Skip to content

chore(deps): bump the python-packaging group across 1 directory with 26 updates - #788

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-packaging-b1868cda6f
Open

chore(deps): bump the python-packaging group across 1 directory with 26 updates#788
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-packaging-b1868cda6f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-packaging group with 26 updates in the / directory:

Package From To
certifi 2026.6.17 2026.7.22
polars 1.42.1 2.0.0
pytz 2026.2 2026.5
temporalio 1.30.0 1.34.0
duckdb 1.5.4 1.5.6
statsmodels 0.14.6 0.15.0
coverage 7.15.2 7.16.2
hypothesis 6.152.7 6.168.5
black 26.5.1 26.10.1
commitizen 4.16.5 4.19.2
mypy 2.3.0 2.4.0
pre-commit 4.6.1 4.6.2
ruff 0.16.0 0.17.0
types-pyyaml 6.0.12.20260724 6.0.12.20260906
build 1.5.0 1.6.1
setuptools 83.0.0 84.0.0
twine 6.2.0 7.0.0
wheel 0.47.0 0.48.0
charset-normalizer 3.4.9 3.5.2
idna 3.18 3.20
packaging 26.2 26.3
polars-runtime-32 1.42.1 2.0.0
protobuf 7.35.1 7.36.2
pygments 2.20.0 2.21.0
types-protobuf 7.34.1.20260518 7.35.1.20260906
urllib3 2.7.0 2.8.0

Updates certifi from 2026.6.17 to 2026.7.22

Commits

Updates polars from 1.42.1 to 2.0.0

Release notes

Sourced from polars's releases.

Python Polars 2.0.0

💥 Breaking changes

  • Run SQL window functions over grouped rows on the aggregated rows, and evaluate QUALIFY before the projection (#29746)
  • Type exact SQL numeric literals as Decimal and truncate SQL %/DIV (#29536)
  • Allow deterministic expression plugins to opt into CSE/CSPE (#29428)
  • Read Parquet ENUM type as pl.String (#29331)
  • More map operations (#29296)
  • Deprecate cut/qcut (#29329)

🚀 Performance improvements

  • Fix phases ending too soon due to join sampling (#29752)
  • Group record batch fetches of remote IPC scans (#29750)
  • Mark group-by node as memory intensive pipeline blocker (#29749)
  • Don't inline slow OOC memory drift path (#29745)
  • Only prefetch on unspill when there is memory headroom (#29701)
  • Pushdown filters to scan_lance (#29538)
  • Do not materialize equal ScalarColumns in Column::append/extend (#28989)
  • Evaluate scalar windows in the streaming window node (#29698)
  • Don't materialize scalar columns in DataFrame::estimated_size (#29711)
  • Defer cached pread from prefetch to decode for Parquet (#29702)
  • Decode IPC scans out of order when order is not observed (#29675)
  • IPC metadata suffix fetch (#29692)
  • Speed up null tracking in streaming group-by sum, min and max (#29691)
  • Cache Iceberg manifest files across scans (#29623)
  • Improve pushdown support for fallible Hive predicates (#29594)
  • Streamline BytecodeParser method rewriting (#29632)
  • Stream from_dicts records straight into column buffers (#29656)
  • Read correlated SQL aggregates from the outer join when the subquery repeats it (#29685)
  • Emit files unordered for remote IPC files when order not observed (#29678)
  • Don't keep input order for order-insensitive windows in all engines (#29680)
  • Fix parallelization in top-k reducer (#29684)
  • Share one bloom filter between the build threads of a runtime filter (#29677)
  • Add streaming (out-of-core) sort (#29657)
  • Insert keys that start a run of equal keys into the hot group-by table right away (#29673)
  • Prefetch key-row hash table lookups in blocks (#29663)
  • Lower count-guarded sums to a sum that is null on empty input (#29668)
  • Use single PUT for small cloud uploads (#29603)
  • Don't cache plain scans in the streaming engine (#29654)
  • Change single-key group-by hash table layout and add prefetching (#29661)
  • Use the integer ranges of sampled parquet row groups in filter estimates (#29655)
  • Raise HTTP rate-limiter read init default (#29584)
  • Change join hash table layout and add prefetching (#29653)
  • Add a fast-path for as_list with only a single input (#29592)
  • Use one runtime filter builder per thread for a finished sample (#29646)
  • Compute decimal addition, subtraction and multiplication in i64 when values fit (#29638)
  • Spread decimal sums and means over lanes and check the sum's 38 digits once (#29637)
  • Compute decimal addition, subtraction and multiplication without per-row validity (#29634)
  • Skip or reuse UDF disassembly in BytecodeParser (#29625)

... (truncated)

Commits
  • 22a147d perf: Fix phases ending too soon due to join sampling (#29752)
  • e319cca Python Polars 2.0 (#29723)
  • d1d6ba4 fix: Find SQL aggregates by their function name, and raise on nested aggregat...
  • 5c6a473 perf: Group record batch fetches of remote IPC scans (#29750)
  • c630040 perf: Mark group-by node as memory intensive pipeline blocker (#29749)
  • e1fbe49 fix: Run SQL window functions over grouped rows on the aggregated rows, and e...
  • 3de661d feat: Enable OOC by default with 80% of available RAM as threshold (#29741)
  • 0159b45 refactor: Hold the category mapping in the categorical is_in lookup (#29747)
  • 29995b3 perf: Don't inline slow OOC memory drift path (#29745)
  • 8399cf6 fix: Match categories added after is_in prepares a string haystack (#29744)
  • Additional commits viewable in compare view

Updates pytz from 2026.2 to 2026.5

Commits
  • 21be17f Add Python 3.14 to test suite
  • fddd01c Bump version numbers to 2026.5 (2026e)
  • 8f05ab3 IANA 2026e
  • d79605f Squashed 'tz/' changes from d633fe7ed3..db07415c7d
  • 1ac6e51 Bump version numbers to 2026.4 (2026d)
  • 1672798 IANA 2026d
  • 0b5995b Squashed 'tz/' changes from 71f28b9ab3..bac9223f4b
  • e96461b Make deprecation notice louder
  • 3c7af58 Merge branch 'nicoleman0-fix/timezone-non-string-input' into 2026d
  • 234a247 Merge branch 'nicoleman0-fix/fixedoffset-basetzinfo' into 2026d
  • Additional commits viewable in compare view

Updates temporalio from 1.30.0 to 1.34.0

Release notes

Sourced from temporalio's releases.

1.34.0

Notable Changes

Added

  • Added WorkflowAlreadyStartedError.first_run_id for the first execution run ID when provided by the server.

  • Experimental: temporalio.contrib.google_adk_agents now supports ADK v2 graph workflows, dynamic @node workflows, and durable HITL.

  • Experimental: Experimental support for Event Groups. Event Groups is a new form of Workflow-level metadata that allows for improved visibility into a Workflow execution's history by grouping logically related Events together based on user-defined or system-inferred criteria. workflow.create_event_group(...) takes the Event Group's ID as its first and only required argument; the user-provided ID is used verbatim and should not contain sensitive information. The label is optional and passed as a keyword argument; it is a codec-encoded Payload.

  • Added workflow.Info.original_execution_run_id, the run ID recorded on the workflow execution started event. Unlike run_id, this value is preserved across workflow resets.

  • Experimental: temporalio.contrib.strands now supports durable, Workflow-isolated Strands sandboxes through TemporalSandbox and worker-side factories registered with StrandsPlugin(sandboxes=...).

  • Added the temporalio.contrib.gcp.cloud_run.id module with the CloudRunIdPlugin client plugin to set the worker identity on Cloud Run.

Changed

  • The deepagents extra now requires deepagents>=0.7,<0.8 (was <0.7). Because deepagents 0.7 requires langsmith>=0.10.9, the langsmith extra now allows langsmith<0.13 (was <0.9).

💥 Breaking Changes

  • The google-adk extra now requires google-adk>=2.8.0,<3, up from >=2.2.0.
  • temporalio.contrib.google_adk_agents: ADK-generated ids and retry jitter now draw from the workflow's deterministic random stream. A workflow started under an earlier release that calls workflow.random() or workflow.uuid4() after ADK code may not replay deterministically across the upgrade; drain such workflows or use worker versioning.

Fixed

  • temporalio.contrib.deepagents now preserves model binding options such as response_format and tool_choice when tools are also bound.

  • Workflow handles returned when a start attaches to a running workflow now use the server-provided first execution run ID with Temporal Server 1.32.0 or later.

  • Restore frozenset values when decoding JSON payloads with a frozenset type hint, including nested frozen sets.

  • Ordinary absolute imports of already-loaded modules in sandboxed workflows no longer go through

... (truncated)

Changelog

Sourced from temporalio's changelog.

[1.34.0] - 2026-09-30

Added

  • Added WorkflowAlreadyStartedError.first_run_id for the first execution run ID when provided by the server.

  • Experimental: temporalio.contrib.google_adk_agents now supports ADK v2 graph workflows, dynamic @node workflows, and durable HITL.

  • Experimental: Experimental support for Event Groups. Event Groups is a new form of Workflow-level metadata that allows for improved visibility into a Workflow execution's history by grouping logically related Events together based on user-defined or system-inferred criteria. workflow.create_event_group(...) takes the Event Group's ID as its first and only required argument; the user-provided ID is used verbatim and should not contain sensitive information. The label is optional and passed as a keyword argument; it is a codec-encoded Payload.

  • Added workflow.Info.original_execution_run_id, the run ID recorded on the workflow execution started event. Unlike run_id, this value is preserved across workflow resets.

  • Experimental: temporalio.contrib.strands now supports durable, Workflow-isolated Strands sandboxes through TemporalSandbox and worker-side factories registered with StrandsPlugin(sandboxes=...).

  • Added the temporalio.contrib.gcp.cloud_run.id module with the CloudRunIdPlugin client plugin to set the worker identity on Cloud Run.

Changed

  • The deepagents extra now requires deepagents>=0.7,<0.8 (was <0.7). Because deepagents 0.7 requires langsmith>=0.10.9, the langsmith extra now allows langsmith<0.13 (was <0.9).

💥 Breaking Changes

  • The google-adk extra now requires google-adk>=2.8.0,<3, up from >=2.2.0.
  • temporalio.contrib.google_adk_agents: ADK-generated ids and retry jitter now draw from the workflow's deterministic random stream. A workflow started under an earlier release that calls workflow.random() or workflow.uuid4() after ADK code may not replay deterministically across the upgrade; drain such workflows or use worker versioning.

Fixed

  • temporalio.contrib.deepagents now preserves model binding options such as response_format and tool_choice when tools are also bound.

  • Workflow handles returned when a start attaches to a running workflow now use the server-provided first execution run ID with Temporal Server 1.32.0 or later.

  • Restore frozenset values when decoding JSON payloads with a frozenset type hint, including nested frozen sets.

  • Ordinary absolute imports of already-loaded modules in sandboxed workflows no longer go through importlib's module locks, fixing intermittent Failed validating workflow errors on Python 3.10

... (truncated)

Commits

Updates duckdb from 1.5.4 to 1.5.6

Release notes

Sourced from duckdb's releases.

v1.5.6 Bugfix Release

See DuckDB's changelog for all changes in DuckDB.

v1.5.5 Bugfix Release

See DuckDB's changelog for all changes in DuckDB.

What's Changed in DuckDB-Python

Commits

Updates statsmodels from 0.14.6 to 0.15.0

Release notes

Sourced from statsmodels's releases.

Release 0.15.0

The statsmodels developers are happy to announce the release of 0.15.0. 358 issues were closed in this release and 655 pull requests were merged. Major new features include:

  • Standardized on rng for controlling randomness across the package (SPEC 007), replacing seed/random_state
  • Functions with variable-length tuple returns now return documented NamedTuple results instead
  • A new abstracted formula engine that supports both patsy and formulaic as the backend
  • Support for Polars DataFrames and Series as model input
  • Switched the build backend from setuptools to meson-python
  • New robust estimators: CovDetMCD, CovDetS, CovDetMM, and RLMDetSMM
  • New tests: Diebold-Mariano, Pesaran-Timmermann, Jonckheere-Terpstra, Leybourne-McCabe, and a delete-k block jackknife estimator
  • The Hamilton filter, local false discovery rate correction, and an L1-penalized GLM solver
  • HurdleCountModel gained fit_regularized, and MICEData is now iterable

This release also raises the minimum supported versions of NumPy, SciPy, and pandas, and tightens input validation for many string-valued options across the package (invalid values that previously failed silently or with a confusing error now raise a clear ValueError). A handful of long-standing bugs in seldom-exercised code paths were also corrected as part of a systematic coverage audit this cycle, some of which change numerical output for affected models. See the release notes for the complete list of enhancements, breaking changes, and bug fixes.

Commits
  • 278ff99 Merge pull request #10211 from bashtage/update-release-note
  • ab3f3bc DOC: Final release note
  • 9307ef1 Merge pull request #8712 from bdpedigo/nobs-style
  • 463e5c5 Merge pull request #10210 from Panzerkampfwagen-del/mice-data-iterable
  • cc734d8 Merge branch 'main' into mice-data-iterable
  • 2912b84 Merge pull request #10209 from Panzerkampfwagen-del/var-df-model-docstring
  • 279b9f4 ENH: make MICEData iterable, yielding successive imputed datasets
  • ce7f2c0 DOC: clarify VARResults.df_model counts parameters per equation
  • d1e1875 Merge pull request #10205 from bashtage/fix-hurdle-and-l1-cov
  • bb385fb Merge pull request #10208 from bashtage/update-release-note
  • Additional commits viewable in compare view

Updates coverage from 7.15.2 to 7.16.2

Release notes

Sourced from coverage's releases.

7.16.2

Version 7.16.2 — 2026-09-27

  • Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
  • Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
  • Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

7.16.1

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
  • Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

7.16.0

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
  • The Coverage.switch_context() method now returns the previous context.
  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
  • Fixes to validation of options and configuration settings:
    • Negative precision settings now always cause useful error messages (pull 2261).
    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

7.15.4

Version 7.15.4 — 2026-08-06

  • Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
  • Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
  • Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

  • Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
  • A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.

... (truncated)

Changelog

Sourced from coverage's changelog.

Version 7.16.2 — 2026-09-27

  • Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168_.

  • Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289_.

  • Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923_.

.. _issue 1923: coveragepy/coveragepy#1923 .. _issue 2168: coveragepy/coveragepy#2168 .. _issue 2289: coveragepy/coveragepy#2289

.. _changes_7-16-1:

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

  • Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

.. _issue 1563: coveragepy/coveragepy#1563 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

  • The :meth:.Coverage.switch_context method now returns the previous context.

  • Fix: previously, a [paths] pattern would be replaced everywhere in a file

... (truncated)

Commits

Updates hypothesis from 6.152.7 to 6.168.5

Release notes

Sourced from hypothesis's releases.

Hypothesis for Python - version 6.152.9

This release substantially improves our internal distribution for generating integers. This release has the most visible effect on "integers()", but may incidentally improve other strategies which draw integers internally.

Our integers distribution had two problems. First, it had jagged discontinuities at certain values where we switched sampling approaches. Second, it used a different distribution for bounded and unbounded ranges, which resulted in "st.integers()" and "st.integers(-264, 264)" producing very different distributions despite being semantically similar.

We now use a smooth distribution for both "st.integers()" and "st.integers(a, b)", which fixes both of these issues. This should substantially improve our testing power in certain cases.

The only way this release should be user-visible is that it finds more bugs! If this release is user-visible in other ways - for example, because it is slower, or produces a worse distribution in some cases - please open an issue.

The canonical version of these notes (with links) is on readthedocs.

Hypothesis for Python - version 6.152.8

This release drops support for end-of-life Django 4.2.

The canonical version of these notes (with links) is on readthedocs.

Commits
  • ca2a4c6 Bump hypothesis version to 6.168.5 and update changelog
  • c1c9957 Merge pull request #4894 from MarcoGorelli/django-from-field-return-type
  • d862501 Bump hypothesis version to 6.168.4 and update changelog
  • de4ec1c Merge pull request #4887 from HypothesisWorks/create-pull-request/patch
  • 8a80889 add pypy312 support
  • 9ee265d Update pinned dependencies
  • f92f61c Fix the return type of django's from_field
  • 44b82b2 Bump hypothesis version to 6.168.3 and update changelog
  • aeaafb5 Merge pull request #4888 from gpacix/fix-quadratic-statistics
  • f3f4a29 wording, remove hardcoded test
  • Additional commits viewable in compare view

Updates black from 26.5.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

  • Add --cache-dir to configure the cache directory from the command line (#5433)
  • Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

  • Add --cache-dir to configure the cache directory from the command line (#5433)

... (truncated)

Commits
  • 258e7db Prepare release 26.10.1 (#5511)
  • ac1f715 Action: validate required-version better (#5510)
  • fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
  • 4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
  • 6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
  • c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
  • 8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
  • c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
  • eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
  • 939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
  • Additional commits viewable in compare view

Updates commitizen from 4.16.5 to 4.19.2

Release notes

Sourced from commitizen's releases.

v4.19.2 (2026-10-07)

Fix

  • tags: give ignored tag formats precedence over version formats

v4.19.1 (2026-10-03)

Refactor

  • bump: use VersionIncrement ordering for bump detection (#2097)

v4.19.0 (2026-09-22)

Feat

  • add extensible commit filters

v4.18.0 (2026-08-19)

Feat

  • commit: add a tag(--body-length-limit) and a function for command commit (#1849)

v4.17.1 (2026-08-17)

Fix

  • init: skip hook question when no installer is present
  • init: use prek when installing hooks if pre-commit is missing

v4.17.0 (2026-07-29)

Feat

  • cmd/version: add support for --next USE_GIT_COMMITS

Fix

  • robuster agents
  • version: remove next from exclusive group
  • bump: use correct type for calling changelog
Changelog

Sourced from commitizen's changelog.

v4.19.2 (2026-10-07)

Fix

  • tags: give ignored tag formats precedence over version formats

v4.19.1 (2026-10-03)

Refactor

  • bump: use VersionIncrement ordering for bump detection (#2097)

v4.19.0 (2026-09-22)

Feat

  • add extensible commit filters

v4.18.1 (2026-09-13)

Fix

  • preserve blank lines with body length limit (#2080)

v4.18.0 (2026-08-19)

Feat

  • commit: add a tag(--body-length-limit) and a function for command commit (#1849)

v4.17.1 (2026-08-17)

Fix

  • init: skip hook question when no installer is present
  • init: use prek when installing hooks if pre-commit is missing

v4.17.0 (2026-07-29)

Feat

  • cmd/version: add support for --next USE_GIT_COMMITS

Fix

  • robuster agents
  • version: remove next from exclusive group
  • bump: use correct type for calling changelog
Commits
  • 57217c3 bump: version 4.19.1 → 4.19.2
  • 6ef4a34 fix(tags): give ignored tag formats precedence over version formats
  • 2bcb46f ci(deps): bump gitpython from 3.1.59 to 3.1.62 (

@dependabot
chore(deps): bump the python-packaging group across 1 directory with …
a06751b 
…26 updates

Bumps the python-packaging group with 26 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [certifi](https://github.com/certifi/python-certifi) | `2026.6.17` | `2026.7.22` |
| [polars](https://github.com/pola-rs/polars) | `1.42.1` | `2.0.0` |
| [pytz](https://github.com/stub42/pytz) | `2026.2` | `2026.5` |
| [temporalio](https://github.com/temporalio/sdk-python) | `1.30.0` | `1.34.0` |
| [duckdb](https://github.com/duckdb/duckdb-python) | `1.5.4` | `1.5.6` |
| [statsmodels](https://github.com/statsmodels/statsmodels) | `0.14.6` | `0.15.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.2` | `7.16.2` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.152.7` | `6.168.5` |
| [black](https://github.com/psf/black) | `26.5.1` | `26.10.1` |
| [commitizen](https://github.com/commitizen-tools/commitizen) | `4.16.5` | `4.19.2` |
| [mypy](https://github.com/python/mypy) | `2.3.0` | `2.4.0` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.1` | `4.6.2` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.0` | `0.17.0` |
| [types-pyyaml](https://github.com/python/typeshed) | `6.0.12.20260724` | `6.0.12.20260906` |
| [build](https://github.com/pypa/build) | `1.5.0` | `1.6.1` |
| [setuptools](https://github.com/pypa/setuptools) | `83.0.0` | `84.0.0` |
| [twine](https://github.com/pypa/twine) | `6.2.0` | `7.0.0` |
| [wheel](https://github.com/pypa/wheel) | `0.47.0` | `0.48.0` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.9` | `3.5.2` |
| [idna](https://github.com/kjd/idna) | `3.18` | `3.20` |
| [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` |
| [polars-runtime-32](https://github.com/pola-rs/polars) | `1.42.1` | `2.0.0` |
| [protobuf](https://developers.google.com/protocol-buffers/) | `7.35.1` | `7.36.2` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |
| [types-protobuf](https://github.com/python/typeshed) | `7.34.1.20260518` | `7.35.1.20260906` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.7.0` | `2.8.0` |



Updates `certifi` from 2026.6.17 to 2026.7.22
- [Commits](certifi/python-certifi@2026.06.17...2026.07.22)

Updates `polars` from 1.42.1 to 2.0.0
- [Release notes](https://github.com/pola-rs/polars/releases)
- [Commits](pola-rs/polars@py-1.42.1...py-2.0.0)

Updates `pytz` from 2026.2 to 2026.5
- [Release notes](https://github.com/stub42/pytz/releases)
- [Commits](stub42/pytz@release_2026.2...release_2026.5)

Updates `temporalio` from 1.30.0 to 1.34.0
- [Release notes](https://github.com/temporalio/sdk-python/releases)
- [Changelog](https://github.com/temporalio/sdk-python/blob/main/CHANGELOG.md)
- [Commits](temporalio/sdk-python@1.30.0...1.34.0)

Updates `duckdb` from 1.5.4 to 1.5.6
- [Release notes](https://github.com/duckdb/duckdb-python/releases)
- [Commits](duckdb/duckdb-python@v1.5.4...v1.5.6)

Updates `statsmodels` from 0.14.6 to 0.15.0
- [Release notes](https://github.com/statsmodels/statsmodels/releases)
- [Changelog](https://github.com/statsmodels/statsmodels/blob/main/CHANGES.md)
- [Commits](statsmodels/statsmodels@v0.14.6...v0.15.0)

Updates `coverage` from 7.15.2 to 7.16.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.2...7.16.2)

Updates `hypothesis` from 6.152.7 to 6.168.5
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@hypothesis-python-6.152.7...v6.168.5)

Updates `black` from 26.5.1 to 26.10.1
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@26.5.1...26.10.1)

Updates `commitizen` from 4.16.5 to 4.19.2
- [Release notes](https://github.com/commitizen-tools/commitizen/releases)
- [Changelog](https://github.com/commitizen-tools/commitizen/blob/master/CHANGELOG.md)
- [Commits](commitizen-tools/commitizen@v4.16.5...v4.19.2)

Updates `mypy` from 2.3.0 to 2.4.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.0...v2.4.0)

Updates `pre-commit` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.1...v4.6.2)

Updates `ruff` from 0.16.0 to 0.17.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.17.0)

Updates `types-pyyaml` from 6.0.12.20260724 to 6.0.12.20260906
- [Commits](https://github.com/python/typeshed/commits)

Updates `build` from 1.5.0 to 1.6.1
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.5.0...1.6.1)

Updates `setuptools` from 83.0.0 to 84.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v83.0.0...v84.0.0)

Updates `twine` from 6.2.0 to 7.0.0
- [Release notes](https://github.com/pypa/twine/releases)
- [Changelog](https://github.com/pypa/twine/blob/main/docs/changelog.rst)
- [Commits](pypa/twine@6.2.0...7.0.0)

Updates `wheel` from 0.47.0 to 0.48.0
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](pypa/wheel@0.47.0...0.48.0)

Updates `charset-normalizer` from 3.4.9 to 3.5.2
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.9...3.5.2)

Updates `idna` from 3.18 to 3.20
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.20)

Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.2...26.3)

Updates `polars-runtime-32` from 1.42.1 to 2.0.0
- [Release notes](https://github.com/pola-rs/polars/releases)
- [Commits](pola-rs/polars@py-1.42.1...py-2.0.0)

Updates `protobuf` from 7.35.1 to 7.36.2

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

Updates `types-protobuf` from 7.34.1.20260518 to 7.35.1.20260906
- [Commits](https://github.com/python/typeshed/commits)

Updates `urllib3` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.7.0...2.8.0)

---
updated-dependencies:
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: polars
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-packaging
- dependency-name: pytz
  dependency-version: '2026.5'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: temporalio
  dependency-version: 1.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: duckdb
  dependency-version: 1.5.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packaging
- dependency-name: statsmodels
  dependency-version: 0.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: coverage
  dependency-version: 7.16.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: hypothesis
  dependency-version: 6.168.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: black
  dependency-version: 26.10.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: commitizen
  dependency-version: 4.19.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packaging
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20260906
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packaging
- dependency-name: build
  dependency-version: 1.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: setuptools
  dependency-version: 84.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-packaging
- dependency-name: twine
  dependency-version: 7.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python-packaging
- dependency-name: wheel
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: charset-normalizer
  dependency-version: 3.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: idna
  dependency-version: '3.20'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: polars-runtime-32
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-packaging
- dependency-name: protobuf
  dependency-version: 7.36.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: types-protobuf
  dependency-version: 7.35.1.20260906
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packaging
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packaging
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the modern-tooling Modern tooling, CI, release, coverage, and packaging hygiene label Oct 13, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

modern-tooling Modern tooling, CI, release, coverage, and packaging hygiene

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants