[dependabot]

Bumps the python-minor-patch group with 27 updates:

Package	From	To
anyio	4.14.2	4.15.1
typing-extensions	4.15.0	4.16.0
pytest	9.0.3	9.1.1
pytest-asyncio	1.3.0	1.4.0
pytest-cov	7.0.0	7.1.0
respx	0.22.0	0.23.1
ruff	0.14.10	0.17.1
python-dotenv	1.2.2	1.2.4
fhirpy	2.2.0	2.3.1
aiohttp	3.14.4	3.14.5
fhir-resources	8.2.0	8.3.0
aiohappyeyeballs	2.6.2	2.7.1
annotated-types	0.7.0	0.8.0
charset-normalizer	3.4.7	3.5.2
coverage	7.13.1	7.16.2
fhir-core	1.1.8	1.1.12
idna	3.15	3.20
iniconfig	2.3.0	2.3.1
librt	0.7.7	0.16.0
pluggy	1.6.0	1.7.0
propcache	0.5.2	0.5.4
pydantic	2.13.4	2.14.1
pydantic-core	2.46.4	2.50.1
pygments	2.20.0	2.21.0
pytz	2026.2	2026.5
tomli	2.3.0	2.5.0
typing-inspection	0.4.2	0.4.4

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

• Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

• Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

  • follow_symlinks on exists() (Python 3.12+)
  • follow_symlinks on is_dir() (Python 3.13+)
  • follow_symlinks on is_file() (Python 3.13+)
  • follow_symlinks on owner() (Python 3.13+)
  • follow_symlinks on group() (Python 3.13+)
  • newline on read_text() (Python 3.13+)

  (#1286, #1293; PR by @​jaideeppyne)

• Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

• Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

• Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

• Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

• Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

• Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

• Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

• Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

• Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

• Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

• Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

• Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

• Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

• Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

• Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

• Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

• Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

• Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits

• ffcd154 Bumped up the version
• 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
• 9283662 Bumped up the version
• d137692 Improved the instructions for AI agents
• 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
• 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
• b825c3b Fixed pyproject.toml changes not triggering the test suite
• 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
• b05fe6d Fixed wrong type in move_on_after (#1297)
• 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
• Additional commits viewable in compare view

Updates typing-extensions from 4.15.0 to 4.16.0

Release notes

Sourced from typing-extensions's releases.

4.16.0

No changes since 4.16.0rc2.

Changes since 4.15.0:

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
• Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
• Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
• Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
• Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
• Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
• Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
• Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
• Add support for pickling sentinels.
• Sentinels now preserve their identity when copied or deep-copied.
• Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
• The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
• Deprecate arbitrary attribute assignments to sentinels.
• Deprecate subclassing sentinels.
• Add support for Python 3.15.
• Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

4.16.0rc2

Changes since 4.16.0rc1:

• Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

Changes since 4.15.0:

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
• Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
• Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
• Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
• Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
• Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
• Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
• Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
• Add support for pickling sentinels.
• Sentinels now preserve their identity when copied or deep-copied.
• Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
• The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
• Deprecate arbitrary attribute assignments to sentinels.
• Deprecate subclassing sentinels.
• Add support for Python 3.15.

4.16.0rc1

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.

... (truncated)

Changelog

Sourced from typing-extensions's changelog.

Release 4.16.0 (July 2, 2026)

No user-facing changes since 4.16.0rc2.

Release 4.16.0rc2 (June 25, 2026)

• Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

Release 4.16.0rc1 (June 24, 2026)

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
• Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
• Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
• Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
• Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
• Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
• Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
• Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
• Add support for pickling sentinels.
• Sentinels now preserve their identity when copied or deep-copied.
• Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
• The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
• Deprecate arbitrary attribute assignments to sentinels.
• Deprecate subclassing sentinels.
• Add support for Python 3.15.

Commits

• f29cd28 Prepare relase 4.16.0 (#774)
• 4317461 Bump version to 4.16.0rc2.dev (#772)
• 4f71098 Prepare release 4.16.0rc2 (#771)
• 37ed08a Remove use of asyncio.coroutines.iscoroutinefunction() (#769)
• 8dcc559 Improve TypedDict documentation (#770)
• 224f8d5 Post-release followups for 3.16.0rc1 (#767)
• 777de3e Prepare release 4.16.0rc1 (#766)
• 890be90 Type variable tuple variance (#741)
• 0e05458 Pin SQLAlchemy third-party tests to pytest==9.0.3 (#765)
• d277746 docs: add version compatibility table (#733)
• Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates pytest-asyncio from 1.3.0 to 1.4.0

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio v1.4.0

1.4.0 - 2026-05-26

Deprecated

• Overriding the event_loop_policy fixture is deprecated. Use the pytest_asyncio_loop_factories hook instead. (#1419)

Added

• Added the pytest_asyncio_loop_factories hook to parametrize asyncio tests with custom event loop factories.

  The hook returns a mapping of factory names to loop factories, and pytest.mark.asyncio(loop_factories=[...]) selects a subset of configured factories per test. When a single factory is configured, test names are unchanged.

  Synchronous @pytest_asyncio.fixture functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via asyncio.run() or asyncio.set_event_loop(None)). (#1164)

Changed

• Improved the readability of the warning message that is displayed when asyncio_default_fixture_loop_scope is unset (#1298)
• Only import asyncio.AbstractEventLoopPolicy for type checking to avoid raising a DeprecationWarning. (#1394)
• Updated minimum supported pytest version to v8.4.0. (#1397)

Fixed

• Fixed a ResourceWarning: unclosed event loop warning that could occur when a synchronous test called asyncio.run() or otherwise unset the current event loop after pytest-asyncio had run an async test or fixture. (#724)

Notes for Downstream Packagers

• Added dependency on sphinx-tabs >= 3.5 to organize documentation examples into tabs. (#1395)

pytest-asyncio v1.4.0a2

1.4.0a2 - 2026-05-02

Deprecated

• Overriding the event_loop_policy fixture is deprecated. Use the pytest_asyncio_loop_factories hook instead. (#1419)

Added

• Added the pytest_asyncio_loop_factories hook to parametrize asyncio tests with custom event loop factories.

  The hook returns a mapping of factory names to loop factories, and pytest.mark.asyncio(loop_factories=[...]) selects a subset of configured factories per test. When a single factory is configured, test names are unchanged on pytest 8.4+.

  Synchronous @pytest_asyncio.fixture functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via asyncio.run() or asyncio.set_event_loop(None)). (#1164)

Changed

• Improved the readability of the warning message that is displayed when asyncio_default_fixture_loop_scope is unset (#1298)
• Only import asyncio.AbstractEventLoopPolicy for type checking to avoid raising a DeprecationWarning. (#1394)

... (truncated)

Commits

• 6e14cd2 chore: Prepare release of v1.4.0.
• 4b900fb Build(deps): Bump codecov/codecov-action from 6.0.0 to 6.0.1
• ab9f632 Build(deps): Bump zipp from 3.23.1 to 4.1.0
• a56fc77 Build(deps): Bump hypothesis from 6.152.6 to 6.152.8
• e8bae9b Build(deps): Bump requests from 2.34.0 to 2.34.2
• fc43340 Build(deps): Bump idna from 3.14 to 3.15
• 762eaf5 Build(deps): Bump jaraco-functools from 4.4.0 to 4.5.0
• b62e222 Build(deps): Bump click from 8.3.3 to 8.4.0
• 9190447 Build(deps): Bump pydantic from 2.13.3 to 2.13.4
• 82a393c ci: Remove unnecessary debug output.
• Additional commits viewable in compare view

Updates pytest-cov from 7.0.0 to 7.1.0

Changelog

Sourced from pytest-cov's changelog.

7.1.0 (2026-03-21)

• Fixed total coverage computation to always be consistent, regardless of reporting settings. Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on reporting options. See [#641](https://github.com/pytest-dev/pytest-cov/issues/641) <https://github.com/pytest-dev/pytest-cov/issues/641>_.

• Improve handling of ResourceWarning from sqlite3.

  The plugin adds warning filter for sqlite3 ResourceWarning unclosed database (since 6.2.0). It checks if there is already existing plugin for this message by comparing filter regular expression. When filter is specified on command line the message is escaped and does not match an expected message. A check for an escaped regular expression is added to handle this case.

  With this fix one can suppress ResourceWarning from sqlite3 from command line::

  pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...

• Various improvements to documentation. Contributed by Art Pelling in [#718](https://github.com/pytest-dev/pytest-cov/issues/718) <https://github.com/pytest-dev/pytest-cov/pull/718>_ and "vivodi" in [#738](https://github.com/pytest-dev/pytest-cov/issues/738) <https://github.com/pytest-dev/pytest-cov/pull/738>. Also closed [#736](https://github.com/pytest-dev/pytest-cov/issues/736) <https://github.com/pytest-dev/pytest-cov/issues/736>.

• Fixed some assertions in tests. Contributed by in Markéta Machová in [#722](https://github.com/pytest-dev/pytest-cov/issues/722) <https://github.com/pytest-dev/pytest-cov/pull/722>_.

• Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

Commits

• 66c8a52 Bump version: 7.0.0 → 7.1.0
• f707662 Make the examples use pypy 3.11.
• 6049a78 Make context test use the old ctracer (seems the new sysmon tracer behaves di...
• 8ebf20b Update changelog.
• 861d30e Remove the backup context manager - shouldn't be needed since coverage 5.0, ...
• fd4c956 Pass the precision on the nulled total (seems that there's some caching goion...
• 78c9c4e Only run the 3.9 on older deps.
• 4849a92 Punctuation.
• 197c35e Update changelog and hopefully I don't forget to publish release again :))
• 14dc1c9 Update examples to use 3.11 and make the adhoc layout example look a bit more...
• Additional commits viewable in compare view

Updates respx from 0.22.0 to 0.23.1

Release notes

Sourced from respx's releases.

Version 0.23.1

0.23.1 (8th April 2026)

Fixed

• Fix regression causing params pattern to stop working under some conditions, by doing a strict detection of ANY in multi items patterns (#313)

CI

• Update workflows actions (#310)

Version 0.23.0

0.23.0 (7th April 2026)

Fixed

• Fix data pattern with list value (#264)
• Fix and enhance incorrect documentations about iterable side effects (#287)
• Fix documentation typo, thanks @​markhobson (#298)
• Fix support for multiple slashes // in URL path by not using urljoin when prepending path, thanks @​lewiscollard and @​Skeen (#302)
• Type Route.respond json as Any to align with HTTPX, thanks @​JacobHayes (#284)
• Properly handle ANY in MuitiItems patterns (#289)

CI

• Fix test warnings (#267)
• Add Python 3.14 to test matrix, thanks @​carlosdorneles-mb (#300)
• Update nix flake, mypy target and workflows (#306, #282)

Changelog

Sourced from respx's changelog.

[0.23.1] - 2026-04-08

Fixed

• Fix regression causing params pattern to stop working under some conditions, by doing a strict detection of ANY in multi items patterns (#313)

CI

• Update workflows actions (#310)

[0.23.0] - 2026-04-07

Fixed

• Fix data pattern with list value (#264)
• Fix and enhance incorrect documentations about iterable side effects (#287)
• Fix documentation typo, thanks @​markhobson (#298)
• Fix support for multiple slashes // in URL path by not using urljoin when prepending path, thanks @​lewiscollard and @​Skeen (#302)
• Type Route.respond json as Any to align with HTTPX, thanks @​JacobHayes (#284)
• Properly handle ANY in MuitiItems patterns (#289)

CI

• Fix test warnings (#267)
• Add Python 3.14 to test matrix, thanks @​carlosdorneles-mb (#300)
• Update nix flake, mypy target and workflows (#306, #282)

Commits

• fc8b43b Release 0.23.1
• 1da5d2f Strict detection of ANY in multi items patterns (#313)
• 6f1bf70 Bump checkout and python actions (#310)
• 62aaeab Release 0.23.0
• d8edf3d Adjust badges
• b3a193d Add downloads badge to docs
• 9961e9b Handle multiple routes using MuitiItems pattern with ANY (#289)
• e51c2a6 Update Route.respond json type hint to Any to match HTTPX (#284)
• a499260 Bump less-action/reusables from 8 to 10 (#282)
• 7b44b51 Update nix flake and mypy target (#306)
• Additional commits viewable in compare view

Updates ruff from 0.14.10 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15

... (truncated)

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (#29384)
• 355b42a [ty] Avoid writable override contracts from object (#29373)
• e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
• Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

• dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
• An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
• dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

• dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
• An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
• dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in