Skip to content

deps(deps): bump the python-minor-patch group across 1 directory with 9 updates - #92

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-patch-bb7e8c61c0
Open

deps(deps): bump the python-minor-patch group across 1 directory with 9 updates#92
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-patch-bb7e8c61c0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 9 updates in the / directory:

Package From To
anyio 4.14.1 4.14.2
charset-normalizer 3.4.8 3.4.9
dulwich 1.2.9 1.2.12
filelock 3.29.5 3.31.1
jaraco-functools 4.5.0 4.6.0
platformdirs 4.10.0 4.10.1
ruff 0.15.20 0.15.22
tomlkit 0.15.0 0.15.1
torch 2.12.1 2.13.0

Updates anyio from 4.14.1 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates charset-normalizer from 3.4.8 to 3.4.9

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

  • Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.
Changelog

Sourced from charset-normalizer's changelog.

3.4.9 (2026-07-07)

Fixed

  • Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.
Commits
  • cc68407 Merge pull request #772 from jawah/fix-regression-fallback-path
  • 152b923 chore: release 3.4.9
  • 2bc2607 fix: unicodedecodeerror in fallback path
  • be252d7 chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#767)
  • 71c7bdd chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#768)
  • aeea391 chore(deps): bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#758)
  • See full diff in compare view

Updates dulwich from 1.2.9 to 1.2.12

Release notes

Sourced from dulwich's releases.

dulwich-1.2.12

  • SECURITY: Refuse to write a checkout entry whose leading path resolves through a symlink. `build_index_from_tree` (used by `reset_index` and thus by `clone`/`checkout`) materialized a tree in sorted order without checking leading components, so a tree pairing a symlink `link` with a descendant `link/foo` wrote `foo` through the link to an arbitrary absolute path. The same `verify_leading_dirs` guard already used by porcelain and stash is now applied here. (Jelmer Vernooij, reported by Hugh Lewis)

  • Fix `Bundle.store_objects()` silently dropping every OFS_DELTA/REF_DELTA object in the bundle's pack instead of resolving it, leaving the target object store missing most objects with no error raised. Delta resolution now goes through `PackInflater`, matching how packs are ingested elsewhere in the object store code. (theVinchi, #2312)

dulwich-1.2.11

Security and hardening

  • Apply core.protectHFS and core.protectNTFS together when selecting the checkout path-element validator. Previously only the NTFS validator ran when protectNTFS was on (the default), so on macOS an HFS+ spelling of .git using ignorable code points could pass validation and poison .git on checkout.
  • Canonicalize file modes in git archive tarballs, so a crafted tree entry can no longer carry setuid/setgid/sticky bits into an extracted file.
  • Collapse embedded whitespace in reflog messages, so a crafted multi-line commit message can no longer forge additional reflog entries with attacker-chosen SHAs.
  • Verify that a .bitmap index matches the pack it is loaded for, so a stale or swapped-in bitmap can't produce a wrong reachable-object set during fetch negotiation.
  • Parse commit-message trailers in linear time, fixing a cubic blowup where a crafted commit message could tie up CPU for minutes to hours.

Features and fixes

  • Honour core.worktree, so the working tree can live outside the parent of the control directory.
  • Porcelain functions now take an env argument, and read GIT_PROTOCOL, GIT_SSH_COMMAND/GIT_SSH when called as a library rather than only from the CLI (fixes a regression since 1.2.1 where porcelain.clone() silently ignored the SSH variables).
  • porcelain.archive() gained a remote argument.
  • Recurse into subtrees when merging trees, so non-overlapping changes under a shared directory merge cleanly.
  • Clear core.bare when setting up a submodule's working tree.

Security and hardening fixes in this release were contributed by Kartik Kenchi (@​netliomax25-code).

dulwich-1.2.10

  • Fix regression in 1.2.9 where loose objects whose content inflates to more than 8192 bytes failed to parse with `zlib.error: object header exceeds maximum size`. (Jelmer Vernooij, #2292)
Changelog

Sourced from dulwich's changelog.

1.2.12 2026-07-19

  • Fix Bundle.store_objects() silently dropping every OFS_DELTA/REF_DELTA object in the bundle's pack instead of resolving it, leaving the target object store missing most objects with no error raised. Delta resolution now goes through PackInflater, matching how packs are ingested elsewhere in the object store code. (theVinchi, #2312)

  • SECURITY: Refuse to write a checkout entry whose leading path resolves through a symlink. build_index_from_tree (used by reset_index and thus by clone/checkout) materialized a tree in sorted order without checking leading components, so a tree pairing a symlink link with a descendant link/foo wrote foo through the link to an arbitrary absolute path. The same verify_leading_dirs guard already used by porcelain and stash is now applied here. (Jelmer Vernooij, reported by Hugh Lewis)

1.2.11 2026-07-16

  • Let porcelain functions that consult the environment take an env argument overriding os.environ. As a side effect tag_create now honours GIT_COMMITTER_NAME/GIT_COMMITTER_EMAIL for the tagger line and merge/revert honour GIT_AUTHOR_NAME/GIT_AUTHOR_EMAIL, matching git. (Jelmer Vernooij)

  • Honour the core.worktree configuration option, so the working tree can live somewhere other than the parent of the control directory. Relative paths are resolved against the control directory, and core.bare and core.worktree are now rejected as incompatible. (Jelmer Vernooij, #1785)

  • Clear core.bare when setting up a submodule's working tree. submodule_update cloned the submodule bare and then set core.worktree on it, leaving a configuration git considers invalid. (Jelmer Vernooij)

  • Read GIT_PROTOCOL in porcelain rather than only in the command line interface, so clone and pull honour it when called as a library. An explicit protocol_version argument still wins. (Jelmer Vernooij)

  • Add a remote argument to porcelain.archive(), so an archive can be retrieved from a remote repository without dropping down to dulwich.client. (Jelmer Vernooij)

  • Read GIT_SSH_COMMAND/GIT_SSH in porcelain rather than only in the command line interface, so clone, fetch, ls_remote, pull and push honour them again when called as a library. Since 1.2.1 only the CLI resolved these, so porcelain.clone() silently ignored them. An explicit ssh_command argument still wins, and push and pull gained an env argument. (Jelmer Vernooij, #2209)

... (truncated)

Commits
  • c9240bc Release 1.2.12
  • fabed56 Fix Bundle.store_objects() silently dropping delta objects (#2314)
  • d845b3c validate object ids in receive-pack ref commands (#2309)
  • e6d123e catch ValueError from ref line unpack instead of checking field count
  • 551d0ef Preserve dulwich.porcelain.get_user_identity (#2313)
  • 4cc3d60 Fix Bundle.store_objects() silently dropping delta objects
  • dbf7f15 Preserve dulwich.porcelain.get_user_identity
  • e84043a client: Half-close write side after sending a fetch request (#2311)
  • 6dacf2f client: Half-close write side after sending a fetch request
  • e633cdc Refuse to write checkout entries through leading symlinks (#2308)
  • Additional commits viewable in compare view

Updates filelock from 3.29.5 to 3.31.1

Release notes

Sourced from filelock's releases.

3.31.1

What's Changed

Full Changelog: tox-dev/filelock@3.31.0...3.31.1

3.31.0

What's Changed

Full Changelog: tox-dev/filelock@3.30.3...3.31.0

3.30.3

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.30.2...3.30.3

3.30.2

What's Changed

Full Changelog: tox-dev/filelock@3.30.1...3.30.2

3.30.1

What's Changed

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.31.1 (2026-07-20)

  • A SoftFileLease acquired on one thread keeps its claim when another thread fails to acquire the same lease object, so its heartbeat carries on refreshing the marker instead of being torn down and letting a peer take the live claim. :pr:680

3.31.0 (2026-07-18)

  • Support Termux/Android, whose CPython ships without os.link and reports sys.platform == "android". import filelock and both FileLock and SoftFileLock now work there, StrictSoftFileLock reports its missing hard-link support only when acquired, and process liveness reads /proc on Android instead of PID-only checks. :pr:678
  • StrictSoftFileLock no longer lets two processes hold the lock at once under heavy contention. A holder now keeps its intent claim for the whole hold, so a contender whose directory scan races the holder's freshly linked claim can no longer miss it and win alongside it. A held lock now exposes both an intent and a held claim. :pr:678

3.30.3 (2026-07-17)

  • AsyncFileLock and AsyncSoftFileLock no longer raise a deadlock RuntimeError when a different asyncio task waits for a lock they hold; the check now scopes holders to the owning task, so only a same-task reacquire is refused. :pr:676
  • Keep both tables of contents on screen at any browser font size. The widened body column sized itself in em against the reader's font size while the breakpoints that fold the layout resolve em against a fixed 16px, so a reader whose default font is larger than 16px had the right-hand table of contents clipped off the edge. The body column now flexes instead, and the right-hand table of contents hides only at the mobile breakpoint. :pr:673
  • Color the mermaid diagrams from whichever theme is active. They previously carried a light palette baked into each diagram's source, which stayed light on a dark page. :pr:674

3.30.2 (2026-07-16)

  • Stop :class:~filelock.SoftFileLease deleting a live marker whose mode it does not implement. An unrecognized mode now names its owner instead of reading as malformed, so a record written by a newer filelock survives the grace window rather than being evicted after two seconds. :pr:672
  • Stop :class:~filelock.StrictSoftFileLock and :class:~filelock.AsyncStrictSoftFileLock calling themselves a native OS lock when they warn that they ignore lifetime; they now say a strict claim is only ever cleared by force_break(). :pr:672
  • Cover every lock type in the tutorials and how-to guides, with examples drawn from projects that use filelock, and color the mermaid diagrams. Correct the claims that StrictSoftFileLock exposes owner, that :class:~filelock.SoftFileLock evicts a strict sentinel, that :class:~filelock.ReadWriteLock requires a .db extension, and that every log record is DEBUG. :pr:672

3.30.1 (2026-07-16)

  • StrictSoftFileLock and AsyncStrictSoftFileLock no longer abort acquisition when a peer's claim vanishes as an

... (truncated)

Commits
  • c1b2e6f Release 3.31.1
  • 9fd7de5 scope a lease's claim to the context that acquired it (#680)
  • 2b3ad2c ♻️ refactor(coverage): key exclusions on probed capability (#679)
  • 3b66fdc Release 3.31.0
  • 166b2b5 ✨ feat(platform): support Termux/Android (#678)
  • 51bca89 Release 3.30.3
  • fc27700 asyncio: scope the reentrant-deadlock registry to the owning task (#676)
  • 8699861 📝 docs(mermaid): follow the light and dark theme toggle (#674)
  • 1b8da43 Keep both tables of contents on screen at any browser font size (#673)
  • 9a71d06 Release 3.30.2
  • Additional commits viewable in compare view

Updates jaraco-functools from 4.5.0 to 4.6.0

Changelog

Sourced from jaraco-functools's changelog.

v4.6.0

Features

  • Add signed wrapper to render a value with an explicit sign.
Commits
  • f7f4f3b Finalize
  • 1b61507 Merge pull request #38 from jaraco/feature/signed
  • ec615a5 Add news fragment.
  • 0169374 Add signed, a wrapper to render a value's formatter with an explicit sign
  • See full diff in compare view

Updates platformdirs from 4.10.0 to 4.10.1

Release notes

Sourced from platformdirs's releases.

4.10.1

What's Changed

Full Changelog: tox-dev/platformdirs@4.10.0...4.10.1

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.10.1 (2026-07-18)

  • Stop leaking memory on repeated Windows folder lookups. get_win_folder_via_ctypes defined a fresh ctypes structure on every call, and each one registered a pointer type that was never released; the resolver is now built once and reused. :pr:507

4.10.0 (2026-05-28)

  • Add :func:~platformdirs.user_publicshare_dir, :func:~platformdirs.user_templates_dir, :func:~platformdirs.user_fonts_dir, and :func:~platformdirs.user_preference_dir :pr:491
  • Add :func:~platformdirs.user_projects_dir backed by $XDG_PROJECTS_DIR :pr:490
  • Return only the first path from :func:~platformdirs.site_config_path on macOS when multipath is set :pr:488 - by :user:lphuc2250gma

4.9.6 (2026-04-09)

  • Fix macOS XDG variables leaking across :func:~platformdirs.user_config_dir, :func:~platformdirs.user_data_dir, and :func:~platformdirs.user_state_dir when only some are set :pr:473 - by :user:Goddesen
  • Avoid duplicate site directories in Unix :meth:~platformdirs.PlatformDirs.iter_config_dirs and :meth:~platformdirs.PlatformDirs.iter_data_dirs when use_site_for_root is active :pr:469 - by :user:viccie30

4.9.4 (2026-03-05)

  • Respect XDG_CONFIG_HOME when reading the user-dirs configuration :pr:453 - by :user:bysiber
  • Create the directory in Android :func:~platformdirs.user_log_dir and :func:~platformdirs.user_runtime_dir when ensure_exists is set :pr:452 - by :user:bysiber

4.9.2 (2026-02-16)

  • No user-facing changes

... (truncated)

Commits
  • 2e74013 Release 4.10.1
  • 3076722 📝 docs(changelog): rebuild against release history (#510)
  • 42751ce 🚀 ci(release): towncrier changelog + publish on tag push (#509)
  • d2e5756 fix(windows): stop leaking ctypes pointer types on repeated calls (#507)
  • 4f52c4f build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 in the all group (#506)
  • f68e56f build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 in the all group (#504)
  • 806560b build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 in the all group (#502)
  • 795aac4 [pre-commit.ci] pre-commit autoupdate (#503)
  • 99977a9 [pre-commit.ci] pre-commit autoupdate (#500)
  • 4bd7bb3 💰 Surface GitHub Sponsors + thanks.dev
  • Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Install ruff 0.15.22

Install prebuilt binaries via shell script

</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

0.15.21

Released on 2026-07-09.

Preview features

... (truncated)

Commits

Updates tomlkit from 0.15.0 to 0.15.1

Release notes

Sourced from tomlkit's releases.

0.15.1

What's Changed

... (truncated)

Changelog

Sourced from tomlkit's changelog.

[0.15.1] - 2026-07-17

Changed

  • Speed up membership tests (key in ...) on Container, Table and InlineTable with native __contains__ implementations, avoiding the inherited MutableMapping round-trip through __getitem__ (which resolves the value and builds an exception on every absent key). (#483)
  • Speed up parsing by making Source index-based: it now tracks an integer position over the input string instead of materializing a list of (index, char) tuples up front, so construction is O(1) and state save/restore no longer copies an iterator. (#489)
  • Speed up parsing by scanning character runs in bulk: Source.advance_while/advance_until consume a whole run of whitespace, bare-key or number characters in a single pass over the input string instead of one inc() call per character. (#490)
  • Speed up parsing of single-line strings by bulk-appending the run of ordinary characters up to the next delimiter, backslash or control character in one pass, instead of one character at a time. (#491)
  • Speed up parsing by removing the internal TOMLChar wrapper: the parser now reads plain str characters from Source and detects end-of-input positionally, avoiding a per-character object construction and method dispatch. (#492)
  • Speed up parsing by comparing StringType members by identity (is) instead of building a set on every is_basic/is_literal/is_singleline/is_multiline call, avoiding millions of enum hashes while parsing. (#502)
  • Speed up merging super tables by merging in place instead of deep-copying the growing target on every merge, turning the parse of documents with many subtables under a shared super table (e.g. consecutive [a.b.c] / [a.b.d] headers) from O(n²) into O(n). (#503)
  • Speed up membership tests (key in ...) on out-of-order tables with a native OutOfOrderTableProxy.__contains__, completing #483 for the last mapping type that still inherited the slow MutableMapping mixin (which resolves the value and builds an exception on every absent key). (#515)
  • Speed up parsing documents with many dotted keys or table headers sharing a prefix by validating out-of-order tables incrementally: each new fragment is merged into a cached validation container once, instead of re-merging (and deep-copying) every earlier fragment on each append, turning a super-cubic worst case into linear time (80 shared-prefix dotted keys: ~8 s → ~10 ms). (#479)
  • Speed up parsing of arrays that close right after a value (e.g. the files = [...] blocks that dominate lock files): the parser no longer attempts to read a value while sitting on the closing ], which previously built an UnexpectedCharError just to discard it — and constructing that exception eagerly computes a line/column by scanning the whole document, making it O(document size) per such array. (#517)
  • Speed up parsing of multiline strings by bulk-appending the run of ordinary characters — across raw line feeds and tabs — up to the next delimiter, backslash, carriage return or control character, instead of one character at a time. This extends to """/''' bodies the single-line fast path added in #491; a \r still stops the scan so \r\n stays validated and byte-for-byte preserved. (#518)
  • Speed up unwrap() (converting a parsed document to a plain dict) by resolving each key directly from the container's key map instead of iterating the inherited MutableMapping view, which rebuilt a SingleKey from the bare string for every key just to re-look-up the value. Out-of-order tables still resolve through their proxy, so their validation is unchanged. (#521)
  • Speed up rendering (as_string() / dumps()) of inline tables with many keys by precomputing the last-key and last-deleted-element indices in a single pass, instead of rescanning the remaining body on every separator comma — turning an O(n²) render into O(n). (#525)
  • Raise on malformed array element instead of dropping it, (#527)

Fixed

  • Fix string() dropping a leading newline of a multiline string on round-trip: a value beginning with a newline is now rendered with an extra leading newline (the one the parser trims after the opening delimiter) so it survives re-parsing.
  • Fix invalid serialization with a duplicated comma when removing a non-edge element from a parsed inline table. (#486)
  • Fix invalid serialization with a duplicated comma when appending or inserting into a comma-first formatted array. (

@dependabot
deps(deps): bump the python-minor-patch group across 1 directory with…
fb781d0 
… 9 updates

Bumps the python-minor-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [anyio](https://github.com/agronholm/anyio) | `4.14.1` | `4.14.2` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.8` | `3.4.9` |
| [dulwich](https://github.com/dulwich/dulwich) | `1.2.9` | `1.2.12` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.29.5` | `3.31.1` |
| [jaraco-functools](https://github.com/jaraco/jaraco.functools) | `4.5.0` | `4.6.0` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.10.0` | `4.10.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.15.22` |
| [tomlkit](https://github.com/python-poetry/tomlkit) | `0.15.0` | `0.15.1` |
| [torch](https://github.com/pytorch/pytorch) | `2.12.1` | `2.13.0` |



Updates `anyio` from 4.14.1 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.1...4.14.2)

Updates `charset-normalizer` from 3.4.8 to 3.4.9
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.8...3.4.9)

Updates `dulwich` from 1.2.9 to 1.2.12
- [Release notes](https://github.com/dulwich/dulwich/releases)
- [Changelog](https://github.com/jelmer/dulwich/blob/main/NEWS)
- [Commits](jelmer/dulwich@dulwich-1.2.9...dulwich-1.2.12)

Updates `filelock` from 3.29.5 to 3.31.1
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.29.5...3.31.1)

Updates `jaraco-functools` from 4.5.0 to 4.6.0
- [Release notes](https://github.com/jaraco/jaraco.functools/releases)
- [Changelog](https://github.com/jaraco/jaraco.functools/blob/main/NEWS.rst)
- [Commits](jaraco/jaraco.functools@v4.5.0...v4.6.0)

Updates `platformdirs` from 4.10.0 to 4.10.1
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.10.0...4.10.1)

Updates `ruff` from 0.15.20 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.15.22)

Updates `tomlkit` from 0.15.0 to 0.15.1
- [Release notes](https://github.com/python-poetry/tomlkit/releases)
- [Changelog](https://github.com/python-poetry/tomlkit/blob/master/CHANGELOG.md)
- [Commits](python-poetry/tomlkit@0.15.0...0.15.1)

Updates `torch` from 2.12.1 to 2.13.0
- [Release notes](https://github.com/pytorch/pytorch/releases)
- [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md)
- [Commits](pytorch/pytorch@v2.12.1...v2.13.0)

---
updated-dependencies:
- dependency-name: anyio
  dependency-version: 4.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: charset-normalizer
  dependency-version: 3.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: dulwich
  dependency-version: 1.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: filelock
  dependency-version: 3.31.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: jaraco-functools
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: platformdirs
  dependency-version: 4.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.15.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: tomlkit
  dependency-version: 0.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: torch
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants