[dependabot]

Bumps the python group with 43 updates in the / directory:

Package	From	To
pyarrow	25.0.1	26.0.0
duckdb	1.5.5	1.5.6
geopandas	1.1.4	1.2.0
shapely	2.1.2	2.2.0
torch	2.14.0	2.14.1
marimo	0.24.2	0.25.1
ruff	0.16.8	0.17.0
anyio	4.14.2	4.15.1
charset-normalizer	3.4.9	3.5.2
click	8.4.2	8.5.0
contourpy	1.3.3	1.4.0
coverage	7.15.3	7.16.2
fonttools	4.63.0	4.66.1
idna	3.18	3.20
iniconfig	2.3.0	2.3.1
jedi	0.19.2	0.20.0
joblib	1.5.3	1.6.0
kiwisolver	1.5.0	1.5.1
loro	1.13.2	1.16.2
markdown	3.10.3	3.11
markupsafe	3.0.3	3.0.4
msgspec	0.21.1	0.22.0
narwhals	2.24.0	2.27.1
networkx	3.6.1	3.7
numpy	2.5.1	2.5.4
orjson	3.11.9	3.13.0
overturemaps	1.0.1	1.0.2
packaging	26.2	26.3
platformdirs	4.11.0	4.13.0
pycparser	3.0	3.11
pygments	2.20.0	2.21.0
pymdown-extensions	11.0.1	12.2
pyparsing	3.3.2	3.3.3
pyproj	3.7.2	3.8.0
pyzmq	27.1.0	27.2.0
soupsieve	2.9.1	2.10
starlette	1.3.1	1.7.0
threadpoolctl	3.6.0	3.7.0
tqdm	4.70.0	4.70.1
tzdata	2026.3	2026.5
urllib3	2.7.0	2.8.0
uvicorn	0.52.1	0.54.0
websockets	17.0.1	17.2

Updates pyarrow from 25.0.1 to 26.0.0

Release notes

Sourced from pyarrow's releases.

Apache Arrow 26.0.0

Release Notes URL: https://arrow.apache.org/release/26.0.0.html

Apache Arrow 26.0.0 RC0

Release Notes: Release Candidate: 26.0.0 RC0

Commits

• 4461671 MINOR: [Release] Update versions for 26.0.0
• 9d03a26 MINOR: [Release] Update .deb/.rpm changelogs for 26.0.0
• 5ce3c95 MINOR: [Release] Update CHANGELOG.md for 26.0.0
• 28e6c67 GH-51687: [C++] Skipt tests that require threads if ARROW_ENABLE_THREADING=OF...
• 12409f8 GH-51682: [CI][C++] Add liburiparser-dev to system dependency image (#51683)
• 1deceed GH-51675: [Python][Packaging] Apply upstream fix to UriParser from vcpkg and ...
• cca44b5 GH-51638: [CI][C++][Parquet] Update expected JSON output in parquet-reader-te...
• 5183e21 GH-46901: [C++][Compute] Add remainder and modulo kernels (#48914)
• f0d043c MINOR: [Docs][C++] Fix doxygenfile path for arrow/flight/transport.h (#51677)
• 17be9c7 GH-51652: [Python] Add NumPy StringDType to Arrow conversion (#51157)
• Additional commits viewable in compare view

Updates duckdb from 1.5.5 to 1.5.6

Release notes

Sourced from duckdb's releases.

v1.5.6 Bugfix Release

See DuckDB's changelog for all changes in DuckDB.

Commits

• 802a345 set submodule pin to v1.5.6 release hash
• f4f4ad2 [duckdb-labs bot] Bump DuckDB submodule (#631)
• 3d35637 Bump submodule
• 2929d48 [duckdb-labs bot] Bump DuckDB submodule (#625)
• e1b6247 Bump submodule
• f487d2d [duckdb-labs bot] Bump DuckDB submodule (#624)
• ede665a Bump submodule
• f0829a7 [duckdb-labs bot] Bump DuckDB submodule (#623)
• 7e1aaa2 Bump submodule
• b385dbf [duckdb-labs bot] Bump DuckDB submodule (#621)
• Additional commits viewable in compare view

Updates geopandas from 1.1.4 to 1.2.0

Release notes

Sourced from geopandas's releases.

v1.2.0

What's Changed

New features and improvements:

• Static plotting in GeoPandas has been re-implemented. The new tooling shall be mostly backwards compatible while bringing a set of enhancements:

  • Categorical plotting now allows dict-based mapping of categories to colors and other styles.
  • Legends now reflect the geometry type and complete set of styles, not just a color.
  • Plotting of continuous variables with a classification scheme can now produce a colorbar instead of a categorical legend when using colorbar=True within legend_kwds.
  • vmin and vmax keywords are supported when scheme is defined, not ignored.
  • When using categorical colormap with categorical plots, colors are now assigned in order to optimize the contrast of the resulting map.
  • Colorbar size is automatically adjusted to be approximately the size of the plot.
  • Colorbar now indicates extensions if the vmin and/or vmax clip the values.
  • Legends are created automatically by matplotlib. This also means that you can create a single legend from a layered map by calling ax.legend() directly.
  • GeoPandas now labels axes using the information on units from CRS. This can be controlled via the add_labels keyword.
  • Static plots can include a basemap defined by the tiles keyword, exposing contextily.add_basemap from within the plot method. Requires contextily package to be installed.
  • scheme keyword can take a value "greedy" resulting in a greedy (topological) coloring where no two adjacent polygons share a color. Requires mapclassify and libpysal packages.

  The related refactoring of the plotting infrastructure has changed the internal representation of the figure generated by GeoPandas. This can be considered a breaking change if you rely the composition of collections, as that has changed. A number of plotting-related bugs has been fixed along as a side effect. All changes are reflected in an updated user guide. (#3708, #3728, #3748, #3752, #3753, #3763, #3767, #3689).

• GeoParquet improvements:

  • The upcoming GeoParquet 2.0 specification is now supported for both writing and reading (#3632).
  • read_parquet now support direct reading from HTTP/HTTPS protocols (#3699).
  • GeoDataFrame.to_parquet and read_parquet will now write and read attrs respectively (#3597).

• Added geopandas.make_grid and GeoSeries.make_grid to generate a square or hexagonal grids covering the input geometry (#2062).

• Added geopandas.read_file_info to expose information about file layers, including layer metadata (this is an alias for pyogrio.read_info) (#3759).

• Add grid_size parameter to union, difference, symmetric_difference and intersection (#3593).

• Document how to access the feature ID (fid) as the index when reading files

... (truncated)

Changelog

Sourced from geopandas's changelog.

Version 1.2.0 (September 28, 2026)

New features and improvements:

• Static plotting in GeoPandas has been re-implemented. The new tooling shall be mostly backwards compatible while bringing a set of enhancements:

  • Categorical plotting now allows dict-based mapping of categories to colors and other styles.
  • Legends now reflect the geometry type and complete set of styles, not just a color.
  • Plotting of continuous variables with a classification scheme can now produce a colorbar instead of a categorical legend when using colorbar=True within legend_kwds.
  • vmin and vmax keywords are supported when scheme is defined, not ignored.
  • When using categorical colormap with categorical plots, colors are now assigned in order to optimize the contrast of the resulting map.
  • Colorbar size is automatically adjusted to be approximately the size of the plot.
  • Colorbar now indicates extensions if the vmin and/or vmax clip the values.
  • Legends are created automatically by matplotlib. This also means that you can create a single legend from a layered map by calling ax.legend() directly.
  • GeoPandas now labels axes using the information on units from CRS. This can be controlled via the add_labels keyword.
  • Static plots can include a basemap defined by the tiles keyword, exposing contextily.add_basemap from within the plot method. Requires contextily package to be installed.
  • scheme keyword can take a value "greedy" resulting in a greedy (topological) coloring where no two adjacent polygons share a color. Requires mapclassify and libpysal packages.

  The related refactoring of the plotting infrastructure has changed the internal representation of the figure generated by GeoPandas. This can be considered a breaking change if you rely the composition of collections, as that has changed. A number of plotting-related bugs has been fixed along as a side effect. All changes are reflected in an updated user guide. (#3708, #3728, #3748, #3752, #3753, #3763, #3767, #3689).

• GeoParquet improvements:

  • The upcoming GeoParquet 2.0 specification is now supported for both writing and reading (#3632).
  • read_parquet now support direct reading from HTTP/HTTPS protocols (#3699).
  • GeoDataFrame.to_parquet and read_parquet will now write and read attrs respectively (#3597).

• Added geopandas.make_grid and GeoSeries.make_grid to generate a square or hexagonal grids covering the input geometry (#2062).

• Added geopandas.read_file_info to expose information about file layers, including layer metadata (this is an alias for pyogrio.read_info) (#3759).

• Add grid_size parameter to union, difference, symmetric_difference and intersection (#3593).

• Document how to access the feature ID (fid) as the index when reading files with read_file and the pyogrio engine, using fid_as_index=True (#3829).

... (truncated)

Commits

• 199fc53 RLS: v1.2.0
• 0429cd1 DOC/RLS: update changelog for 1.2 release (#3864)
• 3e07c90 BUG: always use int64 for the explode parts index level (#3871)
• 85f3654 TST: use fixed byte-order in to_wkb tests (for big endian machine) (#3874)
• 6d49816 CI: use nightly wheels for shapely in the dev build (#3872)
• 69fb61f ENH: expose read_file_info as toplevel function (#3759)
• cc8e4e8 TST: filterwarning cleanup (#3867)
• 6302753 ENH: support reading GeoParquet 2.0 files with bbox filter (#3847)
• c0e3867 ENH: add new make_grid() function (equivalent of st_make_grid) (#2197)
• 9e58ea1 DOC: consolidate contributing guides (#3859)
• Additional commits viewable in compare view

Updates shapely from 2.1.2 to 2.2.0

Release notes

Sourced from shapely's releases.

2.2.0

Shapely 2.2.0 is a feature release with various new functions, improvements and bug fixes. Highlights include performance improvements for scalar attribute and method calls, and the new minimum_width, coverage_clean, split, transform_coordseq, and get_segments top-level functions.

Shapely 2.2 supports Python >= 3.11, and binary wheels on PyPI include GEOS 3.14 and are now also provided for the Windows ARM64 platform. Wheels are available for Python 3.15.

For a full changelog, see https://shapely.readthedocs.io/en/stable/release/2.x.html#version-2-2-0

2.2.0rc1

Shapely 2.2.0 is a feature release with various new functions, improvements and bug fixes. This is a first release candidate.

For a full changelog, see https://shapely.readthedocs.io/en/latest/release/2.x.html#version-2-2-0

Changelog

Sourced from shapely's changelog.

2.2.0 (2026-10-07)

Shapely 2.2.0 is a feature release with various new functions, improvements and bug fixes. Highlights include performance improvements for scalar attribute and method calls, and the new minimum_width, coverage_clean, split, transform_coordseq, and get_segments top-level functions.

Shapely 2.2 supports Python >= 3.11, and binary wheels on PyPI include GEOS 3.14 and are now also provided for the Windows ARM64 platform. Wheels are available for Python 3.15.

For a full changelog, see https://shapely.readthedocs.io/en/latest/release/2.x.html#version-2-2-0

Commits

• 229c71f RLS: 2.2.0 (#2526)
• 702d8fd CLN: avoid warnings about discarding const qualifier (#2525)
• 0e92040 DOC: update tranform section in the manual (#2518)
• 677f305 MAINT: avoid meson-python 0.22 + DOC: recommend install c-compiler in conda d...
• 68ff25b Use DeprecationWarning instead of FutureWarning for shapely.ops.transform() d...
• 2590a0c BUG: fix empty / non-array cases for transform (#2523)
• 95008b2 ENH: support array input for transform_coordseq (consistent with transform) (...
• e2fe07b docs: Move changelog entry to docs
• c847bb7 fix: Forward **kwargs in line_interpolate_point and line_locate_point (#2480)
• 30c0a51 MAINT: move versioneer config to pyproject.toml; remove setup.cfg (#2511)
• Additional commits viewable in compare view

Updates torch from 2.14.0 to 2.14.1

Release notes

Sourced from torch's releases.

PyTorch 2.14.1 Release

This release is meant to fix the following regressions and silent correctness issues:

Silent correctness fixes

• Fix incorrect torch.linalg.lstsq solutions on MPS for complex batched underdetermined systems (#196113), fixed by #196128
• Fix non-orthogonal U and inaccurate small singular values from torch.linalg.svd on MPS for rank-deficient and ill-conditioned inputs (#196112), fixed by #196139 and #199063
• Update the CUDA 13.2 Linux binaries to CUDA 13.2.2 (#196351). This NVIDIA update resolves two critical issues that could produce incorrect results (CUDA 13.2.2 release notes):
  • cuBLAS: cublasLtMatmul() could ignore tensor-wide scaling for NVFP4 matrix multiplications (introduced in CUDA 13.2 Update 1)
  • Compiler: failed thread reconvergence could leave stale or corrupted register values in kernels with nested thread divergence (present since CUDA 12.8)

Regression fixes

• Fix torch.linalg.svd, torch.linalg.svdvals and torch.linalg.lstsq failing on MPS with a Metal pipeline-state error for inputs above 8192 elements (#195937), fixed by #195949 and #195950
• Fix internal assert in torch.svd(out=) on MPS for complex inputs (#195822), fixed by #195872

Commits

• 5c48869 [MPS] Fix Jacobi SVD convergence for small columns (#199086)
• 35223a2 [release/2.14] Run the release runner-group reconcile in pytorch/pytorch (#19...
• 41ffbc4 [release-only] Update version to 2.14.1 (#198661)
• e8f0c01 [release/2.14] [CD] Update to CUDA 13.2.2 for Linux binaries (#198644)
• 911665d [MPS] Cherry-pick native SVD fixes into release/2.14 (#198394)
• See full diff in compare view

Updates marimo from 0.24.2 to 0.25.1

Release notes

Sourced from marimo's releases.

0.25.1

✨ Enhancements

• Make local agent pairing easier to discover (#10946)
• Update LLM model catalog (#11002)
• Add expand_outputs as an argument to ctx.edit_cell and ctx.create_cell (#10974)
• Record cache entries in a per-notebook manifest (#10838)
• Marimo cache size (#10837)
• Marimo cache dir (#10836)

🐛 Bug fixes

• Keep getpass responses out of saved console output (#11043)
• Reject invalid code mode cell names (#11032)
• Align and unshrink mo.ui.radio button when option label wraps (#11031)
• Harden sandbox environment selection (#11026)
• Send origin referrer on cross-origin requests from notebook pages (#11015)
• Keep sandbox package managers fixed in install alerts (#10983)
• Render dotted chart columns when data falls back to CSV (#10856)
• Fix plotly hover text rendering issue (#10988)
• Avoid repeated Docker prompt for sandboxed URL edits (#10984)
• Make the kernel SIGINT handler reentrancy-safe (#10975)
• Secure language server websocket listeners (#10979)
• Change tokenization to allow trailing comments (#10981)
• UI fix for SFTP (and a fsspec plugin for ssh) (#10977)
• Ensure partial cell config update preserves existing values (#10971)

📚 Documentation

• Add huggingface/drive to remote storage (#10959)
• Normalize styles from katex bump (#10995)
• Add Whisper sandbox example (#10994)
• Fix quickstart anchors in Spanish and Chinese READMEs (#10989)
• Security clarification on pyproject.toml (#10986)
• Add ffmpeg pixi example for blog post (#10993)

📝 Other changes

• Fix suboptimal assignment in cell-matching Hungarian algorithm (#10654) (f15c5ff)

Contributors

Thanks to all our community and contributors who made this release possible: @​dmadisetti, @​kirangadhave, @​koaning, @​Light2Dark, @​manzt, @​marthacryan, @​mscolnick, @​peter-gy, @​sadov, @​ZainnQureshii

Full Changelog: marimo-team/marimo@0.25.0...0.25.1

0.25.0

This release reworks sandboxing to improve correctness, recovery, and consistency, and adds Pixi as a new sandbox backend.

We expect most users to be able to upgrade without making changes. Existing sandbox commands continue to work, but the underlying environment lifecycle has changed substantially and could affect some workflows.

This release also adds portable WebAssembly exports, persistent expanded outputs, and many fixes across the editor and runtime.

⭐️ Highlights

... (truncated)

Commits

• 92fbbbe release: 0.25.1 (#11056)
• e43977e fix(deps): exclude broken SQLAlchemy 2.1.0 release (#11059)
• 062caf9 fix(test): drop leaked DuckDB schemas in SQL cleanup test (#11057)
• 9f34a51 fix: point pair agents at marimo edit when no session exists (#11055)
• 7d7529a fix(test): prevent DuckDB state leaks and directory watcher races (#11054)
• bfa9639 feat: add shared table export dialog (#11029)
• 719f967 fix: preserve null handling in generated filters (#11036)
• c1220e6 fix(sql): honor DuckDB discovery settings (#11007)
• 6d3d22e fix: give Markdown list markers more room (#11042)
• ce0e849 feat(frontend): publish HTML to web through molab (#10763)
• Additional commits viewable in compare view

Updates ruff from 0.16.8 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

  The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

• Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

  The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

• Remove support for ruff-lsp (#28750)

  Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

• lazy-import-mismatch (TID254)
• lazy-import-immediately-resolved (TID255)
• os-path-commonprefix (RUF071)

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits

• 5b27c1c Bump version to 0.17.0 (#29259)
• 8f362bf Integrate vendored Unicode names into Ruff
• 88a50d6 Revert upstream Unicode loose matching
• 276832a Revert upstream Unicode alias normalization
• 26911ca Vendor unicode_names2 from upstream
• 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
• bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
• 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
• dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
• ef23c9c Update default and latest Python versions for 3.15 (#28792)
• Additional commits viewable in compare view

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

• Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

• Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

  • follow_symlinks on exists() (Python 3.12+)
  • follow_symlinks on is_dir() (Python 3.13+)
  • follow_symlinks on is_file() (Python 3.13+)
  • follow_symlinks on owner() (Python 3.13+)
  • follow_symlinks on group() (Python 3.13+)
  • newline on read_text() (Python 3.13+)

  (#1286, #1293; PR by @​jaideeppyne)

• Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

• Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

• Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

• Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

• Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

• Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

• Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

• Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

• Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

• Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

• Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

• Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

• Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

• Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

• Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

• Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

• Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

• Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits

• ffcd154 Bumped up the version
• 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
• 9283662 Bumped up the version
• d137692 Improved the instructions for AI agents
• 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
• 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
• b825c3b Fixed pyproject.toml changes not triggering the test suite
• 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
• b05fe6d Fixed wrong type in move_on_after (#1297)
• 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
• Additional commits viewable in compare view

Updates charset-normalizer from 3.4.9 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Version 3.5.1

3.5.1 (2026-08-15)

Changed

• Raised upper bound of setuptools to v84 (#794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

... (truncated)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.