Bump the minor-and-patch group with 6 updates

[dependabot]

Bumps the minor-and-patch group with 6 updates:

Package	From	To
aiohttp	3.14.1	3.14.3
ruff	0.15.19	0.16.0
mypy	2.1.0	2.3.0
tox	4.56.0	4.58.0
tox-uv	1.35.2	1.36.0
pandas	3.0.3	3.0.5

Updates aiohttp from 3.14.1 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

• Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

  Related issues and pull requests on GitHub: :issue:13180.

• Fixed error message construction in the C HTTP parser -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:13222.

---

3.14.2 (2026-07-20)

Bug fixes

• Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

  Related issues and pull requests on GitHub: :issue:5303.

• Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

  Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

• 5e392ce Release v3.14.3 (#13225)
• 49f65d5 [PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...
• 240099e [PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...
• d93f30a Bump version (#13202)
• c1b9212 Release v3.14.2 (#13201)
• 380d4b5 [PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...
• e1e1bee Make llhttp method array size dynamic (#13174) (#13196)
• aa4cf29 [PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...
• 71b57b4 [PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...
• 64a03fb [PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...
• Additional commits viewable in compare view

Updates ruff from 0.15.19 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Updates mypy from 2.1.0 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

• No longer provide mypyc-accelerated wheels for macOS x86_64 [mypyc-wheels #119](mypyc/mypy_mypyc-wheels#119)

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

• Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
• Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
• Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
• Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
• Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits

• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
• 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
• 24c237d [mypyc] Improve documentation of Final (#21713)
• b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
• cbcb51a Narrow for frozendict membership check (#21709)
• af2bc0f Sync typeshed (#21707)
• Additional commits viewable in compare view

Updates tox from 4.56.0 to 4.58.0

Release notes

Sourced from tox's releases.

v4.58.0

What's Changed

• 👷 ci: run the test matrix against Python 3.15 by @​gaborbernat in tox-dev/tox#4001

Full Changelog: tox-dev/tox@4.57.2...4.58.0

v4.57.2

What's Changed

• 🐛 fix(session): fix package env failure cascade and state corruption by @​gaborbernat in tox-dev/tox#3991
• 🐛 fix(pkg): repair editable fallback and sdist-wheel root handling by @​gaborbernat in tox-dev/tox#3992
• 🐛 fix(pylock): install exactly what the lock file specifies by @​gaborbernat in tox-dev/tox#3994
• 🐛 fix(cache): self-heal wrong-shape tox-info content by @​gaborbernat in tox-dev/tox#3996
• 🐛 fix(config): rebuild loader chains per config set by @​gaborbernat in tox-dev/tox#3993
• 🐛 fix(pip): stable rendering of set options in install cache by @​gaborbernat in tox-dev/tox#3995
• 🐛 fix(pep723): honor metadata behind a BOM, fail cleanly on bad blocks by @​gaborbernat in tox-dev/tox#3997
• 🐛 fix(run): honor the fail-fast contract, resilient teardown by @​gaborbernat in tox-dev/tox#3999
• 🐛 fix(cli): honor tox c -o, clean devenv ALL error, correct provision pin by @​gaborbernat in tox-dev/tox#3998
• 🐛 fix(ux): four run-edge polish fixes by @​gaborbernat in tox-dev/tox#4000

Full Changelog: tox-dev/tox@4.57.1...4.57.2

v4.57.1

What's Changed

• Run sequentially for run-parallel -p 0 instead of at CPU count by @​chuenchen309 in tox-dev/tox#3989
• Do not let a lone quote in a set_env value swallow the marker by @​chuenchen309 in tox-dev/tox#3988

Full Changelog: tox-dev/tox@4.57.0...4.57.1

v4.57.0

What's Changed

• 💰 Surface the org itself in the FUNDING config by @​webknjaz in tox-dev/tox#3979
• Replace prettier with mdformat and yamlfmt by @​gaborbernat in tox-dev/tox#3984
• 📦 build: use test dependency group in internal envs by @​gaborbernat in tox-dev/tox#3985
• ✨ feat(python): match free-threaded and debug interpreter builds by @​chuenchen309 in tox-dev/tox#3986

New Contributors

• @​chuenchen309 made their first contribution in tox-dev/tox#3986

Full Changelog: tox-dev/tox@4.56.4...4.57.0

... (truncated)

Changelog

Sourced from tox's changelog.

Miscellaneous internal changes - 4.58.0

• Test against Python 3.15 (beta) in CI and declare its classifier - by :user:gaborbernat. (:issue:4001)

---

v4.57.2 (2026-07-21)

---

Bug fixes - 4.57.2

• Fix package environment creation failures being misreported:

  • discard the partially registered configuration on failure, so the real error surfaces instead of a spurious duplicate configuration definition;
  • report the first creation failure in definition order, not a hash-random one;
  • build the PEP 517 frontend lazily, so tox c and tox l work when pyproject.toml cannot be read. (:issue:3987)

• Fix state corruption in the environment creation machinery:

  • a failed run environment build no longer removes shared package environments other run environments still use;
  • a run environment registers with its package environment once, not twice with triple-counted usage;
  • circular depends reports the cycle as an error instead of a raw traceback;
  • Skip raised by a plugin for a package environment marks the run environment package-skipped instead of crashing with UnboundLocalError. (:issue:3991)

• Fix two packaging regressions:

  • package = editable on a build backend without PEP-660 support now falls back to editable-legacy with a warning instead of crashing, also when the project metadata is static;
  • editable and wheel environments running after an sdist-wheel environment build from the project sources again, instead of a stale temporary copy that made source edits invisible. (:issue:3992)

• An environment serving as both a run environment and a package environment now behaves predictably:

  • one defined through a [testenv:...]-style section and referenced by package_env inherits from pkgenv/env_pkg_base as documented, instead of silently keeping run environment defaults;
  • one listed in env_list while referenced as a package environment is reported as a configuration conflict up front, instead of failing late with cannot run packaging environment or silently disappearing from tox l. (:issue:3993)

• pylock.toml installs now match the lock file:

  • a package locked once per Python range installs only the version matching the environment's interpreter;
  • packages locked to a local directory, VCS repository, or archive install from that source instead of resolving the name against the package index;
  • locked hashes are verified when every entry carries one;
  • changing a pip environment variable such as PIP_INDEX_URL reinstalls, as it already did for deps.

... (truncated)

Commits

• 69e1bdc release 4.58.0
• ea8734e 👷 ci: run the test matrix against Python 3.15 (#4001)
• 2d8d5ae release 4.57.2
• b74d78b 🐛 fix(ux): four run-edge polish fixes (#4000)
• 09dad3d 🐛 fix(cli): honor tox c -o, clean devenv ALL error, correct provision pin (#3...
• fa6ec2b 🐛 fix(run): honor the fail-fast contract, resilient teardown (#3999)
• b1b0159 🐛 fix(pep723): honor metadata behind a BOM, fail cleanly on bad blocks (#3997)
• a111ec6 🐛 fix(pip): stable rendering of set options in install cache (#3995)
• e969723 🐛 fix(config): rebuild loader chains per config set (#3993)
• 6a9b6a5 🐛 fix(cache): self-heal wrong-shape tox-info content (#3996)
• Additional commits viewable in compare view

Updates tox-uv from 1.35.2 to 1.36.0

Release notes

Sourced from tox-uv's releases.

1.36.0

What's Changed

• Fix flaky na-interpreter test for skip_missing_interpreters default by @​gaborbernat in tox-dev/tox-uv#349
• Replace prettier with mdformat and yamlfmt by @​gaborbernat in tox-dev/tox-uv#356
• 👷 ci: add Python 3.15 to the test matrix by @​gaborbernat in tox-dev/tox-uv#358

Full Changelog: tox-dev/tox-uv@1.35.2...1.36.0

Commits

• 6268ef9 👷 ci: add Python 3.15 to the test matrix (#358)
• 12edb70 [pre-commit.ci] pre-commit autoupdate (#357)
• a6d24f8 Replace prettier with mdformat and yamlfmt (#356)
• 8bab275 build(deps): bump astral-sh/setup-uv from 8.3.1 to 8.3.2 (#355)
• 75c7409 build(deps): bump astral-sh/setup-uv from 8.3.0 to 8.3.1 (#354)
• a4ef4f2 [pre-commit.ci] pre-commit autoupdate (#353)
• 16203a1 build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.0 (#352)
• af040e7 [pre-commit.ci] pre-commit autoupdate (#351)
• 1a09434 💰 Surface GitHub Sponsors + thanks.dev
• 9781bb7 [pre-commit.ci] pre-commit autoupdate (#350)
• Additional commits viewable in compare view

Updates pandas from 3.0.3 to 3.0.5

Release notes

Sourced from pandas's releases.

pandas 3.0.5

We are pleased to announce the release of pandas 3.0.5. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.0.4

We are pleased to announce the release of pandas 3.0.4. This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

Pandas 3.0 supports Python 3.11 and higher. The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.0.*

Or from conda-forge

conda install -c conda-forge pandas=3.0

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• e68db09 RLS: 3.0.5
• 0697623 Backport PR #66428: DOC: update whatsnew for 3.0.5 (#66430)
• 5d846d0 Backport PR #66090 on branch 3.0.x (BLD: exclude numpy 2.5.0 when building wh...
• bef7a2b Backport PR #66169 on branch 3.0.x (CI: Fix pyarrow-nightly job (stale nightl...
• 8188eb1 RLS: 3.0.4 (#66079)
• bd35f15 [3.0.x] BUG: fix CoW issue in eval() (#66072)
• 6195872 [backport 3.0.x] BUG: anchor whole alternation in Series.str.match for PyArro...
• 70313be Backport PR #66051 on branch 3.0.x (BUG: fix regression in DataFrame setitem ...
• 57ed3e2 [backport 3.0.x] Bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#65934) (#66026)
• f9693fc [backport 3.0.x] BUG(pandas 3.0 regression): drop(index=...) doesn't accept N...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[bh2smith]

@cursor fix the failed CI job https://github.com/duneanalytics/dune-client/actions/runs/30699174477/job/91367010490?pr=215 (formatting).

[cursor]

Fixed the lint-format-types failure and pushed it to the PR branch.

• Root cause: ruff 0.16.0 now formats Python code blocks inside Markdown files by default, so README.md came under the formatter's scope for the first time. Two calls in the README examples were missing magic trailing commas (is_private=False and tags=["XP€N$IV $H1T"]), which is what make fmt-check reported.
• Fix: ran ruff format, which only touched those two lines in README.md. I verified all three steps of that job now pass locally against the bumped versions: make fmt-check (38 files formatted), make lint (all checks passed), and make types (mypy 2.3.0 --strict, no issues in 21 files). The 72 unit tests also pass.

One note on the other red check: the tests job failure is unrelated to the dependency bumps or to formatting. All 40 failures are E2E tests hitting api.dune.com and getting 401/402 responses, which is the expected result of Dependabot PRs not having access to the DUNE_API_KEY repository secret. That can't be fixed from the branch, so I left it alone.

  

[cursor]

PR Summary

Medium Risk
Ruff 0.16’s expanded defaults and Markdown formatting can break or expand CI without config changes; aiohttp/pandas patch bumps are low risk for the HTTP client library.

Overview
This PR refreshes uv.lock for a Dependabot minor-and-patch group: aiohttp 3.14.1→3.14.3, pandas 3.0.3→3.0.5, mypy 2.1.0→2.3.0, tox 4.56.0→4.58.0, tox-uv 1.35.2→1.36.0, and ruff 0.15.19→0.16.0, along with transitive bumps (e.g. ast-serialize, librt, python-discovery).

README only adds trailing commas in the CRUD example (create_query / update_query), consistent with formatter output.

The meaningful CI/dev impact is Ruff 0.16: many more rules enabled by default and Markdown Python-block formatting by default—make check / uv run ruff may surface new diagnostics or format more files unless the project pins or adjusts Ruff config. aiohttp and pandas are patch-level runtime dependency updates; mypy/tox are dev-tooling only.

^{Reviewed by Cursor Bugbot for commit 0105a6d. Configure here.}