[dependabot]

Bumps the python-deps group with 5 updates:

Package	From	To
pydantic	2.14.2	2.14.3
platformdirs	4.14.0	4.14.5
python-multipart	0.0.32	0.0.33
msgpack	1.2.3	1.2.4
ruff	0.17.3	0.17.4

Updates pydantic from 2.14.2 to 2.14.3

Release notes

Sourced from pydantic's releases.

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

• Build wheels for GraalPy 3.13 by @​msimacek in #14136.

  The previous v2.14.2 release published GraalPy 3.11 wheels, which were not working due to a PyO3 version bump. A CI workflow issue made it so that the wheel wasn't tested before publishing. This is now fixed: starting in v2.14.3, we no longer publish GraalPy 3.11 wheels, and GraalPy 3.13 wheels are now published together with the existing 3.12 one.

Performance

• Improve schema generation for fixed type handlers by @​alexmojaki in #14130
• Skip general schema dispatch for builtin scalars by @​alexmojaki in #14141
• Skip annotation handler setup when annotations are empty by @​alexmojaki in #14149
• Fix quadratic serialization time with per-index include/exclude on sequences by @​Viicos in #14160
• Avoid type lookups when checking for None during serialization by @​Viicos in #14167
• Improve performance of model serialization by @​Viicos in #14171
• Improve performance of dict serialization by @​Viicos in #14172
• Improve performance of type inference during serialization by @​Viicos in #14173
• Avoid cloning the field name when using the default value during validation by @​Viicos in #14175
• Do not evaluate model_config annotations by @​Viicos in #14195
• Avoid slow runtime Protocol check when expanding GroupedMetadata annotations by @​Viicos in #14196
• Use a lightweight @contextmanager implementation internally by @​Viicos in #14199

Fixes

• Fix various issues about GC tracking in pydantic-core by @​Viicos in #13819
• Include null in serialization JSON Schema for unless-none field serializers by @​Kropiunig in #13848
• Fix RecursionError when copying or unpickling models with defer_build by @​Viicos in #14115
• Remove dead default_factory check in unsupported Field() attribute by @​owtaylor in #14129
• Disallow non string extra keys during validation by @​Viicos in #14135
• Fix deeply nested data being reported as a cyclic reference by @​Viicos in #14164

New Contributors

• @​owtaylor made their first contribution in #14129

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• ea492e0 Bump pydantic-core to v2.50.4
• 4f4a33f Prepare release v2.14.3
• dca067b Benchmark TypedDict schema generation across builds
• a2d1f6c Skip annotation handler setup when annotations are empty
• 3ae0a40 Construct builtin scalar union schemas directly
• 358d36f Skip general schema dispatch for builtin scalars
• 3cc701a Improve schema generation for fixed type handlers
• 762db7e Remove redundant None check in union schema generation
• c214986 Bump pytest-codspeed to v5.0.4
• 038ee97 Bump typing-inspection to v0.4.5
• Additional commits viewable in compare view

Updates platformdirs from 4.14.0 to 4.14.5

Release notes

Sourced from platformdirs's releases.

4.14.5

Bug fixes

• Resolve the temporary user_runtime_dir fallback to /runtime-<uid> instead of //runtime-<uid> when the temporary directory is / (#687) by @​darrenhuai and @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

4.14.4

🐍 PyPI release

📜 Full Changelog

4.14.3

Bug fixes

• Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (#679) by @​mikegit123git and @​gaborbernat.

New Contributors

• @​mikegit123git made their first contribution in tox-dev/platformdirs#679

PyPI release

Full Changelog

4.14.2

Bug fixes

• Deduplicate equivalent XDG directory spellings across string and path iterators and file searches (#677) by @​AlvaroBalbin and @​gaborbernat.

New Contributors

• @​AlvaroBalbin made their first contribution in tox-dev/platformdirs#677

PyPI release

Full Changelog

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-14-5:

---

4.14.5 (2026-11-04)

---

.. _release-4-14-5-fixed:

Fixed

• Resolve the temporary :func:~platformdirs.user_runtime_dir fallback to /runtime-<uid> instead of //runtime-<uid> when the temporary directory is / (:pr:687) by :user:darrenhuai and :user:gaborbernat.

.. _release-4-14-4:

---

4.14.4 (2026-11-04)

---

.. _release-4-14-3:

---

4.14.3 (2026-11-01)

---

.. _release-4-14-3-fixed:

Fixed

• Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (:pr:679) by :user:mikegit123git and :user:gaborbernat.

.. _release-4-14-2:

---

4.14.2 (2026-10-31)

---

.. _release-4-14-2-fixed:

... (truncated)

Commits

• 6a7d284 release 4.14.5
• c9ad21d 🐛 fix(unix): avoid // in the runtime fallback when the temp dir is / (#687)
• cf51ebd release 4.14.4
• 573a192 👷 ci: adopt shared workflows and dependency hygiene (#685)
• 9008466 build(deps): refresh project lock (#684)
• 246e9ad Bump the "dependencies" group with 2 updates across multiple ecosystems (#683)
• d4064eb 👷 ci(scorecard): publish OpenSSF results (#682)
• f9323b0 🔧 build(deps): use release-creator 4.4 (#681)
• eb0cce8 👷 ci(news): stop cancelling the news check (#680)
• 099c969 release 4.14.3
• Additional commits viewable in compare view

Updates python-multipart from 0.0.32 to 0.0.33

Release notes

Sourced from python-multipart's releases.

Version 0.0.33

🛡️ Safer form parsing

This release lets you cap URL-encoded form fields as they stream in, and fixes several upload and decoding edge cases. It also drops Python 3.10 and adds Python 3.15.

pip install python-multipart==0.0.33

• Limit URL-encoded fields while streaming (#333). The new opt-in MAX_FIELDS and MAX_FIELD_SIZE options for FormParser raise FormParserError before oversized data is buffered. Both default to no limit, and multipart forms are unaffected.
• Nameless uploads no longer crash when spilled to disk (#343). Uploads without a filename used to raise AttributeError when UPLOAD_KEEP_EXTENSIONS or UPLOAD_KEEP_FILENAME was set.
• UPLOAD_DIR accepts str with UPLOAD_KEEP_FILENAME (#335). A str upload directory used to fail on the first write to disk.
• Decoded data is complete before callbacks run (#336, #355). Content-Transfer-Encoding decoders are finalized at the end of each part, and quoted-printable escapes split across writes decode correctly.
• parse_options_header lowercases content types with parameters (#287). Multipart/Form-Data; boundary=abc now returns multipart/form-data, the same as headers without parameters.

⚡ Faster parsing

• Faster opening boundary matching (#328). Complete boundaries are matched in one step.
• Faster parser state lookups (#330). Parser states are module-level enum members, so their repr is now multipart.END instead of <MultipartState.END: 12>.
• Faster querystring callback dispatch (#316).

🐍 Python support

• Python 3.10 is no longer supported (#329). Python 3.11 is now the minimum.
• Python 3.15 is supported (#350).

💜 Thank you

Thanks to @​Edneam, @​sungbin1015, @​carlok, and @​fjvbn2003 for contributing to this release.

Thanks to the individual sponsors who contributed $134.00 to support this work. If python-multipart is useful to you, consider sponsoring me on GitHub.

Full changelog: 0.0.32...0.0.33

Changelog

Sourced from python-multipart's changelog.

0.0.33 (2026-10-31)

• Drop Python 3.10 support #329.
• Add Python 3.15 support #350.
• Add opt-in field-count and field-size limits for URL-encoded forms in FormParser #333.
• Normalize the content type returned by parse_options_header when the header has parameters #287.
• Finalize Content-Transfer-Encoding decoding before invoking field and file callbacks #336.
• Keep only the incomplete escape when quoted-printable data is split across writes #355.
• Handle nameless uploads when UPLOAD_KEEP_FILENAME or UPLOAD_KEEP_EXTENSIONS is set #343.
• Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set #335.
• Speed up parser state lookups #330.
• Speed up opening boundary matching #328.
• Speed up querystring callback dispatch #316.

Commits

• 9217f26 Bump version to 0.0.33 (#357)
• d0344c1 Keep only the incomplete escape when quoted-printable data is split (#355)
• 44871df Handle nameless uploads when keeping the filename or extension (#343)
• b21ea59 Add streaming field limits to FormParser (#333)
• 48f9e21 Fix the In-Depth Example in the docs to return bytes (#338)
• 12a2f8f Accept a str UPLOAD_DIR when UPLOAD_KEEP_FILENAME is set (#335)
• 95f6376 Use the shared security policy (#353)
• 8ec84ef Migrate documentation from MkDocs to Zensical (#352)
• d7af81c Rewrite README for newcomers (#351)
• b035d14 Add Python 3.15 classifier (#350)
• Additional commits viewable in compare view

Updates msgpack from 1.2.3 to 1.2.4

Release notes

Sourced from msgpack's releases.

v1.2.4

What's Changed

• fallback: pass object_pairs_hook a list of pairs by @​youdie006 in msgpack/msgpack-python#744
• fallback: leave the object unread when a header type does not match by @​Shaisolaris in msgpack/msgpack-python#748
• Bump the all-dependencies group with 3 updates by @​dependabot[bot] in msgpack/msgpack-python#749
• fallback: return bytes from Unpacker.read_bytes by @​Cherith1222 in msgpack/msgpack-python#747
• Run tracemalloc tests sequentially by @​methane in msgpack/msgpack-python#758
• ci: bump the all-dependencies group with 3 updates by @​dependabot[bot] in msgpack/msgpack-python#757
• Prepare v1.2.4 release by @​methane in msgpack/msgpack-python#756

New Contributors

• @​youdie006 made their first contribution in msgpack/msgpack-python#744
• @​Shaisolaris made their first contribution in msgpack/msgpack-python#748
• @​Cherith1222 made their first contribution in msgpack/msgpack-python#747

Full Changelog: msgpack/msgpack-python@v1.2.3...v1.2.4

Changelog

Sourced from msgpack's changelog.

1.2.4

Release Date: 2026-10-27

• Limit container preallocation to 10000 items to prevent excessive memory allocation from deeply nested, large array or map headers. Larger containers grow as their contents are decoded; max_array_len and max_map_len still limit their total size. See GHSA-j8c6-9vc5-hj6x.
• Pass a list of pairs to object_pairs_hook in the pure Python unpacker, ensuring that the entire map is consumed even if the hook does not iterate over its argument. #744
• Leave the next object unread when read_array_header() or read_map_header() raises ValueError for a mismatched type in the pure Python unpacker. #748
• Return bytes from Unpacker.read_bytes() in the pure Python implementation, matching the C extension. #747
• Update GitHub Actions dependencies, including cibuildwheel to 4.3.1. #749

Commits

• a284599 Prepare v1.2.4 release (#756)
• 4d189e7 ci: bump the all-dependencies group with 3 updates (#757)
• 4ad53ce Run tracemalloc tests sequentially (#758)
• d2876cd Merge commit from fork
• 3650629 Update SECURITY.md
• 874b828 fallback: return bytes from Unpacker.read_bytes (#747)
• 587c2a3 ci: update actions (#749)
• cfba337 fallback: leave the object unread when a header type does not match (#748)
• 51428c4 fallback: pass object_pairs_hook a list of pairs (#744)
• See full diff in compare view

Updates ruff from 0.17.3 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits

• 05cdc36 Bump version to 0.17.4 (#30073)
• c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
• 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
• 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
• 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
• 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
• c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
• c9150f0 Add project walltime benchmarks for Ruff (#30061)
• 64989ec [ty] Report invalid module globs once per override pattern (#30031)
• 367a563 [ty] Fix conditional type and tuple annotations (#29987)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions