Skip to content

ci: bump the python group across 1 directory with 15 updates - #831

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-ef8a6a281b
Closed

ci: bump the python group across 1 directory with 15 updates#831
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-ef8a6a281b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python group with 15 updates in the / directory:

Package From To
starlette 1.7.0 1.10.0
cedarpy 4.12.1 4.12.2
ruff 0.17.0 0.17.2
mkdocs-material 9.7.7 9.8.0
mkdocstrings 1.0.7 1.0.8
griffe 2.3.2 2.4.1
certifi 2026.10.19 2026.10.23
griffecli 2.3.2 2.4.1
griffelib 2.3.2 2.4.1
markdown 3.11 3.11.2
mkdocs-autorefs 1.4.4 1.4.5
mkdocstrings-python 2.0.9 2.0.10
platformdirs 4.13.0 4.13.5
wcwidth 0.9.2 0.9.4
setuptools 84.0.0 ``

Updates starlette from 1.7.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0
  • Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
  • The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
  • FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

  • Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
  • starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

  • Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
  • Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
  • WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
  • FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

  • Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
  • Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
  • FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
  • Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

... (truncated)

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

  • Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
  • Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
  • Compare Match members by identity during routing #3665 and #3722.

Deprecated

  • Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

  • Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.
  • Keep path parameter values that look like another placeholder in url_path_for() #3725.
  • Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.
  • Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.
  • Strip only one pair of matching outer quotes from Config env file values #3720.
  • Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.
  • Report NaN and infinity correctly in FloatConvertor.to_string() #3716.
  • Ignore Range on requests other than GET and HEAD in FileResponse #3679.

1.9.0 (October 18, 2026)

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.

... (truncated)

Commits
  • 8aa828c Version 1.10.0 (#3728)
  • a85a5c3 Substitute URL path parameters in a single pass (#3725)
  • 6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
  • b973efd Build URL-encoded form fields in parser callbacks (#3724)
  • d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
  • fb3e818 Compare remaining Match members by identity in routing (#3722)
  • fc23aa1 Compare Match members by identity in Router.app (#3665)
  • fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
  • 4114432 Default omitted http.response.start headers in middlewares (#3721)
  • 1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
  • Additional commits viewable in compare view

Updates cedarpy from 4.12.1 to 4.12.2

Release notes

Sourced from cedarpy's releases.

cedarpy v4.12.2

Added

  • With the new keyword-only release_gil=True, other Python threads run while Cedar validates policies or builds a handle, so asyncio.to_thread keeps an event loop responsive during those calls (#120). The default, False, holds the GIL for the whole call, as before. These entry points take it:

    • validate_policies
    • PolicySet.from_str, PolicySet.from_json_str and PolicySet.from_pst
    • Schema.from_str and Schema.from_json_str
    • Entities.from_json_str

    When another thread is busy, a released call typically waits about sys.getswitchinterval() (5 ms by default) to resume, so releasing pays off for calls that take milliseconds or more. Reading the arguments and building the result still hold the GIL. See the Threads and asyncio Guide (#121). Thanks @​kousun12!

Full Changelog: k9securityio/cedar-py@v4.12.1...v4.12.2

Changelog

Sourced from cedarpy's changelog.

[4.12.2] - 2026-10-14

Added

  • With the new keyword-only release_gil=True, other Python threads run while Cedar validates policies or builds a handle, so asyncio.to_thread keeps an event loop responsive during those calls (#120). The default, False, holds the GIL for the whole call, as before. These entry points take it:

    • validate_policies
    • PolicySet.from_str, PolicySet.from_json_str and PolicySet.from_pst
    • Schema.from_str and Schema.from_json_str
    • Entities.from_json_str

    When another thread is busy, a released call typically waits about sys.getswitchinterval() (5 ms by default) to resume, so releasing pays off for calls that take milliseconds or more. Reading the arguments and building the result still hold the GIL. See the Threads and asyncio Guide (#121). Thanks @​kousun12!

Commits
  • f9a3af1 Merge pull request #122 from k9securityio/release/4.12.2
  • fd79b2d release: bump version to 4.12.2
  • 5bf4e43 feat: add opt-in release_gil to validation and handle constructors (#121)
  • See full diff in compare view

Updates ruff from 0.17.0 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

... (truncated)

Commits
  • 30516b4 Bump version to 0.17.2 (#29637)
  • 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
  • 0d562aa [ty] Check inherited attribute conflicts (#28559)
  • 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
  • 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
  • b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
  • 32869b4 Avoid creating deployments for automation jobs (#29626)
  • ec891ba Link the commit in pull request report footers (#29621)
  • 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
  • 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
  • Additional commits viewable in compare view

Updates mkdocs-material from 9.7.7 to 9.8.0

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.8.0

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide. It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Dependency Affected versions New minimum Advisory
Jinja2 <=3.1.5 3.1.6 CVE-2025-27516
Markdown <3.8.1 3.8.1 CVE-2025-69534
Pygments <2.20.0 2.20.0 CVE-2026-4539
PyMdown Extensions <=11.0.0 11.0.1 CVE-2026-67422
Requests <2.33.0 2.33.0 CVE-2026-25645
Pillow <13.0.0 13.0.0 CVE-2026-96636
CairoSVG <=2.9.0 2.9.1 CVE-2026-107378
GitPython <=3.2.0 3.2.1 CVE-2026-114145

Pillow and CairoSVG apply to the imaging extra; GitPython applies to the git extra.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

  • Updated Node build-time dependencies to fix vulnerabilities
  • Updated Python dependency minimums and required Python 3.11
  • Removed RSS from recommended dependencies
  • Updated project status and maintenance links
  • Updated CLI notice with end-of-life and migration guidance
  • Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

PyMdown Extensions: affected <=11.0.0; new minimum 11.0.1 (CVE-2026-67422) GHSA-gm37-52c6-37mw

Requests: affected <2.33.0; new minimum 2.33.0 (CVE-2026-25645) GHSA-gc5v-m9x4-r6x2

... (truncated)

Commits
  • 0f72ad6 Merge pull request #8615 from squidfunk/fix/security
  • 85a048d Documentation
  • 10c572e Prepare 9.8.0 release
  • dd8a7ef Cleaned up unused assets
  • 8771cef Updated README
  • 7c9a1cc Updated changelog
  • 3ce9310 Removed redirects from recommended dependencies
  • 0b77e8f Updated CLI notice with end-of-life and migration guidance
  • 66e4f9c Updated project status and maintenance links
  • 1ed13d2 Removed RSS from recommended dependencies
  • Additional commits viewable in compare view

Updates mkdocstrings from 1.0.7 to 1.0.8

Release notes

Sourced from mkdocstrings's releases.

1.0.8

1.0.8 - 2026-10-19

Compare with 1.0.7

Bug Fixes

Changelog

Sourced from mkdocstrings's changelog.

1.0.8 - 2026-10-19

Compare with 1.0.7

Bug Fixes

Commits
  • df77e42 chore: Prepare release 1.0.8
  • cbc4590 chore: Stop testing on Python 3.10
  • f402d2c fix: Prefix code anchor/span IDs to avoid collisions
  • e9538c4 docs: Link the VBA handler to its published documentation
  • See full diff in compare view

Updates griffe from 2.3.2 to 2.4.1

Release notes

Sourced from griffe's releases.

2.4.1

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

2.4.0

2.4.0 - 2026-10-19

Compare with 2.3.2

Features

  • Expose reference_path in addition to canonical_path (2f6b419 by Timothée Mazzucotelli). Issue-448

Bug Fixes

Performance Improvements

  • Prune function bodies from source before building AST (657ce96 by Timothée Mazzucotelli). PR-489

    This requires the griffe[faster] extra. Griffe is fast by default so this performance improvement will only be noticeable in projects with a lot of Python code.

Changelog

Sourced from griffe's changelog.

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

2.4.0 - 2026-10-19

Compare with 2.3.2

Features

  • Expose reference_path in addition to canonical_path (2f6b419 by Timothée Mazzucotelli). Issue-448

Bug Fixes

Performance Improvements

  • Prune function bodies from source before building AST (657ce96 by Timothée Mazzucotelli). PR-489

    This requires the griffe[faster] extra. Griffe is fast by default so this performance improvement will only be noticeable in projects with a lot of Python code.

Commits
  • a74c9d0 chore: Prepare release 2.4.1
  • 0670d03 refactor: Stop checking attribute values
  • f3f2605 docs: Add back pymdownx.blocks.tab Markdown extension
  • da6f966 docs: Add periods to docstrings
  • 9d51e51 docs: Single block license headers
  • 5b833a9 docs: Fix code tree with annotations
  • 731b3c5 docs: Various improvements
  • 3faeeb1 fix: Load symbols gated behing __getattr__ during dynamic analysis
  • ca60582 chore: Prepare release 2.4.0
  • 07bd484 Merge branch 'issue448'
  • Additional commits viewable in compare view

Updates certifi from 2026.10.19 to 2026.10.23

Commits

Updates griffecli from 2.3.2 to 2.4.1

Release notes

Sourced from griffecli's releases.

2.4.1

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

2.4.0

2.4.0 - 2026-10-19

Compare with 2.3.2

Features

  • Expose reference_path in addition to canonical_path (2f6b419 by Timothée Mazzucotelli). Issue-448

Bug Fixes

Performance Improvements

  • Prune function bodies from source before building AST (657ce96 by Timothée Mazzucotelli). PR-489

    This requires the griffe[faster] extra. Griffe is fast by default so this performance improvement will only be noticeable in projects with a lot of Python code.

Changelog

Sourced from griffecli's changelog.

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

2.4.0 - 2026-10-19

Compare with 2.3.2

Features

  • Expose reference_path in addition to canonical_path (2f6b419 by Timothée Mazzucotelli). Issue-448

Bug Fixes

Performance Improvements

  • Prune function bodies from source before building AST (657ce96 by Timothée Mazzucotelli). PR-489

    This requires the griffe[faster] extra. Griffe is fast by default so this performance improvement will only be noticeable in projects with a lot of Python code.

Commits
  • a74c9d0 chore: Prepare release 2.4.1
  • 0670d03 refactor: Stop checking attribute values
  • f3f2605 docs: Add back pymdownx.blocks.tab Markdown extension
  • da6f966 docs: Add periods to docstrings
  • 9d51e51 docs: Single block license headers
  • 5b833a9 docs: Fix code tree with annotations
  • 731b3c5 docs: Various improvements
  • 3faeeb1 fix: Load symbols gated behing __getattr__ during dynamic analysis
  • ca60582 chore: Prepare release 2.4.0
  • 07bd484 Merge branch 'issue448'
  • Additional commits viewable in compare view

Updates griffelib from 2.3.2 to 2.4.1

Release notes

Sourced from griffelib's releases.

2.4.1

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

2.4.0

2.4.0 - 2026-10-19

Compare with 2.3.2

Features

  • Expose reference_path in addition to canonical_path (2f6b419 by Timothée Mazzucotelli). Issue-448

Bug Fixes

Performance Improvements

  • Prune function bodies from source before building AST (657ce96 by Timothée Mazzucotelli). PR-489

    This requires the griffe[faster] extra. Griffe is fast by default so this performance improvement will only be noticeable in projects with a lot of Python code.

Changelog

Sourced from griffelib's changelog.

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

2.4.0 - 2026-10-19

Compare with 2.3.2

Features

  • Expose reference_path in addition to canonical_path (2f6b419 by Timothée Mazzucotelli). Issue-448

Bug Fixes

  • Preserve standalone named expression parentheses (dc6300d by Alperen). PR-488, Co-authored-by: Timothée Mazzucotelli dev@pawamoy.fr
  • Propagate public value to inherited members (aliases) (

@dependabot
ci: bump the python group across 1 directory with 15 updates
1af3f11 
Bumps the python group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [starlette](https://github.com/Kludex/starlette) | `1.7.0` | `1.10.0` |
| [cedarpy](https://github.com/k9securityio/cedar-py) | `4.12.1` | `4.12.2` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.0` | `0.17.2` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.7` | `9.8.0` |
| [mkdocstrings](https://github.com/mkdocstrings/mkdocstrings) | `1.0.7` | `1.0.8` |
| [griffe](https://github.com/mkdocstrings/griffe) | `2.3.2` | `2.4.1` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.10.19` | `2026.10.23` |
| [griffecli](https://github.com/mkdocstrings/griffe) | `2.3.2` | `2.4.1` |
| [griffelib](https://github.com/mkdocstrings/griffe) | `2.3.2` | `2.4.1` |
| [markdown](https://github.com/Python-Markdown/markdown) | `3.11` | `3.11.2` |
| [mkdocs-autorefs](https://github.com/mkdocstrings/autorefs) | `1.4.4` | `1.4.5` |
| [mkdocstrings-python](https://github.com/mkdocstrings/python) | `2.0.9` | `2.0.10` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.13.0` | `4.13.5` |
| [wcwidth](https://github.com/jquast/wcwidth) | `0.9.2` | `0.9.4` |
| [setuptools](https://github.com/pypa/setuptools) | `84.0.0` | `` |



Updates `starlette` from 1.7.0 to 1.10.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.7.0...1.10.0)

Updates `cedarpy` from 4.12.1 to 4.12.2
- [Release notes](https://github.com/k9securityio/cedar-py/releases)
- [Changelog](https://github.com/k9securityio/cedar-py/blob/main/CHANGELOG.md)
- [Commits](k9securityio/cedar-py@v4.12.1...v4.12.2)

Updates `ruff` from 0.17.0 to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.0...0.17.2)

Updates `mkdocs-material` from 9.7.7 to 9.8.0
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.7...9.8.0)

Updates `mkdocstrings` from 1.0.7 to 1.0.8
- [Release notes](https://github.com/mkdocstrings/mkdocstrings/releases)
- [Changelog](https://github.com/mkdocstrings/mkdocstrings/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/mkdocstrings@1.0.7...1.0.8)

Updates `griffe` from 2.3.2 to 2.4.1
- [Release notes](https://github.com/mkdocstrings/griffe/releases)
- [Changelog](https://github.com/mkdocstrings/griffe/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/griffe@2.3.2...2.4.1)

Updates `certifi` from 2026.10.19 to 2026.10.23
- [Commits](certifi/python-certifi@2026.10.19...2026.10.23)

Updates `griffecli` from 2.3.2 to 2.4.1
- [Release notes](https://github.com/mkdocstrings/griffe/releases)
- [Changelog](https://github.com/mkdocstrings/griffe/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/griffe@2.3.2...2.4.1)

Updates `griffelib` from 2.3.2 to 2.4.1
- [Release notes](https://github.com/mkdocstrings/griffe/releases)
- [Changelog](https://github.com/mkdocstrings/griffe/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/griffe@2.3.2...2.4.1)

Updates `markdown` from 3.11 to 3.11.2
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.11.0...3.11.2)

Updates `mkdocs-autorefs` from 1.4.4 to 1.4.5
- [Release notes](https://github.com/mkdocstrings/autorefs/releases)
- [Changelog](https://github.com/mkdocstrings/autorefs/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/autorefs@1.4.4...1.4.5)

Updates `mkdocstrings-python` from 2.0.9 to 2.0.10
- [Release notes](https://github.com/mkdocstrings/python/releases)
- [Changelog](https://github.com/mkdocstrings/python/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/python@2.0.9...2.0.10)

Updates `platformdirs` from 4.13.0 to 4.13.5
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.13.0...4.13.5)

Updates `wcwidth` from 0.9.2 to 0.9.4
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Changelog](https://github.com/jquast/wcwidth/blob/master/docs/history.rst)
- [Commits](jquast/wcwidth@0.9.2...0.9.4)

Updates `setuptools` from 84.0.0 to 
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](https://github.com/pypa/setuptools/commits)

---
updated-dependencies:
- dependency-name: starlette
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: cedarpy
  dependency-version: 4.12.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.17.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: mkdocs-material
  dependency-version: 9.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: mkdocstrings
  dependency-version: 1.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: griffe
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: certifi
  dependency-version: 2026.10.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: griffecli
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: griffelib
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: markdown
  dependency-version: 3.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: mkdocs-autorefs
  dependency-version: 1.4.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: mkdocstrings-python
  dependency-version: 2.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: platformdirs
  dependency-version: 4.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: wcwidth
  dependency-version: 0.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: setuptools
  dependency-version:
  dependency-type: direct:development
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 28, 2026
carloshvp
carloshvp requested changes Oct 29, 2026
View reviewed changes

@carloshvp carloshvp left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed current head 1af3f1124b84dbb90d3ffec3900714fd416cea96.

The generated development lock loses Windows colorama and the explicit pip/setuptools pins; cMCP also loses pywin32. In a fresh empty interpreter context, a Windows/Python 3.11 uv pip install --dry-run --require-hashes fails on this head because colorama is not pinned. The same resolution succeeds against this PR's base lock. This is a demonstrated lock regression, independent of the existing audit failures. Regenerate with the documented --universal --python-version 3.11 --generate-hashes command, preserve the full platform dependency closure and explicit tooling pins, then check both Linux and Windows. PR #832 supplies a complete independently validated fix for the three audit packages; reconcile any overlapping update with that head. DCO trailers were checked; the current lock cannot be approved.

Prepared with OpenAI Codex.

@dependabot @github

dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 29, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/python-ef8a6a281b branch October 29, 2026 06:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@carloshvp carloshvp carloshvp requested changes
@zohebk8s zohebk8s Awaiting requested review from zohebk8s zohebk8s is a code owner
@qubeena07 qubeena07 Awaiting requested review from qubeena07 qubeena07 is a code owner
@rajnisht7 rajnisht7 Awaiting requested review from rajnisht7 rajnisht7 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@carloshvp