[dependabot]

Bumps the python-dependencies group with 5 updates in the / directory:

Package	From	To
coverage	7.17.0	7.17.2
mypy	2.4.0	2.4.1
pip	26.2.2	26.3
ruff	0.17.3	0.17.4
sphinx-autodoc-typehints	3.17.2	3.17.5

Updates coverage from 7.17.0 to 7.17.2

Release notes

Sourced from coverage's releases.

7.17.2

Version 7.17.2 — 2026-11-04

• Fix: two different scenarios failed with “attempt to write a readonly database”. These were regressions in 7.17.1. They are fixed, closing issue 2356:
  • When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.
  • coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can’t read is now reported like any other unusable data file, and is left in place.

➡️  PyPI page: coverage 7.17.2. :arrow_right:  To install: python3 -m pip install coverage==7.17.2

7.17.1

Version 7.17.1 — 2026-11-03

• Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167 and issue 2337.
• Fix: the HTML report only rewrites a file’s page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.
• Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message “total of 0.4 is less than fail-under=0.5”. Previously, the comparison rounded the total to zero and the message could claim “1 is less than 0”. Closes issue 2295.
• Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &. Now they are properly escaped only once.
• Fix: --source=/ measured no files. A file system root can’t be a source directory, so now it is an error. Closes issue 2291.
• In an abundance of caution, prevent forged SQLite journal files from deleting files they shouldn’t.

➡️  PyPI page: coverage 7.17.1. :arrow_right:  To install: python3 -m pip install coverage==7.17.1

Changelog

Sourced from coverage's changelog.

Version 7.17.2 — 2026-11-04

• Fix: two different scenarios failed with "attempt to write a readonly database". These were regressions in 7.17.1. They are fixed, closing issue 2356_:

  • When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.

  • coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can't read is now reported like any other unusable data file, and is left in place.

.. _issue 2356: coveragepy/coveragepy#2356

.. _changes_7-17-1:

Version 7.17.1 — 2026-11-03

• Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167_ and issue 2337_.

• Fix: the HTML report only rewrites a file's page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.

• Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message "total of 0.4 is less than fail-under=0.5". Previously, the comparison rounded the total to zero and the message could claim "1 is less than 0". Closes issue 2295_.

• Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &. Now they are properly escaped only once.

• Fix: --source=/ measured no files. A file system root can't be a source directory, so now it is an error. Closes issue 2291_.

... (truncated)

Commits

• d0d3e1d docs: combine the two 'combine' failure descriptions
• 33cb85f fix: don't initialize a data file we can only read (#2360)
• 6e71bac docs: prep for 7.17.2
• 8273f72 test: fix two tests that failed on the Rocky 8 old_sqlite job
• ce216fd build: a test environment for old version of SQLite
• 36e4a18 fix: combine failed on SQLite<3.34.0 #2356
• d80ed19 build: bump version to 7.17.2
• 1941ee1 docs: prep for 7.17.1
• 474bba1 chore: make upgrade
• 1ab58b3 chore: bump the action-dependencies group with 6 updates (#2355)
• Additional commits viewable in compare view

Updates mypy from 2.4.0 to 2.4.1

Changelog

Sourced from mypy's changelog.

Mypy 2.4.1

• Process overloads as a whole in two-phase type checking (Ivan Levkivskyi, PR 22231)
• Skip recursive setup for frame-private nested functions in mypyc (Piotr Sawicki, PR 22187)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• A5rocks
• Adam Dangoor
• Alex Waygood
• Ali Hamdan
• Brian Helba
• Chad Dombrova
• David Foster
• dnwpark
• Edgar Ramírez Mondragón
• Giorgos Michas
• Ivan Levkivskyi
• Jelle Zijlstra
• Jukka Lehtosalo
• Marc Mueller
• Michael R. Crusoe
• NIYONSHUTI Emmanuel
• Piotr Sawicki
• Shantanu
• themylogin
• Vaggelis Danias
• Willy Bruns

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

... (truncated)

Commits

• ad02a35 Skip test for 2.4.1
• cad7794 Finalize version to 2.4.1
• d9cbcbc Add changelog for Mypy 2.4.1 (#22310)
• 2860baa Process overloads as a whole in two-phase type-checking (#22231)
• 9b3e307 [mypyc] Skip recursive setup for frame-private nested functions (#22187)
• 10ad5f6 Bump ast-serialize to 0.12.1 (#22093)
• 350052f Bump ast-serialize to 0.12.0 (#22087)
• f7d08cf Bump version to 2.4.1+dev
• See full diff in compare view

Updates pip from 26.2.2 to 26.3

Changelog

Sourced from pip's changelog.

26.3 (2026-11-02)

Improved Documentation

• Clarify in the security policy that pip has never considered installing untrusted wheels safe. This is because Python's import system is dynamic, so pip cannot guarantee that installing a wheel will not execute third-party code. ([#14412](https://github.com/pypa/pip/issues/14412) <https://github.com/pypa/pip/issues/14412>_)

Deprecations and Removals

• Block unexpected imports during installation, warn about unsafe imports afterward, and improve recovery from interrupted installations. ([#13842](https://github.com/pypa/pip/issues/13842) <https://github.com/pypa/pip/issues/13842>_)

Features

• Show build backend warnings for local source directories and log them at debug level for other sources. ([#14372](https://github.com/pypa/pip/issues/14372) <https://github.com/pypa/pip/issues/14372>_)
• Add support for selecting extras in pylock.toml files with -r pylock.toml[extra1,extra2]. ([#14205](https://github.com/pypa/pip/issues/14205) <https://github.com/pypa/pip/issues/14205>_)
• Allow --group to select non-default groups from local pylock files, e.g. --group pylock.toml:docs. ([#14390](https://github.com/pypa/pip/issues/14390) <https://github.com/pypa/pip/issues/14390>_)
• Support --no-binary with -r pylock.toml. Before, pip would get the sdist from the index instead of the locked URL, or fail if no wheel were available in the lock file. ([#14187](https://github.com/pypa/pip/issues/14187) <https://github.com/pypa/pip/issues/14187>_)
• Speed up installing a wheel with console scripts by not resolving every PATH entry. ([#14235](https://github.com/pypa/pip/issues/14235) <https://github.com/pypa/pip/issues/14235>_)
• Clarify the warning for ~-prefixed leftover distribution directories. ([#11849](https://github.com/pypa/pip/issues/11849) <https://github.com/pypa/pip/issues/11849>_)

Bug Fixes

• Report build-backend import failures as pip errors instead of displaying an uncaught traceback. ([#12248](https://github.com/pypa/pip/issues/12248) <https://github.com/pypa/pip/issues/12248>_)
• No longer log the "pip is looking at multiple versions of a package" message until pip has looked at at least two versions of that package. ([#12928](https://github.com/pypa/pip/issues/12928) <https://github.com/pypa/pip/issues/12928>_)
• Fix pip's self version check reporting an outdated version from the environment instead of the running pip when run as a zipapp. ([#13084](https://github.com/pypa/pip/issues/13084) <https://github.com/pypa/pip/issues/13084>_)
• Fix a fatal error when using the PIP_CONFIG_FILE environment variable with pip config set. ([#13279](https://github.com/pypa/pip/issues/13279) <https://github.com/pypa/pip/issues/13279>_)
• Avoid misleading error messages that include extra markers such as ; extra == "..." when installing packages. ([#13618](https://github.com/pypa/pip/issues/13618) <https://github.com/pypa/pip/issues/13618>_)
• When installing to a custom --prefix, use the posix_prefix scheme when running from a Debian patched Python distribution to avoid a superfluous /local/ subdirectory. ([#13634](https://github.com/pypa/pip/issues/13634) <https://github.com/pypa/pip/issues/13634>_)
• Refuse to follow an HTTP redirect to a file: URL. ([#14171](https://github.com/pypa/pip/issues/14171) <https://github.com/pypa/pip/issues/14171>_)
• Prevent wheel cache origin mismatch warnings from exposing URL credentials. ([#14232](https://github.com/pypa/pip/issues/14232) <https://github.com/pypa/pip/issues/14232>_)
• Report the incomplete-download error on Windows, not a PermissionError. ([#14237](https://github.com/pypa/pip/issues/14237) <https://github.com/pypa/pip/issues/14237>_)
• Fix the global configuration location on macOS in virtual environments created from Homebrew Python. ([#14303](https://github.com/pypa/pip/issues/14303) <https://github.com/pypa/pip/issues/14303>_)
• Reject extra arguments to pip config edit instead of silently ignoring them. ([#14347](https://github.com/pypa/pip/issues/14347) <https://github.com/pypa/pip/issues/14347>_)
• Honor supplied hashes when using --no-require-hashes. ([#14355](https://github.com/pypa/pip/issues/14355) <https://github.com/pypa/pip/issues/14355>_)

... (truncated)

Commits

• 191854f Bump for release
• 063058b Update AUTHORS.txt
• d1a81c8 Merge pull request #14233 from carrerasdarren-cell/fix/cache-origin-redact-auth
• 942a415 Merge pull request #14423 from notatallshaw/fix/pkg-resources-deadline-20261102
• f424f1a Merge pull request #14424 from notatallshaw/vendor/msgpack-1.2.4-20261102
• 720a89a Merge branch 'main' into fix/cache-origin-redact-auth
• 8e3414c Merge pull request #14247 from notatallshaw/enforce-import-block
• 5156e03 Upgrade msgpack to 1.2.4
• 95e2e6b Merge branch 'main' into enforce-import-block
• 3859fd1 Defer pkg_resources metadata errors until pip 27.0
• Additional commits viewable in compare view

Updates ruff from 0.17.3 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits

• 05cdc36 Bump version to 0.17.4 (#30073)
• c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
• 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
• 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
• 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
• 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
• c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
• c9150f0 Add project walltime benchmarks for Ruff (#30061)
• 64989ec [ty] Report invalid module globs once per override pattern (#30031)
• 367a563 [ty] Fix conditional type and tuple annotations (#29987)
• Additional commits viewable in compare view

Updates sphinx-autodoc-typehints from 3.17.2 to 3.17.5

Release notes

Sourced from sphinx-autodoc-typehints's releases.

3.17.5

🐍 PyPI release

📜 Full Changelog

3.17.4

Bug fixes

• Link each name in the type after an attribute, data or property name with the role its docstring field uses, so a type alias an inventory lists as data, such as numpy.typing.NDArray, resolves through intersphinx (#1105) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

3.17.3

Packaging

• Publish categorized GitHub Release notes with PyPI and version-comparison links (#1094) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

Changelog

Sourced from sphinx-autodoc-typehints's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-3-17-5:

---

3.17.5 (2026-11-04)

---

.. _release-3-17-4:

---

3.17.4 (2026-10-27)

---

.. _release-3-17-4-fixed:

Fixed

• Link each name in the type after an attribute, data or property name with the role its docstring field uses, so a type alias an inventory lists as data, such as numpy.typing.NDArray, resolves through intersphinx (:pr:1105) by :user:gaborbernat.

.. _release-3-17-3:

---

3.17.3 (2026-10-27)

---

.. _release-3-17-3-packaging:

Packaging

• Publish categorized GitHub Release notes with PyPI and version-comparison links (:pr:1094) by :user:gaborbernat.

.. _release-3-17-2:

---

3.17.2 (2026-10-17)

---

.. _release-3-17-2-fixed:

... (truncated)

Commits

• 421ce6b release 3.17.5
• 21e1674 release 3.17.4
• dc3d7a9 🐛 fix(headers): link names with their field role (#1105)
• 3c231f5 release 3.17.3
• 1b619c7 ✨ feat(release): move releases to shared github-workflows (#1094)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions