Skip to content

Bump the pip-deps group across 1 directory with 13 updates - #3174

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/pip-deps-b6c430099f
Open

Bump the pip-deps group across 1 directory with 13 updates#3174
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/pip-deps-b6c430099f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pip-deps group with 13 updates in the / directory:

Package From To
boto3 1.43.33 1.43.89
pydantic 2.13.4 2.13.5
prance 25.4.8.0 26.7.19.0
asf-search 12.2.2 13.0.1
moto 5.2.2 5.2.3
responses 0.26.1 0.26.3
ruff 0.15.18 0.16.6
mypy 2.1.0 2.3.1
setuptools 83.0.0 84.0.0
setuptools-scm 10.0.5 10.2.3
openapi-spec-validator 0.8.5 0.9.0
cfn-lint 1.51.5 1.56.0
cryptography 50.0.0 50.0.1

Updates boto3 from 1.43.33 to 1.43.89

Commits
  • 1895b95 Merge branch 'release-1.43.89'
  • b85c521 Bumping version to 1.43.89
  • f729083 Add changelog entries from botocore
  • bb429b1 Merge branch 'release-1.43.88'
  • 257465b Merge branch 'release-1.43.88' into develop
  • e373d8d Bumping version to 1.43.88
  • 6ce83de Add changelog entries from botocore
  • d5740c2 Merge branch 'release-1.43.87'
  • bd30961 Merge branch 'release-1.43.87' into develop
  • 316b72c Bumping version to 1.43.87
  • Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates prance from 25.4.8.0 to 26.7.19.0

Release notes

Sourced from prance's releases.

Prance 26.07.19.0

Features

  • Add --allow-recursion CLI flag to validate and compile commands for recursive $ref specs (#124)
  • Speed up reference resolution with pure Python optimizations: structural sharing, caching, optional orjson (prance[fast]), keep_ref_on_recursion, materialize=True, and a path_get falsy-value fix (#169)
  • Add Python 3.14 support to classifiers, CI, and tox

Misc

  • Packaging modernization (pyproject.toml, PEP 735 dependency groups)
  • Dependency and CI updates
  • Sphinx pinned to <8.2 for Python 3.10 compatibility

PyPI: https://pypi.org/project/prance/26.7.19.0/

Changelog

Sourced from prance's changelog.

Prance 26.07.19.0

Features

  • Add --allow-recursion CLI flag to validate and compile commands, allowing specs with self-referencing $ref (e.g. recursive types like linked lists or trees) to be processed without raising ResolutionError. (#124)
  • Speed up reference resolution with pure Python optimizations: structural sharing for O(N) chained $ref resolution (was O(N^2)), resolved-reference caching, optimized iterators and path functions, optional orjson fast deepcopy (prance[fast]), keep_ref_on_recursion handler to preserve $ref on recursion, materialize=True option for independent subtree copies, and a fix for path_get returning defaultvalue for falsy values. (#169)
  • Add Python 3.14 support to classifiers, CI, and tox

Misc

  • Fix sphinx version constraint to <8.2 as 8.2+ requires Python 3.11+
  • Migrate project metadata to pyproject.toml and convert dev dependencies to PEP 735 dependency group
  • Remove obsolete requirements files and appveyor.yml, update docs with modern installation instructions
  • Update GitHub Actions to use latest action versions: checkout@v4, setup-python@v5
  • Update build dependencies: setuptools to >80, setuptools_scm to >9
  • Update core dependencies: ruamel.yaml to 0.18.16, requests to 2.32.5, packaging to 25.0
  • Update dev dependencies: tox to 4.32.0, pytest to 9.0.1, pytest-cov to 7.0.0, towncrier to 25.8.0
  • Update optional CLI dependency: click to 8.3.0
  • Update pre-commit configuration to use --py310-plus for pyupgrade and reorder-python-imports
  • Use dependency groups in tox configuration instead of manually specifying deps
  • Use pip --group flag to install dev dependency group in CI

Prance 25.04.08.0

Compatibility changes

Thank you to Mathis for bringing this forth.

  • migrate from jsonschema to referencing for references
  • drop unmaintained python 3.8/3.9
  • add support + ci for python 3.11/3.12/3.14
  • migrate convert from mermade.org.uk to converter.swagger.io
  • switch yaml mimetype from the x-yaml form to the official yaml form
  • include petstore example data to ease testing without the git subrepo
  • explicitly use openapi-spec-validator backends in tests

... (truncated)

Commits
  • 8ec6f91 Merge pull request #170 from RonnyPfannschmidt/release-26.07.19.0
  • a1643c5 fix changelog dependency notes for 26.07.19.0
  • 78280c8 prepare release 26.07.19.0
  • b976a7c Merge pull request #169 from RonnyPfannschmidt/speedup-resolver-pure-python
  • 41e6e4a Fix KEEP_REF handler and add permissive_object_on_recursion
  • f8247b4 Add --allow-recursion CLI flag for recursive $ref specs (#124)
  • 318aed9 Rewrite resolver as two-phase iterative algorithm
  • 616381f Use isinstance for subclass safety and unify path helpers
  • 3810190 Replace changelog fragments with single PR-numbered entry
  • 17185f8 Add towncrier changelog fragments for resolver improvements
  • Additional commits viewable in compare view

Updates asf-search from 12.2.2 to 13.0.1

Release notes

Sourced from asf-search's releases.

v13.0.1

v13.0.1

Fixed

  • Fixed frame based searches for dataets using FRAME_NUMBER additional attribute
  • Fixed NISAR dataMaturity filter regression

v13.0.0

v13.0.0

Changed

  • asf-search now aliases processingLevel and platform keywords with corresponding collection shortName and not collection concept-id for improved maintainability and debugging. dataset keyword also uses shortName.

v12.3.2

Fixed

  • NISAR dataset geojson export no longer fails when serializing coordinates for multipolygons

v12.3.1

Fixed

  • dataMaturity no longer duplicates searches with multiple options selected.

v12.3.0

Added

  • Adds Sentinel-1 multi-burst support to SBASNetwork class
    • Adds multi-burst supporting classes:
      • S1MultiBurstSceneIDPair
      • S1MultiBurst
      • S1MultiBurstGroup
      • S1MultiBurstProduct
    • For usage examples, see examples/SBASNetwork_S1-Multiburst.ipynb
  • Updates SBASNetwork.add_pairs() and SABANetork.remove_pairs() to take either Pair objects or tuples of date pair strings.
  • Parameter for filtering NISAR products based off of data maturity. 
    • asf.search_count(dataMaturity=asf.constants.MATURITIES.BETA, dataset=asf.constants.DATASET.NISAR)

v12.2.3

v12.2.3

Added

  • Drop old geometry logic for OPERAS1Product dist-alert products
Changelog

Sourced from asf-search's changelog.

v13.0.1

Fixed

  • Fixed frame based searches for dataets using FRAME_NUMBER additional attribute
  • Fixed NISAR dataMaturity filter regression

=======

v13.0.0

Changed

  • asf-search now aliases processingLevel and platform keywords with corresponding collection shortName and not collection concept-id for improved maintainability and debugging. dataset keyword also uses shortName.

=======

v12.3.2

Fixed

  • NISAR dataset geojson export no longer fails when serializing coordinates for multipolygons

=======

v12.3.1

Fixed

  • dataMaturity no longer duplicates searches with multiple options selected.

=======

v12.3.0

Added

  • Adds Sentinel-1 multi-burst support to SBASNetwork class
    • Adds multi-burst supporting classes:
      • S1MultiBurstSceneIDPair
      • S1MultiBurst
      • S1MultiBurstGroup
      • S1MultiBurstProduct
    • For usage examples, see examples/SBASNetwork_S1-Multiburst.ipynb
  • Updates SBASNetwork.add_pairs() and SABANetork.remove_pairs() to take either Pair objects or tuples of date pair strings.
  • Parameter for filtering NISAR products based off of data maturity.
asf.search_count(dataMaturity=asf.constants.MATURITIES.BETA, dataset=asf.constants.DATASET.NISAR)

v12.2.3

Added

  • Drop old goemetry logic for OPERAS1Product dist-alert products
Commits
  • b38ab7a Merge pull request #475 from asfadmin/bug-shortname-frame-fix
  • c40902d bug: fix dataset maturity filter regression
  • 22b56e9 bug: fix frame search bug with shortname
  • 8934685 Update CHANGELOG.md
  • 0a4720e Merge pull request #469 from asfadmin/topic-shortname-alias-migration
  • 2b00f7f chore: fix comment typo, change hidden function name and docstring
  • 02b8c21 Merge branch 'topic-shortname-alias-migration' of https://github.com/asfadmin...
  • a252b98 chore: rename methods and variables for updated aliasing convention
  • bdafba9 Merge branch 'master' into topic-shortname-alias-migration
  • 7371c13 bug: update final test case to use short names
  • Additional commits viewable in compare view

Updates moto from 5.2.2 to 5.2.3

Changelog

Sourced from moto's changelog.

5.2.3

Docker Digest for 5.2.3: sha256:91fd602a21f49cf9eb82fdf474015a3c131d40104c8297ea6a2ca920708ae32c

General:
    * Dropped support for the Panorama service, following the removal by botocore

New Services:
* Clean Rooms:
* create_collaboration()
* create_configured_table()
* create_membership()
* delete_collaboration()
* delete_configured_table()
* delete_membership()
* get_collaboration()
* get_configured_table()
* get_membership()
* list_collaborations()
* list_configured_tables()
* list_members()
* list_memberships()
* list_tags_for_resource()
* tag_resource()
* untag_resource()
* update_collaboration()
* update_configured_table()
* update_membership()


* DevOps Agent:
    * create_agent_space()
    * delete_agent_space()
    * get_agent_space()
    * list_agent_spaces()
    * list_tags_for_resource()
    * tag_resource()
    * update_agent_space()
    * untag_resource()

    

  • Payment Cryptography:

      

    • add_key_replication_regions()
      • 

    • create_alias()
      • 

    • create_key()
      • 

    • delete_alias()
      • 

    • delete_resource_policy()
      • 

    • disable_default_key_replication_regions()
      • 

    • enable_default_key_replication_regions()
      • 

    • get_alias()
      • 

    • get_default_key_replication_regions()
      • 

    • get_key()

... (truncated)

Commits

Updates responses from 0.26.1 to 0.26.3

Release notes

Sourced from responses's releases.

0.26.3

  • Added a keep_headers argument to _recorder.record and Recorder.dump_to_file to preserve named headers (for example Date) that are otherwise stripped as verbose defaults, so a signed response can be recorded and later verified. Matching is case-insensitive. See #763
  • Fixed the element type exposed by CallList so static type checkers infer Call values when iterating, indexing, or filtering recorded calls. See #722
  • Fixed query_string_matcher (and the query matching auto-applied to a registered URL's own query string) discarding blank-valued query params (b=), which caused requests with an extra or missing blank param to match incorrectly. See #804
  • Fixed fragment_identifier_matcher treating opaque fragments (those without =, e.g. /users/5) as always equal, so a required fragment matched a different one or none at all. See #806

0.26.2

  • Default headers (such as Content-Type, Date and Server) are now stripped from recorded files regardless of header name case. Previously, responses recorded from servers that send lowercase header names (for example over HTTP/2) kept these redundant headers in the generated file.
  • Fixed query_param_matcher mutating the caller's params dict when numeric values are provided. See #801
Changelog

Sourced from responses's changelog.

0.26.3

  • Added a keep_headers argument to _recorder.record and Recorder.dump_to_file to preserve named headers (for example Date) that are otherwise stripped as verbose defaults, so a signed response can be recorded and later verified. Matching is case-insensitive. See #763
  • Fixed the element type exposed by CallList so static type checkers infer Call values when iterating, indexing, or filtering recorded calls. See #722
  • Fixed query_string_matcher (and the query matching auto-applied to a registered URL's own query string) discarding blank-valued query params (b=), which caused requests with an extra or missing blank param to match incorrectly. See #804
  • Fixed fragment_identifier_matcher treating opaque fragments (those without =, e.g. /users/5) as always equal, so a required fragment matched a different one or none at all. See #806

0.26.2

  • Default headers (such as Content-Type, Date and Server) are now stripped from recorded files regardless of header name case. Previously, responses recorded from servers that send lowercase header names (for example over HTTP/2) kept these redundant headers in the generated file.
  • Fixed query_param_matcher mutating the caller's params dict when numeric values are provided. See #801
Commits
  • cb13954 release: 0.26.3
  • f30df24 Merge pull request #809 from golikovichev/fix/763-recorder-keep-headers
  • 5c074b9 Add keep_headers to the recorder to preserve named default headers
  • 2827d43 fix: type CallList as a sequence of calls (#807)
  • 2af69cb fix: compare opaque fragment identifiers verbatim (#806)
  • da2c5d1 fix: keep blank-valued query params significant in query_string_matcher (#804)
  • 983a497 Merge branch 'release/0.26.2'
  • 31d28eb release: 0.26.2
  • 6fb610d Fix CHANGES (#802)
  • aae1d47 Set license format to SPDX identifier in setup.py (#803)
  • Additional commits viewable in compare view

Updates ruff from 0.15.18 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Commits

Updates mypy from 2.1.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits
  • d642c44 Bump version to 2.3.1
  • a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
  • 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
  • 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
  • 6dfa06d Fix crash when unpacking return value from overload (#21830)
  • a385746 Bump version to 2.3.1+dev
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • Additional commits viewable in compare view

Updates setuptools from 83.0.0 to 84.0.0

Changelog

Sourced from setuptools's changelog.

v84.0.0

Features

  • Newline-separated keywords and platformspypa/setuptools#4887old specification <https://peps.python.org/pep-0345/>_ separated items with spaces and the current one uses commas. (#4887)
  • Extensionpypa/distutils#373#5022)
  • The C compiler modules now emit log messages through their own compilers.C.* loggers instead of the distutils root logger, part of decoupling the compilers package from distutils. The logger names are normalized to a stable compilers.C.* prefix so they remain constant as the package migrates toward a standalone compilers.C distribution. (#5266)
  • The C compilers gained a Compiler.call method -- a thin wrapper over subprocess.check_call (with macOS deployment-target env injection) that is the modern replacement for Compiler.spawn. The compilers no longer depend on distutils.spawn, distutils.dir_util, distutils.file_util, distutils._modified, or distutils.util.execute/split_quoted: the generic newer/newer_group and split_quoted helpers are vendored into the compilers package, and Compiler.mkpath/move_file/execute are implemented directly on the standard library (os.makedirs/shutil.move). The methods are retained for backward compatibility. (#5267)
  • The compilers no longer depend on distutils.util, distutils.version, distutils.compat, or distutils._macos_compat. The platform-identification helpers (get_platform/get_host_platform/is_mingw) now live in distutils.compilers.platform.detect and the macOS deployment-target logic and compiler_fixup in distutils.compilers.platform.macos; CygwinCCompiler.gcc_version returns a packaging.version.Version. distutils.util re-exports the platform/macOS helpers from their new homes for backward compatibility rather than keeping duplicate copies. (sysconfig lookups still route through distutils pending its own decoupling.) (#5268)
  • The compilers now read their build configuration from the standard library's sysconfig instead of distutils.sysconfig. Per-compiler customization -- previously distutils.sysconfig.customize_compiler -- has moved into Compiler.configure_system(): a no-op on the base class, with UnixCCompiler applying the compiler/flag/archiver settings CPython recorded in sysconfig (and the usual CC/CFLAGS/LDSHARED/… environment overrides). distutils.sysconfig.customize_compiler is retained as a thin wrapper that calls compiler.configure_system(). (#5269)

Bugfixes

  • The MSVC linker now passes its arguments through a response file when the command line would exceed the Windows maximum length, fixing failures when linking a large number of objects. (#4177)
  • The Cygwin and MinGW compilers now pass -O1 instead of a bare -O. The two are equivalent to GCC, but cc1 rejected the bare form when building 32-bit extensions with -m32. -- by :user:dchaudhari7177 (#4873)
  • copy_filepypa/distutils#379#5079)
  • Setuptools wheels no longer bundled the project's own test modules. -- by :user:itscloud0 (#5212)
  • build_ext no longer fails when cross-compiling with a compiler other than MSVC (such as MinGW). Compiler now provides a no-op initialize()pypa/distutils#399

Improved Documentation

  • Clarified what "correspond exactly to the directory structure" means in the packages section of the Package Discovery user guide. (#4109)
  • Documented how bdist_wheel's py_limited_api option controls abi3 wheel tagging for extension modules -- by :user:Himanshuagrawal4 (#4741)

Deprecations and Removals

  • Compiler.spawn is deprecated in favor of the new Compiler.call. call raises native subprocess exceptions; spawn remains as a shim that emits a DeprecationWarning and translates them to DistutilsExecError. The MSVC spawn compatibility shim for third-party monkeypatches predating the env argument (numpy.distutils before 1.19, per pypa/distutils#15) has been removed. distutils.spawn.spawn is likewise reduced to a thin wrapper around subprocess.check_call: it no longer resolves cmd[0] via shutil.which (subprocess searches PATH itself) nor injects MACOSX_DEPLOYMENT_TARGET (that now lives with the compilers, the only callers to which it applied). (#5267)
  • Building an extension with a MACOSX_DEPLOYMENT_TARGET lower than the interpreter's configured value now raises compilers.errors.PlatformError instead of distutils.errors.DistutilsPlatformError (the macOS deployment-target check moved into the compilers package). CygwinCCompiler.gcc_version returns a packaging.version.Version rather than the removed distutils.version.LooseVersion. Completing the transition begun in pypa/distutils#246, UnixCCompiler.runtime_library_dir_option now returns the ["-Wl,--enable-new-dtags", "-Wl,-rpath,<dir>"] list directly for GNU ld rather than collapsing it into a single string, and the temporary distutils.compat.consolidate_linker_args shim has been removed. (#5268)
  • The compilers now define their own exception vocabulary instead of borrowing distutils' framework errors. Language-agnostic exceptions (Error, UnknownFileType, and a new PlatformError) live at distutils.compilers.errors, leaving room for future compilers.<language> siblings; the C/C++-specific CompileError/LinkError/LibError/PreprocessError remain in distutils.compilers.C.errors. The compilers now raise compilers.errors.PlatformError where they previously raised distutils.errors.DistutilsPlatformError/DistutilsModuleError, and compilers._modified.newer raises the stdlib FileNotFoundError. distutils.errors keeps its own framework exceptions and re-exports the compiler ones (CCompilerError, CompileError, etc.) for backward compatibility; because CCompilerError is compilers.errors.Error, code catching it (as distutils' top-level handlers do) still catches the new PlatformError. (#5270)
  • customize_compiler now asserts that the compiler-related config variables (CC, CXX, CFLAGS, etc.) resolve to strings, raising AssertionError if any are unexpectedly Nonepypa/distutils#363
Commits
  • 72e919a Merge pull request #5293 from pypa/bugfix/integration-pip-flit-backend
  • 1b29701 Select the top-level pyproject.toml when reading build requirements
  • bb1b381 Bump version: 83.0.0 → 84.0.0
  • ee6fdd7 Sync with distutils @ e8eb87855 (#5292)
  • 2a4a9e4 Merge remote-tracking branch 'origin/main' into distutils-e8eb87855
  • cbd1195 Merge https://github.com/jaraco/skeleton
  • bd3594e Merge pull request #5287 from Avasam/Configuring-lint.flake8-comprehensions.a...
  • f02e90a Configure C408 to allow dict(a=1) rather than disabling it
  • c55f52b Configuring lint.flake8-comprehensions.allow-dict-calls-with-keyword-argument...
  • e9904b0 Match the distutils sdist base type for the user_options override
  • Additional commits viewable in compare view

Updates setuptools-scm from 10.0.5 to 10.2.3

Release notes

Sourced from setuptools-scm's releases.

setuptools-scm v10.2.3

Miscellaneous

  • Do not run the xmlsec download regression test on Python 3.8, where no lxml wheel exists and --no-build-isolation leaves pip without a build toolchain for the lxml sdist. (#1516)

setuptools-scm v10.2.2

Miscellaneous

  • The pkginfo workdir discovery entry point moved to vcs-versioning; vcs-versioning>=2.3.2 is now required (the workspace pin carries a .dev0 suffix so in-tree builds resolve, matching the existing convention). setuptools_scm._integration._discover.discover_pkginfo remains as a re-export. (#1507)
  • Stop shipping a per-package uv.lock in the sdist. It could not be generated correctly whenever setuptools-scm required an unreleased vcs-versioning, which broke the release proposal workflow. (#1509)

setuptools-scm v10.2.1

Fixed

  • Omit scm_version.json and scm_file_list.json from wheel .dist-info while still including them in sdists for fallback discovery. (#1473)

setuptools-scm v10.2.0

Added

  • Restore Python 3.8 and 3.9 support, re-enabling use as a build dependency for projects like scikit-build that still support these versions. (#1445)

Miscellaneous

  • Move PKG-INFO discovery tests from vcs-versioning to setuptools-scm where the entry points are registered. (#1446)

setuptools-scm v10.1.2

Fixed

  • Fix DeprecationWarning leak by threading VcsEnvironment through VersionInferenceConfig and using env.make_reader() in _should_write_to_source. (#1424)

setuptools-scm v10.1.1

Fixed

  • Update CI to use PyPy 3.11 as cryptography has no PyPy 3.10 build available (#1421)

setuptools-scm v10.1.0

Added

  • Add backward-compatible shims in setuptools_scm.git, setuptools_scm.hg, setuptools_scm.hg_git, and setuptools_scm.scm_workdir so that external code calling get_scm_version(config) or run_describe(config) with an explicit Configuration continues to work. The shim automatically wires _config and VcsEnvironment onto the workdir. (#compat-shims)
  • Write scm_version.json and scm_file_list.json into egg-info directories during egg_info, enabling sdist fallback version inference when no VCS is present. Add ScmEggInfoMixin for workdir-based file finding in find_sources(). (#egg-info-metadata)
  • Add write_to_source pyproject.toml option to control whether version files are written to the source tree. When unset, a deprecation warning advises setting it explicitly before the default changes in a future major release. The SETUPTOOLS_SCM_WRITE_TO_SOURCE environment variable overrides this setting. (#1301)
  • Adopt the workdir-centric pipeline from vcs-versioning: version discovery now follows an explicit env → config → workdir → version chain instead of relying on ambient globals and parse entry points. The egg_info command writes scm_version.json and scm_file_list.json metadata so sdists can infer versions without a VCS checkout. Requires vcs-versioning >= 2.0.0.dev0. (#1378)

Fixed

  • Fix worktree file listing test to expect relative paths from the file finder. The test now passes on Linux; Windows remains xfail due to a subprocess limitation with worktree directories. (#620)
  • Remove the _warn_on_old_setuptools() check that incorrectly warned when a custom build-backend caused setuptools.__version__ to return the project version instead of setuptools' version. The minimum setuptools version is now enforced via build-system requirements. (#1192)

... (truncated)

Commits

@dependabot dependabot Bot added bumpless Changes to documentation, CI/CD pipelines, etc that don't affect the project's version major Bump the major version number of this project labels Aug 31, 2026
@dependabot
dependabot Bot requested review from a team as code owners August 31, 2026 19:27
@dependabot dependabot Bot added the bumpless Changes to documentation, CI/CD pipelines, etc that don't affect the project's version label Aug 31, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 31, 2026 19:27
@dependabot
dependabot Bot force-pushed the dependabot/pip/pip-deps-b6c430099f branch from 48ab442 to 372447d Compare August 31, 2026 20:32
@jhkennedy

jhkennedy commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Waiting on a new release of openapi-core. I don't see an easy way to separate out openapi-spec-validator from this PR, so I'm just going to wait it out, I think... probably should put the openapi collection of tools in its own dependabot group...

@dependabot
Bump the pip-deps group across 1 directory with 13 updates
fe097a5 
Bumps the pip-deps group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.33` | `1.43.89` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [prance](https://github.com/RonnyPfannschmidt/prance) | `25.4.8.0` | `26.7.19.0` |
| [asf-search](https://github.com/asfadmin/Discovery-asf_search) | `12.2.2` | `13.0.1` |
| [moto](https://github.com/getmoto/moto) | `5.2.2` | `5.2.3` |
| [responses](https://github.com/getsentry/responses) | `0.26.1` | `0.26.3` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.18` | `0.16.6` |
| [mypy](https://github.com/python/mypy) | `2.1.0` | `2.3.1` |
| [setuptools](https://github.com/pypa/setuptools) | `83.0.0` | `84.0.0` |
| [setuptools-scm](https://github.com/pypa/setuptools-scm) | `10.0.5` | `10.2.3` |
| [openapi-spec-validator](https://github.com/python-openapi/openapi-spec-validator) | `0.8.5` | `0.9.0` |
| [cfn-lint](https://github.com/aws-cloudformation/cfn-lint) | `1.51.5` | `1.56.0` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.1` |



Updates `boto3` from 1.43.33 to 1.43.89
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.33...1.43.89)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `prance` from 25.4.8.0 to 26.7.19.0
- [Release notes](https://github.com/RonnyPfannschmidt/prance/releases)
- [Changelog](https://github.com/RonnyPfannschmidt/prance/blob/main/CHANGES.rst)
- [Commits](RonnyPfannschmidt/prance@v25.04.08.0...v26.07.19.0)

Updates `asf-search` from 12.2.2 to 13.0.1
- [Release notes](https://github.com/asfadmin/Discovery-asf_search/releases)
- [Changelog](https://github.com/asfadmin/Discovery-asf_search/blob/master/CHANGELOG.md)
- [Commits](asfadmin/Discovery-asf_search@v12.2.2...v13.0.1)

Updates `moto` from 5.2.2 to 5.2.3
- [Release notes](https://github.com/getmoto/moto/releases)
- [Changelog](https://github.com/getmoto/moto/blob/master/CHANGELOG.md)
- [Commits](getmoto/moto@5.2.2...5.2.3)

Updates `responses` from 0.26.1 to 0.26.3
- [Release notes](https://github.com/getsentry/responses/releases)
- [Changelog](https://github.com/getsentry/responses/blob/master/CHANGES)
- [Commits](getsentry/responses@0.26.1...0.26.3)

Updates `ruff` from 0.15.18 to 0.16.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.18...0.16.6)

Updates `mypy` from 2.1.0 to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.1.0...v2.3.1)

Updates `setuptools` from 83.0.0 to 84.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v83.0.0...v84.0.0)

Updates `setuptools-scm` from 10.0.5 to 10.2.3
- [Release notes](https://github.com/pypa/setuptools-scm/releases)
- [Changelog](https://github.com/pypa/setuptools-scm/blob/main/RELEASE_SYSTEM.md)
- [Commits](pypa/setuptools-scm@setuptools-scm-v10.0.5...setuptools-scm-v10.2.3)

Updates `openapi-spec-validator` from 0.8.5 to 0.9.0
- [Release notes](https://github.com/python-openapi/openapi-spec-validator/releases)
- [Commits](python-openapi/openapi-spec-validator@0.8.5...0.9.0)

Updates `cfn-lint` from 1.51.5 to 1.56.0
- [Release notes](https://github.com/aws-cloudformation/cfn-lint/releases)
- [Changelog](https://github.com/aws-cloudformation/cfn-lint/blob/main/CHANGELOG.md)
- [Commits](aws-cloudformation/cfn-lint@v1.51.5...v1.56.0)

Updates `cryptography` from 50.0.0 to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.1)

---
updated-dependencies:
- dependency-name: asf-search
  dependency-version: 13.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip-deps
- dependency-name: boto3
  dependency-version: 1.43.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-deps
- dependency-name: cfn-lint
  dependency-version: 1.55.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-deps
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip-deps
- dependency-name: moto
  dependency-version: 5.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-deps
- dependency-name: mypy
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-deps
- dependency-name: openapi-spec-validator
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-deps
- dependency-name: prance
  dependency-version: 26.7.19.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip-deps
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-deps
- dependency-name: responses
  dependency-version: 0.26.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-deps
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-deps
- dependency-name: setuptools
  dependency-version: 84.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip-deps
- dependency-name: setuptools-scm
  dependency-version: 10.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/pip-deps-b6c430099f branch from 372447d to fe097a5 Compare September 7, 2026 19:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

bumpless Changes to documentation, CI/CD pipelines, etc that don't affect the project's version major Bump the major version number of this project

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jhkennedy