Skip to content

build(deps): bump the python group across 1 directory with 7 updates - #16758

Merged
rmuir merged 1 commit into
mainfrom
dependabot/uv/dev-tools/python-9035bf8914
Oct 2, 2026
Merged

build(deps): bump the python group across 1 directory with 7 updates#16758
rmuir merged 1 commit into
mainfrom
dependabot/uv/dev-tools/python-9035bf8914

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python group with 7 updates in the /dev-tools directory:

Package From To
prek 0.5.2 0.5.3
zizmor 1.30.0 1.30.1
rumdl 0.2.62 0.2.76
ruff 0.16.5 0.16.9
typos 1.50.1 1.50.2
holidays 0.103 0.105
ty 0.0.77 0.0.84

Updates prek from 0.5.2 to 0.5.3

Release notes

Sourced from prek's releases.

0.5.3

Release Notes

Released on 2026-09-13.

Enhancements

  • Add PEP 740 attestations for PyPI releases (#2705)
  • Add a check-jsonc builtin hook (#2682)
  • Allow disabling automatic uv installation (#2702)

Bug fixes

  • Fix Julia additional dependency specifiers (#2703)
  • Update granit-parser to fix YAML flow indentation (#2707)

Contributors

Install prek 0.5.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.3

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.3

Released on 2026-09-13.

Enhancements

  • Add PEP 740 attestations for PyPI releases (#2705)
  • Add a check-jsonc builtin hook (#2682)
  • Allow disabling automatic uv installation (#2702)

Bug fixes

  • Fix Julia additional dependency specifiers (#2703)
  • Update granit-parser to fix YAML flow indentation (#2707)

Contributors

Commits

Updates zizmor from 1.30.0 to 1.30.1

Release notes

Sourced from zizmor's releases.

v1.30.1

Sponsorship is appreciated!

Bug Fixes 🐛🔗

  • Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)

  • Fixed a bug where self-repository auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#2373)

Changelog

Sourced from zizmor's changelog.

1.30.1

Bug Fixes 🐛

  • Fixed a bug where zizmor would crash on pre-commit inputs that reference a GitHub URL with an explicit .git suffix (#2363)

  • Fixed a bug where [self-repository] auto-fixes were incorrectly marked as "safe" instead of "unsafe" (#2373)

Commits

Updates rumdl from 0.2.62 to 0.2.76

Release notes

Sourced from rumdl's releases.

v0.2.76

Added

  • MD094: report each invalid UTF-8 sequence, with its position (6c25d76)
  • encoding: lint files containing invalid UTF-8 instead of skipping them (f531bf4)

Fixed

  • MD013: leave definition lists as written when reflowing, instead of moving a definition's later paragraph out of the list (93ab135)
  • MD013: keep every block of consecutive mkdocstrings blocks out of reflow (7199b0a)
  • MD013: recognize mkdocstrings blocks whose identifier has no dot (31b56ea)
  • cli: report a skipped file on the same stream as the run's other findings, not always stderr (9558bc5)
  • MD092: follow the invocation's rule selection (b0dfbe2)
  • lint-context: record only CommonMark headings as headings (1479a1e)
  • cli: name every ignore file --respect-gitignore controls (268a54d)
  • discovery: attribute empty runs to .markdownlintignore separately (834e10c)

Downloads

File Platform Checksum
rumdl-v0.2.76-x86_64-unknown-linux-gnu.tar.gz Linux x86_64 checksum
rumdl-v0.2.76-x86_64-unknown-linux-musl.tar.gz Linux x86_64 (musl) checksum
rumdl-v0.2.76-aarch64-unknown-linux-gnu.tar.gz Linux ARM64 checksum
rumdl-v0.2.76-aarch64-unknown-linux-musl.tar.gz Linux ARM64 (musl) checksum
rumdl-v0.2.76-x86_64-apple-darwin.tar.gz macOS x86_64 checksum
rumdl-v0.2.76-aarch64-apple-darwin.tar.gz macOS ARM64 (Apple Silicon) checksum
rumdl-v0.2.76-x86_64-pc-windows-msvc.zip Windows x86_64 checksum

Installation

Using uv (Recommended)

uv tool install rumdl

Using pip

pip install rumdl

Using pipx

pipx install rumdl

Direct Download

Download the appropriate binary for your platform from the table above, extract it, and add it to your PATH.

... (truncated)

Changelog

Sourced from rumdl's changelog.

0.2.76 - 2026-09-23

Added

  • MD094: report each invalid UTF-8 sequence, with its position (6c25d76)
  • encoding: lint files containing invalid UTF-8 instead of skipping them (f531bf4)

Fixed

  • MD013: leave definition lists as written when reflowing, instead of moving a definition's later paragraph out of the list (93ab135)
  • MD013: keep every block of consecutive mkdocstrings blocks out of reflow (7199b0a)
  • MD013: recognize mkdocstrings blocks whose identifier has no dot (31b56ea)
  • cli: report a skipped file on the same stream as the run's other findings, not always stderr (9558bc5)
  • MD092: follow the invocation's rule selection (b0dfbe2)
  • lint-context: record only CommonMark headings as headings (1479a1e)
  • cli: name every ignore file --respect-gitignore controls (268a54d)
  • discovery: attribute empty runs to .markdownlintignore separately (834e10c)

0.2.75 - 2026-09-20

Added

  • md093: add opt-in rule for inline formatting in headings (ed627ef)

Fixed

  • md013: add opt-in link text wrapping (effdb6a)
  • MD013: protect opt-in bracket display math during reflow (e2c7fe8)
  • MD044: add opt-in whole-word matching for identifiers (013621e)

0.2.74 - 2026-09-18

Added

  • code-block-tools: add explicit rumdl, oxfmt, djlint, and shuck modes (77f0e55)

Fixed

  • MD092: allow scoped suppression of documented conflicts (6f9a6cb)
  • MD032: keep parent list items open after nested lists (952c507)
  • MD026: delete a setext heading's trailing punctuation where it stands (7f0981c)
  • parser: keep link reference definitions out of a setext heading (80fdfc3)
  • parser: read the whole paragraph as a setext heading (5d7b046)
  • parser: lint the headings a short or quoted setext underline makes (e183924)
  • parser: keep a container open below a block written inside it (e2c13b7)
  • parser: read an empty list item under a paragraph as its text (68a04ae)
  • MD013: write one space at a soft break after a trailing space (6388794)
  • MD013: keep a whole-line display math expression on its own line (cc518ab)
  • MD013: read no math span through a code span (f069246)
  • MD013: keep a definition-list marker written on its own line (7e11b9e)

... (truncated)

Commits
  • 389e12b chore(changelog): list every change in the 0.2.76 section
  • 6934624 fix(MD094): report invalid UTF-8 under --only-code-block-tools
  • 93ab135 fix(MD013): leave definition lists as written when reflowing
  • 7199b0a fix(MD013): keep every block of consecutive mkdocstrings blocks out of reflow
  • 31b56ea fix(MD013): recognize mkdocstrings blocks whose identifier has no dot
  • 9558bc5 fix(cli): report a skipped file where the run reports findings
  • b0dfbe2 fix(MD092): follow the invocation's rule selection
  • 6c25d76 feat(MD094): report invalid UTF-8 instead of refusing the file
  • f7dc5d9 update rumdl schema
  • f531bf4 feat(encoding): lint files with non-UTF8 chars
  • Additional commits viewable in compare view

Updates ruff from 0.16.5 to 0.16.9

Release notes

Sourced from ruff's releases.

0.16.9

Release Notes

Released on 2026-09-24.

Preview features

  • [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

  • [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
  • [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

  • Update LibCST-based fixes for Python 3.15 (#28616)
  • [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

  • Fix horizontal overflow on the rules documentation page (#28699)
  • Update rules table with category information (#28651)
  • [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
  • [flake8-bugbear] Document type-checker interaction (B010) (#28509)
  • [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
  • [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

Install ruff 0.16.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.9

Released on 2026-09-24.

Preview features

  • [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

  • [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
  • [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

  • Update LibCST-based fixes for Python 3.15 (#28616)
  • [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

  • Fix horizontal overflow on the rules documentation page (#28699)
  • Update rules table with category information (#28651)
  • [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
  • [flake8-bugbear] Document type-checker interaction (B010) (#28509)
  • [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
  • [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

0.16.8

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)

... (truncated)

Commits
  • 0be08a2 Bump version to 0.16.9 (#28882)
  • b4920b7 Rename ruff_cli to ruff_command_line (#28881)
  • 47c751b Update dependency astral-sh/uv to v0.12.18 (#28880)
  • 8c244e5 [flake8-comprehensions] Document map/generator exception behavior (C417...
  • 5edf5a1 Use target form in rooster.version_files (#28876)
  • 915bb2b [ty] Prefer existing @ paths over response files in Ruff and ty (#28877)
  • 4710e1a ci(github): update version number in placeholder of issue template (#28871)
  • eedfc62 [ty] Propagate outer type context through cast calls (#28855)
  • ceaa6a0 [ty] Contain rendered code within Markdown fences (#28869)
  • dba0f30 authorize ruff-pre-commit dispatch via OIDC (#28867)
  • Additional commits viewable in compare view

Updates typos from 1.50.1 to 1.50.2

Release notes

Sourced from typos's releases.

v1.50.2

[1.50.2] - 2026-09-15

Fixes

  • Don't panic when files being examined are removed
Changelog

Sourced from typos's changelog.

[1.50.2] - 2026-09-15

Fixes

  • Don't panic when files being examined are removed
Commits
  • 512fc24 chore: Release
  • 982cd9f docs: Update changelog
  • 6edd83e Merge pull request #1617 from nightah/fix-1444-walk-canonicalize-panic
  • 160d792 fix(cli): Don't panic when canonicalize fails mid-walk
  • 25761c7 test(cli): Show panic when canonicalize fails mid-walk
  • See full diff in compare view

Updates holidays from 0.103 to 0.105

Release notes

Sourced from holidays's releases.

v0.105

Version 0.105

Released September 21, 2026

New Contributors:

Full Changelog: vacanza/holidays@v0.104...v0.105

v0.104

Version 0.104

Released September 7, 2026

... (truncated)

Changelog

Sourced from holidays's changelog.

Version 0.105

Released September 21, 2026

Version 0.104

Released September 7, 2026

Commits
  • 532c3ce Merge pull request #3833 from vacanza/dev
  • 4ca8b83 Finalize v0.105
  • cc9c9bc Add support for special holidays inheritance from parent entity (#3830)
  • 636ac52 chore: Update snapshots (#3831)
  • bd3114d Update India holidays: subdiv holidays improvement (East, North-East & South ...
  • 9490dfe Update Indonesia holidays: add 2027 special holidays (#3828)
  • ba5f6b9 Bump the version-updates group with 3 updates (#3824)
  • a85303a Bump the version-updates group with 2 updates (#3825)
  • 899cfe4 Bump the version-updates group with 2 updates (#3826)
  • efab764 chore: Update snapshots (#3823)
  • Additional commits viewable in compare view

Updates ty from 0.0.77 to 0.0.84

Release notes

Sourced from ty's releases.

0.0.84

Release Notes

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

  • Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

  • Complete string keys from dictionary initializers (#28820)
  • Support LSP requests against closed documents (#28595)
  • Select projects for external files using import search paths (#28594)
  • Use workspace editor settings for external files (#28639)

Performance

  • Avoid repeated subtyping checks for materialized recursive protocols (#28774)
  • Skip reading notebooks when discovering scripts (#28781)

Core type checking

  • Avoid incorrect simplification of TypeIs materializations (#28817)
  • Fix disjointness of generic class types (#28787)
  • Fix staticmethod shadowing through generic receivers and unions (#28766)
  • Infer callable signatures from bounded type variables (#28599)
  • Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
  • Infer through optional generic containers in the legacy solver (#28791)
  • Preserve call narrowing during cyclic inference (#28708)
  • Preserve intersections of type guard return types (#28796)
  • Use subtyping for constraint-set implication (#28657)

Configuration

  • Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

  • Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.84

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

  • Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

  • Complete string keys from dictionary initializers (#28820)
  • Support LSP requests against closed documents (#28595)
  • Select projects for external files using import search paths (#28594)
  • Use workspace editor settings for external files (#28639)

Performance

  • Avoid repeated subtyping checks for materialized recursive protocols (#28774)
  • Skip reading notebooks when discovering scripts (#28781)

Core type checking

  • Avoid incorrect simplification of TypeIs materializations (#28817)
  • Fix disjointness of generic class types (#28787)
  • Fix staticmethod shadowing through generic receivers and unions (#28766)
  • Infer callable signatures from bounded type variables (#28599)
  • Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
  • Infer through optional generic containers in the legacy solver (#28791)
  • Preserve call narrowing during cyclic inference (#28708)
  • Preserve intersections of type guard return types (#28796)
  • Use subtyping for constraint-set implication (#28657)

Configuration

  • Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

  • Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Dependency Updates skip-changelog Apply to PRs that don't need a changelog entry, stopping the automated changelog check. labels Oct 1, 2026
@dependabot
build(deps): bump the python group across 1 directory with 7 updates
0e90151 
Bumps the python group with 7 updates in the /dev-tools directory:

| Package | From | To |
| --- | --- | --- |
| [prek](https://github.com/j178/prek) | `0.5.2` | `0.5.3` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.30.0` | `1.30.1` |
| [rumdl](https://github.com/rvben/rumdl) | `0.2.62` | `0.2.76` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.5` | `0.16.9` |
| [typos](https://github.com/crate-ci/typos) | `1.50.1` | `1.50.2` |
| [holidays](https://github.com/vacanza/holidays) | `0.103` | `0.105` |
| [ty](https://github.com/astral-sh/ty) | `0.0.77` | `0.0.84` |



Updates `prek` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.5.2...v0.5.3)

Updates `zizmor` from 1.30.0 to 1.30.1
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.30.0...v1.30.1)

Updates `rumdl` from 0.2.62 to 0.2.76
- [Release notes](https://github.com/rvben/rumdl/releases)
- [Changelog](https://github.com/rvben/rumdl/blob/main/CHANGELOG.md)
- [Commits](rvben/rumdl@v0.2.62...v0.2.76)

Updates `ruff` from 0.16.5 to 0.16.9
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.5...0.16.9)

Updates `typos` from 1.50.1 to 1.50.2
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/main/CHANGELOG.md)
- [Commits](crate-ci/typos@v1.50.1...v1.50.2)

Updates `holidays` from 0.103 to 0.105
- [Release notes](https://github.com/vacanza/holidays/releases)
- [Changelog](https://github.com/vacanza/holidays/blob/dev/CHANGES.md)
- [Commits](vacanza/holidays@v0.103...v0.105)

Updates `ty` from 0.0.77 to 0.0.84
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.77...0.0.84)

---
updated-dependencies:
- dependency-name: holidays
  dependency-version: '0.105'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: prek
  dependency-version: 0.5.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.16.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: rumdl
  dependency-version: 0.2.76
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: ty
  dependency-version: 0.0.84
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: typos
  dependency-version: 1.50.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: zizmor
  dependency-version: 1.30.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump the python group in /dev-tools with 7 updates build(deps): bump the python group across 1 directory with 7 updates Oct 2, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/dev-tools/python-9035bf8914 branch from bbb2268 to 0e90151 Compare October 2, 2026 03:51
@rmuir
rmuir merged commit 3bb5f43 into main Oct 2, 2026
13 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/dev-tools/python-9035bf8914 branch October 2, 2026 04:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency Updates skip-changelog Apply to PRs that don't need a changelog entry, stopping the automated changelog check.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rmuir