Skip to content

chore(deps): bump the python-dependencies group with 5 updates - #22

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-dependencies-88afc4d60d
Open

chore(deps): bump the python-dependencies group with 5 updates#22
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-dependencies-88afc4d60d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 5 updates:

Package From To
ruff 0.15.22 0.16.0
hypothesis 6.156.6 6.161.1
typer 0.26.8 0.27.0
semgrep 1.170.0 1.171.0
fastapi 0.139.1 0.139.2

Updates ruff from 0.15.22 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

  • Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules.

  • Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

  • Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

    import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os

  • Fixes are now shown in check and format --check output:

    ❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted

    This example also shows off the Markdown formatting.

  • format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

    ❯ ruff format --check --output-format github .
::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

    See the CLI help or documentation for the full list of supported formats.

  • The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

  • Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules.

  • Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

  • Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

    import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os

  • Fixes are now shown in check and format --check output:

    ❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted

    This example also shows off the Markdown formatting.

  • format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

    ❯ ruff format --check --output-format github .
::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

... (truncated)

Commits
  • a2635fd Bump 0.16.0 (#27136)
  • 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
  • 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
  • 17ef711 Stabilize --add-ignore (#27125)
  • ef912bb Add newly stabilized rules to defaults (#27055)
  • b30f040 Stabilize new default rules (#27035)
  • bcd70c5 Exclude Markdown files from format-dev runs (#27052)
  • 87e51e2 Fix format --check spans for syntax errors (#27045)
  • afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
  • a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
  • Additional commits viewable in compare view

Updates hypothesis from 6.156.6 to 6.161.1

Commits
  • f6a6b7b Bump hypothesis version to 6.161.1 and update changelog
  • 4a1706e Merge pull request #4814 from Jayashanker-Padishala/fix-lark-escaped-string
  • 9c6561d Use a typed filter predicate for terminal strategies
  • d18e36d Only generate lark terminals the lexer would match entirely
  • f58678b Bump hypothesis version to 6.161.0 and update changelog
  • f7e5f86 Merge pull request #4810 from Zac-HD/claude/note-observability-output-33hcvo
  • 2aada67 Fix test failures under the crosshair backend
  • 5378df7 Address review comments
  • 64acbb2 Drop Unsatisfiable changes from the changelog
  • 6da37c0 Explain exhausted search spaces in the Unsatisfiable error
  • Additional commits viewable in compare view

Updates typer from 0.26.8 to 0.27.0

Release notes

Sourced from typer's releases.

0.27.0

Breaking Changes

Internal

Changelog

Sourced from typer's changelog.

0.27.0 (2026-07-15)

Breaking Changes

Internal

Commits

Updates semgrep from 1.170.0 to 1.171.0

Release notes

Sourced from semgrep's releases.

Release v1.171.0

1.171.0 - 2026-07-22

### Added

  • Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

  • The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

  • Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix)
  • Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty cycle pacing. (ocaml_gc_pacing_fix)
  • Improved the Scan Status output when no code rules will run (e.g. a Secrets-only or Supply-Chain-only scan). The summary line no longer reports a confusing "0 Code rules", and the "Code Rules" section now states explicitly either that code scanning is not enabled or that there are no code rules to run, instead of printing an empty table. (ENGINE-2878)
  • Fixed lockfileless Gradle dependency resolution failing with "Parsing dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The github-dependency-graph-gradle-plugin used during resolution was fetched unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is now pinned to 1.4.1. (sc-3738)
Changelog

Sourced from semgrep's changelog.

1.171.0 - 2026-07-22

### Added

  • Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

  • The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

  • Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix)
  • Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty cycle pacing. (ocaml_gc_pacing_fix)
  • Improved the Scan Status output when no code rules will run (e.g. a Secrets-only or Supply-Chain-only scan). The summary line no longer reports a confusing "0 Code rules", and the "Code Rules" section now states explicitly either that code scanning is not enabled or that there are no code rules to run, instead of printing an empty table. (ENGINE-2878)
  • Fixed lockfileless Gradle dependency resolution failing with "Parsing dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The github-dependency-graph-gradle-plugin used during resolution was fetched unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is now pinned to 1.4.1. (sc-3738)
Commits
  • 6e47ff6 chore: release 1.171.0
  • 96dbab7 fix(CLI): Only print non-zero product fragments (semgrep/semgrep-proprietary#...
  • fb2f1c9semgrep/semgrep-proprietary#6775
  • 9be2ce0 fix(metrics): improve install-semgrep-pro error reporting (semgrep/semgrep-pr...
  • 4ecbbf0semgrep/semgrep-proprietary#6791
  • f9b6379 fix(sca): pin github-dependency-graph-gradle-plugin to 1.4.1 (semgrep/semgrep...
  • 3307ad6 fix: bump OCaml compiler fork to improve GC duty cycle pacing (semgrep/semgre...
  • d3a28afsemgrep/semgrep-proprietary#6769
  • b1b1536semgrep/semgrep-proprietary#6785
  • 5139a96semgrep/semgrep-proprietary#6633#66...
  • Additional commits viewable in compare view

Updates fastapi from 0.139.1 to 0.139.2

Release notes

Sourced from fastapi's releases.

0.139.2

Fixes

  • 🐛 Refactor router route building to make it thread-safe, mainly relevant for tests running in parallel threads (uncommon). PR #16013 by @​tiangolo.
Commits
  • 866b7a3 🔖 Release version 0.139.2 (#16014)
  • 7b3effe 📝 Update release notes
  • 7fe315c 🐛 Refactor router route building to make it thread-safe, mainly relevant for ...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-dependencies group with 5 updates
faf36a4 
Bumps the python-dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.22` | `0.16.0` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.156.6` | `6.161.1` |
| [typer](https://github.com/fastapi/typer) | `0.26.8` | `0.27.0` |
| [semgrep](https://github.com/semgrep/semgrep) | `1.170.0` | `1.171.0` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.139.1` | `0.139.2` |


Updates `ruff` from 0.15.22 to 0.16.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.22...0.16.0)

Updates `hypothesis` from 6.156.6 to 6.161.1
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.156.6...v6.161.1)

Updates `typer` from 0.26.8 to 0.27.0
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.26.8...0.27.0)

Updates `semgrep` from 1.170.0 to 1.171.0
- [Release notes](https://github.com/semgrep/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/v1.171.0/CHANGELOG.md)
- [Commits](semgrep/semgrep@v1.170.0...v1.171.0)

Updates `fastapi` from 0.139.1 to 0.139.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.1...0.139.2)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: hypothesis
  dependency-version: 6.161.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: typer
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: semgrep
  dependency-version: 1.171.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: fastapi
  dependency-version: 0.139.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 24, 2026
@dependabot
dependabot Bot requested a review from amarjaleelbanbhan as a code owner July 24, 2026 00:53
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@amarjaleelbanbhan amarjaleelbanbhan Awaiting requested review from amarjaleelbanbhan amarjaleelbanbhan is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants