Skip to content

chore(deps): bump the python-minor-patch group across 1 directory with 6 updates - #309

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-e789eb12dd
Open

chore(deps): bump the python-minor-patch group across 1 directory with 6 updates#309
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-e789eb12dd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 6 updates in the / directory:

Package From To
packaging 26.2 26.3
ruff 0.16.1 0.16.2
uv 0.12.0 0.12.3
pre-commit 4.6.1 4.6.2
hatch 1.17.1 1.18.0
hatchling 1.31.0 1.32.0

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

    

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
    • 

  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
    • 

  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
    • 

  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
    • 

  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
    • 

  • Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
    • 



Behavior adaptations:


    

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
    • 

  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
    • 



Fixes for versions and specifiers:


    

  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
    • 

  • Raise InvalidVersion for non-string pre-release letters passed to
    
Version.from_parts. (:pull:1241)
    • 

  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
    • 

  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
    • 



Fixes for requirements and markers:


    

  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    
foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates ruff from 0.16.1 to 0.16.2

Release notes

Sourced from ruff's releases.

0.16.2

Release Notes

Released on 2026-08-06.

Bug fixes

  • [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

  • Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

Install ruff 0.16.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.ps1 | iex"

Download ruff 0.16.2

File Platform Checksum
ruff-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
ruff-x86_64-apple-darwin.tar.gz Intel macOS checksum
ruff-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
ruff-i686-pc-windows-msvc.zip x86 Windows checksum
ruff-x86_64-pc-windows-msvc.zip x64 Windows checksum
ruff-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
ruff-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz PPC64 Linux checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
ruff-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum
ruff-s390x-unknown-linux-gnu.tar.gz S390x Linux checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.2

Released on 2026-08-06.

Bug fixes

  • [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

  • Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

Commits
  • 5b48a04 Bump 0.16.2 (#27555)
  • 1b9e5fc Update Swatinem/rust-cache action to v2.9.2 (#27568)
  • c4e86fc [ty] Add helper extension methods for half-range and equality constraints (#2...
  • 17a00de [ty] Reuse primer commands in memory reports (#27553)
  • 6ea296b [ty] Normalize type labels in structured docstrings (#26923)
  • 2fc445f [ty] Diagnose invalid getattr calls (#27502)
  • 22c7823 [ty] Enable (but downrank) auto-import completion suggestions from stub-only ...
  • 05160d5 [ty] Diagnose invalid descriptor __get__ calls (#27400)
  • baea3d0 [ty] Expose strict analysis options in the playground (#27543)
  • c88946e [ty] Bump ecosystem-analyzer for strict project settings (#27542)
  • Additional commits viewable in compare view

Updates uv from 0.12.0 to 0.12.3

Release notes

Sourced from uv's releases.

0.12.3

Release Notes

Released on 2026-08-07.

Python

  • Add CPython 3.13.15 (#20997)

Preview features

  • Add --output-format to select automatic, human-readable, or raw-byte output for uv cache size (#20992)
  • Preserve JSON output from uv workspace metadata --quiet while suppressing diagnostics (#20991)
  • Reduce memory usage for large workspaces by streaming uv workspace metadata JSON output (#20990)

Performance

  • Reduce Linux startup latency by initializing the workspace cache before spawning another thread (#20989)
  • Reuse compiled workspace exclusion patterns during workspace discovery (#20988)
  • Speed up conflict-heavy resolutions by avoiding materialized range complements (#20982)
  • Avoid slow procfs reads during Python interpreter discovery on Linux (#20987)

Documentation

  • Add PEP 740 attestations to the GitHub Actions publishing example (#20986)
  • Restrict the GitHub Actions publishing example to Python version tags (#20973)
  • Correct --python-pin to --pin-python in the uv init --bare example (#20876)

Install uv 0.12.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.3/uv-installer.ps1 | iex"

Download uv 0.12.3

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.3

Released on 2026-08-07.

Python

  • Add CPython 3.13.15 (#20997)

Preview features

  • Add --output-format to select automatic, human-readable, or raw-byte output for uv cache size (#20992)
  • Preserve JSON output from uv workspace metadata --quiet while suppressing diagnostics (#20991)
  • Reduce memory usage for large workspaces by streaming uv workspace metadata JSON output (#20990)

Performance

  • Reduce Linux startup latency by initializing the workspace cache before spawning another thread (#20989)
  • Reuse compiled workspace exclusion patterns during workspace discovery (#20988)
  • Speed up conflict-heavy resolutions by avoiding materialized range complements (#20982)
  • Avoid slow procfs reads during Python interpreter discovery on Linux (#20987)

Documentation

  • Add PEP 740 attestations to the GitHub Actions publishing example (#20986)
  • Restrict the GitHub Actions publishing example to Python version tags (#20973)
  • Correct --python-pin to --pin-python in the uv init --bare example (#20876)

0.12.2

Released on 2026-08-05.

Python

  • Add CPython 3.15.0rc1 (#20948)
  • Add CPython 3.14.7 (#20971)

Enhancements

  • Ensure diagnostic hints end with a newline to prevent malformed terminal output (#20959)

Preview features

  • Audit one or all installed tools with uv tool audit (#20921)
  • Report physically reclaimed disk space during cache cleanup with the cache-physical-space preview feature (#20925)

Configuration

  • Add UV_RUN_RLIMIT_NOFILE to set the open-file limit for commands launched by uv run (#20926)

Performance

... (truncated)

Commits

Updates pre-commit from 4.6.1 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

Commits

Updates hatch from 1.17.1 to 1.18.0

Release notes

Sourced from hatch's releases.

Hatchling v1.18.0

Changed:

  • Drop support for Python 3.7

Added:

  • Update the list of directories that are always excluded for builds

Hatch v1.18.0

Changed:

  • Upgrade default CPython distributions to 20260807

Added:

  • Add the sources environment option, which redirects dependencies to a local path, Git repository, URL, alternate index, or workspace member at install time without altering published metadata. The top-level [tool.hatch.sources] table is an alias for the default environment, environments inherit sources entry by entry, the HATCH_NO_SOURCES environment variable disables them, and hatch dep show sources reports what each source redirects

  • Add the --all/-a flag to the build command to build the workspace root and every workspace member defined by the selected environment, consolidating artifacts in the workspace root's dist directory by default. A root that does not define a project table is skipped so that a top-level pyproject.toml may only contain workspace configuration

  • Add the tool.hatch.requires-hatch field, a version specifier set that commands reading the project's metadata enforce against the running version of Hatch

  • Add first-class support for free-threaded distribution names such as 3.13t and 3.14t to the python commands and environment python option, rather than requiring the HATCH_PYTHON_VARIANT_GIL environment variable

  • The version command can now bump versions that are statically defined by the project.version field, updating pyproject.toml in place. Pass --force to allow an explicit downgrade

  • Support managing Python 3.15 distributions, currently 3.15.0rc1

Fixed:

  • Erase stale coverage data before running hatch test --cover.

  • Fix environment creation crashing when a metadata hook exists that doesn’t happen to be installed in the hatch CLI’s environment.

  • Fix commands run by hatch run no longer being interruptible with Ctrl-C, which happened because the ignored SIGINT of the parent process was inherited by the child process.

  • Fix the generated Pyrefly config being invalid on Windows, since backslashes in the absolute paths were interpreted as TOML escape sequences.

  • Fix the hardcoded reliance on pip when installing dependencies internally by using uv instead.

  • Fix environment creation silently installing a GIL-enabled Python distribution when Hatch itself runs on a free-threaded build. The distribution matching the running interpreter, such as 3.14t, is now selected.

  • Fix free-threaded selectors such as 3.14t being rejected by an environment's python option, even though hatch python install 3.14t already accepted them.

  • Never automatically select a prerelease Python distribution, such as 3.15.0rc1, when falling back to the latest compatible version. A prerelease is still installed when requested explicitly.

Commits
  • 558061c Fix ci (#2377)
  • bc6d1bc release Hatch v1.18.0 (#2376)
  • 8429e5d release Hatchling v1.32.0 (#2375)
  • 413b3a8 Prepare for release (#2374)
  • 4ccc9ea Bug Fix - fix CTRL-C behavior to correctly handle signals (#2369)
  • a885803 Add sources to enable other types of local dependencies (#2313)
  • ab3e000 Add --all flag to hatch build for building all workspace members (#2352)
  • bb90277 fix: Allow the ; private annotation in import-names/import-namespaces p...
  • 3a9d853 fix: prevent backward relative paths in readme (#2354)
  • c4dc4f8 test: Fix test expectations for metadata generated by flit-core (#2365)
  • Additional commits viewable in compare view

Updates hatchling from 1.31.0 to 1.32.0

Release notes

Sourced from hatchling's releases.

Hatchling v1.32.0

Changed:

  • Bump default core metadata version to 2.5

  • Add tomlkit as a runtime dependency, which is required to rewrite pyproject.toml when setting a static version

Added:

  • The version command can now set a version that is statically defined by the project.version field, updating pyproject.toml in place. Pass --force to allow an explicit downgrade

Fixed:

  • Allow the ; private annotation on project.import-names and project.import-namespaces entries rather than rejecting them as invalid import names.

  • Reject project.readme paths that are absolute or resolve outside of the project directory.

Commits
  • 558061c Fix ci (#2377)
  • bc6d1bc release Hatch v1.18.0 (#2376)
  • 8429e5d release Hatchling v1.32.0 (#2375)
  • 413b3a8 Prepare for release (#2374)
  • 4ccc9ea Bug Fix - fix CTRL-C behavior to correctly handle signals (#2369)
  • a885803 Add sources to enable other types of local dependencies (#2313)
  • ab3e000 Add --all flag to hatch build for building all workspace members (#2352)
  • bb90277 fix: Allow the ; private annotation in import-names/import-namespaces p...
  • 3a9d853 fix: prevent backward relative paths in readme (#2354)
  • c4dc4f8 test: Fix test expectations for metadata generated by flit-core (#2365)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 18, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 18, 2026 12:46
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 18, 2026
@socket-security

socket-security Bot commented Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​pre-commit@​4.6.1 ⏵ 4.6.293 +1100100100100
Updatedpypi/​hatch@​1.17.1 ⏵ 1.18.094100100100100
Updatedpypi/​packaging@​26.2 ⏵ 26.399 +1100100100100
Updatedpypi/​uv@​0.12.0 ⏵ 0.12.3100 +1100100100100
Updatedpypi/​ruff@​0.16.1 ⏵ 0.16.2100 +1100100100100

View full report

@socket-security-staging

socket-security-staging Bot commented Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​pre-commit@​4.6.1 ⏵ 4.6.293 +1100100100100
Updatedpypi/​hatch@​1.17.1 ⏵ 1.18.095100100100100
Updatedpypi/​packaging@​26.2 ⏵ 26.399 +1100100100100
Updatedpypi/​uv@​0.12.0 ⏵ 0.12.3100 +1100100100100
Updatedpypi/​ruff@​0.16.1 ⏵ 0.16.2100 +1100100100100

View full report

@dependabot
chore(deps): bump the python-minor-patch group across 1 directory wit…
0721d2e 
…h 6 updates

Bumps the python-minor-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.1` | `0.16.2` |
| [uv](https://github.com/astral-sh/uv) | `0.12.0` | `0.12.3` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.1` | `4.6.2` |
| [hatch](https://github.com/pypa/hatch) | `1.17.1` | `1.18.0` |
| [hatchling](https://github.com/pypa/hatch) | `1.31.0` | `1.32.0` |



Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.2...26.3)

Updates `ruff` from 0.16.1 to 0.16.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.1...0.16.2)

Updates `uv` from 0.12.0 to 0.12.3
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.0...0.12.3)

Updates `pre-commit` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.1...v4.6.2)

Updates `hatch` from 1.17.1 to 1.18.0
- [Release notes](https://github.com/pypa/hatch/releases)
- [Commits](pypa/hatch@hatch-v1.17.1...hatch-v1.18.0)

Updates `hatchling` from 1.31.0 to 1.32.0
- [Release notes](https://github.com/pypa/hatch/releases)
- [Commits](pypa/hatch@hatchling-v1.31.0...hatchling-v1.32.0)

---
updated-dependencies:
- dependency-name: hatch
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: hatchling
  dependency-version: 1.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: uv
  dependency-version: 0.12.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-patch-e789eb12dd branch from a8067c1 to 0721d2e Compare August 19, 2026 20:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants