Skip to content

chore(deps): bump the python-packages group across 1 directory with 7 updates - #15

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-packages-70bc598b77
Open

chore(deps): bump the python-packages group across 1 directory with 7 updates#15
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-packages-70bc598b77

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 13, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown

Bumps the python-packages group with 7 updates in the / directory:

Package From To
squawk-cli 2.53.0 2.62.0
alembic 1.18.4 1.19.0
pre-commit 4.6.0 4.6.1
pytest 9.0.3 9.1.1
ruff 0.13.3 0.16.1
pyrefly 1.1.1 1.2.0
diff-cover 10.2.1 10.4.1

Updates squawk-cli from 2.53.0 to 2.62.0

Release notes

Sourced from squawk-cli's releases.

Add ban-duplicate-column-assignments rule + parser improvements

Added

  • linter: add ban-duplicate-column-assignments rule (#1263, #1262)
  • ide: add code action to switch between comment types (#1271)
  • ide: add code action Rewrite integer as (#1266)
  • ide: fold where clauses (#1265)

Changed

Fixed

Parser Improvements & A Parser Fix

Changed

  • ide: refactor to use AnyName node (#1250)

  • parser: refactor ast::RelationFromItem to use ast::RelationNameRef (#1251)

  • parser: add more nodes for ast on top of cst -> more enums (#1248)

  • parser: refactor Name/NameRef to more specific nodes (#1246, #1247)

    This also fixes schema qualified sequence names:

    CREATE TABLE foo (
    id int GENERATED ALWAYS AS IDENTITY (SEQUENCE NAME public.myseq START 1)
);

require-timeout-settings rule is split & lock warning improvements

Added

  • linter: split require-timeout-settings rule (#1233, #1217). Thanks @​zvdy!

    Now there's require-lock-timeout and require-statement-timeout

  • linter: require-timeout-settings explain lock impact in the warning (#1216, #1219). Thanks @​edeetee!

    Now instead of saying:

    Missing `set lock_timeout` before potentially slow operations

    We say:

... (truncated)

Changelog

Sourced from squawk-cli's changelog.

v2.62.0 - 2026-08-06

Added

  • linter: add ban-duplicate-column-assignments rule (#1263, #1262)
  • ide: add code action to switch between comment types (#1271)
  • ide: add code action Rewrite integer as (#1266)
  • ide: fold where clauses (#1265)

Changed

Fixed

v2.61.0 - 2026-07-24

Changed

  • ide: refactor to use AnyName node (#1250)

  • parser: refactor ast::RelationFromItem to use ast::RelationNameRef (#1251)

  • parser: add more nodes for ast on top of cst -> more enums (#1248)

  • parser: refactor Name/NameRef to more specific nodes (#1246, #1247)

    This also fixes schema qualified sequence names:

    CREATE TABLE foo (
    id int GENERATED ALWAYS AS IDENTITY (SEQUENCE NAME public.myseq START 1)
);

v2.60.0 - 2026-07-18

Added

  • linter: split require-timeout-settings rule (#1233, #1217). Thanks @​zvdy!

    Now there's require-lock-timeout and require-statement-timeout

  • linter: require-timeout-settings explain lock impact in the warning (#1216, #1219). Thanks @​edeetee!

    Now instead of saying:

    Missing `set lock_timeout` before potentially slow operations

... (truncated)

Commits

Updates alembic from 1.18.4 to 1.19.0

Release notes

Sourced from alembic's releases.

1.19.0

Released: August 4, 2026

changed

  • [changed] [installation] Environmental updates:

    -   Trove classifiers now include Python 3.15 which is now part of CI
    integration

      

    • 

      Python 3.14 is also added to trove classifiers which had been previously
omitted
      

      • 

    • 

      Implemented PEP 604 style unions in type annotations

feature

  • [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK constraints, as part of the default autogenerate behavior. Detection is name-based only; a constraint whose name is unchanged is presumed equivalent regardless of its expression text, as reliably normalizing SQL expressions across backends for comparison purposes is not generally feasible. This behavior is implemented as a plugin named alembic.autogenerate.checkconstraint_byname, and may be disabled if not desired by excluding it from the EnvironmentContext.configure.autogenerate_plugins list. Pull request courtesy Francois van Kempen.

    References: #508

bug

  • [bug] [commands] Fixed inconsistency where running stamp or downgrade to base in offline (--sql) mode would emit a DROP TABLE alembic_version statement, while the same operations in online mode never drop the version table. Offline mode no longer emits this DROP, matching online behavior. The version table continues to be created when it does not exist; only the spurious offline-only drop has been removed. Pull request courtesy imurodl.

    References: #1822

1.18.5

... (truncated)

Commits

Updates pre-commit from 4.6.0 to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

Commits
  • 242ce8a v4.6.1
  • 766e550 Merge pull request #3727 from pre-commit/dedupe
  • 1558d06 Merge pull request #3726 from pre-commit/exists-faster
  • 8a1c47a avoid duplicate files in --all-files during conflict
  • 2e01c99 faster check of rev existing locally as a commit
  • 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
  • 1d811d9 Return an error for invalid --repo
  • 374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
  • 1e7994f set JULIA_DEPOT_PATH
  • b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
  • Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

  • #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
  • #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
  • #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
  • #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

  • #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

    If this is undesirable, move the fixture definition to a conftest.py file if possible.

    Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

  • #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

    See 10819 and 14011.

  • #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

    See dynamic-fixture-request-during-teardown for details.

  • #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

    These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

    See parametrize-iterators for details and suggestions.

  • #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

    See config-inicfg for more details.

  • #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits
  • cf470ec Prepare release version 9.1.1
  • e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
  • 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
  • 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
  • b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
  • 9a567e0 [automated] Update plugin list (#14617) (#14618)
  • ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
  • 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
  • 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
  • 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
  • Additional commits viewable in compare view

Updates ruff from 0.13.3 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Commits
  • 80790b3 Bump 0.16.1 (#27330)
  • 63830f3 [ty] Borrow from constraint set storage less often (#27328)
  • f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
  • 0d80497 Lint TOML files in the LSP (#26862)
  • d91586b Update prek dependencies (#27293)
  • 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
  • b20daf7 [ty] refactor: add helper function to send partial results (#27249)
  • 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
  • 7c3e2db [ty] Fix enum class container assignability (#27318)
  • d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
  • Additional commits viewable in compare view

Updates pyrefly from 1.1.1 to 1.2.0

Release notes

Sourced from pyrefly's releases.

Pyrefly v1.2.0

Release date: July 31, 2026

Pyrefly v1.2.0 bundles 901 commits from 59 contributors.

✨ New & Improved

Type Checking

  • Attrs classes are now fully supported with comprehensive field synthesis, validation, and special-method generation. Pyrefly recognizes @attr.s, @define, @frozen, and their variants, handling field specifiers (attr.ib(), field()), converters, validators, defaults, and private-field aliasing. Converters are typed from their real input type rather than Any, including the @<field>.converter decorator, attrs.converters.pipe, attrs.converters.default_if_none, and generic converters like copy.deepcopy. See the new attrs documentation for details.
  • functools.partial is now type-checked instead of treated as opaque. Bound arguments are validated at construction and Pyrefly synthesizes a precise residual signature for the remaining parameters, so errors surface at both the partial(...) call and the later invocation. Generic functions, overloads, constructors, bound methods, and **Unpack[TypedDict] parameters are supported, and results expose .func, .args, and .keywords. Precise residual callable assignment is enabled by the strict and all presets or explicitly with strict-partial-subtyping.
  • Functions decorated with functools.singledispatch now type-check calls using the signature of the function you decorated, and registered implementations are checked against that function's first parameter. Generic singledispatch functions infer from call arguments instead of reporting Unknown.
  • Pyrefly can now warn when a function declared to return a concrete type returns Any, with separate diagnostics for explicit and inferred cases. Off by default, and migrated automatically from mypy's warn_return_any.
  • Pattern matching is substantially more precise: positional class patterns resolve attribute names from __match_args__ at solve time, sequence element captures read from the narrowed subject so sibling constraints refine them, and isinstance on a facet filters the parent union to matching members. Fully covered class and sequence patterns now subtract their union member from later cases.
  • Unpacking a variadic tuple with a fixed prefix and suffix no longer smears those elements into the starred capture, so a, *rest, b = t where t: tuple[int, *tuple[bool, ...], str] types rest as list[bool].
  • TypedDict classes now synthesize __required_keys__ and __optional_keys__, so protocols requiring them (like those in langgraph) satisfy structural checks. .get() and .pop() with literal defaults preserve the field type.
  • Overload handling improved throughout: constrained TypeVar arguments expand during resolution, rejected overloads no longer leak argument errors into diagnostics, and exact callback-forwarding signatures resolve overloaded callbacks against forwarded arguments for helpers like asyncio.to_thread.
  • Enum .value on an enum type now infers as the union of member literal values instead of widening to the mixed-in data type.
  • Lambda parameters are contextually typed more thoroughly. Types are stored directly rather than resolved through inference variables, and *args/**kwargs resolve from callable hints to tuple[...] and dict[str, ...] inside the body while preserving element types in the signature.
  • All properties are now treated as data descriptors, and reflected binary-operation dunders are tried first for proper subclasses, fixing a class of incorrect attribute and operator results.
  • Cyclic type aliases reachable from an annotation are now detected instead of hanging, and class finality is taken into account when deciding whether a condition is redundant.
  • Continued basedpyright parity work: class instance truthiness is recognized, code under if TYPE_CHECKING is handled consistently, typing_extensions.sentinel is supported with relaxed naming restrictions, and super(cls, cls) is accepted.
  • copy.replace is now type-checked like dataclass replacement, and isinstance(x, type) preserves type arguments when narrowing unions.
  • Narrowing a receiver typed as Self to a subclass now preserves Self, eliminating false return errors in methods that return the narrowed receiver.

Library Support

  • Pydantic constructor synthesis now honors populate_by_name and built-in alias_generator functions, ignores Field(init=False) to match runtime, and treats frozen as a readonly field reason.
  • Django ForeignKey targets now resolve attribute expressions and string references such as "app_label.Model", preserving the generated relation and <field>_id types.
  • Bare factory-boy factory calls now return the model type via FactoryMetaClass.
  • PEP 561 partial stub packages are now supported in imports. Pyrefly reads the partial marker from py.typed and merges the stubs with the runtime package, deferring to the runtime package for omitted modules while preserving .pyi-before-.py precedence for provided ones.
  • A configured typeshed-path now supplies stdlib stubs as well as third-party stubs, enabling complete custom-typeshed testing and overrides.

Language Server

  • Hover now resolves keyword arguments, renders callable protocols as their __call__ signature, preserves overload docstrings at call sites, shows enum fields, wraps nested callable and Concatenate[...] signatures for readability, and covers and/or operators, augmented assignments, and union methods.
  • Auto-import completions respect python.analysis.autoImportCompletions, rank deprecated stdlib typing aliases below their modern equivalents, avoid duplicates for already-imported modules, and preserve import aliases correctly.
  • Rename now works on aliased imports and across files for keyword arguments, and renaming a Protocol class targets the class rather than __init__.
  • Go-to-definition now navigates directly to symbols in non-Python files such as .thrift, including nested attribute and enum access and intermediate components of multi-dotted imports.
  • Inlay hints debounce server-side (default 150ms), preventing width jitter while typing. NewType values now use their callable constructor signature instead of producing an invalid type[N] annotation.
  • Notebook support improved: hover and type lookups work past the first cell, and inlay hints, document symbols, references, and diagnostic grouping work in cells following markdown cells.
  • Document symbols fall back to flat SymbolInformation for clients such as Helix, semantic tokens cover with ... as and except ... as bindings, and cross-file diagnostics refresh on save in strict-spec clients such as Zed.
  • #region/#endregion markers create folding regions, and selection ranges now follow AST nesting from expression to statement to scope to document.
  • Baselined errors now appear as hints instead of errors, making it easier to distinguish new issues from known technical debt. Baselining also now applies correctly to unused-ignore diagnostics.
  • Match captures receive consistent semantic highlighting and preserve their declaration identity for go-to-definition.
  • lspArguments defaults to ["lsp"] when empty, preventing startup failures in dev containers and remote environments.
  • The VSCode extension adds an "Infer Types for Current File" command to the command palette.

... (truncated)

Commits
  • 1933169 cut 1.2.0
  • df11f5d Enforce call-boundary consumption in production
  • e67bc8e Transfer quantified handles to call boundaries
  • 6ba516f Move deferred call state into its boundary
  • 8888e70 Scope call contexts to a lexical boundary
  • f8c9e7c LSP: default lspArguments to ["lsp"] when empty
  • 3f0c228 Remove dead .hgignore
  • 335510d improve Sandbox: link shortening #1063 (#4327)
  • 41094b9 Keep lambda hint decomposition transactional
  • 3193b6a fix behavior of init=False for pydantic.BaseModel (#4352)
  • Additional commits viewable in compare view

Updates diff-cover from 10.2.1 to 10.4.1

Release notes

Sourced from diff-cover's releases.

Version 10.4.1

What's Changed

Dependencies

Full Changelog: Bachmann1234/diff_cover@v10.4.0...v10.4.1

Version 10.4.0

What's Changed

Dependency bumps

New Contributors

Full Changelog: Bachmann1234/diff_cover@v10.3.0...v10.4.0

Version 10.3.0

What's Changed

Full Changelog: Bachmann1234/diff_cover@v10.2.1...v10.3.0

Changelog

Sourced from diff-cover's changelog.

8/08/2026 v10.5.0

8/06/2026 v10.4.2

7/23/2026 v10.4.1

7/21/2026 v10.4.0

  • Add --branch-coverage flag to diff-cover to treat partially covered branches in Cobertura XML reports as uncovered PR 608 Thanks @​mofr

05/30/2026 v10.3.0

  • Add --show-covered flag to highlight covered diff lines in HTML report PR 600 Thanks @​duxiaocheng

  • Update readme with cli flags PR 601 Thanks me

05/23/2026 v10.2.1

01/08/2026 v10.2.0

12/30/2025 v10.1.0

  • Add support for floating-point total percentage in reports PR 565 thanks @​tilaven

12/09/2025 v10.0.0

  • Remove python 3.9 support
  • Add python 3.14 support
  • Normalize exlude/include in pyproject.toml to support string or list

11/10/2025 v9.7.2

09/25/2025 v9.7.1

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note

Low Risk
Lockfile and version-pin only; risk is mainly CI/local tooling or squawk-cli lint behavior changing after upgrade, not production runtime logic in this repo.

Overview
Bumps seven Python dependencies in pyproject.toml and refreshes poetry.lock (including the Poetry generator bump to 2.4.1).

Runtime: squawk-cli is raised from >=2.0 to >=2.62.0 (2.53.0 → 2.62.0 in the lockfile), so installs pick up newer linter/parser/IDE behavior from Squawk.

Dev tooling pins move to: alembic 1.19.0, pre-commit 4.6.1, pytest 9.1.1, ruff 0.16.1, pyrefly 1.2.0, and diff-cover 10.4.1. No changes to package source, hooks config, or tests in this diff—only dependency metadata and lock resolution.

Reviewed by Cursor Bugbot for commit 541cac2. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
chore(deps): bump the python-packages group across 1 directory with 7…
541cac2 
… updates

Bumps the python-packages group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [squawk-cli](https://github.com/sbdchd/squawk) | `2.53.0` | `2.62.0` |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.19.0` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.0` | `4.6.1` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.13.3` | `0.16.1` |
| [pyrefly](https://github.com/facebook/pyrefly) | `1.1.1` | `1.2.0` |
| [diff-cover](https://github.com/Bachmann1234/diff-cover) | `10.2.1` | `10.4.1` |



Updates `squawk-cli` from 2.53.0 to 2.62.0
- [Release notes](https://github.com/sbdchd/squawk/releases)
- [Changelog](https://github.com/sbdchd/squawk/blob/master/CHANGELOG.md)
- [Commits](sbdchd/squawk@v2.53.0...v2.62.0)

Updates `alembic` from 1.18.4 to 1.19.0
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `pre-commit` from 4.6.0 to 4.6.1
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.0...v4.6.1)

Updates `pytest` from 9.0.3 to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.3...9.1.1)

Updates `ruff` from 0.13.3 to 0.16.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.13.3...0.16.1)

Updates `pyrefly` from 1.1.1 to 1.2.0
- [Release notes](https://github.com/facebook/pyrefly/releases)
- [Commits](facebook/pyrefly@1.1.1...1.2.0)

Updates `diff-cover` from 10.2.1 to 10.4.1
- [Release notes](https://github.com/Bachmann1234/diff-cover/releases)
- [Changelog](https://github.com/Bachmann1234/diff_cover/blob/main/CHANGELOG)
- [Commits](Bachmann1234/diff_cover@v10.2.1...v10.4.1)

---
updated-dependencies:
- dependency-name: squawk-cli
  dependency-version: 2.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: alembic
  dependency-version: 1.19.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: pre-commit
  dependency-version: 4.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: ruff
  dependency-version: 0.16.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: pyrefly
  dependency-version: 1.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: diff-cover
  dependency-version: 10.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency updates label Aug 13, 2026
cursor[bot]
cursor Bot reviewed Aug 13, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 541cac2. Configure here.

Comment thread pyproject.toml
[tool.poetry.dependencies]
python = ">=3.10"
squawk-cli = ">=2.0"
squawk-cli = ">=2.62.0"

@cursor cursor Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tightened squawk-cli version constraint

High Severity

Dependabot raised the published squawk-cli lower bound from >=2.0 to >=2.62.0. This hook lets consumers pin their own squawk release via additional_dependencies, and the broad floor exists to avoid install conflicts with those pins. The documented example squawk-cli==2.41.0 would fail to resolve after this change.

Fix in Cursor Fix in Web

Triggered by learned rule: squawk-cli broad version constraint is intentional

Reviewed by Cursor Bugbot for commit 541cac2. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants