Skip to content

chore(deps-dev): Bump the python-dependencies group across 1 directory with 3 updates - #8

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-b2b38a386e
Open

chore(deps-dev): Bump the python-dependencies group across 1 directory with 3 updates#8
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-b2b38a386e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 3 updates in the / directory: ruff, mypy and datamodel-code-generator.

Updates ruff from 0.16.8 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

    The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

  • Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

    The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

  • Remove support for ruff-lsp (#28750)

    Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits
  • 5b27c1c Bump version to 0.17.0 (#29259)
  • 8f362bf Integrate vendored Unicode names into Ruff
  • 88a50d6 Revert upstream Unicode loose matching
  • 276832a Revert upstream Unicode alias normalization
  • 26911ca Vendor unicode_names2 from upstream
  • 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
  • bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
  • 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
  • dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
  • ef23c9c Update default and latest Python versions for 3.15 (#28792)
  • Additional commits viewable in compare view

Updates mypy from 2.3.1 to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

  • You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
  • Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
  • Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

Updates datamodel-code-generator from 0.82.0 to 0.83.0

Release notes

Sourced from datamodel-code-generator's releases.

0.83.0

Breaking Changes

Code Generation Changes

  • Deduplication now compares referenced models - Models that render identically are only merged when the models they reference also match structurally, so schemas whose same-named references resolve to different definitions in other files no longer collapse into a single class; such models are now emitted separately and may gain suffixed names such as LeafModel or Values1, changing class names and module contents compared with previous output (#4115)
  • Generic schemas using $dynamicRef are now specialized per dynamic scope - A plain-name $dynamicRef previously resolved lexically within its own schema resource, so every referrer shared one model of the referenced generic. The parser now tracks the dynamic scope of the schemas that referenced a model, binds each $dynamicAnchor name to its outermost declaration in that scope, and re-parses a referenced schema as an additional specialized model whenever its bindings differ. Schemas that combine $dynamicRef with $dynamicAnchor, including remote, embedded, recursive, root-level and tuple additionalItems generics, now emit extra model classes with suffixed names and different field types than before, so generated module contents, class names and import sites can change for existing users (#4117)
  • Specialized dynamic-scope models shift generated class names - Specialized models are registered under the referencing model and named like the shared model before parsing, so the shared model keeps naming priority and specializations receive derived names such as numeric or Model suffixes. Output ordering and names of surrounding models can therefore differ from previous releases, and this applies under --naming-strategy full-path and --collapse-root-models as well (#4117)
  • OpenAPI specifications referencing external JSON Schema generics gain specialized models - parse_raw now drains pending dynamic-scope specializations after every specification has been read, so components that reference external schemas rebinding a $dynamicAnchor produce additional specialized models instead of reusing a single shared model (#4117)
  • Dynamic ref resolution scope for inline resources and merged refs - $dynamicRef is now resolved within the schema resource a subschema stands for, namely an inline subschema declaring its own $id and the target of a $ref merged with sibling keywords, with enclosing and referencing resources still able to override the binding so the outermost $dynamicAnchor declaration wins; schemas combining $dynamicRef with embedded $id resources or with $ref plus sibling keywords may now generate different field types and model shapes than before, for example a resource-local anchor type such as RootModel[str] where the previous output used the anchor visible in the outer scope (#4119)
  • Model reuse no longer merges models whose same-named references point at different models - Deduplication for --reuse-model, --collapse-reuse-models and --reuse-scope=tree previously matched models on rendered output and imports alone, so models that rendered identically but referenced different models sharing a name were incorrectly collapsed into one. Duplicate detection within a module and across modules now also requires the referenced models to match, so these models stay distinct. Affected schemas now generate additional or differently named classes, such as a suffixed FieldModel alongside Field, extra per-module classes, and inheritance from a shared base instead of a single merged model, which can change class names and module layout that downstream code imports (#4121)
  • Merged $ref targets now resolve through aliases - A referenced schema that is itself a $ref is merged with its own target, so a $ref with sibling keywords pointing at an alias now generates the aliased definition instead of the alias node, changing model names and field types in generated output for JSON Schema 2020-12 documents that use $ref alongside other keywords (#4122)
  • References inside merged targets from other documents are rebased - When a $ref with sibling keywords points into another document, nested $ref and plain-name $dynamicRef values are rewritten to absolute locations before merging, so schemas whose relative references previously resolved against the wrong base now produce different models, imports, and field types (#4122)
  • Resolve $recursiveRef in merged cross-document $ref targets - A self-pointing $recursiveRef inside a schema merged in from another document now resolves to the nearest enclosing $recursiveAnchor of its defining document, or that document's root, instead of resolving against the merging document; schemas that rely on the previous resolution generate different recursive model references and field annotations, so regenerated models may name different classes than before, and when the merging document itself declares $recursiveAnchor the reference is instead left to extend the dynamic scope (#4127)
  • OpenAPI component schemas that declare an $id are now registered as schema resources - References naming an $id declared inside a component schema now resolve to that embedded schema when the document itself has no matching target, instead of only being treated as document-relative or external document references, and the OpenAPI parser now parses the normalized specification returned by _prepare_schema_resources rather than the original raw specification, so specifications that use $id inside component schemas can produce different models, model names, and field types than before (#4128)
  • Merged schema copies now collapse into shared models - Object models parsed from a schema merged in from another document are now recognized as duplicates of an identically named model when their rendered shapes match, even if their dedup keys differ because nested referenced names only converge later in the same pass; schemas that previously produced extra suffixed classes such as a second Tree, Node, or Branch now reuse the single shared model, so generated class names, class counts, and field annotations can change and code importing the previously emitted duplicate class names will need updating (#4133)
  • Recursive references inside embedded $id resources resolve to the resource root - A $recursiveRef located in a subschema that declares its own $id but no $recursiveAnchor now targets the root of that embedded resource instead of the nearest enclosing $recursiveAnchor or the document root, both when the document is parsed directly and when its schemas are merged into another document, so affected fields are annotated with the embedded resource model instead of the outer model, and targets reachable only through $recursiveRef are now loaded and can add generated models (#4130)
  • Root models of documents referenced only by JSON pointer are named after the document - When an external document is reached only through pointer references into it and its own subschemas refer back to the document root, that root model was previously generated as Field or FieldModel; it is now named after the file stem, for example Tree or Node, so class names and field annotations such as list[Field] change for such schemas (#4132)

Error Handling Changes

  • New warning for allOf base classes that cannot follow dynamic scope bindings - When an allOf base class is referenced from a schema whose dynamic scope would rebind its $dynamicAnchor, the parser now emits a UserWarning stating that the base class resolves its $dynamicRef within its own schema resources. Generation still succeeds, but builds that treat warnings as errors or assert on captured warnings can now fail (#4117)
  • New SchemaResourceRefWarning raised for compatibility-resolved references - A reference that keeps resolving against the document, or keeps loading the referenced document, for compatibility while JSON Schema would resolve it to an embedded $id resource now emits the newly added SchemaResourceRefWarning, so generation runs that previously completed silently can now surface warnings and can fail where warnings are configured as errors (#4128)

Default Behavior Changes

  • External reference mapping keys are matched against the defining document - Because merged target references are rebased to absolute locations, --external-ref-mapping entries must now name the path of the document the reference actually comes from rather than a path relative to the merged target, so existing mappings that relied on the previous matching may silently stop applying (#4122)

What's Changed

... (truncated)

Changelog

Sourced from datamodel-code-generator's changelog.

0.83.0 - 2026-09-24

Breaking Changes

Code Generation Changes

  • Deduplication now compares referenced models - Models that render identically are only merged when the models they reference also match structurally, so schemas whose same-named references resolve to different definitions in other files no longer collapse into a single class; such models are now emitted separately and may gain suffixed names such as LeafModel or Values1, changing class names and module contents compared with previous output (#4115)
  • Generic schemas using $dynamicRef are now specialized per dynamic scope - A plain-name $dynamicRef previously resolved lexically within its own schema resource, so every referrer shared one model of the referenced generic. The parser now tracks the dynamic scope of the schemas that referenced a model, binds each $dynamicAnchor name to its outermost declaration in that scope, and re-parses a referenced schema as an additional specialized model whenever its bindings differ. Schemas that combine $dynamicRef with $dynamicAnchor, including remote, embedded, recursive, root-level and tuple additionalItems generics, now emit extra model classes with suffixed names and different field types than before, so generated module contents, class names and import sites can change for existing users (#4117)
  • Specialized dynamic-scope models shift generated class names - Specialized models are registered under the referencing model and named like the shared model before parsing, so the shared model keeps naming priority and specializations receive derived names such as numeric or Model suffixes. Output ordering and names of surrounding models can therefore differ from previous releases, and this applies under --naming-strategy full-path and --collapse-root-models as well (#4117)
  • OpenAPI specifications referencing external JSON Schema generics gain specialized models - parse_raw now drains pending dynamic-scope specializations after every specification has been read, so components that reference external schemas rebinding a $dynamicAnchor produce additional specialized models instead of reusing a single shared model (#4117)
  • Dynamic ref resolution scope for inline resources and merged refs - $dynamicRef is now resolved within the schema resource a subschema stands for, namely an inline subschema declaring its own $id and the target of a $ref merged with sibling keywords, with enclosing and referencing resources still able to override the binding so the outermost $dynamicAnchor declaration wins; schemas combining $dynamicRef with embedded $id resources or with $ref plus sibling keywords may now generate different field types and model shapes than before, for example a resource-local anchor type such as RootModel[str] where the previous output used the anchor visible in the outer scope (#4119)
  • Model reuse no longer merges models whose same-named references point at different models - Deduplication for --reuse-model, --collapse-reuse-models and --reuse-scope=tree previously matched models on rendered output and imports alone, so models that rendered identically but referenced different models sharing a name were incorrectly collapsed into one. Duplicate detection within a module and across modules now also requires the referenced models to match, so these models stay distinct. Affected schemas now generate additional or differently named classes, such as a suffixed FieldModel alongside Field, extra per-module classes, and inheritance from a shared base instead of a single merged model, which can change class names and module layout that downstream code imports (#4121)
  • Merged $ref targets now resolve through aliases - A referenced schema that is itself a $ref is merged with its own target, so a $ref with sibling keywords pointing at an alias now generates the aliased definition instead of the alias node, changing model names and field types in generated output for JSON Schema 2020-12 documents that use $ref alongside other keywords (#4122)
  • References inside merged targets from other documents are rebased - When a $ref with sibling keywords points into another document, nested $ref and plain-name $dynamicRef values are rewritten to absolute locations before merging, so schemas whose relative references previously resolved against the wrong base now produce different models, imports, and field types (#4122)
  • Resolve $recursiveRef in merged cross-document $ref targets - A self-pointing $recursiveRef inside a schema merged in from another document now resolves to the nearest enclosing $recursiveAnchor of its defining document, or that document's root, instead of resolving against the merging document; schemas that rely on the previous resolution generate different recursive model references and field annotations, so regenerated models may name different classes than before, and when the merging document itself declares $recursiveAnchor the reference is instead left to extend the dynamic scope (#4127)
  • OpenAPI component schemas that declare an $id are now registered as schema resources - References naming an $id declared inside a component schema now resolve to that embedded schema when the document itself has no matching target, instead of only being treated as document-relative or external document references, and the OpenAPI parser now parses the normalized specification returned by _prepare_schema_resources rather than the original raw specification, so specifications that use $id inside component schemas can produce different models, model names, and field types than before (#4128)
  • Merged schema copies now collapse into shared models - Object models parsed from a schema merged in from another document are now recognized as duplicates of an identically named model when their rendered shapes match, even if their dedup keys differ because nested referenced names only converge later in the same pass; schemas that previously produced extra suffixed classes such as a second Tree, Node, or Branch now reuse the single shared model, so generated class names, class counts, and field annotations can change and code importing the previously emitted duplicate class names will need updating (#4133)
  • Recursive references inside embedded $id resources resolve to the resource root - A $recursiveRef located in a subschema that declares its own $id but no $recursiveAnchor now targets the root of that embedded resource instead of the nearest enclosing $recursiveAnchor or the document root, both when the document is parsed directly and when its schemas are merged into another document, so affected fields are annotated with the embedded resource model instead of the outer model, and targets reachable only through $recursiveRef are now loaded and can add generated models (#4130)
  • Root models of documents referenced only by JSON pointer are named after the document - When an external document is reached only through pointer references into it and its own subschemas refer back to the document root, that root model was previously generated as Field or FieldModel; it is now named after the file stem, for example Tree or Node, so class names and field annotations such as list[Field] change for such schemas (#4132)

Error Handling Changes

  • New warning for allOf base classes that cannot follow dynamic scope bindings - When an allOf base class is referenced from a schema whose dynamic scope would rebind its $dynamicAnchor, the parser now emits a UserWarning stating that the base class resolves its $dynamicRef within its own schema resources. Generation still succeeds, but builds that treat warnings as errors or assert on captured warnings can now fail (#4117)
  • New SchemaResourceRefWarning raised for compatibility-resolved references - A reference that keeps resolving against the document, or keeps loading the referenced document, for compatibility while JSON Schema would resolve it to an embedded $id resource now emits the newly added SchemaResourceRefWarning, so generation runs that previously completed silently can now surface warnings and can fail where warnings are configured as errors (#4128)

Default Behavior Changes

  • External reference mapping keys are matched against the defining document - Because merged target references are rebased to absolute locations, --external-ref-mapping entries must now name the path of the document the reference actually comes from rather than a path relative to the merged target, so existing mappings that relied on the previous matching may silently stop applying (#4122)

What's Changed

... (truncated)

Commits
  • f59ac9f docs: update release benchmark data (#4082)
  • 0fdffc7 Fix release draft breaking changes merge (#4138)
  • 3e2b6d8 Switch release draft analysis to Opus 5.5 (#4137)
  • 5acbd12 [pre-commit.ci] pre-commit autoupdate (#4113)
  • ad26676 Fix duplicate models left by merged copies of recursive schemas (#4133)
  • 01df579 Fix Field class name for roots of pointer-referenced documents (#4132)
  • 352362f Fix $anchor references in OpenAPI component schemas (#4131)
  • 066dff1 Fix $recursiveRef targets in embedded $id resources and other documents (#4130)
  • 3532c44 Fix $ref to embedded $id resources in OpenAPI component schemas (#4128)
  • 1fa694f Fix $recursiveRef in cross-file merged $ref targets (#4127)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 7, 2026
@dependabot
dependabot Bot requested a review from troycorbinz as a code owner October 7, 2026 20:35
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 7, 2026
@dependabot
chore(deps-dev): Bump the python-dependencies group across 1 director…
8a4a583 
…y with 3 updates

Bumps the python-dependencies group with 3 updates in the / directory: [ruff](https://github.com/astral-sh/ruff), [mypy](https://github.com/python/mypy) and [datamodel-code-generator](https://github.com/datamodel-code-generator/datamodel-code-generator).


Updates `ruff` from 0.16.8 to 0.17.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.8...0.17.0)

Updates `mypy` from 2.3.1 to 2.4.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.1...v2.4.0)

Updates `datamodel-code-generator` from 0.82.0 to 0.83.0
- [Release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases)
- [Changelog](https://github.com/datamodel-code-generator/datamodel-code-generator/blob/main/CHANGELOG.md)
- [Commits](datamodel-code-generator/datamodel-code-generator@0.82.0...0.83.0)

---
updated-dependencies:
- dependency-name: datamodel-code-generator
  dependency-version: 0.83.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.16.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/python-dependencies-b2b38a386e branch from 78248b5 to 8a4a583 Compare October 14, 2026 21:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@troycorbinz troycorbinz Awaiting requested review from troycorbinz troycorbinz is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants