit.ci] pre-commit autoupdate (#781)
  • 6a7e84e Add changelog fragment for #776
  • d22cfb5 Drop tox from the dev dependency group
  • 74cbfa2 Relock pytest and tox that dependabot downgraded
  • 87f130a Merge pull request #755 from harbinresearcher/codex/entrypoint-plugin-presence
  • Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

  • Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
  • Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

  • Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
  • Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
  • Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
  • Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
  • Reject out-of-range int inputs for timedelta by @​Viicos in

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
59dc639 
…y with 22 updates

Bumps the production-dependencies group with 22 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [ast-serialize](https://github.com/mypyc/ast_serialize) | `0.11.2` | `0.13.1` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.7.22` | `2026.10.19` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.5.1` | `3.5.2` |
| [distlib](https://github.com/pypa/distlib) | `0.4.3` | `0.4.4` |
| [identify](https://github.com/pre-commit/identify) | `2.6.19` | `2.6.20` |
| [iniconfig](https://github.com/pytest-dev/iniconfig) | `2.3.0` | `2.3.1` |
| [librt](https://github.com/mypyc/librt) | `0.15.0` | `0.16.0` |
| [markupsafe](https://github.com/pallets/markupsafe) | `3.0.3` | `3.0.4` |
| [mypy](https://github.com/python/mypy) | `2.3.1` | `2.4.0` |
| [nodeenv](https://github.com/ekalinin/nodeenv) | `1.10.0` | `1.11.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.10` | `4.13.5` |
| [pluggy](https://github.com/pytest-dev/pluggy) | `1.6.0` | `1.7.0` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.5` | `2.14.1` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.5` | `2.50.1` |
| [python-dateutil](https://github.com/dateutil/dateutil) | `2.9.0.post0` | `3.0.0` |
| [python-discovery](https://github.com/tox-dev/python-discovery) | `1.6.1` | `1.6.4` |
| [python-gitlab](https://github.com/python-gitlab/python-gitlab) | `6.5.0` | `8.6.0` |
| [python-slugify](https://github.com/un33k/python-slugify) | `9.0.0` | `9.1.3` |
| [tomlkit](https://github.com/python-poetry/tomlkit) | `0.15.1` | `0.15.2` |
| [tzdata](https://github.com/python/tzdata) | `2026.4` | `2026.5` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.7.14` | `21.14.13` |
| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `2.4.1` | `2.5.1` |



Updates `ast-serialize` from 0.11.2 to 0.13.1
- [Commits](mypyc/ast_serialize@v0.11.2...v0.13.1)

Updates `certifi` from 2026.7.22 to 2026.10.19
- [Commits](certifi/python-certifi@2026.07.22...2026.10.19)

Updates `charset-normalizer` from 3.5.1 to 3.5.2
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.5.1...3.5.2)

Updates `distlib` from 0.4.3 to 0.4.4
- [Release notes](https://github.com/pypa/distlib/releases)
- [Changelog](https://github.com/pypa/distlib/blob/master/CHANGES.rst)
- [Commits](pypa/distlib@0.4.3...0.4.4)

Updates `identify` from 2.6.19 to 2.6.20
- [Commits](pre-commit/identify@v2.6.19...v2.6.20)

Updates `iniconfig` from 2.3.0 to 2.3.1
- [Release notes](https://github.com/pytest-dev/iniconfig/releases)
- [Changelog](https://github.com/pytest-dev/iniconfig/blob/main/CHANGELOG)
- [Commits](pytest-dev/iniconfig@v2.3.0...v2.3.1)

Updates `librt` from 0.15.0 to 0.16.0
- [Commits](mypyc/librt@v0.15.0...v0.16.0)

Updates `markupsafe` from 3.0.3 to 3.0.4
- [Release notes](https://github.com/pallets/markupsafe/releases)
- [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst)
- [Commits](pallets/markupsafe@3.0.3...3.0.4)

Updates `mypy` from 2.3.1 to 2.4.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.1...v2.4.0)

Updates `nodeenv` from 1.10.0 to 1.11.0
- [Release notes](https://github.com/ekalinin/nodeenv/releases)
- [Changelog](https://github.com/ekalinin/nodeenv/blob/master/CHANGES)
- [Commits](ekalinin/nodeenv@1.10.0...1.11.0)

Updates `platformdirs` from 4.11.10 to 4.13.5
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.10...4.13.5)

Updates `pluggy` from 1.6.0 to 1.7.0
- [Changelog](https://github.com/pytest-dev/pluggy/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pluggy@1.6.0...1.7.0)

Updates `pydantic` from 2.13.5 to 2.14.1
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.5...v2.14.1)

Updates `pydantic-core` from 2.46.5 to 2.50.1
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@core-v2.46.5...core-v2.50.1)

Updates `python-dateutil` from 2.9.0.post0 to 3.0.0
- [Release notes](https://github.com/dateutil/dateutil/releases)
- [Changelog](https://github.com/dateutil/dateutil/blob/master/NEWS)
- [Commits](dateutil/dateutil@2.9.0.post0...3.0.0)

Updates `python-discovery` from 1.6.1 to 1.6.4
- [Release notes](https://github.com/tox-dev/python-discovery/releases)
- [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst)
- [Commits](tox-dev/python-discovery@1.6.1...1.6.4)

Updates `python-gitlab` from 6.5.0 to 8.6.0
- [Release notes](https://github.com/python-gitlab/python-gitlab/releases)
- [Changelog](https://github.com/python-gitlab/python-gitlab/blob/main/CHANGELOG.md)
- [Commits](python-gitlab/python-gitlab@v6.5.0...v8.6.0)

Updates `python-slugify` from 9.0.0 to 9.1.3
- [Release notes](https://github.com/un33k/python-slugify/releases)
- [Changelog](https://github.com/un33k/python-slugify/blob/master/CHANGELOG.md)
- [Commits](un33k/python-slugify@v9.0.0...v9.1.3)

Updates `tomlkit` from 0.15.1 to 0.15.2
- [Release notes](https://github.com/python-poetry/tomlkit/releases)
- [Changelog](https://github.com/python-poetry/tomlkit/blob/master/CHANGELOG.md)
- [Commits](python-poetry/tomlkit@0.15.1...0.15.2)

Updates `tzdata` from 2026.4 to 2026.5
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.4...2026.5)

Updates `virtualenv` from 21.7.14 to 21.14.13
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.7.14...21.14.13)

Updates `wrapt` from 2.4.1 to 2.5.1
- [Release notes](https://github.com/GrahamDumpleton/wrapt/releases)
- [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst)
- [Commits](GrahamDumpleton/wrapt@2.4.1...2.5.1)

---
updated-dependencies:
- dependency-name: ast-serialize
  dependency-version: 0.13.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: certifi
  dependency-version: 2026.10.19
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: charset-normalizer
  dependency-version: 3.5.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: distlib
  dependency-version: 0.4.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: identify
  dependency-version: 2.6.20
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: iniconfig
  dependency-version: 2.3.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: librt
  dependency-version: 0.16.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: markupsafe
  dependency-version: 3.0.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: nodeenv
  dependency-version: 1.11.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: platformdirs
  dependency-version: 4.13.5
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pluggy
  dependency-version: 1.7.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pydantic-core
  dependency-version: 2.50.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: python-dateutil
  dependency-version: 3.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: python-discovery
  dependency-version: 1.6.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: python-gitlab
  dependency-version: 8.6.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: python-slugify
  dependency-version: 9.1.3
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tomlkit
  dependency-version: 0.15.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: tzdata
  dependency-version: '2026.5'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: virtualenv
  dependency-version: 21.14.13
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: wrapt
  dependency-version: 2.5.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot requested a review from JonZeolla as a code owner October 26, 2026 08:12
@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: jonzeolla. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

ai-coding-guardrails[bot]
ai-coding-guardrails Bot reviewed Oct 26, 2026
View reviewed changes

@ai-coding-guardrails ai-coding-guardrails Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work! 😎

I didn't find anything of concern

Risk: 🟢 Low

Reviewed with 🤟 by Zenable

@ai-coding-guardrails ai-coding-guardrails Bot added the zenable/risk:low Zenable assessed this PR as LOW risk. label Oct 26, 2026
@JonZeolla JonZeolla closed this Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ai-coding-guardrails ai-coding-guardrails[bot] ai-coding-guardrails[bot] left review comments
@JonZeolla JonZeolla Awaiting requested review from JonZeolla JonZeolla is a code owner

Assignees

@JonZeolla JonZeolla

Labels

zenable/risk:low Zenable assessed this PR as LOW risk.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JonZeolla