Skip to content

Python: build(deps-dev): bump the basics group across 2 directories with 2 updates - #8941

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python/basics-f3350fc970
Closed

Python: build(deps-dev): bump the basics group across 2 directories with 2 updates#8941
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python/basics-f3350fc970

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the basics group with 2 updates in the /python directory: uv and ruff.
Bumps the basics group with 1 update in the /python/packages/lab directory: uv.

Updates uv from 0.12.16 to 0.12.18

Release notes

Sourced from uv's releases.

0.12.18

Release Notes

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

  • Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
  • Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
  • Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

  • Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

  • Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#21918)

Bug fixes

  • Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#21835, #21836)
  • Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#21860, #21856)
  • Use configured dependency-metadata when checking whether installed requirements are satisfied (#21843)
  • Reject archive entries that normalize to absolute Windows paths (#21923)
  • Recognize distribution filenames and archive extensions when URL fragments contain ? (#21920)
  • Generate correctly lowercased platform tags for BSD and Haiku releases (#21853)
  • Avoid rebuilding a Windows relative path into an absolute form (#21923)

Install uv 0.12.18

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.ps1 | iex"

Download uv 0.12.18

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.18

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

  • Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
  • Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
  • Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

  • Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

  • Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#21918)

Bug fixes

  • Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#21835, #21836)
  • Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#21860, #21856)
  • Use configured dependency-metadata when checking whether installed requirements are satisfied (#21843)
  • Reject archive entries that normalize to absolute Windows paths (#21923)
  • Recognize distribution filenames and archive extensions when URL fragments contain ? (#21920)
  • Generate correctly lowercased platform tags for BSD and Haiku releases (#21853)
  • Avoid rebuilding a Windows relative path into an absolute form (#21923)

0.12.17

Released on 2026-09-18.

Enhancements

  • Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (#21780)

Preview features

  • Set minimum glibc and musl versions that universal resolutions must support with minimum-libc-version (#21651)
  • Reject pylock.toml files whose wheel filenames do not match their declared package names or versions (#20746)
  • Keep uv workspace metadata read-only unless --sync is provided (#21821)
  • Apply uv check lock modes when retrieving workspace metadata (#21821)

Performance

  • Speed up builds with many exclusion patterns by avoiding quadratic deduplication (#21650)
  • Reduce resolver allocations when deduplicating package and distribution requests (#21810)

... (truncated)

Commits

Updates ruff from 0.16.7 to 0.16.8

Release notes

Sourced from ruff's releases.

0.16.8

Release Notes

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Install ruff 0.16.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.8

Released on 2026-09-16.

Bug fixes

  • Visit functional TypedDict keyword arguments correctly (#28584)
  • [flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
  • [flake8-simplify] Preserve operand order in SIM109 fix (#27824)
  • [pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
  • [pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

  • Add support for __lazy_modules__ (#28459)
  • Recognize PEP-728 TypedDict class keywords (#28533)
  • Recognize quoted types in typing.TypeForm (#28507)
  • Support conditional assignment to __lazy_modules__ (#28491)
  • [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
  • [pyupgrade] Make the fix for UP040 always unsafe (#28526)
  • [pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
  • [ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
  • [ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

  • Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

  • [flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

Commits
  • 62914c4 Bump version to 0.16.8 (#28648)
  • c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
  • ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
  • 94efeaa [ty] Compact reachable binding and declaration histories (#28349)
  • 50020fb [ty] Avoid storing constraint nodes twice (#28375)
  • 446bb68 [ty] Compare bound-method receivers before signatures (#28384)
  • 304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
  • d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
  • fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
  • 31131db [ty] Support type[A & B] (#27124)
  • Additional commits viewable in compare view

Updates uv from 0.12.15 to 0.12.18

Release notes

Sourced from uv's releases.

0.12.18

Release Notes

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

  • Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
  • Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
  • Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

  • Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

  • Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#21918)

Bug fixes

  • Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#21835, #21836)
  • Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#21860, #21856)
  • Use configured dependency-metadata when checking whether installed requirements are satisfied (#21843)
  • Reject archive entries that normalize to absolute Windows paths (#21923)
  • Recognize distribution filenames and archive extensions when URL fragments contain ? (#21920)
  • Generate correctly lowercased platform tags for BSD and Haiku releases (#21853)
  • Avoid rebuilding a Windows relative path into an absolute form (#21923)

Install uv 0.12.18

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.18/uv-installer.ps1 | iex"

Download uv 0.12.18

File Platform Checksum
uv-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.18

Released on 2026-09-22.

This release addresses GHSA-2cv4-cqwr-gwf7, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.

Enhancements

  • Add --output-format json to uv pip install and uv pip sync, including for --dry-run and --check (#21893)
  • Add --check to uv pip install and uv pip sync to report planned changes without modifying the environment (#21844)
  • Identify failures from get_requires_for_build_* hooks correctly in build errors (#21881)

Preview features

  • Validate build requirements for uv build --no-build-isolation with --preview-features build-dependency-check; use --skip-dependency-check to opt out (#21880)

Performance

  • Speed up uv_build editable wheel creation by omitting compression from temporary wheels (#21918)

Bug fixes

  • Select package versions with wheels compatible with each Python resolution fork, correctly interpreting generic and stable-ABI wheel tags (#21835, #21836)
  • Restore project, script, and lock files when uv add, uv remove, or uv version fails or is interrupted (#21860, #21856)
  • Use configured dependency-metadata when checking whether installed requirements are satisfied (#21843)
  • Reject archive entries that normalize to absolute Windows paths (#21923)
  • Recognize distribution filenames and archive extensions when URL fragments contain ? (#21920)
  • Generate correctly lowercased platform tags for BSD and Haiku releases (#21853)
  • Avoid rebuilding a Windows relative path into an absolute form (#21923)

0.12.17

Released on 2026-09-18.

Enhancements

  • Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (#21780)

Preview features

  • Set minimum glibc and musl versions that universal resolutions must support with minimum-libc-version (#21651)
  • Reject pylock.toml files whose wheel filenames do not match their declared package names or versions (#20746)
  • Keep uv workspace metadata read-only unless --sync is provided (#21821)
  • Apply uv check lock modes when retrieving workspace metadata (#21821)

Performance

  • Speed up builds with many exclusion patterns by avoiding quadratic deduplication (#21650)
  • Reduce resolver allocations when deduplicating package and distribution requests (#21810)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the basics group across 2 directories with 2 up…
0d4112e 
…dates

Bumps the basics group with 2 updates in the /python directory: [uv](https://github.com/astral-sh/uv) and [ruff](https://github.com/astral-sh/ruff).
Bumps the basics group with 1 update in the /python/packages/lab directory: [uv](https://github.com/astral-sh/uv).


Updates `uv` from 0.12.16 to 0.12.18
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.16...0.12.18)

Updates `ruff` from 0.16.7 to 0.16.8
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.7...0.16.8)

Updates `uv` from 0.12.15 to 0.12.18
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.16...0.12.18)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.12.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: basics
- dependency-name: ruff
  dependency-version: 0.16.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: basics
- dependency-name: uv
  dependency-version: 0.12.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: basics
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI balanced review requested due to automatic review settings October 1, 2026 14:42
@dependabot dependabot Bot added dependencies Usage: [Issues, PRs], Target: dependencies in the project python Usage: [Issues, PRs], Target: Python labels Oct 1, 2026
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 1, 2026 14:42 Inactive
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 1, 2026 14:43 Inactive
@github-actions github-actions Bot changed the title build(deps-dev): bump the basics group across 2 directories with 2 updates Python: build(deps-dev): bump the basics group across 2 directories with 2 updates Oct 1, 2026
@agent-framework-automation agent-framework-automation Bot added the lab Usage: [Issues, PRs], Target: lab packages label Oct 1, 2026
Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Both frozen lockfiles retain old dependency versions and must be regenerated.

Review effort: Balanced
Findings: 3 Medium severity

Open (3)
What changed in this PR

Updates Python development tooling dependencies.

Changes:

  • Bumps uv to 0.12.18 in root and Lab.
  • Bumps root ruff to 0.16.8.
File Description
python/​pyproject.toml Updates root uv and ruff pins.
python/​packages/​lab/​pyproject.toml Updates the Lab uv pin.

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Comment thread python/packages/lab/pyproject.toml
dev = [
"agent-framework-openai>=1.14.2,<2",
"uv==0.12.15",
"uv==0.12.18",
Comment thread python/pyproject.toml
[dependency-groups]
dev = [
"uv==0.12.16",
"uv==0.12.18",
Comment thread python/pyproject.toml
"uv==0.12.18",
"flit==4.1.0",
"ruff==0.16.7",
"ruff==0.16.8",
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 2, 2026 01:31 Inactive
@dependabot @github

dependabot Bot commented on behalf of github Oct 2, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #8959.

@dependabot dependabot Bot closed this Oct 2, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/python/basics-f3350fc970 branch October 2, 2026 01:34
@dependabot
dependabot Bot temporarily deployed to github-app-auth October 2, 2026 01:34 Inactive

This branch was previously deployed

1 inactive deployment
github-app-auth — 0d4112e5 Deployed Oct 2, 2026 by dependabot[bot] via add_label #24229
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@eavanvalkenburg Eduard van Valkenburg (eavanvalkenburg) Awaiting requested review from eavanvalkenburg eavanvalkenburg is a code owner
@SergeyMenshykh SergeyMenshykh Awaiting requested review from SergeyMenshykh SergeyMenshykh is a code owner
@rogerbarreto Roger Barreto (rogerbarreto) Awaiting requested review from rogerbarreto rogerbarreto is a code owner
@westey-m westey (westey-m) Awaiting requested review from westey-m westey-m is a code owner
@moonbox3 Evan Mattson (moonbox3) Awaiting requested review from moonbox3 moonbox3 is a code owner
@jpalvarezl Jose Alvarez (jpalvarezl) Awaiting requested review from jpalvarezl jpalvarezl is a code owner
@sophia-ramsey sophia-ramsey Awaiting requested review from sophia-ramsey sophia-ramsey is a code owner
@TaoChenOSU Tao Chen (TaoChenOSU) Awaiting requested review from TaoChenOSU TaoChenOSU is a code owner
@giles17 Giles Odigwe (giles17) Awaiting requested review from giles17 giles17 is a code owner

Assignees

No one assigned

Labels

dependencies Usage: [Issues, PRs], Target: dependencies in the project lab Usage: [Issues, PRs], Target: lab packages python Usage: [Issues, PRs], Target: Python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant