deps(uv): bump the uv-minor-patch group across 1 directory with 11 updates by dependabot[bot] · Pull Request #2104 · DataBoar/data-boar

dependabot · 2026-10-19T15:19:00Z

Bumps the uv-minor-patch group with 11 updates in the / directory:

Package	From	To
numpy	`2.5.3`	`2.5.4`
pydantic	`2.14.0`	`2.14.1`
pymssql	`2.4.3`	`2.4.4`
py7zr	`1.1.3`	`1.1.4`
pillow-heif	`1.8.0`	`1.8.1`
hypothesis	`6.168.5`	`6.169.0`
jsonpointer	`3.2.0`	`3.2.1`
narwhals	`2.26.0`	`2.27.1`
platformdirs	`4.12.4`	`4.13.0`
python-discovery	`1.6.1`	`1.6.2`
virtualenv	`21.14.6`	`21.14.7`

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

Many typing fixes and improvements,

A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits

a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
91acd87 REL: Prepare for the NumPy 2.5.4 release.
9cc555b Merge pull request #32956 from charris/backport-typing-1
e04b972 TYP: dtype[void].names: allow setting with list (#32943)
d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
839467f TYP: ma.getmaskarray: accept array-likes (#32934)
64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
c7bcd2c TYP: place: widen mask (#32926)
Additional commits viewable in compare view

Updates pydantic from 2.14.0 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

Avoid Python tuple allocation during model fields validation by @Viicos in #13955

Avoid unnecessary extra dict allocation in model validation by @Viicos in #13956

Fixes

Fix arguments-v3 schema with variadic keywords by @Viicos in #13954

Fix TypeError on ForwardRef on Python 3.10.0 by @Viicos in #13964

Support closed and extra_items via inheritance in TypedDict by @Viicos in #13967

Enforce the max_digits whole-digits limit in the Python Decimal validator by @Viicos in #13972

Reject out-of-range int inputs for timedelta by @Viicos in #13973

Support named tuples in Sequence validation by @Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

Changelog

Sourced from pydantic's changelog.

Commits

b2212c7 Prepare release v2.14.1
968fb2b Fix docs conversion table
6adc8b3 Support named tuples in Sequence validation
7637fbc Reject out-of-range int inputs for timedelta
dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
e2456d3 Support closed and extra_items via inheritance in TypedDict
317655d Harden CI security
3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
43681ab Bump samuelcolvin/check-python-version action to v5.1
d6bc53a Avoid unnecessary extra dict allocation in model validation
See full diff in compare view

Updates pymssql from 2.4.3 to 2.4.4

Release notes

Sourced from pymssql's releases.

pymssql 2.0 greenish

Experimental support for greening for gevent, etc.

Changelog

Sourced from pymssql's changelog.

Version 2.4.4 - 2026-10-09 - Mikhail Terekhov

General

Fixed unicode encoding problem #854 & #1000·thanks to maprangnaveya

Commits

4977d62 Update ChangeLog.rst
7a19871 Install gnu-libconv-dev when building wheels on Github for musllinux to fix e...
b16dedd Install glibc-gconv-extra when building wheels on Github to fix encoding issu...
See full diff in compare view

Updates py7zr from 1.1.3 to 1.1.4

Release notes

Sourced from py7zr's releases.

Fix multiple Vulnerbilities and bugs

Fix arbitrary file write outside the extraction directory (GHSA-jwx8-hv8g-gjjq).

Fix memory exhaustion when opening a crafted archive header (GHSA-6pr6-cqpq-x889).

Fix extraction hang on a crafted COPY stream (GHSA-v999-q5cj-95jg).

Changelog

Sourced from py7zr's changelog.

v1.1.4_

Security

Fix arbitrary file write above the extraction directory via a symlink chain (incomplete fix of CVE-2026-23879, GHSA-jwx8-hv8g-gjjq).

canonical_path() cancelled .. lexically before any symlink was resolved, so link/.. was treated as the directory holding link instead of the parent of its target. A chain of symlink members extracted from the same archive could therefore redirect a later write an archive-chosen number of levels above the extraction directory, while the member name still reduced to something apparently inside it.

Containment is now decided on the real path: symlink components are followed first and .. is normalized only afterwards. This also covers symlink targets, which may legitimately contain .. and so cannot be rejected by name.

Archive member names containing a .. component are now rejected outright.

Fix memory exhaustion when opening a crafted archive header (GHSA-6pr6-cqpq-x889).

Fix extraction hang on a crafted COPY stream (GHSA-v999-q5cj-95jg).

Users are encouraged to upgrade. Details will be published in the corresponding security advisories.

Fixed

Raise PasswordRequired when an archive is opened in write or append mode with a crypto filter (e.g. FILTER_CRYPTO_AES256_SHA256) but no password, instead of failing later with an AttributeError. The check also covers direct use of SevenZipCompressor. (#723, #739)

Limit concurrent extraction workers for non-solid archives to os.cpu_count(), instead of starting one thread or process per folder. When the limit is reached, the oldest task is joined before a new one starts. (#630, #740)

Fix AttributeError in archiveinfo() for archives with no compressed content, such as an empty archive or one containing only empty files or directories. _get_method_names(), _is_solid() and archiveinfo() now handle header.main_streams being None. (#665, #741)

Fix intermittent false negatives in the relative-path check on Windows. Path.resolve() may or may not return the extended-length prefix (\\?\), and when only one of the compared paths had it, the relative_to check always failed. The prefix is now stripped before comparison. (#714, #743)

Fix io.UnsupportedOperation in extract() and extractall() when a WriterFactory returns a non-seekable handle, such as one from zipfile.ZipFile.open. The unnecessary seek(0) after decompression is removed, and MemIO.close() now rewinds only

... (truncated)

Commits

c717d21 Release version 1.1.4 to fix multiple vulnerabilities and bugs
c51e4f6 Merge commit from fork
f4204fa Merge commit from fork
5c78459 Merge commit from fork
23610d1 fix: raise Bad7zFile when decompression makes no progress
f3e4862 fix: enhance path sanitization and symlink resolution to prevent directory tr...
e41864c docs: update SECURITY.rst with threat model, hardening measures, and regressi...
8ff8a30 docs: add guidelines for writing and organizing security regression tests
0a3c81e tests: add malformed header tests into test_badheaders.py and enhance coverage
3e37932 feat: add boundary checks for truncated reads in read_byte, read_uint64, ...
Additional commits viewable in compare view

Updates pillow-heif from 1.8.0 to 1.8.1

Release notes

Sourced from pillow-heif's releases.

v1.8.1

This is the last version that supports Python 3.10 and Pillow 11/12: version 1.9.0 will require Pillow 13, which needs Python 3.11 or newer.

Changed

libheif was updated from the 1.23.4 to 1.23.6 version. #491 #499

Saving ;10/;12 data with sample values above its bit depth now raises ValueError. #499

libx265 was updated from the 4.2 to 4.3 version. #503

Changelog

Sourced from pillow-heif's changelog.

[1.8.1 - 2026-10-11]

This is the last version that supports Python 3.10 and Pillow 11/12: version 1.9.0 will require Pillow 13, which needs Python 3.11 or newer.

Changed

libheif was updated from the 1.23.4 to 1.23.6 version. #491 #499

Saving ;10/;12 data with sample values above its bit depth now raises ValueError. #499

libx265 was updated from the 4.2 to 4.3 version. #503

Commits

0ed5379 v1.8.1
39acefb feat(libheif): update libx265 to 4.3, download it from GitHub (#503)
1a3f85a chore(deps): update dependency strukturag/libheif to v1.23.6 (#499)
3937253 chore(deps): update msys2/setup-msys2 action to v2.33.0 (#495)
2f183a4 [pre-commit.ci] pre-commit autoupdate (#497)
33c51b7 chore(deps): update actions/download-artifact action to v8.0.2 (#500)
7c08c7f chore(deps): update actions/upload-artifact action to v7.0.2 (#501)
b16be11 ci: fix leak tests failing on free-threaded Linux and Python 3.10 (#494)
4ce7129 chore(deps): update dependency strukturag/libheif to v1.23.5 (#491)
f99594a chore(deps): update codecov/codecov-action action to v7.1.1 (#485)
Additional commits viewable in compare view

Updates hypothesis from 6.168.5 to 6.169.0

Commits

82fa40a Bump hypothesis version to 6.169.0 and update changelog
0116655 Merge pull request #4899 from Arjun-Aravind/fix/uv-download-metadata-url
4f7ef96 claude: exclude rarely-hit realize branch from coverage
4d42db9 Update uv download-metadata URL
1484f6d Merge pull request #4896 from Liam-DeVoe/drop-python-3.10
e3e5fea claude: address review comments
7c22da6 claude: simplify add_note fallback
f6a8067 claude: check ghostwriter golden outputs on 3.11 instead of 3.10
2416a79 Merge remote-tracking branch 'upstream/master' into plait/worktop-270d0237
b4c5a08 claude: drop support for Python 3.10
Additional commits viewable in compare view

Updates jsonpointer from 3.2.0 to 3.2.1

Release notes

Sourced from jsonpointer's releases.

3.2.1

What's Changed

Report test coverage to Coveralls from GitHub Actions by @stefankoegl in stefankoegl/python-json-pointer#87

Replace Travis CI link with GitHub Actions badge in README by @stefankoegl in stefankoegl/python-json-pointer#88

Preserve trailing member-name spaces in pointer files by @fhgffy in stefankoegl/python-json-pointer#89

Full Changelog: stefankoegl/python-json-pointer@v3.2.0...v3.2.1

Commits

f2641f0 bump version to 3.2.1
5eb90c3 Merge pull request #89 from fhgffy/fix-cli-pointer-file-whitespace
709d2ee Fix CLI pointer file whitespace preservation
439f0ed Merge pull request #88 from stefankoegl/claude/coveralls-upload
9ce983e Merge pull request #87 from stefankoegl/claude/coveralls-upload
330f27b Replace Travis CI link with GitHub Actions badge and link
4727a8b Update Coveralls badge and link to current URLs
47e3676 Report test coverage to Coveralls from GitHub Actions
See full diff in compare view

Updates narwhals from 2.26.0 to 2.27.1

Release notes

Sourced from narwhals's releases.

Narwhals v2.27.1

What's Changed

fix: return a numeric dtype from str.len_chars on all-null object columns by @FBruzzesi in narwhals-dev/narwhals#4031

fix: count characters, not bytes, in str.zfill on Polars < 2.0 by @FBruzzesi in narwhals-dev/narwhals#4040

Full Changelog: narwhals-dev/narwhals@v2.27.0...v2.27.1

Narwhals v2.27.0

Changes

test: cover concat_str single expression and null inputs (#3978)

test: cover corr and cov constant, stability and group_by cases (#3917)

fix(tests): PySpark tests fixup (#3940)

test: test cover quantile boundaries, invalid raises, median over (#3919)

✨ Enhancements

feat: Add {DataFrame, LazyFrame}.cast (#3815)

feat: support list.contains for PyArrow, pandas and Dask (#4001)

feat: accept file-like objects in {read,scan}_* (#3956)

feat: hint at narwhals-datafusion plugin for datafusion.DataFrame (#3937)

🐞 Bug fixes

fix: avoid LazyFrame.cast from resolving the full schema to check column names (#4016)

fix: return null for floor division by zero on pandas-like backends (#4011)

fix: upcast {Int8,Int16,UInt8,UInt16} to Int64 in pyarrow cum_sum (#3995)

fix: align scalar operands before fill_null and horizontal reductions in Dask (#3972)

fix: use relations' own connection for concat(how="diagonal") on DuckDB (#3998)

fix: align list.contains null handling with Polars on lazy backends (#3996)

fix: cum_count(reverse=True) counts non-null values on pandas-like backends (#3991)

fix: align pandas-like and Dask concat_str boolean rendering (#3979)

fix: match Polars in str.slice for negative offset, raise on negative length (#3969)

fix: correct str.zfill for +-prefixed strings on polars<=1.30 and support polars 0.20.4 (#3958)

fix: align concat_str behavior for polars<0.20.6 (#3981)

fix: broadcast scalar-only concat_str for sql-like backends (#3980)

fix: avoid DIVIDE_BY_ZERO in PySpark corr on constant columns (#3960)

fix: preserve all-null rows in concat_str for pyarrow backend (#3966)

fix: align series before fillna and isna in dask mean_horizontal (#3968)

fix: drop trailing separator in concat_str(..., ignore_nulls=True) for pandas-like and Dask backends (#3967)

fix: broadcast literals in pandas-like and PyArrow horizontal functions (#3941)

fix: preserve nulls when casting to String on pandas pre v3.0.0 (#3939)

fix: reject a negative width in str.zfill consistently across backends (#3770)

fix: align __mod__ and __rmod__ behavior with negative operands across backends (#3929)

fix: raise DuplicateError on duplicate struct field names; cover nested struct schema round trip in tests (#3918)

fix: reject invalid str.{pad_start,pad_end} arguments consistently; cover pad length-zero and unicode edge cases in tests (#3910)

fix: str.replace(n=0) on pandas-like backends; cover replace regex and n edge cases in tests (#3911)

fix(pyarrow): use native {starts,ends}_with kernels, fixing empty-suffix ends_with; cover empty-pattern and null expr-pattern search in tests (#3912)

... (truncated)

Commits

185de76 release: Bump version to 2.27.1
67a2cff chore(deps): lock file maintenance (#4049)
a295df1 chore(deps): lock file maintenance (#4035)
19ad1eb chore: prek autoupdate (#4039)
2b2521b fix: count characters, not bytes, in str.zfill on Polars < 2.0 (#4040)
b89e14a skip changelog(deps): Update github/codeql-action action to v4.38.2 (#4034)
faf5bde fix: return a numeric dtype from str.len_chars on all-null object columns...
1acc082 release: Bump version to 2.27.0 (#4028)
b8dd014 fix: avoid LazyFrame.cast from resolving the full schema to check column na...
cc2b466 fix: return null for floor division by zero on pandas-like backends (#4011)
Additional commits viewable in compare view

Updates platformdirs from 4.12.4 to 4.13.0

Release notes

Sourced from platformdirs's releases.

4.13.0

Detect Homebrew Python for the MacOS site directories under python:-S, which leaves base_prefix on the Cellar keg, and for the python-freethreading formula - by sricharanreddycheruku. #612

Use Python 3.15 for development and automation. #613

PyPI release

Full Changelog: tox-dev/platformdirs@4.12.4...4.13.0

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.13.5 (2026-10-19)

Publish a GitHub Release with changelog notes, a PyPI link, and a version comparison after each PyPI release. :pr:631

4.13.4 (2026-10-17)

Require a complete files path segment when locating Android app directories from sys.path. :pr:621

Keep root directory tests independent of inherited XDG environment variables. :pr:622

Raise RuntimeError when iOS cannot resolve the home directory, rather than returning paths rooted at a literal ~. :pr:624

Keep user directory strings, paths and iterators consistent inside isolated_dirs when Unix root enables use_site_for_root. Restore root redirection when the context exits. :pr:625

Raise RuntimeError when the Windows Projects directory cannot resolve the home directory, rather than returning a path rooted at a literal ~. :pr:627

Correct the contributor guide to name ty as the type checker used by the type environment. :pr:623

4.13.3 (2026-10-16)

4.13.2 (2026-10-16)

Normalize user_fonts_dir when XDG_DATA_HOME ends with a separator. :pr:619

4.13.1 (2026-10-15)

Free the path buffer from SHGetKnownFolderPath when the known-folder lookup fails. :pr:618

Preserve literal backslashes before ordinary characters in double-quoted user-dirs.dirs paths instead of removing them.

4.13.0 (2026-10-10)

... (truncated)

Commits

f05fb4e Release 4.13.0
b3174fd feat(python): require 3.11 and default to 3.15 (#613)
d7eb4fe fix: recognize Homebrew Cellar framework prefixes (#612)
See full diff in compare view

Updates python-discovery from 1.6.1 to 1.6.2

Release notes

Sourced from python-discovery's releases.

v1.6.2

Bug fixes - 1.6.2

Discard malformed interpreter cache entries and query the interpreter again, including entries with missing, non-string or unusable system_executable paths - by darrenhuai. (#141)

Use the default interpreter query timeout and warn for invalid PY_DISCOVERY_TIMEOUT values. Accept inf or values above the subprocess wait limit to disable the timeout - by darrenhuai. (#143)

PyPI release

Full Changelog: tox-dev/python-discovery@1.6.1...1.6.2

Changelog

Sourced from python-discovery's changelog.

Bug fixes - 1.6.2

Discard malformed interpreter cache entries and query the interpreter again, including entries with missing, non-string or unusable system_executable paths - by :user:darrenhuai. (:issue:141)

Use the default interpreter query timeout and warn for invalid PY_DISCOVERY_TIMEOUT values. Accept inf or values above the subprocess wait limit to disable the timeout - by :user:darrenhuai. (:issue:143)

v1.6.1 (2026-09-18)

Commits

4fe2ade release 1.6.2
60ddef1 fix(query): validate PY_DISCOVERY_TIMEOUT (#143)
eb1eab7 fix(cache): discard unusable interpreter cache entries (#141)
db810b8 feat(python): default to 3.15 and match virtualenv (#142)
614afa4 ci: run old Python checks in parallel (#140)
9148aa4 [pre-commit.ci] pre-commit autoupdate (#139)
a69c0d9 👷 ci: pin ubuntu-26.04 and bump dependencies (#138)
c8fcbf5 build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
f0b3a20 [pre-commit.ci] pre-commit autoupdate (#136)
b4eea32 build(deps): bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-acti...
Additional commits viewable in compare view

Updates virtualenv from 21.14.6 to 21.14.7

Release notes

Sourced from virtualenv's releases.

21.14.7

Bugfixes - 21.14.7

Escape the environment name in the bash activator for both of bash's PS1 passes, so a name or --prompt value with a backslash before $(...) or backticks no longer runs as a command each time bash draws the prompt - by gaborbernat. (#3390)

PyPI release

Full Changelog: pypa/virtualenv@21.14.6...21.14.7

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.14.7

Escape the environment name in the bash activator for both of bash's PS1 passes, so a name or --prompt value with a backslash before $(...) or backticks no longer runs as a command each time bash draws the prompt - by :user:gaborbernat. (:issue:3390)

v21.14.6 (2026-10-08)

Commits

a857a78 release 21.14.7
4004d88 🔧 build(release): bump pydantic for 3.15 wheels (#3391)
212f69f 🧪 test(activation): undo both bash prompt passes on bash < 4.4 (#3392)
c3104e0 🐛 fix(activation): escape the bash prompt for both PS1 passes (#3390)
f29efc4 📝 docs(security): add an email reporting contact (#3388)
c26cc29 🧪 test(util): skip safe_delete permission tests as root (#3389)
8b21c36 🔧 chore: enroll in Anthropic OSS Scanner (#3387)
bf09c7e feat(python): default to Python 3.15 (#3386)
3f07792 🧪 test(seed): verify periodic update scheduling (#3384)
7614b02 Upgrade embedded pip/setuptools/wheel and CI test tools (#3385)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates Bumps the uv-minor-patch group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [numpy](https://github.com/numpy/numpy) | `2.5.3` | `2.5.4` | | [pydantic](https://github.com/pydantic/pydantic) | `2.14.0` | `2.14.1` | | [pymssql](https://github.com/pymssql/pymssql) | `2.4.3` | `2.4.4` | | [py7zr](https://github.com/miurahr/py7zr) | `1.1.3` | `1.1.4` | | [pillow-heif](https://github.com/bigcat88/pillow_heif) | `1.8.0` | `1.8.1` | | [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.168.5` | `6.169.0` | | [jsonpointer](https://github.com/stefankoegl/python-json-pointer) | `3.2.0` | `3.2.1` | | [narwhals](https://github.com/narwhals-dev/narwhals) | `2.26.0` | `2.27.1` | | [platformdirs](https://github.com/tox-dev/platformdirs) | `4.12.4` | `4.13.0` | | [python-discovery](https://github.com/tox-dev/python-discovery) | `1.6.1` | `1.6.2` | | [virtualenv](https://github.com/pypa/virtualenv) | `21.14.6` | `21.14.7` | Updates `numpy` from 2.5.3 to 2.5.4 - [Release notes](https://github.com/numpy/numpy/releases) - [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst) - [Commits](numpy/numpy@v2.5.3...v2.5.4) Updates `pydantic` from 2.14.0 to 2.14.1 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.14.0...v2.14.1) Updates `pymssql` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/pymssql/pymssql/releases) - [Changelog](https://github.com/pymssql/pymssql/blob/master/ChangeLog.rst) - [Commits](pymssql/pymssql@v2.4.3...v2.4.4) Updates `py7zr` from 1.1.3 to 1.1.4 - [Release notes](https://github.com/miurahr/py7zr/releases) - [Changelog](https://github.com/miurahr/py7zr/blob/master/docs/Changelog.rst) - [Commits](miurahr/py7zr@v1.1.3...v1.1.4) Updates `pillow-heif` from 1.8.0 to 1.8.1 - [Release notes](https://github.com/bigcat88/pillow_heif/releases) - [Changelog](https://github.com/bigcat88/pillow_heif/blob/master/CHANGELOG.md) - [Commits](bigcat88/pillow_heif@v1.8.0...v1.8.1) Updates `hypothesis` from 6.168.5 to 6.169.0 - [Release notes](https://github.com/HypothesisWorks/hypothesis/releases) - [Commits](HypothesisWorks/hypothesis@v6.168.5...v6.169.0) Updates `jsonpointer` from 3.2.0 to 3.2.1 - [Release notes](https://github.com/stefankoegl/python-json-pointer/releases) - [Commits](stefankoegl/python-json-pointer@v3.2.0...v3.2.1) Updates `narwhals` from 2.26.0 to 2.27.1 - [Release notes](https://github.com/narwhals-dev/narwhals/releases) - [Commits](narwhals-dev/narwhals@v2.26.0...v2.27.1) Updates `platformdirs` from 4.12.4 to 4.13.0 - [Release notes](https://github.com/tox-dev/platformdirs/releases) - [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst) - [Commits](tox-dev/platformdirs@4.12.4...4.13.0) Updates `python-discovery` from 1.6.1 to 1.6.2 - [Release notes](https://github.com/tox-dev/python-discovery/releases) - [Changelog](https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst) - [Commits](tox-dev/python-discovery@1.6.1...1.6.2) Updates `virtualenv` from 21.14.6 to 21.14.7 - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](pypa/virtualenv@21.14.6...21.14.7) --- updated-dependencies: - dependency-name: numpy dependency-version: 2.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv-minor-patch - dependency-name: pydantic dependency-version: 2.14.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv-minor-patch - dependency-name: pymssql dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv-minor-patch - dependency-name: py7zr dependency-version: 1.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv-minor-patch - dependency-name: pillow-heif dependency-version: 1.8.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv-minor-patch - dependency-name: hypothesis dependency-version: 6.169.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-minor-patch - dependency-name: jsonpointer dependency-version: 3.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv-minor-patch - dependency-name: narwhals dependency-version: 2.27.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-minor-patch - dependency-name: platformdirs dependency-version: 4.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv-minor-patch - dependency-name: python-discovery dependency-version: 1.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv-minor-patch - dependency-name: virtualenv dependency-version: 21.14.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-19T15:19:22Z

requirements.txt / pylock.toml drift (unsigned push blocked)

uv.lock / pyproject.toml changed but GitHub Actions cannot push an unsigned commit under the required_signatures ruleset (#1419).

Option A — signed commit on this Dependabot branch:

git fetch origin pull/2104/head:dependabot-review
git checkout dependabot-review
uv export --frozen --no-emit-project -o requirements.txt
uv export --format pylock.toml --frozen --all-extras --all-groups --output-file pylock.toml
git add requirements.txt pylock.toml
git commit -S -m "chore(deps): regenerate requirements.txt and pylock.toml after uv.lock update"
git push origin "HEAD:<dependabot-branch-name>"

Option B — supersede PR: apply the bump + export locally with signed commits (see CONTRIBUTING.md).

Download the CI-generated requirements.txt and pylock.toml from the workflow artifact on this run when present.

dependabot · 2026-10-20T13:56:51Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 19, 2026

FabioLeitao mentioned this pull request Oct 20, 2026

chore(deps): refresh uv minor/patch lock and ignore filelock 4.x #2108

Merged

1 of 3 tasks

dependabot Bot closed this Oct 20, 2026

dependabot Bot deleted the dependabot/uv/uv-minor-patch-fed8e67e6c branch October 20, 2026 13:56

Navigation Menu

Repository navigation

deps(uv): bump the uv-minor-patch group across 1 directory with 11 updates - #2104

deps(uv): bump the uv-minor-patch group across 1 directory with 11 updates#2104
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-minor-patch-fed8e67e6c

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Improvements

StringDType hashing with NaN sentinels

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

v2.14.1 2026-10-11

What's Changed

Performance

Fixes

pymssql 2.0 greenish

Version 2.4.4 - 2026-10-09 - Mikhail Terekhov

General

Fix multiple Vulnerbilities and bugs

v1.1.4_

Security

Fixed

v1.8.1

Changed

[1.8.1 - 2026-10-11]

Changed

3.2.1

What's Changed

Narwhals v2.27.1

What's Changed

Narwhals v2.27.0

Changes

✨ Enhancements

🐞 Bug fixes

4.13.0

v1.6.2

Bug fixes - 1.6.2

Bug fixes - 1.6.2

21.14.7

Bugfixes - 21.14.7

Bugfixes - 21.14.7

Uh oh!

github-actions Bot commented Oct 19, 2026

requirements.txt / pylock.toml drift (unsigned push blocked)

Uh oh!

dependabot Bot commented on behalf of github Oct 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading

`MaskedArray` resets a fill_value that cannot be represented in a new dtype

`v1.1.4`_