Skip to content

build(deps): bump the python-minor group across 1 directory with 8 updates#157

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/python-minor-19055a17e8
Open

build(deps): bump the python-minor group across 1 directory with 8 updates#157
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/python-minor-19055a17e8

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 14, 2026

Bumps the python-minor group with 8 updates in the / directory:

Package From To
cryptography 46.0.6 46.0.7
pillow 12.1.1 12.2.0
pytest 9.0.2 9.0.3
hypothesis 6.151.10 6.151.14
mypy 1.19.1 1.20.1
build 1.4.2 1.4.3
werkzeug 3.1.7 3.1.8
maturin 1.12.6 1.13.1

Updates cryptography from 46.0.6 to 46.0.7

Changelog

Sourced from cryptography's changelog.

46.0.7 - 2026-04-07


* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
  passed to APIs that accept Python buffers, which could lead to buffer
  overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.

.. _v46-0-6:

Commits

Updates pillow from 12.1.1 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Dependencies

Testing

Other changes

... (truncated)

Commits

Updates pytest from 9.0.2 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

    -- by aleguy02

Commits

Updates hypothesis from 6.151.10 to 6.151.14

Release notes

Sourced from hypothesis's releases.

Hypothesis for Python - version 6.151.14

This patch fixes our "from_regex()" type annotations so that "from_regex(..., alphabet=None)" is accepted.

This patch also adds unicode line breaks and thai combining vowels to our list of constant strings to upweight at runtime.

The canonical version of these notes (with links) is on readthedocs.

Hypothesis for Python - version 6.151.13

This patch removes some newly unnecessary "# type: ignore" comments.

The canonical version of these notes (with links) is on readthedocs.

Hypothesis for Python - version 6.151.12

This release improves "Phase.explain" output by excluding pytest- related syrupy files as a possible source of variation.

The canonical version of these notes (with links) is on readthedocs.

Hypothesis for Python - version 6.151.11

This patch improves printing of primitive values generated from complex strategies, particularly for "from_regex()". Previously, these would often be printed as function calls desctribing how to construct them. Now they will always be printed as a literal value.

The canonical version of these notes (with links) is on readthedocs.

Commits
  • e571cf3 Bump hypothesis-python version to 6.151.14 and update changelog
  • cd37169 Merge pull request #4698 from Liam-DeVoe/more-constant-strings
  • 72f0006 remove typing from from_regex with bytes
  • 888a373 Merge remote-tracking branch 'upstream/master' into more-constant-strings
  • 4939dab Bump hypothesis-python version to 6.151.13 and update changelog
  • e3dab36 Merge pull request #4693 from HypothesisWorks/create-pull-request/patch
  • 4b5e745 fix rare test issue
  • b2f6737 changelog
  • 4839630 update type hints
  • 458eb1b fix release docs syntax
  • Additional commits viewable in compare view

Updates mypy from 1.19.1 to 1.20.1

Changelog

Sourced from mypy's changelog.

Mypy 1.20.1

  • Always disable sync in SQLite cache (Ivan Levkivskyi, PR 21184)
  • Temporarily skip few base64 tests (Ivan Levkivskyi, PR 21193)
  • Revert dict.__or__ typeshed change (Ivan Levkivskyi, PR 21186)
  • Fix narrowing for match case with variadic tuples (Shantanu, PR 21192)
  • Avoid narrowing type[T] in type calls (Shantanu, PR 21174)
  • Fix regression for catching empty tuple in except (Shantanu, PR 21153)
  • Fix reachability for frozenset and dict view narrowing (Shantanu, PR 21151)
  • Fix narrowing with chained comparison (Shantanu, PR 21150)
  • Avoid narrowing to unreachable at module level (Shantanu, PR 21144)
  • Allow dangerous identity comparisons to Any typed variables (Shantanu, PR 21142)
  • --warn-unused-config should not be a strict flag (Ivan Levkivskyi, PR 21139)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • A5rocks
  • Aaron Wieczorek
  • Adam Turner
  • Ali Hamdan
  • asce
  • BobTheBuidler
  • Brent Westbrook
  • Brian Schubert
  • bzoracler
  • Chris Burroughs
  • Christoph Tyralla
  • Colin Watson
  • Donghoon Nam
  • E. M. Bray
  • Emma Smith
  • Ethan Sarp
  • George Ogden
  • getzze
  • grayjk
  • Gregor Riepl
  • Ivan Levkivskyi
  • James Hilliard
  • James Le Cuirot
  • Jeremy Nimmer
  • Joren Hammudoglu
  • Kai (Kazuya Ito)
  • kaushal trivedi
  • Kevin Kannammalil
  • Lukas Geiger
  • Łukasz Langa
  • Marc Mueller
  • Michael R. Crusoe
  • michaelm-openai

... (truncated)

Commits

Updates build from 1.4.2 to 1.4.3

Release notes

Sourced from build's releases.

1.4.3

What's Changed

New Contributors

Full Changelog: pypa/build@1.4.2...1.4.3

Changelog

Sourced from build's changelog.

#################### 1.4.3 (2026-04-10) ####################

Features

  • Add kind parameter to log messages to separate semantic and representation - by :user:abitrolly (:issue:973)

Bugfixes

  • Strip PYTHONPATH from the environment during isolated builds to prevent host packages from leaking into the build
    • by :user:gaborbernat (:issue:405)
  • Pass --no-input to pip to prevent hidden credential prompts that cause hangs, and automatically set PIP_KEYRING_PROVIDER=subprocess (or UV_KEYRING_PROVIDER=subprocess for the uv installer) when the keyring CLI is on PATH -- by :user:gaborbernat (:issue:409)
  • check_dependency now reports URL requirements as unmet instead of silently accepting them when a package with the same name is installed - by :user:gaborbernat (:issue:860)
  • Fix misleading missing dependency error display where transitive dependency chains showed the top-level package on a separate line, making it appear as if the top-level package itself was missing - by :user:gaborbernat (:issue:875)
  • Fix towncrier template to generate changelog categories in definition order - by :user:gaborbernat (:issue:1007)
  • Resolve thread-safety races in the build API - by :user:gaborbernat (:issue:1015)
  • Validate backend-path entries exist on disk with a clear error - by :user:gaborbernat (:issue:1016)

Miscellaneous

  • :issue:1020, :issue:1021

#################### 1.4.2 (2026-03-25) ####################

Bugfixes

  • Ensure the uv installer uses the current version of Python, avoiding an issue if UV_PYTHON is set, for example. (:issue:977)
  • Fix _has_valid_outer_pip returning True when pip is missing, causing build to try using a non-existent pip instead of falling back to virtualenv. (:issue:1003)

#################### 1.4.1 (2026-03-24) ####################

... (truncated)

Commits

Updates werkzeug from 3.1.7 to 3.1.8

Release notes

Sourced from werkzeug's releases.

3.1.8

This is the Werkzeug 3.1.8 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.8/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-8 Milestone: https://github.com/pallets/werkzeug/milestone/45?closed=1

  • Request.host and get_host return the empty string if the header is missing or has invalid characters. #3142
Changelog

Sourced from werkzeug's changelog.

Version 3.1.8

Released 2026-04-02

  • Request.host and get_host return the empty string if the header is missing or has invalid characters. :issue:3142
Commits

Updates maturin from 1.12.6 to 1.13.1

Release notes

Sourced from maturin's releases.

v1.13.1

What's Changed

See also v1.13.0 release highlight: https://github.com/PyO3/maturin/releases/tag/v1.13.0

Full Changelog: PyO3/maturin@v1.13.0...v1.13.1

v1.13.0

maturin 1.13.0 is a feature-rich release focused on better wheel generation, improved packaging workflows, and smoother cross-platform builds. This release adds new capabilities for stub generation and PGO builds, significantly improves wheel repair support on macOS and Windows, and includes a broad set of fixes for ABI tagging, source distributions, and platform-specific build behavior.

Highlights

  • Added support for Profile-Guided Optimization (PGO).
  • Added PyO3 stub generation support, including a new generate-stubs command and --generate-stubs build option.
  • Re-implemented macOS wheel repair (delocate) and Windows wheel repair (delvewheel) in maturin, currently warn only when external shared libraries dependencies are required.
  • Added support for large zip files.
  • Added support for [tool.maturin.generate-ci.github] configuration.
  • Improved PEP 517 compatibility by respecting metadata_directory in build_wheel.

This release also includes substantial internal refactoring across build orchestration, interpreter resolution, and command structure, plus dependency and CI updates that improve maintainability and reliability.

No major intentional breaking changes are expected, but users with custom CI or packaging setups may want to validate their workflows after upgrading.

What's Changed

... (truncated)

Changelog

Sourced from maturin's changelog.

Changelog

1.13.0

  • Fix: fall back to placeholder for abi3 when found interpreters are too old (#3126)

1.13.0

  • Refactor: unified interpreter resolution pipeline (#3032)
  • Refactor: decompose large modules into focused submodules (#3052)
  • Keep cargo build artifact at original path after staging (#3054)
  • Fix --strip conflicting with --include-debuginfo in develop (#3057)
  • Fix abi3 wheel producing version-specific tags for CPython below minimum (#3061)
  • Generate-ci: use uv pip for pytest steps to fix local wheel preference (#3063)
  • Update reflink-copy to 0.1.29 to fix sparc Linux builds
  • Add [tool.maturin.generate-ci.github] config support (#3066)
  • Fix(sdist): handle parent workspaces and refactor sdist generation (#3055)
  • Test: refactor integration suite and switch mixed fixtures to cffi (#3068)
  • Fix data symlink permission handling (#3069)
  • Fix: correct bugs in audit.rs typo and module_writer (#3070)
  • Perf: use lazy-initialized regexes instead of per-call compilation (#3071)
  • Refactor: extract duplicated helpers and reduce code repetition (#3072)
  • Refactor: split monster functions into focused methods (#3073)
  • Refactor: improve type safety and API clarity (#3074)
  • Refactor: cleanup anti-patterns (#3075)
  • Refactor: decompose build_context into focused submodules (#3076)
  • Fix: skip legacy manylinux aliases not in PyPI allow-list (#3078)
  • Fix: auto-generate .def file for zig + windows-gnu to export PyInit symbol (#3079)
  • Ci: upgrade run-on-arch-action to ubuntu24.04, add deadsnakes PPA for newer Python (#3081)
  • Fix: pass -undefined dynamic_lookup via CARGO_ENCODED_RUSTFLAGS on macOS (#3083)
  • Feat: add Profile-Guided Optimization (PGO) support (#3085)
  • Respect metadata_directory in build_wheel per PEP 517 (#3086)
  • Update lddtree to 0.5.0
  • Fix cargo path with puccinialin for Windows (#3093)
  • Update and pin cargo-cyclonedx to 0.5.9
  • Ci: improve GitHub Actions generation logic (#3097)
  • Refactor: split BuildOptions and BuildContext into logical sub-groups (#3098)
  • Refactor: move subcommands to separate modules (#3099)
  • Refactor: decouple build orchestration from BuildContext (#3100)
  • Upgrade pyo3 to 0.28 (#3101)
  • Fix: only enable include_debuginfo by default on Windows in develop command
  • PyO3: Adds --generate_stubs build options (#3105)
  • Fix: prevent panic when no interpreters match abi3 minimum version (#3108)
  • Refactor to store CPython ABI metadata in a struct combining two enums (#3110)
  • Refactor: introduce WheelRepairer trait (#3112)
  • Feat: re-implement delocate for repairing macOS wheels (#3114)
  • PyO3: Adds generate-stubs command (#3115)
  • Feat: re-implement delvewheel for repairing Windows wheels (#3116)
  • Add auditwheel Warn mode, default to Warn on macOS/Windows (#3121)
  • Feat: Support large zip files (#3118)
Commits
  • b27b7e1 Release v1.13.1
  • 4a3df46 fix: fall back to placeholder for abi3 when found interpreters are too old (#...
  • e8ebb2f Release v1.13.0 (#3124)
  • 1e5d362 feat: Support large zip files (#3118)
  • 062bea7 Add auditwheel Warn mode, default to Warn on macOS/Windows (#3121)
  • 70ea112 feat: re-implement delvewheel for repairing Windows wheels (#3116)
  • 83cb185 PyO3: Adds generate-stubs command (#3115)
  • ac062c3 [pre-commit.ci] pre-commit autoupdate (#3117)
  • a8393eb feat: re-implement delocate for repairing macOS wheels (#3114)
  • d97bbd0 refactor: introduce WheelRepairer trait (#3112)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the python-minor group across 1 directory with 8 up…
5377496 
…dates

Bumps the python-minor group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cryptography](https://github.com/pyca/cryptography) | `46.0.6` | `46.0.7` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.1.1` | `12.2.0` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.2` | `9.0.3` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.151.10` | `6.151.14` |
| [mypy](https://github.com/python/mypy) | `1.19.1` | `1.20.1` |
| [build](https://github.com/pypa/build) | `1.4.2` | `1.4.3` |
| [werkzeug](https://github.com/pallets/werkzeug) | `3.1.7` | `3.1.8` |
| [maturin](https://github.com/pyo3/maturin) | `1.12.6` | `1.13.1` |



Updates `cryptography` from 46.0.6 to 46.0.7
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.6...46.0.7)

Updates `pillow` from 12.1.1 to 12.2.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.1.1...12.2.0)

Updates `pytest` from 9.0.2 to 9.0.3
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.2...9.0.3)

Updates `hypothesis` from 6.151.10 to 6.151.14
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@hypothesis-python-6.151.10...hypothesis-python-6.151.14)

Updates `mypy` from 1.19.1 to 1.20.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.19.1...v1.20.1)

Updates `build` from 1.4.2 to 1.4.3
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.4.2...1.4.3)

Updates `werkzeug` from 3.1.7 to 3.1.8
- [Release notes](https://github.com/pallets/werkzeug/releases)
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)
- [Commits](pallets/werkzeug@3.1.7...3.1.8)

Updates `maturin` from 1.12.6 to 1.13.1
- [Release notes](https://github.com/pyo3/maturin/releases)
- [Changelog](https://github.com/PyO3/maturin/blob/main/Changelog.md)
- [Commits](PyO3/maturin@v1.12.6...v1.13.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: pillow
  dependency-version: 12.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: pytest
  dependency-version: 9.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: hypothesis
  dependency-version: 6.151.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: mypy
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
- dependency-name: build
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: werkzeug
  dependency-version: 3.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor
- dependency-name: maturin
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Apr 14, 2026

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot requested a review from systemslibrarian as a code owner April 14, 2026 00:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@systemslibrarian systemslibrarian Awaiting requested review from systemslibrarian systemslibrarian is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants