chore(deps): bump the production-dependencies group across 1 directory with 13 updates by dependabot[bot] · Pull Request #121 · Zenable-io/ai-native-python

dependabot · 2026-11-09T09:12:07Z

Bumps the production-dependencies group with 13 updates in the / directory:

Package	From	To
filelock	`4.2.4`	`4.2.9`
mypy	`2.4.0`	`2.4.1`
mypy-extensions	`1.1.0`	`1.2.0`
nodeenv	`1.11.0`	`1.12.0`
platformdirs	`4.13.5`	`4.14.5`
pydantic	`2.14.1`	`2.14.3`
pydantic-core	`2.50.1`	`2.50.4`
python-dateutil	`3.0.0`	`4.0.0`
python-discovery	`1.6.4`	`1.9.4`
typing-inspection	`0.4.4`	`0.4.5`
tzdata	`2026.5`	`2026.6`
virtualenv	`21.14.13`	`21.15.5`
wrapt	`2.5.1`	`2.5.2`

Updates filelock from 4.2.4 to 4.2.9

Release notes

Sourced from filelock's releases.

4.2.9

Bug fixes

ReadWriteLock, SoftReadWriteLock and their async wrappers now raise TypeError for a blocking that is not a bool, in the constructor and on acquire, as FileLock already does. Before, blocking=0 waited out the full timeout on a contended ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (#908) by @abhishekcpp007 and @gaborbernat.

New Contributors

@abhishekcpp007 made their first contribution in tox-dev/filelock#908

🐍 PyPI release

📜 Full Changelog

4.2.8

Documentation

Clarify the platform-specific locking primitive and range used by descriptor locks, and correct the guidance on interoperating with byte-range lock protocols such as conda's repodata lock (#905) by @boyfeiyu.

New Contributors

@boyfeiyu made their first contribution in tox-dev/filelock#905

🐍 PyPI release

📜 Full Changelog

4.2.7

Bug fixes

A SoftFileLease reclaims a dead holder's lease marker even when that holder published another lease_duration. It used to raise LeaseSettingsMismatch on every attempt instead, so after a holder crashed and its peers restarted with a changed duration the lock stayed wedged until force_break(). A live holder with another duration still raises (#900) by @dxbjavid and @gaborbernat.

PyPI release

Full Changelog

4.2.6

Bug fixes

Fix a race in SoftFileLock, MarkerSoftFileLock and SoftFileLease when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (#899) by @dxbjavid and @gaborbernat.

PyPI release

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-9:

4.2.9 (2026-11-04)

.. _release-4-2-9-fixed:

Fixed

:class:~filelock.ReadWriteLock, :class:~filelock.SoftReadWriteLock and their async wrappers now raise :class:TypeError for a blocking that is not a :class:bool, in the constructor and on acquire, as :class:~filelock.FileLock already does. Before, blocking=0 waited out the full timeout on a contended :class:~filelock.ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (:pr:908) by :user:abhishekcpp007 and :user:gaborbernat.

.. _release-4-2-8:

4.2.8 (2026-11-04)

.. _release-4-2-8-documentation:

Documentation

Clarify the platform-specific locking primitive and range used by descriptor locks, and correct the guidance on interoperating with byte-range lock protocols such as conda's repodata lock (:pr:905) by :user:boyfeiyu.

.. _release-4-2-7:

4.2.7 (2026-11-02)

.. _release-4-2-7-fixed:

Fixed

... (truncated)

Commits

8803429 release 4.2.9
030c5e2 🐛 fix(rw): reject a non-bool blocking (#908)
90760d8 release 4.2.8
19af0ad 👷 ci: adopt shared check, CodeQL and release workflows (#907)
2ac1e92 📝 docs(descriptor): clarify native lock protocol compatibility (#905)
6223054 build(deps): refresh project lock (#906)
bee5ab3 🔧 build(deps): refresh CI and docs tools (#904)
825f3b5 👷 ci(scorecard): publish OpenSSF results (#903)
e386afb 🔧 build(deps): use release-creator 4.4 (#902)
4257ca7 👷 ci(news): stop cancelling the news check (#901)
Additional commits viewable in compare view

Updates mypy from 2.4.0 to 2.4.1

Changelog

Sourced from mypy's changelog.

Mypy 2.4.1

Process overloads as a whole in two-phase type checking (Ivan Levkivskyi, PR 22231)

Skip recursive setup for frame-private nested functions in mypyc (Piotr Sawicki, PR 22187)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

A5rocks

Adam Dangoor

Alex Waygood

Ali Hamdan

Brian Helba

Chad Dombrova

David Foster

dnwpark

Edgar Ramírez Mondragón

Giorgos Michas

Ivan Levkivskyi

Jelle Zijlstra

Jukka Lehtosalo

Marc Mueller

Michael R. Crusoe

NIYONSHUTI Emmanuel

Piotr Sawicki

Shantanu

themylogin

Vaggelis Danias

Willy Bruns

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy
You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

... (truncated)

Commits

ad02a35 Skip test for 2.4.1
cad7794 Finalize version to 2.4.1
d9cbcbc Add changelog for Mypy 2.4.1 (#22310)
2860baa Process overloads as a whole in two-phase type-checking (#22231)
9b3e307 [mypyc] Skip recursive setup for frame-private nested functions (#22187)
10ad5f6 Bump ast-serialize to 0.12.1 (#22093)
350052f Bump ast-serialize to 0.12.0 (#22087)
f7d08cf Bump version to 2.4.1+dev
See full diff in compare view

Updates mypy-extensions from 1.1.0 to 1.2.0

Commits

35af63f Change version to 1.2.0 (drop -dev)
ef995d3 Add i8, u64, u32 and u16 native integer types (#78)
c03837c Drop support for Python 3.8 and 3.9, officially support 3.14 and 3.15 (#79)
a6221ad Permit building with flit core 4 (#76)
9fc7fe0 Bump version for development (#62)
See full diff in compare view

Updates nodeenv from 1.11.0 to 1.12.0

Release notes

Sourced from nodeenv's releases.

1.12.0

What's Changed

New Features 🎉

feat(nodeenv): print shell completion scripts with shtab by @ekalinin in ekalinin/nodeenv#460

Fixed bugs 🐛

fix(nodeenv): point npm_config_prefix at the env in activate.bat and Activate.ps1 by @ekalinin in ekalinin/nodeenv#420

fix(nodeenv): install npm from the registry tarball on Windows by @ekalinin in ekalinin/nodeenv#425

fix(nodeenv): read quoted config values and mirror credentials by @ekalinin in ekalinin/nodeenv#426

fix: stop putting ^/dev/null on PATH in activate.fish by @r3wretrhy in ekalinin/nodeenv#427

fix(nodeenv): retry broken node downloads and stop hanging on stalls by @ekalinin in ekalinin/nodeenv#428

fix: do not require python2 to build node from source by @r3wretrhy in ekalinin/nodeenv#429

fix(nodeenv): do not put the venv bin on PATH twice with -p by @ekalinin in ekalinin/nodeenv#448

fix(nodeenv): skip node.js pre-releases for latest and ranges by @ekalinin in ekalinin/nodeenv#454

fix: preserve fish activation environment by @jihtsan in ekalinin/nodeenv#431

fix(nodeenv): read a config value raw when interpolation fails by @r3wretrhy in ekalinin/nodeenv#449

fix(nodeenv): ignore source trees during prebuilt installs by @fly1d in ekalinin/nodeenv#450

fix(nodeenv): escape glob characters in prebuilt paths by @tridev-tej in ekalinin/nodeenv#447

fix(nodeenv): raise on bad config references again by @r3wretrhy in ekalinin/nodeenv#458

Improvements 🛠

Make tox configuration more flexible by @ssbarnea in ekalinin/nodeenv#373

chore(tests): port the Makefile test targets to pytest by @ekalinin in ekalinin/nodeenv#445

Align Python support metadata and runtime with Python 3.10+ by @jihtsan in ekalinin/nodeenv#439

perf(nodeenv): unpack the node.js zip archive in parallel by @ekalinin in ekalinin/nodeenv#459

Documentation 📄

docs(site): new landing page for ekalinin.github.io/nodeenv by @ekalinin in ekalinin/nodeenv#421

docs(site): show GitHub stars and PyPI downloads badges by @ekalinin in ekalinin/nodeenv#424

docs: update isolated installation instructions by @jihtsan in ekalinin/nodeenv#434

docs(contributing): add contributing guide and templates by @ekalinin in ekalinin/nodeenv#446

docs(changes): move the #453 entry under 1.11.1 by @ekalinin in ekalinin/nodeenv#455

Other Changes

chore(release): bump nodeenv version to 1.12.0 by @ekalinin in ekalinin/nodeenv#461

New Contributors

@ssbarnea made their first contribution in ekalinin/nodeenv#373

@jihtsan made their first contribution in ekalinin/nodeenv#434

@fly1d made their first contribution in ekalinin/nodeenv#450

@tridev-tej made their first contribution in ekalinin/nodeenv#447

Full Changelog: ekalinin/nodeenv@1.11.1...1.12.0

1.11.1

What's Changed

Fixed bugs 🐛

fix(nodeenv): skip node.js pre-releases for latest and ranges by @ekalinin in ekalinin/nodeenv#454

1.11.1 is 1.11.0 plus this fix only. nodejs.org now lists 27.0.0-alpha.0.0.0 first, and nodeenv stopped with a traceback when it used the default latest or a semver range (#453).

Full Changelog: ekalinin/nodeenv@1.11.0...1.11.1

Changelog

Sourced from nodeenv's changelog.

Version 1.12.0

--print-completion SHELL prints a completion script for bash, zsh or fish. It needs shtab, installed with pip install "nodeenv[completion]" [#351](https://github.com/ekalinin/nodeenv/issues/351) <https://github.com/ekalinin/nodeenv/issues/351>_

--prebuilt installs no longer fail when the environment path or the node.js version contains [, * or ? [#441](https://github.com/ekalinin/nodeenv/issues/441) <https://github.com/ekalinin/nodeenv/issues/441>_

On Windows, Cygwin and MSYS the node.js zip archive is extracted 32 files at a time instead of one by one, so a security scanner that checks every new file no longer makes the install wait for each file in turn. --no-parallel-extract, or parallel_extract = False in ~/.nodeenvrc, extracts it one file at a time again [#366](https://github.com/ekalinin/nodeenv/issues/366) <https://github.com/ekalinin/nodeenv/issues/366>_

--prebuilt installs no longer mistake a cached source tree for a prebuilt archive, or fail when both trees remain in src/ [#443](https://github.com/ekalinin/nodeenv/issues/443) <https://github.com/ekalinin/nodeenv/issues/443>_

activate.fish restores the caller's NODE_PATH and npm configuration on deactivation, including empty values and when NODE_VIRTUAL_ENV has been removed. Existing environments keep their old activate.fish; recreate them with the same options to get the fix. With -p, remove the old nodeenv part from the virtualenv's activate.fish first [#399](https://github.com/ekalinin/nodeenv/issues/399) <https://github.com/ekalinin/nodeenv/issues/399>_

A % in a [nodeenv] config value, such as a percent-encoded mirror login, no longer crashes nodeenv: a value that can't be interpolated and has no %(name)s reference is read as written. %% still gives %, which setup.cfg needs, as setuptools reads that file too [#440](https://github.com/ekalinin/nodeenv/issues/440) <https://github.com/ekalinin/nodeenv/issues/440>_

nodeenv -p no longer puts the python venv's bin directory on PATH a second time: the venv's own activate and activate.fish put it there already. Envs without those scripts, such as conda envs, and the git-bash activate on Windows keep it, and running nodeenv -p again fixes an existing venv [#332](https://github.com/ekalinin/nodeenv/issues/332) <https://github.com/ekalinin/nodeenv/issues/332>_

Require Python 3.10 or later, matching the minimum version tested in CI. Update package classifiers and wheel tags, and remove the unused Python 2 compatibility paths. Old Node.js source builds still require Python 2.7 as their build interpreter [#436](https://github.com/ekalinin/nodeenv/issues/436) <https://github.com/ekalinin/nodeenv/issues/436>_

--source builds of node.js 13 and later no longer need a python2 command; 8.8 to 12.x still need one but point python at it on their own, so the python to python2 link in PATH is only set up for older versions, and versions before 13 still fail early with a clear error when python2 is missing [#419](https://github.com/ekalinin/nodeenv/issues/419) <https://github.com/ekalinin/nodeenv/issues/419>_

The node.js archive download also retries when the connection is reset or times out in the middle of the body, pauses between the attempts and ends with an error message instead of a traceback when all of them fail; a server that stops answering is given up on after 60 seconds instead of

... (truncated)

Commits

cb7fc97 chore(release): bump nodeenv version to 1.12.0 (#461)
c2e21d0 fix(nodeenv): raise on bad config references again (#458)
0fd263f feat(nodeenv): print shell completion scripts with shtab (#460)
e1e016b fix(nodeenv): escape glob characters in prebuilt paths (#447)
ac28019 perf(nodeenv): unpack the node.js zip archive in parallel (#459)
0e30103 fix(nodeenv): ignore source trees during prebuilt installs (#450)
02f4ce3 fix(nodeenv): read a config value raw when interpolation fails (#449)
2226040 fix(nodeenv): preserve fish activation environment (#431)
e27db1e docs(changes): move the #453 entry under 1.11.1 (#455)
8dee9f3 fix(nodeenv): skip node.js pre-releases for latest and ranges (#454)
Additional commits viewable in compare view

Updates platformdirs from 4.13.5 to 4.14.5

Release notes

Sourced from platformdirs's releases.

4.14.5

Bug fixes

Resolve the temporary user_runtime_dir fallback to /runtime-<uid> instead of //runtime-<uid> when the temporary directory is / (#687) by @darrenhuai and @gaborbernat.

🐍 PyPI release

📜 Full Changelog

4.14.4

🐍 PyPI release

📜 Full Changelog

4.14.3

Bug fixes

Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (#679) by @mikegit123git and @gaborbernat.

New Contributors

@mikegit123git made their first contribution in tox-dev/platformdirs#679

PyPI release

Full Changelog

4.14.2

Bug fixes

Deduplicate equivalent XDG directory spellings across string and path iterators and file searches (#677) by @AlvaroBalbin and @gaborbernat.

New Contributors

@AlvaroBalbin made their first contribution in tox-dev/platformdirs#677

PyPI release

Full Changelog

4.14.0

Features

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-14-5:

4.14.5 (2026-11-04)

.. _release-4-14-5-fixed:

Fixed

Resolve the temporary :func:~platformdirs.user_runtime_dir fallback to /runtime-<uid> instead of //runtime-<uid> when the temporary directory is / (:pr:687) by :user:darrenhuai and :user:gaborbernat.

.. _release-4-14-4:

4.14.4 (2026-11-04)

.. _release-4-14-3:

4.14.3 (2026-11-01)

.. _release-4-14-3-fixed:

Fixed

Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (:pr:679) by :user:mikegit123git and :user:gaborbernat.

.. _release-4-14-2:

4.14.2 (2026-10-31)

.. _release-4-14-2-fixed:

... (truncated)

Commits

6a7d284 release 4.14.5
c9ad21d 🐛 fix(unix): avoid // in the runtime fallback when the temp dir is / (#687)
cf51ebd release 4.14.4
573a192 👷 ci: adopt shared workflows and dependency hygiene (#685)
9008466 build(deps): refresh project lock (#684)
246e9ad Bump the "dependencies" group with 2 updates across multiple ecosystems (#683)
d4064eb 👷 ci(scorecard): publish OpenSSF results (#682)
f9323b0 🔧 build(deps): use release-creator 4.4 (#681)
eb0cce8 👷 ci(news): stop cancelling the news check (#680)
099c969 release 4.14.3
Additional commits viewable in compare view

Updates pydantic from 2.14.1 to 2.14.3

Release notes

Sourced from pydantic's releases.

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

Build wheels for GraalPy 3.13 by @msimacek in #14136.

The previous v2.14.2 release published GraalPy 3.11 wheels, which were not working due to a PyO3 version bump. A CI workflow issue made it so that the wheel wasn't tested before publishing. This is now fixed: starting in v2.14.3, we no longer publish GraalPy 3.11 wheels, and GraalPy 3.13 wheels are now published together with the existing 3.12 one.

Performance

Improve schema generation for fixed type handlers by @alexmojaki in #14130

Skip general schema dispatch for builtin scalars by @alexmojaki in #14141

Skip annotation handler setup when annotations are empty by @alexmojaki in #14149

Fix quadratic serialization time with per-index include/exclude on sequences by @Viicos in #14160

Avoid type lookups when checking for None during serialization by @Viicos in #14167

Improve performance of model serialization by @Viicos in #14171

Improve performance of dict serialization by @Viicos in #14172

Improve performance of type inference during serialization by @Viicos in #14173

Avoid cloning the field name when using the default value during validation by @Viicos in #14175

Do not evaluate model_config annotations by @Viicos in #14195

Avoid slow runtime Protocol check when expanding GroupedMetadata annotations by @Viicos in #14196

Use a lightweight @contextmanager implementation internally by @Viicos in #14199

Fixes

Fix various issues about GC tracking in pydantic-core by @Viicos in #13819

Include null in serialization JSON Schema for unless-none field serializers by @Kropiunig in #13848

Fix RecursionError when copying or unpickling models with defer_build by @Viicos in #14115

Remove dead default_factory check in unsupported Field() attribute by @owtaylor in #14129

Disallow non string extra keys during validation by @Viicos in #14135

Fix deeply nested data being reported as a cyclic reference by @Viicos in #14164

New Contributors

@owtaylor made their first contribution in #14129

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.

Packaging

Bump PyO3 to 0.30.1, jiter to 0.18.0, use PyFrozenDict by @Viicos in #14003

Bump speedate to v0.18.0 by @Viicos in #14007

Publish pydantic-core wheels for PyPy 8.0 (pp80 ABI) by @Viicos in #14083

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

Add support for multiple_of constraint in fraction and timedelta core schemas by @Viicos in #13873

Add __namespace__ parameter to create_model() by @Viicos in #13895

Changes

Add an ordered-dict core schema by @Viicos in #13796

Add a counter core schema by @Viicos in #13824

Do not mutate model_config attribute by @Viicos in #13825

Reject newlines in NameEmail validation by @Viicos in #13897

Fixes

Call enum constructors in both validation modes by @Viicos in #13792

Fix documentation examples not raising and remove unused string_sub_type unused error code by @Viicos in #13821

Catch OverflowError during ByteSize validation by @Viicos in #13850

Require multiple_of constraints to be positive by @Viicos in #13862

Always pop field name and model type stacks during schema generation by @saquibjawedbit in #13859

Handle TypeError gracefully during docstring extraction by @Viicos in #13874

Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @Viicos in #13891

Don't apply ser_json_timedelta to all datetime types in serialization inference by @Viicos in #13892

Encode JSON Schema defaults with a consistent configuration by @Viicos in #13893

Propagate init and kw_only=False from Field() to stdlib dataclass fields by @Viicos in #13898

Respect propagated extra config in the JSON Schema of stdlib dataclasses by @Viicos in #13899

Handle OS errors during ZoneInfo validation by @Viicos in #13912

Handle exceptions during Decimal validation by @Viicos in #13940

Rebuild incomplete types during serialization inference by @Viicos in #13922

Reject large exponents in Fraction validation by @Viicos in #13944

Avoid validating URL prefix multiple times in multi host URLs by @Viicos in #13945

New Contributors

@saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

ea492e0 Bump pydantic-core to v2.50.4
4f4a33f Prepare release v2.14.3
dca067b Benchmark TypedDict schema generation across builds
a2d1f6c Skip annotation handler setup when annotations are empty
3ae0a40 Construct builtin scalar union schemas directly
358d36f Skip general schema dispatch for builtin scalars
3cc701a Improve schema generation for fixed type handlers
762db7e Remove redundant None check in union schema generation
c214986 Bump pytest-codspeed to v5.0.4
038ee97 Bump typing-inspection to v0.4.5
Additional commits viewable in compare view

Updates pydantic-core from 2.50.1 to 2.50.4

Commits

ea492e0 Bump pydantic-core to v2.50.4
4f4a33f Prepare release v2.14.3
dca067b Benchmark TypedDict schema generation across builds
a2d1f6c Skip annotation handler setup when annotations are empty
3ae0a40 Construct builtin scalar union schemas directly
358d36f Skip general schema dispatch for builtin scalars
3cc701a Improve schema generation for fixed type handlers
762db7e Remove redundant None check in union schema generation
c214986 Bump pytest-codspeed to v5.0.4
038ee97 Bump typing-inspection to v0.4.5
Additional commits viewable in compare view

Updates python-dateutil from 3.0.0 to 4.0.0

Release notes

Sourced from python-dateutil's releases.

4.0.0

dateutil 4.0 requires Python 3.11 or later and no longer depends on six. Apart from that, the changes in this release are bug fixes, but note that isoparse is now stricter about the numeric fields it accepts (see below).

Deprecations

Dropped support for Python versions older than 3.11 and removed the dependency on six, along with Python 2 compatibility helpers that were never part of the public API, such as dateutil.tz.tzname_in_python2. (gh pr #1625)

Bugfixes

parser.isoparse, and the isoparser methods parse_isodate, parse_isotime and parse_tzstr, now require each numeric field to be exactly the expected number of ASCII digits. Strings that were previously accepted, such as 20200728121240 (read as 21:24), 2014- 4-21 and 2_14-04-21, and offsets such as +-1:00, now raise ValueError. tzical applies the same check to TZOFFSETFROM and TZOFFSETTO. Reported by @janos-gonye (gh issue #1074). Fixed by @varun3257 (gh pr #1617).

Fixed an issue where iterating over a cached rrule or rruleset could hang forever if another iterator over the same rule had already completed the cache, for example when a cached rrule was included twice in an rruleset. Reported by @bysiber (gh pr #1455). Fixed by @pganssle (gh pr #1655).

Unpickling a tzutc now gives the dateutil.tz.UTC singleton, and unpickling a tzoffset gives the same object as calling tzoffset(name, offset). Previously unpickling bypassed the singleton-generation logic. Reported and fixed by @masipcat (gh issue #1051, gh pr #1053).

relativedelta(yearday=366) now resolves to December 31 in leap years. Previously it gave December 30, the same date as yearday=365. Reported and fixed by @Master-Norna (gh pr #1583).

Misc

The build backend is now Hatchling, and the package metadata is in pyproject.toml. Versions are still derived from Git tags and exposed as dateutil.__version__. This mainly affects people building dateutil from source. (gh pr #1637, #1638)

Changes to CI, tests and release tooling that do not affect users of the package: gh pr #1636, #1644, #1645, #1646, #1648, #1649, #1650.

Changelog

Sourced from python-dateutil's changelog.

Version 4.0.0 (2026-11-01)

dateutil 4.0 requires Python 3.11 or later and no longer depends on six. Apart from that, the changes in this release are bug fixes, but note that isoparse is now stricter about the numeric fields it accepts (see below).

Deprecations

Dropped support for Python versions older than 3.11 and removed the dependency on six, along with Python 2 compatibility helpers that were never part of the public API, such as dateutil.tz.tzname_in_python2. (gh pr #1625)

Bugfixes

parser.isoparse, and the isoparser methods parse_isodate, parse_isotime and parse_tzstr, now require each numeric field to be exactly the expected number of ASCII digits. Strings that were previously accepted, such as 20200728121240 (read as 21:24), 2014- 4-21 and 2_14-04-21, and offsets such as +-1:00, now raise ValueError. tzical applies the same check to TZOFFSETFROM and TZOFFSETTO. Reported by @janos-gonye (gh issue #1074). Fixed by @varun3257 (gh pr #1617).

Fixed an issue where iterating over a cached rrule or rruleset could hang forever if another iterator over the same rule had already completed the cache, for example when a cached rrule was included twice in an rruleset. Reported by @bysiber (gh pr #1455). Fixed by @pganssle (gh pr #1655).

Unpickling a tzutc now gives the dateutil.tz.UTC singleton, and unpickling a tzoffset gives the same object as calling tzoffset(name, offset). Previously unpickling bypassed the singleton-generation logic. Reported and fixed by @masipcat (gh issue #1051, gh pr #1053).

relativedelta(yearday=366) now resolves to December 31 in leap years. Previously it gave December 30, the same date as yearday=365. Reported and fixed by @Master-Norna (gh pr #1583).

Misc

The build backend is now Hatchling, and the package metadata is in pyproject.toml. Versions are still derived from Git tags and exposed as dateutil.__version__. This mainly affects people building dateutil from source. (gh pr #1637, #1638)

Changes to CI, tests and release tooling that do not affect users of the

... (truncated)

Commits

a78cbd8 Prepare release 4.0.0
d23ff76 Fix yearday=366 resolving to Dec 30 in leap years
5391455 Return the cached instances when unpickling tzutc and tzoffset
6f13622 Reject non-digit characters in isoparse and tzical numeric fields
6e1864c Release the rrule cache lock on every exit from a refill (#1655)
71d92da Skip coverage collection on PyPy in CI
d9cad2f Run the tests in parallel with pytest-xdist (#1649)
433c98b Add news fragment for #1650
ea6bc3f Remove stale warning from the tz tox environments
27ecba2 Keep GitHub Actions pins updated with Dependabot
Additional commits viewable in compare view

Updates python-discovery from 1.6.4 to 1.9.4

Release notes

Sourced from python-discovery's releases.

v1.9.4

🐍 PyPI release

📜 Full Changelog

v1.9.2

Bug fixes

Match literal interpreter names against the executable found on PATH, including symlink names (#220) by @gaborbernat. (#188)

Preserve a virtual environment selected through try_first_with instead of returning its base interpreter (#218) by @gaborbernat. (#191)

Skip interpreter candidates that return JSON without usable interpreter metadata and continue searching (#231) by @gaborbernat. (#197)

Reject format widths in interpreter sysconfig paths before they allocate ...
Description has been truncated

…y with 13 updates Bumps the production-dependencies group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [filelock](https://github.com/tox-dev/filelock) | `4.2.4` | `4.2.9` | | [mypy](https://github.com/python/mypy) | `2.4.0` | `2.4.1` | | [mypy-extensions](https://github.com/python/mypy_extensions) | `1.1.0` | `1.2.0` | | [nodeenv](https://github.com/ekalinin/nodeenv) | `1.11.0` | `1.12.0` | | [platformdirs](https://github.com/tox-dev/platformdirs) | `4.13.5` | `4.14.5` | | [pydantic](https://github.com/pydantic/pydantic) | `2.14.1` | `2.14.3` | | [pydantic-core](https://github.com/pydantic/pydantic) | `2.50.1` | `2.50.4` | | [python-dateutil](https://github.com/dateutil/dateutil) | `3.0.0` | `4.0.0` | | [python-discovery](https://github.com/tox-dev/python-discovery) | `1.6.4` | `1.9.4` | | [typing-inspection](https://github.com/pydantic/typing-inspection) | `0.4.4` | `0.4.5` | | [tzdata](https://github.com/python/tzdata) | `2026.5` | `2026.6` | | [virtualenv](https://github.com/pypa/virtualenv) | `21.14.13` | `21.15.5` | | [wrapt](https://github.com/GrahamDumpleton/wrapt) | `2.5.1` | `2.5.2` | Updates `filelock` from 4.2.4 to 4.2.9 - [Release notes](https://github.com/tox-dev/filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@4.2.4...4.2.9) Updates `mypy` from 2.4.0 to 2.4.1 - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v2.4.0...v2.4.1) Updates `mypy-extensions` from 1.1.0 to 1.2.0 - [Commits](python/mypy_extensions@1.1.0...1.2.0) Updates `nodeenv` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/ekalinin/nodeenv/releases) - [Changelog](https://github.com/ekalinin/nodeenv/blob/master/CHANGES) - [Commits](ekalinin/nodeenv@1.11.0...1.12.0) Updates `platformdirs` from 4.13.5 to 4.14.5 - [Release notes](https://github.com/tox-dev/platformdirs/releases) - [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst) - [Commits](tox-dev/platformdirs@4.13.5...4.14.5) Updates `pydantic` from 2.14.1 to 2.14.3 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.14.1...v2.14.3) Updates `pydantic-core` from 2.50.1 to 2.50.4 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@core-v2.50.1...core-v2.50.4) Updates `python-dateutil` from 3.0.0 to 4.0.0 - [Release notes](https://github.com/dateutil/dateutil/releases) - [Changelog](https://github.com/dateutil/dateutil/blob/master/NEWS) - [Commits](dateutil/dateutil@3.0.0...4.0.0) Updates `python-discovery` from 1.6.4 to 1.9.4 - [Release notes](https://github.com/tox-dev/python-discovery/releases) - [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst) - [Commits](tox-dev/python-discovery@1.6.4...1.9.4) Updates `typing-inspection` from 0.4.4 to 0.4.5 - [Release notes](https://github.com/pydantic/typing-inspection/releases) - [Changelog](https://github.com/pydantic/typing-inspection/blob/main/HISTORY.md) - [Commits](pydantic/typing-inspection@v0.4.4...v0.4.5) Updates `tzdata` from 2026.5 to 2026.6 - [Release notes](https://github.com/python/tzdata/releases) - [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md) - [Commits](python/tzdata@2026.5...2026.6) Updates `virtualenv` from 21.14.13 to 21.15.5 - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](pypa/virtualenv@21.14.13...21.15.5) Updates `wrapt` from 2.5.1 to 2.5.2 - [Release notes](https://github.com/GrahamDumpleton/wrapt/releases) - [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst) - [Commits](GrahamDumpleton/wrapt@2.5.1...2.5.2) --- updated-dependencies: - dependency-name: filelock dependency-version: 4.2.9 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: mypy dependency-version: 2.4.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: mypy-extensions dependency-version: 1.2.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: nodeenv dependency-version: 1.12.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: platformdirs dependency-version: 4.14.5 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: pydantic dependency-version: 2.14.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: pydantic-core dependency-version: 2.50.4 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: python-dateutil dependency-version: 4.0.0 dependency-type: indirect update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: python-discovery dependency-version: 1.9.4 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: typing-inspection dependency-version: 0.4.5 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: tzdata dependency-version: '2026.6' dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: virtualenv dependency-version: 21.15.5 dependency-type: indirect update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: wrapt dependency-version: 2.5.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2026-11-09T09:12:12Z

Assignees

The following users could not be added as assignees: jonzeolla. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

ai-coding-guardrails

Nice work! 😎

I didn't find anything of concern

Risk: 🟢 Low

Did you know we can integrate this feedback directly into 50+ IDEs? Get setup in just one command

dependabot Bot requested a review from JonZeolla as a code owner November 9, 2026 09:12

dependabot Bot assigned JonZeolla Nov 9, 2026

ai-coding-guardrails Bot reviewed Nov 9, 2026

View reviewed changes

ai-coding-guardrails Bot added the zenable/risk:low Zenable assessed this PR as LOW risk. label Nov 9, 2026

Navigation Menu

Repository navigation

chore(deps): bump the production-dependencies group across 1 directory with 13 updates - #121

chore(deps): bump the production-dependencies group across 1 directory with 13 updates#121
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/production-dependencies-d4bd7ab94c

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

ai-coding-guardrails Bot left a comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

4.2.9

Bug fixes

New Contributors

4.2.8

Documentation

New Contributors

4.2.7

Bug fixes

4.2.6

Bug fixes

Fixed

Documentation

Fixed

Mypy 2.4.1

Acknowledgements

Mypy 2.3

The Upcoming Switch to the New Native Parser

Mypyc Free-threading Memory Safety

1.12.0

What's Changed

New Features 🎉

Fixed bugs 🐛

Improvements 🛠

Documentation 📄

Other Changes

New Contributors

1.11.1

What's Changed

Fixed bugs 🐛

Version 1.12.0

4.14.5

Bug fixes

4.14.4

4.14.3

Bug fixes

New Contributors

4.14.2

Bug fixes

New Contributors

4.14.0

Features

Fixed

Fixed

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

Performance

Fixes

New Contributors

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

Packaging

v2.14.0 (2026-10-08)

What's Changed

New Features

Changes

Fixes

New Contributors

4.0.0

Deprecations

Bugfixes

Misc

Version 4.0.0 (2026-11-01)

Deprecations

Bugfixes

Misc

v1.9.4

v1.9.2

Bug fixes

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2026

Assignees

Labels

Uh oh!

ai-coding-guardrails Bot left a comment

Choose a reason for hiding this comment

Risk: 🟢 Low