Skip to content

build(deps-dev): bump the basics group across 1 directory with 2 updates - #8716

Closed
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/pip/python/packages/lab/basics-d916921fa5
Closed

dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/pip/python/packages/lab/basics-d916921fa5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the basics group with 2 updates in the /python/packages/lab directory: uv and ruff.

Updates uv from 0.12.13 to 0.12.15

Release notes

Sourced from uv's releases.

0.12.15

Release Notes

Released on 2026-09-15.

Performance

  • Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (#21675)

Bug fixes

  • Fix regressions in 0.12.14 when installing to symlinked destinations or using uv pip install --target . (#21699)

Install uv 0.12.15

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.15/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.15/uv-installer.ps1 | iex"

Download uv 0.12.15

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
uv-x86_64-apple-darwin.tar.gz Intel macOS checksum
uv-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
uv-i686-pc-windows-msvc.zip x86 Windows checksum
uv-x86_64-pc-windows-msvc.zip x64 Windows checksum
uv-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
uv-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum
uv-s390x-unknown-linux-gnu.tar.gz S390x Linux checksum
uv-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz ARMv7 Linux checksum
uv-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
uv-i686-unknown-linux-musl.tar.gz x86 MUSL Linux checksum
uv-riscv64gc-unknown-linux-musl.tar.gz RISCV MUSL Linux checksum
uv-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum
uv-arm-unknown-linux-musleabihf.tar.gz ARMv6 MUSL Linux (Hardfloat) checksum
uv-armv7-unknown-linux-musleabihf.tar.gz ARMv7 MUSL Linux checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.15

Released on 2026-09-15.

Performance

  • Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (#21675)

Bug fixes

  • Fix regressions in 0.12.14 when installing to symlinked destinations or using uv pip install --target . (#21699)

0.12.14

Released on 2026-09-15.

Enhancements

  • Resume interrupted downloads with HTTP Range requests when supported (#21570)
  • Use a consistent format for error rendering (#17110)
  • Render error and warning causes with compact cause: labels (#21599, #21603)
  • Show underlying causes and hints in user warnings (#21565)
  • Show resolver hints for failed uv tool upgrade operations (#21566)

Preview features

  • Export multiple dependency selections from a shared lockfile in one uv export --batch invocation with the batch-export preview feature (#21618)

Performance

  • Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task (#21619)
  • Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers (#21593)
  • Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task (#21621)

Bug fixes

  • Select releases that satisfy required-environments within each resolver fork instead of combining incompatible wheel coverage across forks (#21672)
  • Install packages with paths longer than MAX_PATH on Windows systems without long-path support enabled (#21625)
  • Prevent uv python install from overwriting valid unmanaged Python symlinks with relative targets on Unix (#21639)
  • Redact credentials and signatures from missing-path-segment URL errors (#21616)
  • Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation (#21640)
  • Prefer bin/python over bin/python3 when discovering interpreters in Unix environments (#21559)
  • Classify package-operation exit codes by their underlying cause: return 1 for expected failures and 2 for recognized operational and internal failures (#17110)
  • Suppress managed-Python fallback warnings under --quiet (#21565)
  • Keep failed uv tool upgrade errors visible with -q while suppressing them with -qq (#21566)
Commits

Updates ruff from 0.16.7 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Commits
  • 62914c4 Bump version to 0.16.8 (#28648)
  • c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
  • ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
  • 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
  • 50020fb [ty] Avoid storing constraint nodes twice (#28375)
  • 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
  • 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
  • d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
  • fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
  • 31131db [ty] Support type[A & B] (#27124)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Usage: [Issues, PRs], Target: dependencies in the project python Usage: [Issues, PRs], Target: Python labels Sep 24, 2026
Copilot AI balanced review requested due to automatic review settings September 24, 2026 10:32
@dependabot dependabot Bot added python Usage: [Issues, PRs], Target: Python dependencies Usage: [Issues, PRs], Target: dependencies in the project labels Sep 24, 2026
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 24, 2026 10:32 Inactive
@github-actions github-actions Bot changed the title build(deps-dev): bump the basics group across 1 directory with 2 updates Python: build(deps-dev): bump the basics group across 1 directory with 2 updates Sep 24, 2026
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 24, 2026 10:33 Inactive
@agent-framework-automation agent-framework-automation Bot added the lab Usage: [Issues, PRs], Target: lab packages label Sep 24, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The committed lockfile remains stale, so frozen synchronization installs the previous versions.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 Medium severity

Open (1)
What changed in this PR

Updates the Python lab development tooling dependencies.

Changes:

  • Bumps uv from 0.12.13 to 0.12.15.
  • Bumps Ruff from 0.16.7 to 0.16.8.
File Description
python/​packages/​lab/​pyproject.toml Updates pinned development-tool versions.

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Comment thread python/packages/lab/pyproject.toml
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 24, 2026 14:33 Inactive
Bumps the basics group with 2 updates in the /python/packages/lab directory: [uv](https://github.com/astral-sh/uv) and [ruff](https://github.com/astral-sh/ruff).


Updates `uv` from 0.12.13 to 0.12.15
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.13...0.12.15)

Updates `ruff` from 0.16.7 to 0.16.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.7...0.16.8)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.16.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: basics
- dependency-name: uv
  dependency-version: 0.12.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: basics
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Python: build(deps-dev): bump the basics group across 1 directory with 2 updates build(deps-dev): bump the basics group across 1 directory with 2 updates Sep 24, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/python/packages/lab/basics-d916921fa5 branch from 4d715f2 to 031752a Compare September 24, 2026 14:35
@dependabot
dependabot Bot temporarily deployed to github-app-auth September 24, 2026 14:35 Inactive
@eavanvalkenburg

Copy link
Copy Markdown
Member

Copilot fix the uv lock, and make sure the lab pyproject is in sync, and then also update that lock

Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>

Copilot AI commented Sep 24, 2026

Copy link
Copy Markdown
Contributor

Copilot fix the uv lock, and make sure the lab pyproject is in sync, and then also update that lock

Regenerated python/packages/lab/uv.lock with uv lock — pyproject.toml already pins uv==0.12.15 and ruff==0.16.8, and the lockfile now matches (verified with uv lock --check). See b66aff2.

@github-code-quality

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: Python

Python / code-coverage/python

The overall line coverage in commit b66aff2 in the dependabot/pip/pytho... branch is 91%. Line coverage data for the main branch is not yet available.

Show a line coverage summary of the most covered files.
File main dependabot/pip/pytho... b66aff2 +/-
packages/core/a...ework/_tools.py — 96% —
packages/openai..._chat_client.py — 95% —
packages/core/a...work/_skills.py — 95% —
packages/core/a.../_compaction.py — 95% —
packages/core/a...ework/_types.py — 93% —
packages/core/a...ork/_vectors.py — 93% —
packages/core/a...bservability.py — 93% —
packages/core/a...amework/_mcp.py — 92% —
packages/ag-ui/...i/_agent_run.py — 89% —
packages/core/a...ork/security.py — 89% —

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot Current main already contains the intended uv/ruff pins, so the remaining net diff now downgrades huggingface-hub in python/packages/lab/uv.lock from 1.32.0 to 1.31.0 and removes its tomli metadata, undoing #8728. Please update the branch from current main and regenerate the Lab lockfile. cc Dependabot (@dependabot)

…/packages/lab/basics-d916921fa5

Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com>

Copilot AI commented Sep 28, 2026

Copy link
Copy Markdown
Contributor

Copilot Current main already contains the intended uv/ruff pins, so the remaining net diff now downgrades huggingface-hub in python/packages/lab/uv.lock from 1.32.0 to 1.31.0 and removes it...

Merged current main into the branch (cd61888). The Lab lockfile now keeps huggingface-hub at 1.32.0 with its tomli metadata from #8728, and uv lock --check passes against python/packages/lab/pyproject.toml.

Note that the net diff versus main is now empty — the uv==0.12.15 / ruff==0.16.8 pins and matching lockfile entries are already on main, so this PR has nothing left to contribute and can be closed.

@eavanvalkenburg

Copy link
Copy Markdown
Member

Copilot Thanks for updating this. #8728 already contains the dependency updates, and this branch now has no net file changes against current main, so I am closing it as superseded. cc Dependabot (@dependabot)

auto-merge was automatically disabled September 28, 2026 12:31

Pull request was closed

@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/pip/python/packages/lab/basics-d916921fa5 branch September 28, 2026 12:31

This branch was previously deployed

1 inactive deployment
github-app-auth — cd61888b Deployed Sep 28, 2026 by Copilot via add_label #23855
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Usage: [Issues, PRs], Target: dependencies in the project lab Usage: [Issues, PRs], Target: lab packages python Usage: [Issues, PRs], Target: Python

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants