Skip to content

build(deps-dev): bump the minor-uv-updates group with 5 updates - #15

Merged
jku merged 1 commit into
mainfrom
dependabot/uv/minor-uv-updates-4064b76787
Jul 30, 2026
Merged

build(deps-dev): bump the minor-uv-updates group with 5 updates#15
jku merged 1 commit into
mainfrom
dependabot/uv/minor-uv-updates-4064b76787

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-uv-updates group with 5 updates:

Package From To
mypy 2.2.0 2.3.0
ruff 0.15.21 0.15.22
zizmor 1.26.1 1.28.0
zensical 0.0.50 0.0.51
uv 0.11.28 0.11.31

Updates mypy from 2.2.0 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

  • Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
  • Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
  • Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
  • Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
  • Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
  • 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
  • 24c237d [mypyc] Improve documentation of Final (#21713)
  • b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
  • cbcb51a Narrow for frozendict membership check (#21709)
  • af2bc0f Sync typeshed (#21707)
  • Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Install ruff 0.15.22

Install prebuilt binaries via shell script

</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Commits

Updates zizmor from 1.26.1 to 1.28.0

Release notes

Sourced from zizmor's releases.

v1.28.0

Security 🔒🔗

  • v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

    Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

  • The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

  • The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)

  • sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛🔗

  • Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

  • Fixed a bug where the github-env audit would incorrectly flag some printf calls as exploitable (#2201)

  • Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

v1.27.0

New Features 🌈🔗

  • zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#2153) Enhancements 🌱🔗

  • zizmor's handling of paths is now more consistent, particularly when run on Windows (#2163)

  • zizmor now emits a helpful warning when being run in implicit offline mode (#2180)

Bug Fixes 🐛🔗

  • Fixed a bug where the secrets-outside-env audit would not honor ignore comments within the same job scope (#2157)

  • Fixed a bug where the ref-version-mismatch audit would not honor ignore comments within the same steps scope (#2177)

  • Fixed a bug where --collect=[MODE] was not correctly handled when auditing remote inputs (#2185)

Changelog

Sourced from zizmor's changelog.

1.28.0

Security 🔒

  • v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See [GHSA-f42p-wjw5-97qh] for full information.

    Many thanks to @​shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱

  • The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

  • The [dependabot-cooldown] audit is now aware of GitHub's new three-day default cooldown (#2193)

  • sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛

  • Fixed a bug where the [template-injection] audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

  • Fixed a bug where the [github-env] audit would incorrectly flag some printf calls as exploitable (#2201)

  • Fixed a bug where zizmor would produce a misleading and confusing error message when asked to audit an ambiguous remote input (#2205)

1.27.0

New Features 🌈

  • zizmor now has experimental support for workflows that specify parallel steps. See Usage - Parallel steps for more information (#2153)

Enhancements 🌱

  • zizmor's handling of paths is now more consistent, particularly when run on Windows (#2163)

  • zizmor now emits a helpful warning when being run in implicit offline mode (#2180)

Bug Fixes 🐛

  • Fixed a bug where the [secrets-outside-env] audit would not honor

... (truncated)

Commits

Updates zensical from 0.0.50 to 0.0.51

Release notes

Sourced from zensical's releases.

0.0.51

Summary

This version improves cached rebuilds by persisting objects.inv and autorefs data, fixes stale builds after removing files, and upgrades soupsieve to address vulnerabilities.

Changelog

Bug fixes

  • ec69acc zensical, compat – cache objects.inv to persist it across cached rebuilds (#815)
  • 7e6940f zensical – cache autorefs data for cross-ref resolution across rebuilds (#805)
Commits
  • 362bf5d chore: release v0.0.51
  • 7989a55 Update dependencies
  • ec69acc fix: cache objects.inv to persist it across cached rebuilds (#815)
  • 7e6940f fix: cache autorefs data for cross-ref resolution across rebuilds (#805)
  • See full diff in compare view

Updates uv from 0.11.28 to 0.11.31

Release notes

Sourced from uv's releases.

0.11.31

Release Notes

Released on 2026-07-21.

Enhancements

  • Allow workspace sources to reference members in another workspace by path (#18401)
  • Support .venv files containing paths to centralized project environments (#20022)
  • Update bundled Windows timezone data to IANA 2026c (#20554)

Preview features

  • Add an index-specific hash-algorithm setting for lockfile generation (#20605)

Configuration

  • Add audit.malware-check and audit.malware-check-url settings (#20587)

Performance

  • Avoid quadratic work when deduplicating transitive conflicts (#20578)

Bug fixes

  • Suggest --emit-build-options for unsupported uv pip compile --emit-options (#20582)
  • Reject source distributions and wheels with mismatched package names (#20432)
  • Avoid retrying TLS certificate verification failures (#16245)
  • Avoid warnings about uv_build settings for in-tree build backends (#20153)

Install uv 0.11.31

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"

Download uv 0.11.31

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.11.31

Released on 2026-07-21.

Enhancements

  • Allow workspace sources to reference members in another workspace by path (#18401)
  • Support .venv files containing paths to centralized project environments (#20022)
  • Update bundled Windows timezone data to IANA 2026c (#20554)

Preview features

  • Add an index-specific hash-algorithm setting for lockfile generation (#20605)

Configuration

  • Add audit.malware-check and audit.malware-check-url settings (#20587)

Performance

  • Avoid quadratic work when deduplicating transitive conflicts (#20578)

Bug fixes

  • Suggest --emit-build-options for unsupported uv pip compile --emit-options (#20582)
  • Reject source distributions and wheels with mismatched package names (#20432)
  • Avoid retrying TLS certificate verification failures (#16245)
  • Avoid warnings about uv_build settings for in-tree build backends (#20153)

0.11.30

Released on 2026-07-20.

Python

  • Add CPython 3.15.0b4 (#20519)

Preview features

  • Allow uv workspace metadata --sync to target the active virtual environment with --active (#20500)
  • Reuse centralized project environments when workspaces are accessed through symlinks (#20436)

Performance

  • Skip resolver candidates whose files are all excluded by exclude-newer (#20460)
  • Limit parallel cache reads to reduce resolver scheduling and allocation overhead (#20427)
  • Accelerate lockfile serialization with toml_writer (#20450)
  • Compact cached Simple API distribution metadata and hashes (#20463, #20483)
  • Decode stale cache entries in a single blocking task (#20486)
  • Decode cached payloads outside resolver workers (#20464)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the minor-uv-updates group with 5 updates
f1a809c 
Bumps the minor-uv-updates group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [mypy](https://github.com/python/mypy) | `2.2.0` | `2.3.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.15.22` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.26.1` | `1.28.0` |
| [zensical](https://github.com/zensical/zensical) | `0.0.50` | `0.0.51` |
| [uv](https://github.com/astral-sh/uv) | `0.11.28` | `0.11.31` |


Updates `mypy` from 2.2.0 to 2.3.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.2.0...v2.3.0)

Updates `ruff` from 0.15.21 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/0.15.22/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.21...0.15.22)

Updates `zizmor` from 1.26.1 to 1.28.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.26.1...v1.28.0)

Updates `zensical` from 0.0.50 to 0.0.51
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.50...v0.0.51)

Updates `uv` from 0.11.28 to 0.11.31
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/0.11.31/CHANGELOG.md)
- [Commits](astral-sh/uv@0.11.28...0.11.31)

---
updated-dependencies:
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-uv-updates
- dependency-name: ruff
  dependency-version: 0.15.22
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-uv-updates
- dependency-name: zizmor
  dependency-version: 1.28.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-uv-updates
- dependency-name: zensical
  dependency-version: 0.0.51
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-uv-updates
- dependency-name: uv
  dependency-version: 0.11.31
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-uv-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 30, 2026
@jku
jku merged commit 99beb65 into main Jul 30, 2026
18 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/minor-uv-updates-4064b76787 branch July 30, 2026 10:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jku