Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 1, 2025

Bumps the regular-version-updates group with 8 updates:

Package From To
cryptography 45.0.6 46.0.1
coverage 7.10.6 7.10.7
mypy 1.17.1 1.18.2
types-requests 2.32.4.20250809 2.32.4.20250913
pytest 8.4.1 8.4.2
pytest-cov 6.2.1 7.0.0
tox 4.29.0 4.30.2
twine 6.1.0 6.2.0

Updates cryptography from 45.0.6 to 46.0.1

Changelog

Sourced from cryptography's changelog.

46.0.1 - 2025-09-16


* Fixed an issue where users installing via ``pip`` on Python 3.14 development
  versions would not properly install a dependency.
* Fixed an issue building the free-threaded macOS 3.14 wheels.

.. _v46-0-0:

46.0.0 - 2025-09-16

  • BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been removed.
  • Support for OpenSSL < 3.0 is deprecated and will be removed in the next release.
  • Support for x86_64 macOS (including publishing wheels) is deprecated and will be removed in two releases. We will switch to publishing an arm64 only wheel for macOS.
  • Support for 32-bit Windows (including publishing wheels) is deprecated and will be removed in two releases. Users should move to a 64-bit Python installation.
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.3.
  • We now build ppc64le manylinux wheels and publish them to PyPI.
  • We now build win_arm64 (Windows on Arm) wheels and publish them to PyPI.
  • Added support for free-threaded Python 3.14.
  • Removed the deprecated get_attribute_for_oid method on :class:~cryptography.x509.CertificateSigningRequest. Users should use :meth:~cryptography.x509.Attributes.get_attribute_for_oid instead.
  • Removed the deprecated CAST5, SEED, IDEA, and Blowfish classes from the cipher module. These are still available in :doc:/hazmat/decrepit/index.
  • In X.509, when performing a PSS signature with a SHA-3 hash, it is now encoded with the official NIST SHA3 OID.

.. _v45-0-7:

45.0.7 - 2025-09-01


* Added a function to support an upcoming ``pyOpenSSL`` release.

.. _v45-0-6:

Commits

Updates coverage from 7.10.6 to 7.10.7

Changelog

Sourced from coverage's changelog.

Version 7.10.7 — 2025-09-21

  • Performance: with branch coverage in large files, generating HTML, JSON, or LCOV reports could take far too long due to some quadratic behavior when creating the function and class index pages. This is now fixed, closing issue 2048_. Thanks to Daniel Diniz for help diagnosing the problem.

  • Most warnings and a few errors now have links to a page in the docs explaining the specific message. Closes issue 1921_.

.. _issue 1921: nedbat/coveragepy#1921 .. _issue 2048: nedbat/coveragepy#2048

.. _changes_7-10-6:

Commits
  • 92a2af5 docs: sample HTML for 7.10.7
  • 952afda docs: prep for 7.10.7
  • a301761 build: riscv64 wheels (#2055)
  • 5daff8d docs: now source is formatted with ruff
  • 04bbc3a docs: discuss cog in the contributing docs
  • c181b93 build: use cog --check-fail-msg to instruct devs
  • 33c4ba1 chore: make upgrade
  • 0744b73 chore: bump the action-dependencies group across 1 directory with 2 updates (...
  • 0d5a112 perf: bulk narrowing to avoid N**2. #2048
  • a868ed9 docs: mention Python Discord on the index page
  • Additional commits viewable in compare view

Updates mypy from 1.17.1 to 1.18.2

Changelog

Sourced from mypy's changelog.

Mypy 1.18.2

  • Fix crash on recursive alias (Ivan Levkivskyi, PR 19845)
  • Add additional guidance for stubtest errors when runtime is object.__init__ (Stephen Morton, PR 19733)
  • Fix handling of None values in f-string expressions in mypyc (BobTheBuidler, PR 19846)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • Ali Hamdan
  • Anthony Sottile
  • BobTheBuidler
  • Brian Schubert
  • Chainfire
  • Charlie Denton
  • Christoph Tyralla
  • CoolCat467
  • Daniel Hnyk
  • Emily
  • Emma Smith
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jahongir Qurbonov
  • Jelle Zijlstra
  • Joren Hammudoglu
  • Jukka Lehtosalo
  • Marc Mueller
  • Omer Hadari
  • Piotr Sawicki
  • PrinceNaroliya
  • Randolf Scholz
  • Robsdedude
  • Saul Shanabrook
  • Shantanu
  • Stanislav Terliakov
  • Stephen Morton
  • wyattscarpenter

I’d also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 1.17

We’ve just uploaded mypy 1.17 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

... (truncated)

Commits
  • df05f05 remove +dev from version
  • 01a7a12 Update changelog for 1.18.2 (#19873)
  • ca5abf0 Typeshed cherry-pick: Make type of unitest.mock.Any a subclass of Any (#1...
  • 9d794b5 [mypyc] fix: inappropriate Nones in f-strings (#19846)
  • 2c0510c stubtest: additional guidance on errors when runtime is object.init (#19733)
  • 2f3f03c Bump version to 1.18.2+dev for point release
  • 7669841 Fix crash on recursive alias in indirection.py (#19845)
  • 03fbaa9 bump version to 1.18.1 due to wheels failure
  • b44a1fb removed +dev from version
  • 7197a99 Removed Unreleased in the Changelog for Release 1.18 (#19827)
  • Additional commits viewable in compare view

Updates types-requests from 2.32.4.20250809 to 2.32.4.20250913

Commits

Updates pytest from 8.4.1 to 8.4.2

Release notes

Sourced from pytest's releases.

8.4.2

pytest 8.4.2 (2025-09-03)

Bug fixes

  • #13478: Fixed a crash when using console_output_style{.interpreted-text role="confval"} with times and a module is skipped.

  • #13530: Fixed a crash when using pytest.approx{.interpreted-text role="func"} and decimal.Decimal{.interpreted-text role="class"} instances with the decimal.FloatOperation{.interpreted-text role="class"} trap set.

  • #13549: No longer evaluate type annotations in Python 3.14 when inspecting function signatures.

    This prevents crashes during module collection when modules do not explicitly use from __future__ import annotations and import types for annotations within a if TYPE_CHECKING: block.

  • #13559: Added missing [int]{.title-ref} and [float]{.title-ref} variants to the [Literal]{.title-ref} type annotation of the [type]{.title-ref} parameter in pytest.Parser.addini{.interpreted-text role="meth"}.

  • #13563: pytest.approx{.interpreted-text role="func"} now only imports numpy if NumPy is already in sys.modules. This fixes unconditional import behavior introduced in [8.4.0]{.title-ref}.

Improved documentation

  • #13577: Clarify that pytest_generate_tests is discovered in test modules/classes; other hooks must be in conftest.py or plugins.

Contributor-facing changes

  • #13480: Self-testing: fixed a few test failures when run with -Wdefault or a similar override.
  • #13547: Self-testing: corrected expected message for test_doctest_unexpected_exception in Python 3.14.
  • #13684: Make pytest's own testsuite insensitive to the presence of the CI environment variable -- by ogrisel{.interpreted-text role="user"}.
Commits
  • bfae422 Prepare release version 8.4.2
  • 8990538 Fix passenv CI in tox ini and make tests insensitive to the presence of the C...
  • ca676bf Merge pull request #13687 from pytest-dev/patchback/backports/8.4.x/e63f6e51c...
  • 975a60a Merge pull request #13686 from pytest-dev/patchback/backports/8.4.x/12bde8af6...
  • 7723ce8 Merge pull request #13683 from even-even/fix_Exeption_to_Exception_in_errorMe...
  • b7f0568 Merge pull request #13685 from CoretexShadow/fix/docs-pytest-generate-tests
  • 2c94c4a add missing colon (#13640) (#13641)
  • c3d7684 Merge pull request #13606 from pytest-dev/patchback/backports/8.4.x/5f9938563...
  • dc6e3be Merge pull request #13605 from The-Compiler/training-update-2025-07
  • f87289c Fix crash with times output style and skipped module (#13573) (#13579)
  • Additional commits viewable in compare view

Updates pytest-cov from 6.2.1 to 7.0.0

Changelog

Sourced from pytest-cov's changelog.

7.0.0 (2025-09-09)

  • Dropped support for subprocesses measurement.

    It was a feature added long time ago when coverage lacked a nice way to measure subprocesses created in tests. It relied on a .pth file, there was no way to opt-out and it created bad interations with coverage's new patch system <https://coverage.readthedocs.io/en/latest/config.html#run-patch>_ added in 7.10 <https://coverage.readthedocs.io/en/7.10.6/changes.html#version-7-10-0-2025-07-24>_.

    To migrate to this release you might need to enable the suprocess patch, example for .coveragerc:

    .. code-block:: ini

    [run] patch = subprocess

    This release also requires at least coverage 7.10.6.

  • Switched packaging to have metadata completely in pyproject.toml and use hatchling <https://pypi.org/project/hatchling/>_ for building. Contributed by Ofek Lev in [#551](https://github.com/pytest-dev/pytest-cov/issues/551) <https://github.com/pytest-dev/pytest-cov/pull/551>_ with some extras in [#716](https://github.com/pytest-dev/pytest-cov/issues/716) <https://github.com/pytest-dev/pytest-cov/pull/716>_.

  • Removed some not really necessary testing deps like six.

6.3.0 (2025-09-06)

  • Added support for markdown reports. Contributed by Marcos Boger in [#712](https://github.com/pytest-dev/pytest-cov/issues/712) <https://github.com/pytest-dev/pytest-cov/pull/712>_ and [#714](https://github.com/pytest-dev/pytest-cov/issues/714) <https://github.com/pytest-dev/pytest-cov/pull/714>_.
  • Fixed some formatting issues in docs. Anonymous contribution in [#706](https://github.com/pytest-dev/pytest-cov/issues/706) <https://github.com/pytest-dev/pytest-cov/pull/706>_.
Commits
  • 224d896 Bump version: 6.3.0 → 7.0.0
  • 73424e3 Cleanup the docs a bit.
  • 36f1cc2 Bump pins in template.
  • f299c59 Bump the github-actions group with 2 updates
  • 25f0b2e Update docs/config.rst
  • bb23eac Improve configuration docs
  • a19531e Switch from build/pre-commit to uv/prek - this should make this faster.
  • 82f9993 Update changelog.
  • 211b5cd Fix links.
  • 97aadd7 Update some ci config, reformat and apply some lint fixes.
  • Additional commits viewable in compare view

Updates tox from 4.29.0 to 4.30.2

Release notes

Sourced from tox's releases.

4.30.2

What's Changed

Full Changelog: tox-dev/tox@4.30.1...4.30.2

4.30.1

What's Changed

New Contributors

Full Changelog: tox-dev/tox@4.30.0...4.30.1

4.30.0

What's Changed

New Contributors

Full Changelog: tox-dev/tox@4.29.0...4.30.0

Changelog

Sourced from tox's changelog.

v4.30.2 (2025-09-04)

Bugfixes - 4.30.2

- Previously, when tox ran in an automatically provisioned environment, it could hang waiting for a PEP 517 build backend
  if used in conjunction with the ``--installpkg`` option. This has been fixed by properly tearing down the automatically
  provisioned environment after the tests.
  - by :user:`vytas7` (:issue:`3600`)

v4.30.1 (2025-09-03)

Bugfixes - 4.30.1

  • Prevent tox from hanging upon exit due to orphaned build threads and subprocesses when the --installpkg option is used with sdist.
    • by :user:vytas7 (:issue:3530)

v4.30.0 (2025-09-03)

Features - 4.30.0

- Add ``__TOX_ENVIRONMENT_VARIABLE_ORIGINAL_CI``, which passes through the ``CI`` variable if present. This is intended for use by other libraries to detect if tox is running under CI. (:issue:`3442`)

Bugfixes - 4.30.0

  • Makes the error message more clear when pyproject.toml file cannot be loaded or is missing expected keys. (:issue:3578)

  • The :func:tox_extend_envs() hook <tox.plugin.spec.tox_extend_envs> recently added in :pull:3591 turned out to not work well with tox run. It was fixed internally, not to exhaust the underlying iterator on the first use.

    -- by :user:webknjaz (:issue:3598)

Commits
  • 5e0784a release 4.30.2
  • 64e8a34 Bump pypa/gh-action-pypi-publish in /.github/workflows (#3604)
  • 7230088 Ensure automatically provisioned environment is torn down (#3601)
  • 2c31dbc Bump pypa/gh-action-pypi-publish from 1.12.4 to 1.13.0 (#3603)
  • b33a43c release 4.30.1
  • 9ea1c32 Prevent Tox from hanging with --installpkg sdist due to orphaned build back...
  • aa90652 release 4.30.0
  • 48fecab Ensure tox_extend_envs list can be read twice (#3598)
  • 0b8f66f fix: provide clear messaging about config file loading (#3578)
  • adf0997 Add a "version added" note for tox_extend_envs (#3595)
  • Additional commits viewable in compare view

Updates twine from 6.1.0 to 6.2.0

Changelog

Sourced from twine's changelog.

twine 6.2.0 (2025-09-04)

Features ^^^^^^^^

  • Automatically refresh short-lived PyPI token in long running Trusted Publishing uploads.

    In the event that a trusted publishing upload job is taking longer than the validity period of a trusted publishing token (15 minutes at the time of this writing), and we are already 10 minutes into that validity period, we will begin to attempt to replace the token on each subsequent request. ([#1246](https://github.com/pypa/twine/issues/1246) <https://github.com/pypa/twine/issues/1246>_)

Bugfixes ^^^^^^^^

  • Fix compatibility kludge for invalid License-File metadata entries emitted by build backends to work also with packaging version 24.0. ([#1217](https://github.com/pypa/twine/issues/1217) <https://github.com/pypa/twine/issues/1217>_)
  • Fix a couple of incorrectly rendered error messages. ([#1224](https://github.com/pypa/twine/issues/1224) <https://github.com/pypa/twine/issues/1224>_)
  • twine now enforces keyring >= 21.2.0, which was previously implicitly required by API usage. ([#1229](https://github.com/pypa/twine/issues/1229) <https://github.com/pypa/twine/issues/1229>_)
  • twine now catches configparser.Error to prevent accidental leaks of secret tokens or passwords to the user's console. ([#1240](https://github.com/pypa/twine/issues/1240) <https://github.com/pypa/twine/issues/1240>_)

Deprecations and Removals ^^^^^^^^^^^^^^^^^^^^^^^^^

  • Remove hacks that support --skip-existing for indexes other than PyPI and TestPyPI.

    To date, these hacks continue to accrue and there have been numerous issues with them, not the least of which being that every time we update them, the paid index providers change things to break the compatibility we implement for them. Beyond that, these hacks do not work when text is internationalized in the response from the index provider.

    For a sample of past issues, see:

... (truncated)

Commits
  • 14ceb29 Update changelog for 6.2.0 (#1264)
  • 60e377b build(deps): bump actions/checkout from 4.2.2 to 5.0.0 (#1263)
  • 88821f2 feat(package): remove MD5 hashing entirely (#1262)
  • ce5fe53 build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0
  • 6a696ed PEP 639 compliance
  • 9175334 rename 1247.misc.rst to changelog/1247.misc.rst
  • d94a475 fix(tests): update expected error message
  • c1c02d1 Remove --skip-existing support for non-PyPI indices
  • a24d308 Set trusted publishing logging to INFO/WARN (#1247)
  • becf1a8 Fix py3.9 mypy error in __init__ around PackageMetadata
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the regular-version-updates group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [cryptography](https://github.com/pyca/cryptography) | `45.0.6` | `46.0.1` |
| [coverage](https://github.com/nedbat/coveragepy) | `7.10.6` | `7.10.7` |
| [mypy](https://github.com/python/mypy) | `1.17.1` | `1.18.2` |
| [types-requests](https://github.com/typeshed-internal/stub_uploader) | `2.32.4.20250809` | `2.32.4.20250913` |
| [pytest](https://github.com/pytest-dev/pytest) | `8.4.1` | `8.4.2` |
| [pytest-cov](https://github.com/pytest-dev/pytest-cov) | `6.2.1` | `7.0.0` |
| [tox](https://github.com/tox-dev/tox) | `4.29.0` | `4.30.2` |
| [twine](https://github.com/pypa/twine) | `6.1.0` | `6.2.0` |


Updates `cryptography` from 45.0.6 to 46.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@45.0.6...46.0.1)

Updates `coverage` from 7.10.6 to 7.10.7
- [Release notes](https://github.com/nedbat/coveragepy/releases)
- [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.10.6...7.10.7)

Updates `mypy` from 1.17.1 to 1.18.2
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.17.1...v1.18.2)

Updates `types-requests` from 2.32.4.20250809 to 2.32.4.20250913
- [Commits](https://github.com/typeshed-internal/stub_uploader/commits)

Updates `pytest` from 8.4.1 to 8.4.2
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@8.4.1...8.4.2)

Updates `pytest-cov` from 6.2.1 to 7.0.0
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v6.2.1...v7.0.0)

Updates `tox` from 4.29.0 to 4.30.2
- [Release notes](https://github.com/tox-dev/tox/releases)
- [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst)
- [Commits](tox-dev/tox@4.29.0...4.30.2)

Updates `twine` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/pypa/twine/releases)
- [Changelog](https://github.com/pypa/twine/blob/main/docs/changelog.rst)
- [Commits](pypa/twine@6.1.0...6.2.0)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: regular-version-updates
- dependency-name: coverage
  dependency-version: 7.10.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: regular-version-updates
- dependency-name: mypy
  dependency-version: 1.18.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: regular-version-updates
- dependency-name: types-requests
  dependency-version: 2.32.4.20250913
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: regular-version-updates
- dependency-name: pytest
  dependency-version: 8.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: regular-version-updates
- dependency-name: pytest-cov
  dependency-version: 7.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: regular-version-updates
- dependency-name: tox
  dependency-version: 4.30.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: regular-version-updates
- dependency-name: twine
  dependency-version: 6.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: regular-version-updates
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 1, 2025
@dependabot dependabot bot requested a review from a team as a code owner October 1, 2025 00:05
@dependabot dependabot bot requested a review from ohemorange October 1, 2025 00:05
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 1, 2025
@ohemorange ohemorange merged commit 31b936f into main Oct 1, 2025
19 checks passed
@ohemorange ohemorange deleted the dependabot/pip/regular-version-updates-008607ef5b branch October 1, 2025 17:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants