Skip to content

build(deps-dev): bump the dev-tooling group with 10 updates - #11

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dev-tooling-a37d91d0d5
Open

build(deps-dev): bump the dev-tooling group with 10 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dev-tooling-a37d91d0d5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on ruff, hypothesis, numpy, openai, cohere, anthropic, sentence-transformers, mkdocs, mkdocs-material and setuptools to permit the latest version.
Updates ruff to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

... (truncated)

Commits
  • 30516b4 Bump version to 0.17.2 (#29637)
  • 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
  • 0d562aa [ty] Check inherited attribute conflicts (#28559)
  • 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
  • 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
  • b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
  • 32869b4 Avoid creating deployments for automation jobs (#29626)
  • ec891ba Link the commit in pull request report footers (#29621)
  • 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
  • 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
  • Additional commits viewable in compare view

Updates hypothesis to 6.170.9

Commits
  • 5057a16 Bump hypothesis version to 6.170.9 and update changelog
  • 2d859e6 Merge pull request #4942 from moreati/issue4934
  • 5954d0b Fix DeprecationWarning triggered by importing dateutil.zoneinfo
  • f0764a4 Bump hypothesis version to 6.170.8 and update changelog
  • c134e15 Merge pull request #4936 from Zac-HD/claude/affectionate-pascal-e8sqgn
  • a2406ed Bump hypothesis version to 6.170.7 and update changelog
  • ecbcafa Don't enumerate collection "continue" draws in simplest probes
  • 416fd28 Merge pull request #4916 from jorenham/typing/stateful/coverage
  • d6dc78d Bump hypothesis version to 6.170.6 and update changelog
  • d01ccc3 Merge pull request #4935 from Zac-HD/claude/gallant-meitner-6blj9q
  • Additional commits viewable in compare view

Updates numpy to 2.4.6

Release notes

Sourced from numpy's releases.

v2.4.6 (May 18, 2026)

NumPy 2.4.6 Release Notes

NumPy 2.4.6 is a quick release that fixes a regression discovered in the 2.4.5 release.

This release supports Python versions 3.11-3.14

Contributors

A total of 4 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • !EarlMilktea
  • Charles Harris
  • Sebastian Berg
  • Warren Weckesser

Pull requests merged

A total of 4 pull requests were merged for this release.

  • #31444: MAINT: Prepare 2.4.x for further development
  • #31453: BUG: Fix regression in arr.conj()
  • #31459: BUG: np.linalg.svd(..., hermitian=True) returns non-unitary...
  • #31460: BUG: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator...
Changelog

Sourced from numpy's changelog.

This is a walkthrough of the NumPy 2.4.0 release on Linux, which will be the first feature release using the numpy/numpy-release <https://github.com/numpy/numpy-release>__ repository.

The commands can be copied into the command line, but be sure to replace 2.4.0 with the correct version. This should be read together with the :ref:general release guide <prepare_release>.

Facility preparation

Before beginning to make a release, use the dependency groups from pyproject.toml to ensure that you have the needed software. Most software can be installed with pip, but some will require apt-get, dnf, or whatever your system uses for software. You will also need a GitHub personal access token (PAT) to push the documentation. There are a few ways to streamline things:

  • Git can be set up to use a keyring to store your GitHub personal access token. Search online for the details.

Prior to release

Add/drop Python versions

When adding or dropping Python versions, multiple config and CI files need to be edited in addition to changing the minimum version in pyproject.toml. Make these changes in an ordinary PR against main and backport if necessary. We currently release wheels for new Python versions after the first Python RC once manylinux and cibuildwheel support that new Python version.

Backport pull requests

Changes that have been marked for this release must be backported to the maintenance/2.4.x branch.

Update 2.4.0 milestones

Look at the issues/prs with 2.4.0 milestones and either push them off to a later version, or maybe remove the milestone. You may need to add a milestone.

Check the numpy-release repo

... (truncated)

Commits
  • b832a09 Merge pull request #31462 from charris/prepare-2.4.6
  • 57cc147 REL: Prepare for the NumPy 2.4.6 release
  • 0c72b0b Merge pull request #31459 from charris/backport-31347
  • 9778d26 BUG: core: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator. (#...
  • e0e3876 BUG: core: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator. (#...
  • d1bffeb BUG: np.linalg.svd(..., hermitian=True) returns non-unitary vh (#31347)
  • 8d8d7e5 Merge pull request #31453 from seberg/issue-31452
  • bddaab7 BUG: Fix regression in arr.conj()
  • 37a1ecc Merge pull request #31444 from charris/begin-2.4.6
  • 3c0e043 MAINT: Prepare 2.4.x for further development
  • Additional commits viewable in compare view

Updates openai to 3.37.0

Release notes

Sourced from openai's releases.

v3.37.0

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

  • api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

  • api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

  • api: preserve file and video polling helpers (#4155) (7db9d88)
  • api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)
  • deps: bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109) (fa9a161)
Changelog

Sourced from openai's changelog.

3.37.0 (2026-10-22)

⚠ BREAKING CHANGES

  • api: This minor release includes a breaking change to Decisions types. In Live response models, question instructions can now be a string or a list of structured text, image, or JSON parts; check isinstance(question.instructions, str) before using string operations and handle the structured form. Decisions request input types also include additional message roles and tool-history items, so update exhaustive type checks accordingly. Existing string instructions and DecisionInputMessageParam user-message inputs remain supported.

Features

  • api: expand Decisions input and question types (#4158) (1e45ad1)

Chores

  • api: preserve file and video polling helpers (#4155) (7db9d88)
  • api: preserve upload helpers and Live connection defaults (#4152) (a29dc39)
  • deps: bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109) (fa9a161)

3.36.1 (2026-10-22)

Bug Fixes

  • api: honor per-call WebSocket query settings (#4138) (d40a5e1)
  • examples: stop microphone capture between recordings (#4143) (26e5d92)
  • validate browser calls before reading driver state (#4142) (2bfe460)

Chores

  • api: clarify service-account API key deletion (#4151) (6ed945e)

Refactors

  • prepare handwritten chunked upload runtime (#4146) (2d58e82)
  • prepare handwritten vector-store polling runtime (#4148) (7cd7028)

3.36.0 (2026-10-21)

Features

  • add Vertex AI support for the Responses API (#4139) (3e63d33)
  • api: add 30-minute cache-write usage counts (#4111) (5589146)
  • api: add compaction trigger IDs (#4122) (0e5794d)
  • api: add custom voice consent management (#4135) (de6d70d)
  • types: prepare native synchronous WebSocket option type (#4118) (90c0bac)

... (truncated)

Commits
  • e8a0fd2 release: 3.37.0 (#4154)
  • fa9a161 chore(deps): bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#4109)
  • 1e45ad1 feat(api): expand Decisions input and question types (#4158)
  • 1f76a59 ci: allow time for browser dependency installation (#4159)
  • 7db9d88 chore(api): preserve file and video polling helpers (#4155)
  • a29dc39 chore(api): preserve upload helpers and Live connection defaults (#4152)
  • 49e6757 release: 3.36.1 (#4145)
  • 6ed945e chore(api): clarify service-account API key deletion (#4151)
  • 7cd7028 refactor: prepare handwritten vector-store polling runtime (#4148)
  • d40a5e1 fix(api): honor per-call WebSocket query settings (#4138)
  • Additional commits viewable in compare view

Updates cohere to 7.3.0

Release notes

Sourced from cohere's releases.

7.3.0

What's Changed

Full Changelog: cohere-ai/cohere-python@7.1.0...7.3.0

Commits

Updates anthropic to 2.3.0

Release notes

Sourced from anthropic's releases.

v2.3.0

Features

  • api: add Claude Tag endpoints for Claude Enterprise organizations

Bug Fixes

  • google-cloud: send user profiles requests to the organization endpoint

Chores

  • client: stop sending query params hardcoded in endpoint paths
  • docs: improve the descriptions of the code execution tool and its encrypted results
  • docs: reword work queue, skill and external key descriptions
  • docs: update descriptions of the per-user usage and cost reports
  • internal: carry endpoint path query params to the request layer
  • internal: check the repository by owner and public name in workflows
  • internal: read the beta route qualifier instead of the beta=true query
  • internal: remove preview build upload from CI
  • internal: stop sending the beta query param from parse and stream

Documentation

  • mcp: remove the stray await from the async tool_runner examples
  • google-cloud: update the product name
  • client: link the Bedrock and Vertex raw response docstrings to the SDK documentation
  • update the README and the example request
Changelog

Sourced from anthropic's changelog.

2.3.0 (2026-10-23)

Features

  • api: add Claude Tag endpoints for Claude Enterprise organizations

Bug Fixes

  • google-cloud: send user profiles requests to the organization endpoint

Chores

  • client: stop sending query params hardcoded in endpoint paths
  • docs: improve the descriptions of the code execution tool and its encrypted results
  • docs: reword work queue, skill and external key descriptions
  • docs: update descriptions of the per-user usage and cost reports
  • internal: carry endpoint path query params to the request layer
  • internal: check the repository by owner and public name in workflows
  • internal: read the beta route qualifier instead of the beta=true query
  • internal: remove preview build upload from CI
  • internal: stop sending the beta query param from parse and stream

Documentation

  • mcp: remove the stray await from the async tool_runner examples
  • google-cloud: update the product name
  • client: link the Bedrock and Vertex raw response docstrings to the SDK documentation
  • update the README and the example request

2.2.0 (2026-10-23)

Features

  • api: add support for message threads
  • api: add usage and cost reports by dimension, mark older reports legacy

Bug Fixes

  • client: stop suggesting math.inf in the max_retries error message
  • tools: leave the tool runner's history to the caller after append_messages(), and keep the current reply out of the set_messages_params() callback
  • tools: keep running the tool runner's function tools when set_messages_params() gives tools as definitions, and stop running one it takes out of tools
  • tools: give the set_messages_params() callback of a tool runner its tools as definitions again
  • tools: keep a tool runner's betas, user_profile_id and workspace_id when set_messages_params() leaves them out

Chores

... (truncated)

Commits
  • 202db72 release: 2.3.0
  • d0cbc80 Merge pull request #1069 from anthropics/synced/published
  • aba9374 feat(api): add Claude Tag endpoints for Claude Enterprise organizations
  • 013f5a2 chore(internal): remove preview build upload from CI (#1077)
  • 10908cd chore(docs): improve the descriptions of the code execution tool and its encr...
  • f46b53c docs: update the README and the example request
  • 5da2887 docs(client): link the Bedrock and Vertex raw response docstrings to the SDK ...
  • 7c50ea2 chore(internal): stop sending the beta query param from parse and stream (#1076)
  • 4866287 chore(internal): check the repository by owner and public name in workflows
  • 691be0d chore(client): stop sending query params hardcoded in endpoint paths
  • Additional commits viewable in compare view

Updates sentence-transformers to 6.2.0

Release notes

Sourced from sentence-transformers's releases.

v6.2.0 - Model merging, faster loading, and distributed evaluation

This release adds model merging for all four model types, reduces redundant Hub requests when loading models, and distributes evaluator inference across DDP ranks. It also includes lower-memory training losses, more flexible multi-vector compression, and fixes throughout inference, training, and evaluation.

Install this version with

# Inference only, use one of:
pip install sentence-transformers==6.2.0
pip install sentence-transformers[openvino]==6.2.0
Multimodal dependencies (optional):
pip install sentence-transformers[image]==6.2.0
pip install sentence-transformers[audio]==6.2.0
pip install sentence-transformers[video]==6.2.0
Training + Inference
pip install sentence-transformers[train]==6.2.0
pip install sentence-transformers[merge]==6.2.0
Or combine as needed:
pip install sentence-transformers[train,image]==6.2.0

Model merging for all four model types (#3776)

Combine compatible fine-tuned checkpoints without another training run using SentenceTransformer.merge, SparseEncoder.merge, CrossEncoder.merge, or MultiVectorEncoder.merge. The integration uses Arcee AI's mergekit and supports well over a dozen methods such as Linear, SLERP, TIES, and DARE.

Install the merge extra with pip install "sentence-transformers[merge]". For example, take a weighted average of two compatible MiniLM models:

from sentence_transformers import SentenceTransformer
models = [
"sentence-transformers/all-MiniLM-L6-v2",
"sentence-transformers/multi-qa-MiniLM-L6-cos-v1",
]
merged = SentenceTransformer.merge(
models,
method="linear",
parameters={"weight": [0.6, 0.4]},
)
merged.save_pretrained("merged-MiniLM-L6")
embeddings = merged.encode(["Combining compatible model weights."])

Or interpolate between the same inputs with SLERP:

</tr></table>

... (truncated)

Commits
  • 0b6937d Release v6.2.0
  • 45682ed Update documentation announcement for v6.2 (#4243)
  • aed573b Forward gradient checkpointing options to Transformers (#4241)
  • c7adf47 Skip bfloat16 transformer head tests on affected Windows runners (#4242)
  • 1b4b624 Fix blank rows in CrossEncoder and RRF evaluator CSVs on Windows (#4077)
  • ea5435c Treat a string positive or negative as one document in RerankingEvaluator (#4...
  • 3a5232b Follow only duplicate pairs in the paraphrase mining transitive closure (#4120)
  • 7d64d3b Keep the RRF fusion order the same from run to run (#4067)
  • 67f11a3 Evaluate the main similarity function in TripletEvaluator (#4088)
  • fd6b188 Accept a string main_score_function in NanoBEIREvaluator (#4034)
  • Additional commits viewable in compare view

Updates mkdocs to 1.6.1

Release notes

Sourced from mkdocs's releases.

1.6.1

Version 1.6.1 (Friday 30th August, 2024)

Fixed

  • Fix build error when environment variable SOURCE_DATE_EPOCH=0 is set. #3795
  • Fix build error when mkdocs_theme.yml config is empty. #3700
  • Support python -W and PYTHONWARNINGS instead of overriding the configuration. #3809
  • Support running with Docker under strict mode, by removing 0.0.0.0 dev server warning. #3784
  • Drop unnecessary changefreq from sitemap.xml. #3629
  • Fix JavaScript console error when closing menu dropdown. #3774
  • Fix JavaScript console error that occur on repeated clicks. #3730
  • Fix JavaScript console error that can occur on dropdown selections. #3694

Added

  • Added translations for Dutch. #3804
  • Added and updated translations for Chinese (Simplified). #3684
Commits

Updates mkdocs-material to 9.8.0

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.8.0

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide. It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Dependency Affected versions New minimum Advisory
Jinja2 <=3.1.5 3.1.6 CVE-2025-27516
Markdown <3.8.1 3.8.1 CVE-2025-69534
Pygments <2.20.0 2.20.0 CVE-2026-4539
PyMdown Extensions <=11.0.0 11.0.1 CVE-2026-67422
Requests <2.33.0 2.33.0 CVE-2026-25645
Pillow <13.0.0 13.0.0 CVE-2026-96636
CairoSVG <=2.9.0 2.9.1 CVE-2026-107378
GitPython <=3.2.0 3.2.1 CVE-2026-114145

Pillow and CairoSVG apply to the imaging extra; GitPython applies to the git extra.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

PyMdown Extensions: affected <=11.0.0; new minimum 11.0.1 (CVE-2026-67422) GHSA-gm37-52c6-37mw

Requests: affected <2.33.0; new minimum 2.33.0 (CVE-2026-25645) GHSA-gc5v-m9x4-r6x2

... (truncated)

Commits
  • 0f72ad6 Merge pull request #8615 from squidfunk/fix/security
  • 85a048d Documentation
  • 10c572e Prepare 9.8.0 release
  • dd8a7ef Cleaned up unused assets
  • 8771cef Updated README
  • 7c9a1cc Updated changelog
  • 3ce9310 Removed redirects from recommended dependencies
  • 0b77e8f Updated CLI notice with end-of-life and migration guidance
  • 66e4f9c Updated project status and maintenance links
  • 1ed13d2 Removed RSS from recommended dependencies
  • Additional commits viewable in compare view

Updates setuptools to 84.2.1

Changelog

Sourced from setuptools's changelog.

v84.2.1

Bugfixes

  • Changed wheel tags and stable-ABI validation to use sysconfig data. (#5360)
  • Fixed unimportable extensions on free-threaded Python 3.13 and 3.14 when Extension.py_limited_api is enabled. These builds now use their version-specific extension suffix instead of using the unsupported .abi3t suffix. (#5363)

Improved Documentation

  • Replaced broken link to Python Eggs documentation with an archived version from the Wayback Machine. (#1929)

v84.2.0

Features

  • Added support for building abi3t extensions and abi3.abi3t wheels on Python 3.15 and newer. See :pep:803 and the Python 3.15 "What's New" entry <https://docs.python.org/3.15/whatsnew/3.15.html#pep-803-abi3t-stable-abi-for-free-threaded-builds>_ for more details. (#5193)
  • Updated vendored packaging version to 26.3, which adds support for the abi3t tag from :pep:803. (#5361)

Bugfixes

  • Use target sysconfig data for stable-ABI extension filenames. (#5351)

v84.1.0

Features

  • setuptools.archive_util now raises the new UnsafeMember exception when an archive member would be extracted outside of the extraction directory, where previously such a member was silently skipped. Aborting makes a malicious or malformed archive visible to the caller instead of yielding a quietly incomplete extraction, and matches the behavior of the standard

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
    ...

Description has been truncated

@dependabot
build(deps-dev): bump the dev-tooling group with 10 updates
d536159 
Updates the requirements on [ruff](https://github.com/astral-sh/ruff), [hypothesis](https://github.com/HypothesisWorks/hypothesis), [numpy](https://github.com/numpy/numpy), [openai](https://github.com/openai/openai-python), [cohere](https://github.com/cohere-ai/cohere-python), [anthropic](https://github.com/anthropics/anthropic-sdk-python), [sentence-transformers](https://github.com/huggingface/sentence-transformers), [mkdocs](https://github.com/mkdocs/mkdocs), [mkdocs-material](https://github.com/squidfunk/mkdocs-material) and [setuptools](https://github.com/pypa/setuptools) to permit the latest version.

Updates `ruff` to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.1...0.17.2)

Updates `hypothesis` to 6.170.9
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.170.1...v6.170.9)

Updates `numpy` to 2.4.6
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v1.26.0...v2.4.6)

Updates `openai` to 3.37.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v1.0.0...v3.37.0)

Updates `cohere` to 7.3.0
- [Release notes](https://github.com/cohere-ai/cohere-python/releases)
- [Commits](cohere-ai/cohere-python@5.0.0...7.3.0)

Updates `anthropic` to 2.3.0
- [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-python@v0.40.0...v2.3.0)

Updates `sentence-transformers` to 6.2.0
- [Release notes](https://github.com/huggingface/sentence-transformers/releases)
- [Commits](huggingface/sentence-transformers@v3.0.0...v6.2.0)

Updates `mkdocs` to 1.6.1
- [Release notes](https://github.com/mkdocs/mkdocs/releases)
- [Commits](mkdocs/mkdocs@1.6.0...1.6.1)

Updates `mkdocs-material` to 9.8.0
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.5.0...9.8.0)

Updates `setuptools` to 84.2.1
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v68.0.0...v84.2.1)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.17.2
  dependency-type: direct:development
  dependency-group: dev-tooling
- dependency-name: hypothesis
  dependency-version: 6.170.9
  dependency-type: direct:development
  dependency-group: dev-tooling
- dependency-name: numpy
  dependency-version: 2.4.6
  dependency-type: direct:development
  dependency-group: dev-tooling
- dependency-name: openai
  dependency-version: 3.37.0
  dependency-type: direct:development
  dependency-group: dev-tooling
- dependency-name: cohere
  dependency-version: 7.3.0
  dependency-type: direct:development
  dependency-group: dev-tooling
- dependency-name: anthropic
  dependency-version: 2.3.0
  dependency-type: direct:development
  dependency-group: dev-tooling
- dependency-name: sentence-transformers
  dependency-version: 6.2.0
  dependency-type: direct:development
  dependency-group: dev-tooling
- dependency-name: mkdocs
  dependency-version: 1.6.1
  dependency-type: direct:development
  dependency-group: dev-tooling
- dependency-name: mkdocs-material
  dependency-version: 9.8.0
  dependency-type: direct:development
  dependency-group: dev-tooling
- dependency-name: setuptools
  dependency-version: 84.2.1
  dependency-type: direct:development
  dependency-group: dev-tooling
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 28, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants