Update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
actions/upload-artifact	action	patch	v7.0.0 → v7.0.1
click (changelog)	project.dependencies	minor	8.3.1 → 8.4.1
cyclonedx-python-lib (changelog)	project.dependencies	minor	11.7.0 → 11.11.0
mypy (changelog)	dev	patch	1.20.0 → 1.20.2
pypa/gh-action-pypi-publish	action	minor	v1.13.0 → v1.14.0
pytest (changelog)	dev	minor	9.0.3 → 9.1.0
requests (changelog)	project.dependencies	minor	2.33.1 → 2.34.2
ruff (source, changelog)	dev	patch	0.15.8 → 0.15.17

---

Release Notes

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

• Update the readme with direct upload details by @​danwkennedy in #​795
• Readme: bump all the example versions to v7 by @​danwkennedy in #​796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in #​797

Full Changelog: actions/upload-artifact@v7...v7.0.1

pallets/click (click)

v8.4.1

Compare Source

Released 2026-05-21

• get_parameter_source() is available during eager callbacks and type
  conversion again. :issue:3458 :issue:3484
• Zsh completion scripts parse correctly on Windows. :issue:3277 :pr:3466
• Shell completion of Choice Enum values produces a valid completion
  result. :issue:3015
• Fix empty byte-string handling in echo. :issue:3487
• Fix closed file error with echo_via_pager. :issue:3449

v8.4.0

Compare Source

Released 2026-05-17

• :class:ParamType typing improvements. :pr:3371

  • :class:ParamType is now a generic abstract base class,
    parameterized by its converted value type.
  • :meth:~ParamType.convert return types are narrowed on all
    concrete types (str for :class:STRING, int for
    :class:INT, etc.).
  • :meth:~ParamType.to_info_dict returns specific
    :class:~typing.TypedDict subclasses instead of
    dict[str, Any].
  • :class:CompositeParamType and the number-range base are now
    generic with abstract methods.

• Refactor convert_type to extract type inference into a private
  _guess_type helper, and add :func:typing.overload signatures.
  :pr:3372

• :class:Parameter typing improvements. :pr:2805

  • :class:Parameter is now an abstract base class, making explicit
    that it cannot be instantiated directly.
  • :attr:Parameter.name is now str instead of str | None.
    When expose_value=False, the name is set to "" instead
    of None.
  • The ctx parameter of :meth:Parameter.get_error_hint is now
    typed as Context | None, matching the runtime behavior.

• Split string values from default_map for parameters with nargs > 1
  or :class:Tuple type, matching environment variable behavior.
  :issue:2745 :pr:3364

• Auto-detect type=UNPROCESSED for flag_value of non-basic types
  (not str, int, float, or bool), so programmer-provided
  Python objects like classes and enum members are passed through unchanged
  instead of being stringified. Previously type=click.UNPROCESSED had
  to be set explicitly. :issue:2012 :pr:3363

• The error hint now uses :meth:Command.get_help_option_names to pick
  non-shadowed help option names, so Try '... -h' no longer points to a
  subcommand option that shadows -h. The longest surviving name is
  shown (--help over -h) for readability. :issue:2790 :pr:3208

• Fix readline functionality on non-Windows platforms. Prompt text is now
  passed directly to readline instead of being printed separately, allowing
  proper backspace, line editing, and line wrapping behavior. :issue:2968
  :pr:2969

• Use :func:os.startfile on Windows to open URLs in :func:open_url,
  replacing the start built-in which cannot be invoked without
  shell=True. :issue:3164 :pr:3186

• Fix Fish shell completion errors when option help text contains newlines.
  :issue:3043 :pr:3126

• Add :class:NoSuchCommand exception with suggestions for misspelled
  commands. :issue:3107 :pr:3228

• Use :class:ValueError message when conversion in :class:FuncParamType would
  fail. :issue:3105 :pr:3211

• Add click.get_pager_file for file-like access to an output
  pager. :pr:1572 :pr:3405

• :func:~click.formatting.wrap_text now measures line width in visible
  characters, ignoring ANSI escape sequences. :pr:3420

• Fix :meth:HelpFormatter.write_usage emitting only a blank line when
  called without args. The usage prefix and program name are now
  written even when no arguments follow, and the trailing separator
  space is stripped so the line ends at the program name.
  :issue:3360 :pr:3434

• Show custom error messages from types when :func:prompt with
  hide_input=True fails validation, instead of always showing a
  generic message. Built-in type messages mask the input value.
  :issue:2809 :pr:3256

• Add capture parameter to :class:CliRunner with two modes: sys
  (default) and fd. fd redirects file descriptors 1 and 2
  via :func:os.dup2 so output that bypasses sys.stdout (stale stream
  references, C extensions, subprocesses, faulthandler) is captured
  with proper isolation. :issue:854 :issue:2412 :issue:2468
  :issue:2497 :issue:2761 :issue:2827 :issue:2865 :pr:3391

• Revert the 8.3.3 change that exposed the original file descriptor
  via fileno() on the redirected CliRunner streams in the default
  capture mode. os.dup2(w, sys.stdout.fileno()) calls inside a CLI no
  longer mutate the host runner's stdout, which broke Pytest's fd-level
  capture teardown. C-level consumers that need a real fd should use
  capture="fd". :issue:3384 :pr:3391

• Mark additional built-in strings with gettext() to extend translation
  coverage. :pr:2902

• Fix feature switch groups (several flag_value options sharing one
  parameter name) silently dropping an explicit default when a sibling
  option without an explicit default was declared first. Arbitration is now
  source-aware: a more explicit :class:ParameterSource always wins, and
  within ParameterSource.DEFAULT, an option that received an explicit
  default= keyword wins over a sibling whose default was auto-derived.
  The 8.3.x first-wins fallback for remaining ties was reverted to the
  pre-8.3.x last-wins fallback. :issue:3403 :pr:3404

• Fix missing space between option help text and the (DEPRECATED)
  label, and localize the option label so it matches the command label.
  The label and the DeprecationWarning reason suffix are now produced
  by shared helpers. :pr:3423

• Document short option stacking (-abc is parsed as -a -b -c) and
  clarify that multi-character short option names are not supported.
  :issue:2779 :pr:3431

v8.3.3

Compare Source

v8.3.2

Compare Source

Released 2026-04-02

• Fix handling of flag_value when is_flag=False to allow such options to be
  used without an explicit value. :issue:3084 :pr:3152
• Hide Sentinel.UNSET values as None when using lookup_default().
  :issue:3136 :pr:3199 :pr:3202 :pr:3209 :pr:3212 :pr:3224
• Prevent _NamedTextIOWrapper from closing streams owned by StreamMixer.
  :issue:824 :issue:2991 :issue:2993 :issue:3110 :pr:3139 :pr:3140
• Add comprehensive tests for CliRunner stream lifecycle, covering
  logging interaction, multi-threaded safety, and sequential invocation
  isolation. Add high-iteration stress tests behind a stress marker
  with a dedicated CI job. :pr:3139
• Fix callable flag_value being instantiated when used as a default via
  default=True. :issue:3121 :pr:3201 :pr:3213 :pr:3225

CycloneDX/cyclonedx-python-lib (cyclonedx-python-lib)

v11.11.0

Compare Source

Bug Fixes

• Protocolpropertiestype enum case 5g-aka for CycloneDX 1.7
  (#​1004,
  bc97e1c)

Features

• cryptoprimitive enum cases for CycloneDX 1.7
  (#​1002,
  788ced1)

• protocolpropertiestype enum cases for CycloneDX 1.7
  (#​1003,
  f9223d8)

v11.10.0

Compare Source

Bug Fixes

• Lossless flattening of dependency graph during JSON serialization
  (#​993,
  d0e10ca)

• Typing in contrib.bom.utils.BomDependencyGraphFlatMerger
  (#​998,
  988a937)

Documentation

• Improve docs of contrib.bom.utils.BomRefDiscriminator
  (#​996,
  9beaf5c)

Features

• Add contrib.bom.utils.BomDependencyGraphFlatMerger
  (#​997,
  78b8d8b)

• Move output.BomRefDiscriminator to contrib.bom.utils.BomRefDiscriminator
  (#​995,
  3bb87aa)

Performance Improvements

• contrib.bom.utils.bomdependencygraphflatmerger._flatten_merge
  (#​999,
  a8579b8)

v11.9.0

Compare Source

Features

• Add support for license expression details
  (#​908,
  b502381)

v11.8.0

Compare Source

Documentation

• Update CDX summary (#​951,
  752b162)

Features

• Add support CycloneDX 1.7.1 & 1.6.2 & 1.5.1
  (#​985,
  303889b)

• Pull SPDX license IDs v1.1-3.28.0
  (#​986,
  42ff044)

python/mypy (mypy)

v1.20.2

Compare Source

v1.20.1

Compare Source

• Always disable sync in SQLite cache (Ivan Levkivskyi, PR 21184)
• Temporarily skip few base64 tests (Ivan Levkivskyi, PR 21193)
• Revert dict.__or__ typeshed change (Ivan Levkivskyi, PR 21186)
• Fix narrowing for match case with variadic tuples (Shantanu, PR 21192)
• Avoid narrowing type[T] in type calls (Shantanu, PR 21174)
• Fix regression for catching empty tuple in except (Shantanu, PR 21153)
• Fix reachability for frozenset and dict view narrowing (Shantanu, PR 21151)
• Fix narrowing with chained comparison (Shantanu, PR 21150)
• Avoid narrowing to unreachable at module level (Shantanu, PR 21144)
• Allow dangerous identity comparisons to Any typed variables (Shantanu, PR 21142)
• --warn-unused-config should not be a strict flag (Ivan Levkivskyi, PR 21139)

pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)

v1.14.0

Compare Source

Audit your supply chain regularly!

✨ What's Changed

The main change in this release is that verbose and print-hash inputs are now on by default. This was contributed by @​whitequark💰 in #​397.

📝 Docs

@​woodruffw💰 updated the mentions of PEP 740 to stop implying that it might be experimental (it hasn't been for quite a while!) in #​388 and @​him2him2💰 brushed up some grammar in the README and SECURITY docs via #​395.

🛠️ Internal Updates

@​woodruffw💰 bumped sigstore and pypi-attestations in the lock file (#​391) and @​webknjaz💰 added infra for using type annotations in the project (#​381).

💪 New Contributors

• @​him2him2 made their first contribution in #​395
• @​whitequark made their first contribution in #​397

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.13.0...v1.14.0

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​facutuesca💰 and @​woodruffw💰 for helping maintain this project when I can't!

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

pytest-dev/pytest (pytest)

v9.1.0

Compare Source

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #​14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested:
  When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration).
  Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module.
  This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #​10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #​12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #​13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration,
  leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times,
  using class-level parametrize decorators,
  or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #​13946: The private config.inicfg attribute is now deprecated.
  Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #​14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

  Use the node parameter instead for fixture scoping. This enables more robust node-based
  matching instead of string prefix matching.
  If you've used nodeid=None, pass node=session instead.

  This will be removed in pytest 10.

• #​14335: The method of configuring hooks using markers, deprecated since pytest 7.2, is now scheduled to be removed in pytest 10.
  See hook-markers for more details.

• #​14434: The --pastebin option is now deprecated.
  The same functionality is now available in an external plugin, pytest-pastebin.
  See pastebin-deprecated for more details.

• #​14513: The private FixtureDef.has_location attribute is now deprecated and will be removed in pytest 10.
  See fixturedef-has-location-deprecated for details.

• #​1764: pytest.console_main is now deprecated and will be removed in pytest 10.
  It was never intended for programmatic use; use pytest.main instead.

New features

• #​12376: Added pytest.register_fixture() to register fixtures using an imperative interface.

  This is an advanced function intended for use by plugins.

  Normally, fixtures should be registered declaratively using the @pytest.fixture <pytest.fixture> decorator.
  Pytest looks for these fixture definitions during the collection phase and registers them automatically.
  For some plugin usecases the declarative interface can be cumbersome or unviable, in which case this imperative interface can be used.

• #​14023: Added --report-chars long CLI option.

• #​14371: Added --max-warnings command-line option and max_warnings configuration option to fail the test run when the number of warnings exceeds a given threshold -- by miketheman.

• #​6757: Added the assertion_text_diff_style configuration option, allowing
  string equality failures to be rendered as separate Left: and Right:
  blocks instead of ndiff output.

• #​8395: Added support for ~datetime.datetime and ~datetime.timedelta comparisons with pytest.approx. An explicit abs or rel tolerance as a ~datetime.timedelta is required and relative tolerance is not supported for datetime comparisons -- by hamza-mobeen.

Improvements in existing functionality

• #​11225: pytest.warns now shows "Regex pattern did not match" instead of "DID NOT WARN" when warnings were emitted but the match pattern did not match.

• #​11295: Improved output of --fixtures-per-test by excluding internal-implementation fixtures generated by @pytest.mark.parametrize and similar.

• #​13241: pytest.raises, pytest.warns and pytest.deprecated_call now uses ParamSpec for the type hint to the (old and not recommended) callable overload, instead of Any. This allows type checkers to raise errors when passing incorrect function parameters.
  func can now also be passed as a kwarg, which the type hint previously showed as possible but didn't accept.

• #​13862: Improved the readability of "DID NOT RAISE" error messages by using the exception type's name instead of its repr.

• #​14026: Added test coverage for compiled regex patterns in pytest.raises match parameter.

• #​14137: pytest.ScopeName is now public to allow using it in function signatures.

• #​14342: Marked yield_fixture as deprecated to type checkers using the deprecated decorator. Note it
  has originally been deprecated <yield-fixture-deprecated> in pytest 6.2 already.

• #​14373: Added type annotations for pytest.approx.

• #​14430: When using --setup-show, a space is now printed after the test name (and possibly used fixtures), to separate it from the test result.

• #​14441: Reduced the default number of gc.collect() passes in the unraisableexception plugin from 5 to 1 on CPython, where reference counting makes a single pass sufficient. PyPy retains 5 passes due to object resurrection via __del__. This can noticeably speed up test suites that trigger many pytester runs.

• #​14461: Improved assertion failure explanations for equality comparisons between mapping objects that are not dict instances.

• #​14513: The order in which fixture definitions overriding each other are resolved is now determined first by their visibility in the collection tree rather than by the order in which they are registered.

  A fixture defined for a more specific node (e.g. a module or an item) now always takes precedence over one with the same name defined for a more general node (e.g. the session), even when the more general one was registered later.
  Fixtures with non-comparable visibility or the same visibility keep the existing behavior of "last registered wins".
  This change is supposed to only affect plugins which register multiple fixtures programmatically with the same name.

• #​14524: Add official Python 3.15 support.

• #​1764: Improved argparse program name to show pytest, python -m pytest, or pytest.main() based on how pytest was invoked, making help and error messages clearer.

• #​8265: Emit a PytestCollectionWarning when a module-level __getattr__ returns None for pytestmark instead of raising AttributeError.

  Previously this caused a cryptic TypeError: got None instead of Mark error.
  Now pytest issues a helpful warning and continues collecting the module normally.

Bug fixes

• #​13192: Fixed | (pipe) not being treated as a regex meta-character that needs escaping in pytest.raises(match=...) <pytest.raises>.

• #​13484: Fixed -W option values being duplicated in Config.known_args_namespace.

• #​13626: Fixed function-scoped fixture values being kept alive after a test was interrupted by KeyboardInterrupt or early exit,
  allowing them to potentially be released more promptly.

• #​13784: Fixed capteesys producing doubled output when used with --capture=no (-s).

• #​13817: Fixed a secondary AttributeError masking the original error when an option argument fails to initialize.

• #​13884: Fixed rare internal IndexError caused by builtins.compile being overridden in client code.

• #​13885: Fixed autouse fixtures defined inside a unittest.TestCase class running even when the class is decorated with unittest.skip or unittest.skipIf -- regression since pytest 8.1.0.

• #​13917: unittest.SkipTest is no longer considered an interactive exception, i.e. pytest_exception_interact is no longer called for it.

• #​13963: Fixed subtests running with pytest-xdist when their contexts contain objects that are not JSON-serializable.

  Fixes pytest-dev/pytest-xdist#1273.

• #​14004: Fixed conftest.py fixture scoping when testpaths points outside of the rootdir <rootdir>.

  Previously, fixtures from nested conftest.py files would incorrectly leak to sibling directories
  when using a relative testpaths like ../tests/sdk.

  Conftest fixtures are now parsed during Directory <pytest.Directory> collection, using the Directory node for proper scoping.

• #​14050: Display dictionary differences in assertion failures using the original key insertion order instead of sorted order.

• #​14080: fix missing type annotations on Pytester.makepyfile and Pytester.maketxtfile methods.

• #​14114: An exception from pytest_fixture_post_finalizer no longer prevents fixtures from being torn down, causing additional errors in the following tests.

• #​14161: Fixed monkeypatch.setattr() <pytest.MonkeyPatch.setattr> leaving a stale entry on the undo stack when the underlying setattr() call fails (e.g. on immutable targets), causing an AttributeError crash during teardown.

• #​14214: Fixed -v hint in pytest.raises match diff not working because assertion verbosity was not propagated.

• #​14234: Allow pytest.HIDDEN_PARAM <hidden-param> in @pytest.mark.parametrize(ids=...) <pytest.mark.parametrize ref> typing.

• #​14248: Fixed direct parametrization causing the static fixture closure (as reflected in request.fixturenames <pytest.FixtureRequest.fixturenames>) to omit fixtures that are requested transitively from overridden fixtures.

• #​14263: Unraisable exceptions from finalizers are now collected during pytest_unconfigure, before pytest tears down the warning filters installed for the session. Previously the collection ran from a cleanup callback whose order relative to other plugins' cleanups was not guaranteed, so an active error filter could be removed before the exception surfaced and a late resource leak would pass silently. A -W error filter, or any filter matching pytest.PytestUnraisableExceptionWarning, now promotes these exceptions to failures regardless of plugin cleanup order.

• #​14377: Fixed crash in Config.get_terminal_writer when an assertion fails with the terminalreporter plugin disabled.

• #​14381: Fixed -V (short form of --version) to properly display the current version.

• #​14389: Improved pytest.raises(..., match=...) <pytest.raises> failures to suppress the mismatched exception as a cause of the resulting AssertionError.

• #​14392: Fixed a bug in pytest.raises(match=...) <pytest.raises> "fully escaped" detection, causing the regex diff display to be shown in some instances when the raw string diff display should be shown instead.

• #​14442: Fixed a regression in pytest 9.0 where --strict-markers and --strict-config specified through addopts were silently ignored.

  Note that when targeting pytest >= 9.0, it's nicer to use strict_markers and strict_config, or strict mode <strict mode>.

• #​14456: Fixed pytest.approx not recognizing types with __array_interface__ as numpy-like arrays.

• #​14474: Fixed a regression where -k and -m expressions containing both backslash characters in identifiers and string literal arguments would incorrectly raise a SyntaxError about escaping.

• #​14483: Fixed JUnit XML report incorrectly escaping high Unicode codepoints (supplementary plane characters like emoji) in test failure messages. -- by EternalRights

• #​14492: Fixed Code.getargs() incorrectly including local variable names in the returned argument tuple for functions with *args and/or **kwargs. The method was using co_flags bitmask values (4 and 8) directly as counts instead of converting them to 1 via bool(), and was not accounting for co_kwonlyargcount when var=True.

• #​3697: Logging capture now works for non-propagating loggers.
  Previously only logs which reached the root logger were captured.
  This includes caplog and the "Captured log calls" test reporting.

• #​3850: Fixed JUnit XML report: the tests attribute of the <testsuite> element now always matches the number of <testcase> elements in the file. In some cases (test passes but fails during teardown) the tests attribute would report an incorrect number of testcases in the XML file.

• #​5848: pytest_fixture_post_finalizer is no longer called extra times for the same fixture teardown in some cases.

• #​719: Fixed @pytest.mark.parametrize <pytest.mark.parametrize ref> not unpacking single-element tuple values when using a string argnames with a trailing comma (e.g., "arg,").

  The trailing comma form now correctly behaves like the tuple form ("arg",), treating argvalues as a list of tuples to unpack.

Improved documentation

• #​11022: Document safer alternatives and scope guidance for monkeypatching standard library functions.
• #​11307: Document that @pytest.hookimpl(specname=...) only works for function names starting with pytest_.
• #​13038: Document that doctests do not support parametrized fixtures, including parametrized autouse fixtures.
• #​13155: Clarified how the request fixture provides indirect parametrization values via request.param.
• #​13304: Clarified in the documentation that hook implementations defined in conftest.py files are not available to other plugins during their pytest_addoption() execution, as conftest files are discovered and loaded after builtin and third-party plugins have been initialized. However, initial conftest files themselves can implement pytest_addoption() to add their own command-line options.
• #​13902: Clarified how subtest progress markers are shown in the documentation.
• #​14012: The ini options ref section of the API Reference now specified the type and default value of every configuration option.
• #​14148: Documented a safe pytestconfig.cache access pattern when the
  cacheprovider plugin is disabled.
• #​14303: The documentation is now built with Sphinx >= 9.
• #​14465: Updated the hooks how-to page to link the newhooks.py file in pytest-xdist at tag v3.8.0 instead of an unrelated 2017-era commit under the old layout. Pointing at a tag keeps the example in sync with the version users actually install, while remaining stable when the project's main branch moves on.

Miscellaneous internal changes

• #​14582: Improved the recursion traceback test to exercise all requested traceback styles.

psf/requests (requests)

v2.34.2

Compare Source

• Moved headers input type back to Mapping to avoid invariance issues
  with MutableMapping and inferred dict types. Users calling
  Request.headers.update() may need to narrow typing in their code. (#​7441)

v2.34.1

Compare Source

Bugfixes

• Widened json input type from dict and list to Mapping
  and Sequence. (#​7436)
• Changed headers input type to MutableMapping and removed None from
  Request.headers typing to improve handling for users. (#​7431)
• Response.reason moved from str | None to str to improve handling
  for users. (#​7437)
• Fixed a bug where some bodies with custom __getattr__ implementations
  weren't being properly detected as Iterables. (#​7433)

v2.34.0

Compare Source

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by
  typeshed. Public API types should be fully compatible with mypy, pyright,
  and ty. We believe types are comprehensive but if you find issues, please
  report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for
  helping review and test the types ahead of the release. (#​7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify
  security considerations. (#​7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects
  should be able to start testing prior to its release in October. (#​7422)
• Requests added support for Python 3.14t. (#​7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing
  accidental looping when traversing the history list. (#​7328)
• Requests no longer performs greedy matching on no_proxy domains. The
  proxy_bypass implementation has been updated with CPython's fix from
  bpo-39057. (#​7427)
• Requests no longer incorrectly strips duplicate leading slashes in
  URI paths. This should address user issues with specific presigned
  URLs. Note the full fix requires urllib3 2.7.0+. (#​7315)

astral-sh/ruff (ruff)

v0.15.17

Compare Source

Released on 2026-06-11.

Preview features

• Allow human-readable names in suppression comments (#​25614)
• Fix handling of ignore comments within a disable/enable pair (#​25845)
• Prioritize human-readable names in CLI output (#​25869)
• Respect diagnostic start and parent ranges and trailing comments in ruff:ignore suppressions (#​25673)
• [flake8-async] Add trio.as_safe_channel to safe decorators (ASYNC119) (#​25775)
• [flake8-pytest-style] Also check pytest_asyncio fixtures (#​25375)
• [ruff] Ban pytest autouse fixtures (RUF076) (#​25477)
• [pyupgrade] Add from __future__ import annotations automatically (UP007, UP045) (#​23259)

Bug fixes

• Fix diagnostic when ruff:enable or ruff:disable appears where ruff:ignore is expected (#​25700)
• [pyupgrade] Preserve leading empty literals to avoid syntax errors (UP032) (#​25491)

Rule changes

• [flake8-pytest-style] Clarify diagnostic message for single parameters (PT007) (#​25592)
• [numpy] Drop autofix for np.in1d (NPY201) (#​25612)
• [pylint] Exempt Python version comparisons (PLR2004) (#​25743)

Performance

• Reserve AST Vecs with correct capacity for common cases (#​25451)

Formatter

• Preserve whitespace for Quarto cell option comments (#​25641)

CLI

• Allow rule names in ruff rule (#​25640)

Other changes

• Fix playground diagnostics scrollbars (#​25642)

Contributors

• @​SuryanshSS1011
• @​anishgirianish
• @​romero-deshaw
• @​karlhillx
• @​carljm
• @​ntBre
• @​11happy
• @​Kilo59
• @​oconnor663
• @​LeonidasZhak
• @​DavisVaughan
• @​MeGaGiGaGon
• @​jonathandung
• @​MichaReiser
• @​brianmego

v0.15.16

Compare Source

Released on 2026-06-04.

Preview features

• [flake8-async] Implement yield-in-context-manager-in-async-generator (ASYNC119) (#​24644)
• [pylint] Narrow diagnostic range and exclude cases without exception handlers (PLW0717) (#​25440)
• [ruff] Treat yield before break from a terminal loop as terminal (RUF075) (#​25447)

Bug fixes

• [eradicate] Avoid flagging ruff:ignore comments as code (ERA001) (#​25537)
• [eradicate] Fix ERA001/RUF100 conflict when noqa is on commented-out code (#​25414)
• [pyflakes] Avoid removing the format call when it would change behavior (F523) (#​25320)
• [pylint] Avoid syntax errors in invalid character replacements in f-strings before Python 3.12 (PLE2510, PLE2512, PLE2513, PLE2514, PLE2515) (#​25544)
• [pyupgrade] Avoid converting format calls with more kinds of side effects (UP032) (#​25484)

Rule changes

• [flake8-pytest-style] Avoid fixes for ambiguous argnames and argvalues combinations (PT006) (#​24776)

Performance

• Drop excess capacity from statement suites during parsing (#​25368)

Documentation

• [pydocstyle] Improve discoverability of rules enabled for each convention (#​24973)
• [ruff] Restore example code for Python versions before 3.15 (RUF017) (#​25439)
• Fix typo bin/active → bin/activate in tutorial (#​25473)

Other changes

• Shrink additional parser AST collections (#​25465)

Contributors

• @​Redslayer112
• @​koriyoshi2041
• @​George-Ogden
• @​TejasAmle
• @​anishgirianish
• @​ntBre
• @​MichaReiser
• @​loganrosen
• @​RafaelJohn9
• @​adityasingh2400

v0.15.15

Compare Source

Released on 2026-05-28.

Preview features

• Fix Markdown closing fence handling (#​25310)
• [pyflakes] Report duplicate imports in typing.TYPE_CHECKING block (F811) (#​22560)

Bug fixes

• [pyflakes] Treat function-scope bare annotations as locals per PEP 526 (F821) (#​21540)

Performance

• Avoid redundant TokenValue drops in the lexer (#​25300)
• Reduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens Vec size (#​25354)
• Use ThinVec in AST to shrink Stmt (#​25361)

Documentation

• Fix line-length example for --config option (#​25389)
• [flake8-comprehensions] Document RecursionError edge case in __len__ (C416) (#​25286)
• [mccabe] Improve example (C901) (#​25287)
• [pyupgrade] Clarify fix safety docs (UP007, UP045) (#​25288)
• [refurb] Document FURB192 exception change for empty sequences (#​25317)
• [ruff] Document false negative for user-defined types (RUF013) (#​25289)

Formatter

• Fix formatting of lambdas nested within f-strings (#​25398)

Server

• Return code action for codeAction/resolve requests that contain no or no valid URL (#​25365)

Other changes

• Expand semantic syntax errors for invalid walruses (#​25415)

Contributors

• @​chirizxc
• @​ntBre
• @​adityasingh2400
• @​charliermarsh
• @​fallintoplace
• @​martin-schlossarek
• @​MichaReiser
• @​Ruchir28

v0.15.14

Compare Source

Released on 2026-05-21.

Preview features

• [airflow] Implement airflow-task-implicit-multiple-outputs (AIR202) (#​25152)
• [flake8-use-pathlib] Mark PTH101 fix as unsafe when first argument is a class attribute annotated as int (#​25086)
• [pylint] Implement too-many-try-statements (W0717) (#​23970)
• [ruff] Add incorrect-decorator-order (RUF074) (#​23461)
• [ruff] Add fallible-context-manager (RUF075) (#​22844)

Bug fixes

• Fix lambda formatting in interpolated string expressions (#​25144)
• Treat generic frozenset annotations as immutable (#​25251)
• [flake8-type-checking] Avoid strict behavior when future-annotations are enabled (TC001, TC002, TC003) (#​25035)
• [pylint] Avoid false positives in else clause (PLR1733) ([#​25177](https://redirect.github.c

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.