[dependabot]

Bumps the python-minor-and-patch group with 5 updates:

Package	From	To
pandas	3.1.0	3.1.1
pydantic	2.14.2	2.14.3
typer	0.27.3	0.29.0
ruff	0.17.3	0.17.4
mkdocs-material	9.8.0	9.8.1

Updates pandas from 3.1.0 to 3.1.1

Release notes

Sourced from pandas's releases.

pandas 3.1.1

We are pleased to announce the release of pandas 3.1.1. This is a patch release in the 3.1.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.1.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.1.*

Or from conda-forge

conda install -c conda-forge pandas=3.1

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• 3dcc6fb RLS: 3.1.1
• 01560e3 Backport PR #71896 on branch 3.1.x (DOC: cleanup 3.1.1 whatsnew) (#71898)
• 49709c4 [backport 3.1.x] BUG: ffill/bfill on Arrow arrays without NA returns a view o...
• 55089f8 Backport PR #71025 on branch 3.1.x (BUG: \s and \S in str regex methods missi...
• eea23d0 Backport PR #71782 on branch 3.1.x (BUG: py.path.local treated as an open buf...
• e427eb5 [backport 3.1.x] DOC: avoid system-ui in default font-family for the docs (re...
• 3120a57 Backport PR #71572 on branch 3.1.x (BLD: don't include moments_simd.hpp in mo...
• 378620e Backport PR #71865 on branch 3.1.x (REGR: ensure map() with datetime-like dty...
• ceca8cb Backport PR #71495 on branch 3.1.x (BUG: support python-dateutil 3.0 tzfile (...
• 68fc76e Backport PR #71661 on branch 3.1.x (CI: Remove install requirement-dev.txt sm...
• Additional commits viewable in compare view

Updates pydantic from 2.14.2 to 2.14.3

Release notes

Sourced from pydantic's releases.

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

• Build wheels for GraalPy 3.13 by @​msimacek in #14136.

  The previous v2.14.2 release published GraalPy 3.11 wheels, which were not working due to a PyO3 version bump. A CI workflow issue made it so that the wheel wasn't tested before publishing. This is now fixed: starting in v2.14.3, we no longer publish GraalPy 3.11 wheels, and GraalPy 3.13 wheels are now published together with the existing 3.12 one.

Performance

• Improve schema generation for fixed type handlers by @​alexmojaki in #14130
• Skip general schema dispatch for builtin scalars by @​alexmojaki in #14141
• Skip annotation handler setup when annotations are empty by @​alexmojaki in #14149
• Fix quadratic serialization time with per-index include/exclude on sequences by @​Viicos in #14160
• Avoid type lookups when checking for None during serialization by @​Viicos in #14167
• Improve performance of model serialization by @​Viicos in #14171
• Improve performance of dict serialization by @​Viicos in #14172
• Improve performance of type inference during serialization by @​Viicos in #14173
• Avoid cloning the field name when using the default value during validation by @​Viicos in #14175
• Do not evaluate model_config annotations by @​Viicos in #14195
• Avoid slow runtime Protocol check when expanding GroupedMetadata annotations by @​Viicos in #14196
• Use a lightweight @contextmanager implementation internally by @​Viicos in #14199

Fixes

• Fix various issues about GC tracking in pydantic-core by @​Viicos in #13819
• Include null in serialization JSON Schema for unless-none field serializers by @​Kropiunig in #13848
• Fix RecursionError when copying or unpickling models with defer_build by @​Viicos in #14115
• Remove dead default_factory check in unsupported Field() attribute by @​owtaylor in #14129
• Disallow non string extra keys during validation by @​Viicos in #14135
• Fix deeply nested data being reported as a cyclic reference by @​Viicos in #14164

New Contributors

• @​owtaylor made their first contribution in #14129

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• ea492e0 Bump pydantic-core to v2.50.4
• 4f4a33f Prepare release v2.14.3
• dca067b Benchmark TypedDict schema generation across builds
• a2d1f6c Skip annotation handler setup when annotations are empty
• 3ae0a40 Construct builtin scalar union schemas directly
• 358d36f Skip general schema dispatch for builtin scalars
• 3cc701a Improve schema generation for fixed type handlers
• 762db7e Remove redundant None check in union schema generation
• c214986 Bump pytest-codspeed to v5.0.4
• 038ee97 Bump typing-inspection to v0.4.5
• Additional commits viewable in compare view

Updates typer from 0.27.3 to 0.29.0

Release notes

Sourced from typer's releases.

0.29.0

Features

• ✨ Use Pydantic for parameter validation. PR #1831 by @​svlandeg.

  Typer now uses Pydantic internally to validate command-line parameters. This is a gradual migration focused on preserving compatibility with existing Typer applications. Some validation error messages, help text, and usage output have changed.

  Compatibility changes:

  • Pydantic >=2.5.3 is now a required dependency.
  • click_type has been removed from typer.Option() and typer.Argument(). New ways to provide custom types will be provided with Pydantic, with much more flexibility.
  • Some defaults are now validated more strictly. The previous tuple example's (None, None, None) default now fails validation. Use tuple[str, int, bool] | None with a default of None and check for None before unpacking, as shown in the updated tuple example. This also makes the code more correct, so you could consider this a bug fix, but if you depended on this behavior, there's a change needed in your code.
  • Default datetime parsing now follows Pydantic's rules, accepting Unix timestamps, timezone offsets, and fractional seconds.
  • Callback parameter objects no longer expose Click's .type, .make_metavar(), .human_readable_name, or .type_cast_value(). Custom integrations using these need updating.

Fixes

• 🐛 Escape terminal controls in Pydantic validation errors. PR #2005 by @​tiangolo.

Docs

• 📝 Explain Pydantic validation in the release notes. PR #2006 by @​tiangolo.
• 🎨 Use the Zensical modern theme for docs. PR #2004 by @​tiangolo.
• 📝 Add AI development guidance and coding agent notices. PR #2003 by @​tiangolo.

0.28.0

Fixes

• 🐛 Ensure that the default option name is not changed by setting a metavar. PR #1957 by @​svlandeg.

Docs

• 🎨 Enable Ruff formatting for Python in Markdown. PR #1978 by @​tiangolo.

Internal

• ⬆ Bump certifi from 2025.11.12 to 2026.10.18. PR #1990 by @​dependabot[bot].
• ⬆ Bump the python-packages group with 6 updates. PR #1994 by @​dependabot[bot].
• ⬆ Bump the github-actions group with 6 updates. PR #1993 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #1995 by @​pr-submit[bot].

Changelog

Sourced from typer's changelog.

0.29.0 (2026-11-09)

Features

• ✨ Use Pydantic for parameter validation. PR #1831 by @​svlandeg.

  Typer now uses Pydantic internally to validate command-line parameters. This is a gradual migration focused on preserving compatibility with existing Typer applications. Some validation error messages, help text, and usage output have changed.

  Compatibility changes:

  • Pydantic >=2.5.3 is now a required dependency.
  • click_type has been removed from typer.Option() and typer.Argument(). New ways to provide custom types will be provided with Pydantic, with much more flexibility.
  • Some defaults are now validated more strictly. The previous tuple example's (None, None, None) default now fails validation. Use tuple[str, int, bool] | None with a default of None and check for None before unpacking, as shown in the updated tuple example. This also makes the code more correct, so you could consider this a bug fix, but if you depended on this behavior, there's a change needed in your code.
  • Default datetime parsing now follows Pydantic's rules, accepting Unix timestamps, timezone offsets, and fractional seconds.
  • Callback parameter objects no longer expose Click's .type, .make_metavar(), .human_readable_name, or .type_cast_value(). Custom integrations using these need updating.

Fixes

• 🐛 Escape terminal controls in Pydantic validation errors. PR #2005 by @​tiangolo.

Docs

• 📝 Explain Pydantic validation in the release notes. PR #2006 by @​tiangolo.
• 🎨 Use the Zensical modern theme for docs. PR #2004 by @​tiangolo.
• 📝 Add AI development guidance and coding agent notices. PR #2003 by @​tiangolo.

0.28.0 (2026-11-06)

Fixes

• 🐛 Ensure that the default option name is not changed by setting a metavar. PR #1957 by @​svlandeg.

Docs

• 🎨 Enable Ruff formatting for Python in Markdown. PR #1978 by @​tiangolo.

Internal

• ⬆ Bump certifi from 2025.11.12 to 2026.10.18. PR #1990 by @​dependabot[bot].
• ⬆ Bump the python-packages group with 6 updates. PR #1994 by @​dependabot[bot].
• ⬆ Bump the github-actions group with 6 updates. PR #1993 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #1995 by @​pr-submit[bot].

Commits

• f725d98 🔖 Release version 0.29.0 (#2007)
• 0504306 📝 Update release notes
• ded9e93 📝 Explain Pydantic validation in the release notes (#2006)
• da23637 📝 Update release notes
• 4e70e62 🐛 Escape terminal controls in Pydantic validation errors (#2005)
• 276b6f8 📝 Update release notes
• 7ca7c48 ✨ Use Pydantic for parameter validation (#1831)
• 00381d6 📝 Update release notes
• 9dfc59c 🎨 Use the Zensical modern theme for docs (#2004)
• 4835af8 📝 Update release notes
• Additional commits viewable in compare view

Updates ruff from 0.17.3 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits

• 05cdc36 Bump version to 0.17.4 (#30073)
• c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
• 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
• 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
• 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
• 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
• c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
• c9150f0 Add project walltime benchmarks for Ruff (#30061)
• 64989ec [ty] Report invalid module globs once per override pattern (#30031)
• 367a563 [ty] Fix conditional type and tuple annotations (#29987)
• Additional commits viewable in compare view

Updates mkdocs-material from 9.8.0 to 9.8.1

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.8.1

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

• Updated Docker base image to Alpine 3.24
• Updated Docker image dependencies to fix vulnerabilities
• Updated Node build-time dependencies to fix vulnerabilities

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.1 (2026-11-07)

• Updated Docker base image to Alpine 3.24
• Updated Docker image dependencies to fix vulnerabilities
• Updated Node build-time dependencies to fix vulnerabilities

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

• Updated Node build-time dependencies to fix vulnerabilities
• Updated Python dependency minimums and required Python 3.11
• Removed RSS from recommended dependencies
• Updated project status and maintenance links
• Updated CLI notice with end-of-life and migration guidance
• Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

... (truncated)

Commits

• 16c95ad Prepare 9.8.1 release
• b3fe832 Fixed documentation workflow
• 004d29e Updated dependencies to fix vulnerabilities
• 7590e14 Documentation
• 0f044db Updated documentation build to use public Material
• dc38d1e Documentation
• ebbfb46 Updated Docker base image to Alpine 3.24
• 624aff1 Updated build and documentation workflows
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions