Skip to content

chore(deps): update all non-major dependencies - #84

Closed
khepri-bot[bot] wants to merge 2 commits into
mainfrom
renovate/all-non-major-dependencies
Closed

chore(deps): update all non-major dependencies#84
khepri-bot[bot] wants to merge 2 commits into
mainfrom
renovate/all-non-major-dependencies

Conversation

@khepri-bot

@khepri-bot khepri-bot Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
astral-sh/setup-uv action patch v10.3.0 → v10.3.2 v10.3.3 age confidence
coverage dependency-groups minor ==7.16.2 → ==7.17.0 7.17.2 (+1) age confidence
github/codeql-action action patch v4.39.0 → v4.39.1 v4.39.3 (+1) age confidence
hypothesis (changelog) dependency-groups patch ==6.170.5 → ==6.170.11 6.170.15 (+3) age confidence
pytest-mock (changelog) dependency-groups minor ==3.16.0 → ==3.17.0 age confidence
ruff (source, changelog) dependency-groups patch ==0.17.0 → ==0.17.2 0.17.4 (+1) age confidence

Release Notes

astral-sh/setup-uv

v10.3.2: 🌈 update known checksums for 0.13.5

Compare Source

Changes
🧰 Maintenance
📚 Documentation

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
coveragepy/coveragepy (coverage)

v7.17.0

Compare Source

  • Dropped support for Python 3.10.

  • Binary wheels are now provided for iOS and Android. This allows the use of
    the optimized C tracer on mobile platforms.

  • Fix: three or more levels of nested with statements could make a with
    line look like a branch with an exit that can never happen. Using the
    sys.monitoring core, these phantom branches were reported as partial. Other
    cores hid the problem but still counted the phantom branches in the total.
    Closes issue 1987_.

  • Fix: a comment or string that merely mentioned if True: or
    while True: could mark its line as a branch that is known to be partial,
    so a branch that never ran was reported as taken. These built-in patterns
    now only match at the start of the statement. Closes issue 2314_.

  • Fix: region detection missed functions defined in unusual places, such as
    else and except clauses. This is now fixed.

  • Fix: recent versions of the lcov tool complain if the same function name
    appears more than once in a report. Python can have multiple same-named
    functions in a few ways, for example, getters/setters or conditionally
    defined functions. These are now disambiguated by adding a @<line number>
    suffix to the function name. Fixes issue 2335.

  • Fix: The "Can't combine statement coverage data with branch data" error now
    names the two data files it couldn't combine. The :ref:error description <error_cant_combine> in the docs now lists common causes and how to find the
    process that wrote the file.

  • Fix: at coverage totals close to 0 or 100, the XML report could get incorrect
    line-rate values like 8.333e-05 or 1. This is now fixed, closing
    issue 2293_ and issue 2294_.

  • Fix: a parallel data file saved more than once kept the hash of its first
    save in its file name. Combining could then skip it as a duplicate of another
    file that had the same data at that point, and delete it, losing the data
    recorded after the first save. Each save now updates the hash. This had been
    a problem since 7.13.1. Fixes issue 2338_.

  • Fixes for obscure but legal file names:

    • File names (and plugin names) can contain control characters, which are
      legal in POSIX paths but unsafe in reports: in XML 1.0 they make the
      document non-well-formed, and in a terminal they act as escape sequences
      (colors, title/clipboard sequences, cursor moves that forge output). Now
      the XML report, the text and Markdown summary reports, and coverage debug data replace non-printable characters in names. Printable names are
      unchanged.

    • A file pattern (from include, omit, or a [paths] alias)
      containing a newline sent the glob-to-regex translation into an infinite
      loop, hanging the process. Newlines in patterns are now handled like any
      other character.

  • Fixes in the implementation of the C tracer:

    • If a plugin's dynamic_source_filename method raised an exception, lines
      in that function could be recorded as belonging to a different file. Also
      fixed some minor memory leaks in the C tracer.

    • The refcount of None was mismanaged during function calls, including
      comprehensions. This was unlikely to cause an actual problem, but is now
      fixed. Thanks, Andrew Dalke.

    • The C tracer held borrowed references to dictionary values, which was
      unsafe on free-threaded Python. Now it takes its own references.

    • An internal error while recording a new file could be reported as a
      confusing SystemError instead of the actual exception.

  • Performance: the text summary report (coverage report) held on to every
    file's parsed source until it finished, so its memory use grew with the size
    of the project: ten times or more what 7.14 used on large projects. Now it
    keeps only what it needs to print. Fixes issue 2277_.

  • Performance: HTML reports should be about 5% faster to produce.

  • Kept the political banner in the README. Closes issue 2344_.

.. _issue 1987: #​1987
.. _issue 2277: #​2277
.. _issue 2293: #​2293
.. _issue 2294: #​2294
.. _issue 2314: #​2314
.. _issue 2335: #​2335
.. _issue 2338: #​2338
.. _issue 2344: #​2344

.. _changes_7-16-2:

github/codeql-action

v4.39.1

Compare Source

HypothesisWorks/hypothesis (hypothesis)

v6.170.11: Hypothesis version 6.170.11

Compare Source

This patch makes writing observability data to ".hypothesis/observed"
cheaper when tests run in multiple threads, and defers cleaning up old
observation files from import time until observations are first
written.

The canonical version of these notes (with links) is on readthedocs.

v6.170.10: Hypothesis version 6.170.10

Compare Source

This patch fixes an internal error from "lists()" with "unique=True",
when the elements are a filtered "sampled_from()" with too few allowed
values to reach "min_size". It also ensures that "domains()" always
generates at least one subdomain, even with a small "max_length".

We also fixed some internal bookkeeping that could go wrong when an
exception was raised and caught during generation, for example by
"recursive()", which could make shrinking less effective.

The canonical version of these notes (with links) is on readthedocs.

v6.170.9: Hypothesis version 6.170.9

Compare Source

This release fixes a "DeprecationWarning" when importing
"hypothesis.extra.dateutil" with dateutil 3.0 or higher (issue #​4934).

The canonical version of these notes (with links) is on readthedocs.

v6.170.8: Hypothesis version 6.170.8

Compare Source

This patch fixes a regression in version 6.170.1, where unique
collections of non-empty collections, such as
"st.sets(st.frozensets(st.integers(), min_size=1), min_size=1)", could
fail the "HealthCheck.large_base_example" health check (issue #​4918).

The canonical version of these notes (with links) is on readthedocs.

v6.170.7: Hypothesis version 6.170.7

Compare Source

This improves type coverage of stateful testing.

The canonical version of these notes (with links) is on readthedocs.

v6.170.6: Hypothesis version 6.170.6

Compare Source

This patch adds PyPy 3.12 wheels to releases (issue #​4921).

Thanks to @​moreati for this contribution!

The canonical version of these notes (with links) is on readthedocs.

pytest-dev/pytest-mock (pytest-mock)

v3.17.0

Compare Source

2026-10-17

  • #&#8203;641 <https://github.com/pytest-dev/pytest-mock/pull/641>_: Failures of mock assertions such as assert_called_with are again reported only once, instead of two or three times with the original error from the mock module chained before them.
  • #&#8203;642 <https://github.com/pytest-dev/pytest-mock/pull/642>_: Mock assertion failures no longer show misleading introspection when they are not about the arguments of the last call: assert_called, assert_called_once, assert_not_called, assert_any_call, their await counterparts, and assert_called_once_with/assert_awaited_once_with when the mock was not called (awaited) exactly once. The introspection also no longer reports arguments passed by position versus by keyword as different for autospecced mocks, and no longer shows empty Args:/Kwargs: sections when assertion rewriting is not available.
  • #&#8203;643 <https://github.com/pytest-dev/pytest-mock/pull/643>_: assert_has_calls and assert_has_awaits failures no longer show pytest introspection, which compared the expected and actual calls position by position and so reported differences between unrelated calls. The mock's own message, listing the expected and actual calls, is still shown.

v3.16.1

Compare Source

2026-10-17

  • #&#8203;617 <https://github.com/pytest-dev/pytest-mock/pull/617>_: Fixed assert_has_calls raising ValueError instead of AssertionError (or showing misleading introspection) when the expected calls are plain tuples rather than call(...) objects, such as (args, kwargs) entries of another mock's call_args_list, (args,), (kwargs,), (name, args) or (name, kwargs).
  • #&#8203;621 <https://github.com/pytest-dev/pytest-mock/pull/621>_: Fixed mocker.stop() sometimes stopping the wrong mock, for example with mocks from mocker.create_autospec.
  • #&#8203;621 <https://github.com/pytest-dev/pytest-mock/pull/621>_: mocker.stop() now undoes the most recent patch first when the same object is used in several patches.
  • #&#8203;623 <https://github.com/pytest-dev/pytest-mock/pull/623>_: Fixed misleading introspection in assert_has_awaits failures, and assert_has_calls/assert_has_awaits raising IndexError instead of AssertionError when calls is passed by keyword.
  • #&#8203;624 <https://github.com/pytest-dev/pytest-mock/pull/624>_: Clear spy_return_iter after a spied synchronous or asynchronous function raises, matching spy_return.
  • #&#8203;627 <https://github.com/pytest-dev/pytest-mock/pull/627>_: Document async_stub await assertions and the distinction between call and await tracking.
  • #&#8203;629 <https://github.com/pytest-dev/pytest-mock/pull/629>_: Fixed mocker.resetall() skipping the mocks patched with mocker.patch.multiple(), both the ones it creates and the ones passed explicitly.
  • #&#8203;630 <https://github.com/pytest-dev/pytest-mock/pull/630>_: mocker.resetall() now also resets spy_return and spy_exception of spies, like it already did for spy_return_list and spy_return_iter, and no longer overwrites attributes with these names on mocks that are not spies.
  • #&#8203;633 <https://github.com/pytest-dev/pytest-mock/pull/633>_: Fixed spies on classmethod, staticmethod, builtins and classes returning a MagicMock instead of calling the spied code after mocker.resetall(side_effect=True). Resetting a spy's side_effect now goes back to calling the spied code, also clearing any side_effect set on the spy.
astral-sh/ruff (ruff)

v0.17.2

Compare Source

Released on 2026-10-22.

Preview features
  • [complexity] Add unnecessary-regular-expression-compile (#​25533)
Bug fixes
  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#​28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#​29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#​29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#​29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#​29413)
Performance
  • Avoid intermediate names in lint name resolution (#​29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#​29561)
  • Share postfix parsing and reduce expression copies (#​29480)
Configuration
  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#​18961)
Documentation
  • Clarify documentation and correct stale guidance (#​29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#​29592)
Contributors

v0.17.1

Compare Source

Released on 2026-10-15.

Preview features
  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#​29322)
Bug fixes
  • Fix dedent with multiple leading comments (#​29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#​28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#​29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#​29366)
Rule changes
  • Treat more collections and weakref containers as mutable (#​29213)
Documentation
  • [flake8-import-conventions] Update default and example aliases (#​29333)
Contributors

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • Between 12:00 AM and 08:59 AM, only on Monday (* 0-8 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@khepri-bot
khepri-bot Bot requested a review from a team November 9, 2026 06:42
@khepri-bot khepri-bot Bot added the renovate label Nov 9, 2026
@khepri-bot

khepri-bot Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pyproject.toml
Command failed: khepri-verify-pypi-source coverage 7.17.0
[SUPPLY_CHAIN_BLOCK] coverage==7.17.0: coverage-7.17.0-py3-none-any.whl: 'a1_coverage.pth:1' contains executable startup import: import sys; exec('import os\n\nif os.getenv("COVERAGE_PROCESS_START") or os.gete
[SUPPLY_CHAIN_BLOCK] coverage==7.17.0: coverage-7.17.0.tar.gz: sdist 'a1_coverage.pth:1' contains executable .pth import

@wgordon17

wgordon17 commented Nov 9, 2026

Copy link
Copy Markdown
Member

Closing stale PR #76 branch; coverage 7.17.0 .pth SHA-256 allowlist added in khepri-deps/renovate#73 so the next Renovate run will open a clean PR.

@wgordon17 wgordon17 closed this Nov 9, 2026
@wgordon17
wgordon17 deleted the renovate/all-non-major-dependencies branch November 9, 2026 14:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@wgordon17