Skip to content

chore(deps): bump the python-deps group across 1 directory with 9 updates - #13

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-deps-10ad17a7a8
Open

chore(deps): bump the python-deps group across 1 directory with 9 updates#13
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-deps-10ad17a7a8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-deps group with 9 updates in the / directory:

Package From To
pydantic 2.13.5 2.14.2
typer 0.27.2 0.27.3
graphql-core 3.2.12 3.3.1
pydantic-settings 2.15.0 2.16.2
hypothesis 6.168.0 6.170.14
mypy 2.3.1 2.4.1
pytest 9.1.1 9.2.0
ruff 0.16.8 0.17.3
types-pyyaml 6.0.12.20260906 6.0.12.20261030

Updates pydantic from 2.13.5 to 2.14.2

Release notes

Sourced from pydantic's releases.

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.

Packaging

Performance

Fixes

  • Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

    JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

    from pydantic import BaseModel, ConfigDict
from pydantic.alias_generators import to_camel
class Page(BaseModel):
model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
page_size: int = 10

Page.model_validate_json('{"page_size": 50}')
Before: Page(page_size=10)
After: ValidationError (extra_forbidden)

    See the pull request for the full list of behavior changes. This change addresses GHSA-qpmf-fgh3-ff25.

  • Ignore extra data matching a field name in TypedDict and dataclasses with extra=allow by @​Viicos in #14090. Addresses GHSA-3r8g-cqwr-jr29.

  • Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

  • Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

  • Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

  • Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

  • Implement recursion guard for validate_strings() by @​Viicos in #14029

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.2 (2026-10-29)

GitHub release

What's Changed

Packaging

Performance

Fixes

  • Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

    JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

    from pydantic import BaseModel, ConfigDict
from pydantic.alias_generators import to_camel
class Page(BaseModel):
model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
page_size: int = 10

Page.model_validate_json('{"page_size": 50}')
Before: Page(page_size=10)
After: ValidationError (extra_forbidden)

    See the pull request for the full list of behavior changes.

  • Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

  • Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

  • Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

  • Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

  • Implement recursion guard for validate_strings() by @​Viicos in #14029

  • Support named tuples in Sequence serialization by @​Viicos in #14033

... (truncated)

Commits
  • aa540ac Update changelog for v2.14.2
  • 6cde12f Update changelog for v2.14.2
  • 2db7c25 Fix deep copy of self-referential models
  • d783154 Update changelog for v2.14.2
  • df49b6c Avoid heap allocation for small JSON model field buffers
  • cd93e69 Skip decorator field checks when no field decorators exist
  • 2771e57 Make JSON validation by iteration consistent with Python approach
  • 8102e3f Avoid Python tuple allocation during model fields validation
  • dd139b5 Bump pydantic.v1 namespace to v1.10.27
  • 66155f9 Prepare release v2.14.2
  • Additional commits viewable in compare view

Updates typer from 0.27.2 to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

Commits

Updates graphql-core from 3.2.12 to 3.3.1

Release notes

Sourced from graphql-core's releases.

v3.3.1

Patch-release GraphQL-core v3.3.1, based on GraphQL.js v17.0.2.

This patch-release supports Python 3.10 to 3.15.

This is a security release. It fixes a denial-of-service vulnerability in the validator. Upgrading is recommended for all users of GraphQL-core 3.3.

Security fix:

  • CVE-2026-119286: Fixed a memory leak that could be used for a denial of service (see the security advisory). When a validation was aborted because the document had more errors than allowed by max_errors (100 by default), the same error object was raised every time. Its traceback grew with each aborted validation and kept the frames of all these validations alive, including their documents. Any client could exhaust the memory of a server by sending documents with more than 100 validation errors. Now a new error is created for every aborted validation (#287). GraphQL-core 3.2 is not affected.

Bug fixes:

  • The memoization of collected subfields used the ids of objects that could be freed and reused during execution. Therefore, a field could be resolved with the selection set of another field. The cache now uses the identity of the field list like GraphQL.js and keeps the list alive during execution (#284). This was a regression in 3.3.
  • Closing a subscription did not close the source iterator if the __aiter__ method of the source returned a different object, such as an async generator (#283). This was a regression in 3.3.
  • Decimal, Fraction and NumPy scalar values, as returned by database drivers, ORMs and NumPy/pandas, can be serialized as Int, Float and Boolean again (#280). This was a regression in 3.3. Different from 3.2, non-integer values such as Decimal("2.5") are rejected as Int instead of being truncated.
  • If input values of different types shared the same default value, e.g. after extend_schema(), the default was coerced for the type that was used first (#279). Coerced default values are now memoized on the argument or input field like in GraphQL.js. Schemas that were pickled with 3.3.0 can still be unpickled.

Behavior changes:

  • A GraphQLError created while another exception is handled does not take over the traceback of that exception anymore. If the error is raised, it gets its own traceback, and the handled exception becomes its context. Errors of incremental computations and reasons of abort signals do not accumulate tracebacks anymore when they are raised repeatedly.
  • validation_aborted_error has been removed from graphql.validation.validate. It was not exported.

Other changes:

  • Improved performance when coercing literal arguments, and added a benchmark for executing fields with arguments.

Thanks to @​riodw for reporting the memory leak and to @​Fire162 for submitting a first fix (#288), to @​abraira85 for reporting and analyzing the issue with the subfields and to @​jadenfix for fixing it, to @​patrick91 for fixing the shared default values and improving performance, to @​AryanRG for fixing the subscription iterator, and to @​gabor-lbl for reporting the serialization issue.

Thanks to @​jkimbo for sponsoring this project.

v3.3.0

Stable release GraphQL-core v3.3.0, based on GraphQL.js v17.0.2.

This release supports Python 3.10 to 3.15.

This is the first stable release of GraphQL-core 3.3, which follows GraphQL.js 17. Since the minor version of GraphQL-core corresponds to the major version of GraphQL.js, this release contains breaking changes compared to GraphQL-core 3.2. Most of them come from GraphQL.js 17 and are described in the GraphQL.js v16 to v17 upgrade guide. If you need to stay compatible with GraphQL.js 16 or need support for Python 3.7 to 3.9, you can continue to use GraphQL-core 3.2.13.

Breaking changes compared to GraphQL-core 3.2.13:

  • Python 3.7 to 3.9 are no longer supported.
  • Functions and options that had been deprecated in GraphQL.js 16 have been removed.
  • AST nodes are now frozen dataclasses, and all AST collection fields are tuples instead of lists.
  • ExecutionContext has been renamed to Executor, and the parameter execution_context_class to executor_class.
  • subscribe() stays synchronous when possible, like execute(), and raises a GraphQLError for non-subscription operations. create_source_event_stream() now takes a built Executor (see Executor.build()) instead of the request arguments.
  • A Python int that cannot be represented exactly as a float now raises a GraphQLError when coerced to Float.
  • An explicit Undefined variable value is treated as omitted, so the variable's default applies.
  • Input coercion follows the specification more strictly, and default values are validated against their types.
  • Directives on directive definitions and directive extensions are now part of the language, so the parser option experimental_directives_on_directive_definitions has been removed.
  • Input objects that cannot be given a finite value are rejected by schema validation, with a new error message for circular input object references.

... (truncated)

Commits
  • d83193f Bump version
  • e8bd478 Memoize collected subfields on the identity of the list (#285)
  • f9fc5ad Do not let errors adopt or accumulate tracebacks
  • 3c319fd Create a new error for every aborted validation
  • f0598fe Split tests for closing the consumed source iterator
  • 6b0588f Close the consumed subscription source iterator (#286)
  • d913a61 Memoize coerced default values on the input value (#282)
  • 3be333a Only reuse memoized default values for the type they were coerced to (#279)
  • e46bc83 Serialize Decimal, Fraction and NumPy scalars (#281)
  • bdab43b Avoid per-argument work when coercing literal arguments
  • Additional commits viewable in compare view

Updates pydantic-settings from 2.15.0 to 2.16.2

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

  • Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
  • A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

v2.16.0

Highlights

Breaking changes and behavior changes

  • Python 3.10 is no longer supported (#1003). pydantic-settings now requires Python 3.11+, since 3.10 reaches end of life this month. The tomli fallback is gone in favor of stdlib tomllib; the toml extra is kept as an empty extra so pip install pydantic-settings[toml] keeps working.
  • python-dotenv>=1.2.2 is now required (#971) to pick up the fix for CVE-2026-28684.
  • Aliases are ignored in every source when validate_by_alias=False (#1033). Env vars, secrets, CLI flags and defaults now use only field names, matching pydantic. An env var named after the alias is now ignored instead of raising extra_forbidden, and the CLI exposes --apple rather than --pomo.
  • validation_alias takes precedence over alias (#1038). When the two differ, values from JSON/YAML/TOML files and the CLI were silently ignored; they now load. CLI help lists the validation_alias flag first, and CliApp.serialize emits it.
  • CLI case-insensitivity only lowercases registered options (#1036). With case_sensitive=False, args after -- and those captured by CliUnknownArgs keep their case (-Xmx4G no longer becomes -xmx4g). Unrecognized options are now reported as typed (--NOPE instead of --nope).
  • JSON and YAML config files are read as UTF-8 by default (#955) instead of the locale encoding, completing the secrets-file fix from 2.15.0. json_file_encoding/yaml_file_encoding still override it.
  • Discriminated union defaults are partially updated again (#997). This reverts the 2.15.0 regression with nested_model_default_partial_update=True: the default is only dropped when the incoming value selects a different union member.

New features

  • Python 3.15 and pydantic 2.14 support (#1026, #1029, #1022). pydantic 2.14 broke CliApp.run and validate_by_alias=False handling; both are fixed.
  • Cached settings instances via Settings.settings_cached() and Settings.settings_clear_cache() (#952). These give you a process-local singleton per settings class without hand-rolling lru_cache wrappers. Calling the class directly still builds a fresh instance.
  • AWS Systems Manager Parameter Store source — AWSSystemsManagerSettingsSource (#941). It recursively reads every parameter under an ssm_path, with / mapping onto nested models. Install it with the new aws-systems-manager extra.
  • env_file_depth (#940) lets a relative env_file be found in parent directories, mirroring pyproject_toml_depth. This is useful when scripts run from a subdirectory of a monorepo. It defaults to 0, which keeps the current behavior.
  • CliVariadicArg for named variadic options (#949, #958). It accepts --param a b c in addition to repeated --param a --param b. Required fields need at least one value.

Bug fixes

CLI

... (truncated)

Commits
  • 94150a0 Prepare release 2.16.2 (#1111)
  • 9e02de0 Fix JSON decoding of nested dictionary environment values (#1109)
  • 7e2dacb Fix CliApp reconstruction of AliasPath inputs (#1096)
  • 2d1f924 Fix explicit nested secrets directory precedence (#1093)
  • e9588ae Fix regressions from nested dict union value decoding (#1089) (#1097)
  • e71a53e Decode nested dictionary values with complex union types (#1089)
  • 8dc9e05 Resolve only the discriminator annotation of stdlib dataclass defaults (#1077)
  • c50c853 Detect nested Field discriminators in default partial updates (#1076)
  • 9aabb8a build(deps): bump the python-packages group with 3 updates (#1056)
  • 4e286e2 Prepare release 2.16.1 (#1087)
  • Additional commits viewable in compare view

Updates hypothesis from 6.168.0 to 6.170.14

Commits
  • 255a880 Bump hypothesis version to 6.170.14 and update changelog
  • fd6038c Merge pull request #4949 from moreati/issue4926-denylist
  • 8dd4664 Rephrase RELEASE note following review
  • 5e93693 Bump hypothesis version to 6.170.13 and update changelog
  • a5512a3 Merge pull request #4952 from jorenham/codemods/characters-kwargs
  • 8375d12 Fix characters() codemod crash with **kwargs
  • ac21c15 Add RELEASE note
  • 04e55b4 dateutil: Exclude coverage measurement of old releases
  • 891e478 Update pinned dependencies (to block eMudhra certificates)
  • 8fca8fd Bump hypothesis version to 6.170.12 and update changelog
  • Additional commits viewable in compare view

Updates mypy from 2.3.1 to 2.4.1

Changelog

Sourced from mypy's changelog.

Mypy 2.4.1

  • Process overloads as a whole in two-phase type checking (Ivan Levkivskyi, PR 22231)
  • Skip recursive setup for frame-private nested functions in mypyc (Piotr Sawicki, PR 22187)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • A5rocks
  • Adam Dangoor
  • Alex Waygood
  • Ali Hamdan
  • Brian Helba
  • Chad Dombrova
  • David Foster
  • dnwpark
  • Edgar Ramírez Mondragón
  • Giorgos Michas
  • Ivan Levkivskyi
  • Jelle Zijlstra
  • Jukka Lehtosalo
  • Marc Mueller
  • Michael R. Crusoe
  • NIYONSHUTI Emmanuel
  • Piotr Sawicki
  • Shantanu
  • themylogin
  • Vaggelis Danias
  • Willy Bruns

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

... (truncated)

Commits

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

  • #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

  • #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

    Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

  • #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

    • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
    • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

    pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

  • #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

  • #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

  • #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

    They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

  • #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

  • #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

  • #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
  • #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
  • #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

  • #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits
  • ae1d0ff Prepare release version 9.2.0
  • 143ce31 pre-commit: exclude codespell on generated release announcements
  • 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
  • a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
  • 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
  • 41d12cd docs: clarify typing for yield fixtures
  • b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
  • 16f87a7 docs: improve getting-started.rst test execution description
  • 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
  • ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
  • Additional commits viewable in compare view

Updates ruff from 0.16.8 to 0.17.3

Release notes

Sourced from ruff's releases.

0.17.3

Release Notes

Released on 2026-10-26.

Preview features

  • [suspicious] Add shared-clock-mock (#29074)

Bug fixes

  • [pyupgrade] Avoid incorrect conversions to f-strings (UP032) (#25485)

Performance

  • Buffer stdout in ruff format (#29631)
  • Specialize ASCII identifier lexing (#29503)
  • Speed up identifier and keyword lexing (#29463)

Documentation

  • [flake8-bandit] Describe what the rule actually checks for httpx (S113) (#27936)

Contributors

Install ruff 0.17.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.ps1 | iex"

Download ruff 0.17.3

File Platform Checksum
ruff-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
ruff-x86_64-apple-darwin.tar.gz Intel macOS checksum
ruff-aarch64-pc-windows-msvc.zip ARM64 Windows checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.3

Released on 2026-10-26.

Preview features

  • [suspicious] Add shared-clock-mock (#29074)

Bug fixes

  • [pyupgrade] Avoid incorrect conversions to f-strings (UP032) (#25485)

Performance

  • Buffer stdout in ruff format (#29631)
  • Specialize ASCII identifier lexing (#29503)
  • Speed up identifier and keyword lexing (#29463)

Documentation

  • [flake8-bandit] Describe what the rule actually checks for httpx (S113) (#27936)

Contributors

0.17.2

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

... (truncated)

Commits

@dependabot
chore(deps): bump the python-deps group across 1 directory with 9 upd…
6d1e88a 
…ates

Bumps the python-deps group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.5` | `2.14.2` |
| [typer](https://github.com/fastapi/typer) | `0.27.2` | `0.27.3` |
| [graphql-core](https://github.com/graphql-python/graphql-core) | `3.2.12` | `3.3.1` |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.15.0` | `2.16.2` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.168.0` | `6.170.14` |
| [mypy](https://github.com/python/mypy) | `2.3.1` | `2.4.1` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.8` | `0.17.3` |
| [types-pyyaml](https://github.com/python/typeshed) | `6.0.12.20260906` | `6.0.12.20261030` |



Updates `pydantic` from 2.13.5 to 2.14.2
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.14.2/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.5...v2.14.2)

Updates `typer` from 0.27.2 to 0.27.3
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.2...0.27.3)

Updates `graphql-core` from 3.2.12 to 3.3.1
- [Release notes](https://github.com/graphql-python/graphql-core/releases)
- [Commits](graphql-python/graphql-core@v3.2.12...v3.3.1)

Updates `pydantic-settings` from 2.15.0 to 2.16.2
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.15.0...v2.16.2)

Updates `hypothesis` from 6.168.0 to 6.170.14
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.168.0...v6.170.14)

Updates `mypy` from 2.3.1 to 2.4.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.1...v2.4.1)

Updates `pytest` from 9.1.1 to 9.2.0
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.1.1...9.2.0)

Updates `ruff` from 0.16.8 to 0.17.3
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.8...0.17.3)

Updates `types-pyyaml` from 6.0.12.20260906 to 6.0.12.20261030
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: pydantic
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: typer
  dependency-version: 0.27.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: graphql-core
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: pydantic-settings
  dependency-version: 2.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: hypothesis
  dependency-version: 6.170.14
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: mypy
  dependency-version: 2.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: ruff
  dependency-version: 0.17.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20261030
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants