Skip to content

build(deps-dev): bump the pip group with 4 updates - #36

Merged
C3EQUALZz merged 1 commit into
mainfrom
dependabot/uv/pip-4ca012f316
Oct 17, 2026
Merged

build(deps-dev): bump the pip group with 4 updates#36
C3EQUALZz merged 1 commit into
mainfrom
dependabot/uv/pip-4ca012f316

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 4 updates: mypy, ruff, semgrep and prek.

Updates mypy from 2.3.1 to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

  • You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
  • Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
  • Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

Updates ruff from 0.16.9 to 0.16.10

Release notes

Sourced from ruff's releases.

0.16.10

Release Notes

Released on 2026-10-01.

Preview features

  • Add a migration guide for categories (#28087)
  • [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

  • Reduce memory used by diagnostics (#28951)

Server

  • Avoid running uv format in untrusted workspaces (#28873)

Documentation

  • Fix links to moved changelog sections and renamed mdtests (#28941)
  • Add Python 3.15 as a supported version (#28907)
  • Add ty as a type checker example (#28906)

Other changes

  • Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

Install ruff 0.16.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.ps1 | iex"

Download ruff 0.16.10

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.10

Released on 2026-10-01.

Preview features

  • Add a migration guide for categories (#28087)
  • [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

  • Reduce memory used by diagnostics (#28951)

Server

  • Avoid running uv format in untrusted workspaces (#28873)

Documentation

  • Fix links to moved changelog sections and renamed mdtests (#28941)
  • Add Python 3.15 as a supported version (#28907)
  • Add ty as a type checker example (#28906)

Other changes

  • Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

Commits
  • 3265ed1 Bump version to 0.16.10 (#29055)
  • e786964 Authorize shared PR security-review workflow to publish findings (#29052)
  • a81291e [ty] Defer uv workspace discovery until after project configuration (#28525)
  • b6a74d2 [ty] Refresh uv project metadata when uv files change (#28529)
  • 41d30df Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)
  • 317e0a3 [ty] Bound nested callable signature display (#29049)
  • 8546752 [ty] Fix member lookup on union-bounded type variables (#29018)
  • 56180bc [ty] Specialize instance members once (#29043)
  • aa9a1ff [ty] Avoid stale I/O diagnostics when closing deleted files (#28988)
  • 2d25346 [ty] Improve unresolved-import documentation (#29039)
  • Additional commits viewable in compare view

Updates semgrep from 1.178.0 to 1.179.0

Release notes

Sourced from semgrep's releases.

Release v1.179.0

1.179.0 - 2026-10-01

### Added

  • Semgrep Supply Chain now parses Bun bun.lock lockfiles (text format, lockfileVersion 1) paired with a package.json manifest, including the dependency relationships between packages. The deprecated binary bun.lockb format is still unsupported. (SC-2419)

### Changed

  • Pro: Stabilize file processing order in inter-file analysis, which was previously arbitrary but deterministic. We believe this is very unlikely to affect findings but there is a theoretical path by which it could in certain rare cases. (stabilize)

  • c grammar update (v0.24.2):

    • No verified user-facing improvements: Agent feature assessment was not run for this grammar.

    (c-v0.24.2)

  • cpp grammar update (v0.23.4):

    • C++ target parsing now supports attributes on namespace definitions and preserves their arguments in the AST.
    • C++ target parsing now supports reference typedef declarators, including references to arrays and functions.
    • C++ target parsing now supports C++20 lambda pack init-captures such as [...values = args] and [&...values = args]. Capture-sensitive matching remains an existing limitation.
    • C++ target parsing now supports GNU inline-assembly output operands that are expressions, including pointer dereferences and array accesses.
    • C++ target parsing now supports composite type arguments in alignas declarations, such as alignas(int *), while preserving the alignment argument.
    • C++ target parsing now accepts single-digit hexadecimal escapes in string literals, such as "\xA", while retaining support for longer hexadecimal escapes.

    (cpp-v0.23.4)

  • Update the html grammar to v0.23.2. (html-v0.23.2)

  • r grammar update (v1.3.0):

    • R target parsing now supports unary and binary help expressions (?) and exponentiation written with **.
    • R target parsing correctly represents hexadecimal fractional and exponent literals, including imaginary forms, and decimal or exponent notation with the L suffix.
    • R target parsing now supports quoted namespace and slot names, such as "base"::"mean" and x@"slot".
    • R parsing preserves else branches placed on a new line within braced expressions.
    • R string parsing preserves literal newlines and excludes raw-string delimiters from string values. Short hexadecimal and Unicode escape spellings are accepted; escape decoding remains unchanged.
    • R parsing preserves omitted argument positions in calls and subscripts, and retains the indexed expression for single-index subscripts.

    (r-v1.3.0)

  • sfapex grammar update (v2.3):

    • Apex target parsing now supports null-coalescing expressions using ??, preserving both operands.
    • Apex target parsing now supports DML operations with explicit as user and as system security modes, retaining the mode, operation targets, and optional upsert key.
    • Apex target parsing now supports numeric package-version expressions such as Package.Version.1.2.
    • Apex target parsing now recognizes the webservice modifier and annotations with empty argument lists.
    • Apex target parsing now accepts whitespace within relational and shift operators, including compound shift assignments.
    • Embedded SOQL parsing in Apex now supports dotted TYPEOF operands, functions such as convertTimezone, and HAVING comparisons on grouped fields.
    • Apex target parsing now supports multiple top-level method declarations followed by executable statements in anonymous Apex.
    • Apex parsing now preserves native java: qualifiers on types and supports java:-prefixed field-access expressions.
    • Apex patterns now distinguish safe navigation (?.) from ordinary field and method access (.).

    (sfapex-v2.3)

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.179.0 - 2026-10-01

### Added

  • Semgrep Supply Chain now parses Bun bun.lock lockfiles (text format, lockfileVersion 1) paired with a package.json manifest, including the dependency relationships between packages. The deprecated binary bun.lockb format is still unsupported. (SC-2419)

### Changed

  • Pro: Stabilize file processing order in inter-file analysis, which was previously arbitrary but deterministic. We believe this is very unlikely to affect findings but there is a theoretical path by which it could in certain rare cases. (stabilize)

  • c grammar update (v0.24.2):

    • No verified user-facing improvements: Agent feature assessment was not run for this grammar.

    (c-v0.24.2)

  • cpp grammar update (v0.23.4):

    • C++ target parsing now supports attributes on namespace definitions and preserves their arguments in the AST.
    • C++ target parsing now supports reference typedef declarators, including references to arrays and functions.
    • C++ target parsing now supports C++20 lambda pack init-captures such as [...values = args] and [&...values = args]. Capture-sensitive matching remains an existing limitation.
    • C++ target parsing now supports GNU inline-assembly output operands that are expressions, including pointer dereferences and array accesses.
    • C++ target parsing now supports composite type arguments in alignas declarations, such as alignas(int *), while preserving the alignment argument.
    • C++ target parsing now accepts single-digit hexadecimal escapes in string literals, such as "\xA", while retaining support for longer hexadecimal escapes.

    (cpp-v0.23.4)

  • Update the html grammar to v0.23.2. (html-v0.23.2)

  • r grammar update (v1.3.0):

    • R target parsing now supports unary and binary help expressions (?) and exponentiation written with **.
    • R target parsing correctly represents hexadecimal fractional and exponent literals, including imaginary forms, and decimal or exponent notation with the L suffix.
    • R target parsing now supports quoted namespace and slot names, such as "base"::"mean" and x@"slot".
    • R parsing preserves else branches placed on a new line within braced expressions.
    • R string parsing preserves literal newlines and excludes raw-string delimiters from string values. Short hexadecimal and Unicode escape spellings are accepted; escape decoding remains unchanged.
    • R parsing preserves omitted argument positions in calls and subscripts, and retains the indexed expression for single-index subscripts.

    (r-v1.3.0)

  • sfapex grammar update (v2.3):

    • Apex target parsing now supports null-coalescing expressions using ??, preserving both operands.
    • Apex target parsing now supports DML operations with explicit as user and as system security modes, retaining the mode, operation targets, and optional upsert key.
    • Apex target parsing now supports numeric package-version expressions such as Package.Version.1.2.
    • Apex target parsing now recognizes the webservice modifier and annotations with empty argument lists.
    • Apex target parsing now accepts whitespace within relational and shift operators, including compound shift assignments.
    • Embedded SOQL parsing in Apex now supports dotted TYPEOF operands, functions such as convertTimezone, and HAVING comparisons on grouped fields.
    • Apex target parsing now supports multiple top-level method declarations followed by executable statements in anonymous Apex.
    • Apex parsing now preserves native java: qualifiers on types and supports java:-prefixed field-access expressions.
    • Apex patterns now distinguish safe navigation (?.) from ordinary field and method access (.).

    (sfapex-v2.3)

### Fixed

... (truncated)

Commits
  • fed9646 chore: release 1.179.0
  • a8fc986 fix(deps): bump pyjwt pin from ~=2.13.0 to >=2.15.0,<3 (semgrep/semgrep-propr...
  • 313161c chore(ci): point semgrep-compare trigger at new Argo Workflows hostname (semg...
  • b1b7d76semgrep/semgrep-proprietary#7139
  • 01c5bebsemgrep/semgrep-proprietary#7135
  • 5e3db32semgrep/semgrep-proprietary#7150
  • 3133459semgrep/semgrep-proprietary#7157
  • e44447b test: disable automatic maintenance in temporary Git repositories (semgrep/se...
  • 5b7f795semgrep/semgrep-proprietary#7155
  • 2260e46 feat(lockfile-parsers): Add supply chain parser for bun.lock (semgrep/semgrep...
  • Additional commits viewable in compare view

Updates prek from 0.5.4 to 0.5.5

Release notes

Sourced from prek's releases.

0.5.5

Release Notes

Released on 2026-10-05.

Enhancements

  • Add Nushell completion generation (#2785)
  • Add ppc64le wheel and binary builds (#2809)

Performance

  • Avoid JSON imports when querying Python interpreters (#2790)
  • Avoid duplicate diffs after hooks rewrite files (#2815)
  • Batch file reads in shebang checks (#2793)
  • Check cached hook environments concurrently (#2797)
  • Overlap Git discovery with worktree status checks (#2821)
  • Query staged additions only for case conflicts (#2802)
  • Reduce worker overhead in XML and pygrep checks (#2789)
  • Reuse Git worktree state during hook startup (#2787)
  • Reuse intent-to-add paths when saving unstaged changes (#2788)
  • Run Git queries concurrently for case-conflict checks (#2792)
  • Share Bun and Deno version queries across environments (#2795)
  • Share Lua runtime probes across hook environments (#2796)
  • Share Ruby version queries across hook environments (#2794)
  • Share mise version queries across hook environments (#2798)
  • Skip site initialization in Python interpreter probes (#2822)
  • Skip untracked files in destroyed symlink checks (#2799)
  • Skip unused file input for always-run hooks (#2813)

Bug fixes

  • Preserve staged and unstaged changes on conflicted stash restore (#2803)
  • Default missing core.fileMode in shebang checks (#2832)
  • Match protected branch patterns from the start (#2829)
  • Normalize explicit paths in shebang index checks (#2831)
  • Preserve empty trailing-whitespace character sets (#2830)
  • Reject empty files in check-json (#2826)
  • Reject trailing data in check-json (#2828)
  • Round up file sizes in check-added-large-files (#2827)

Documentation

  • Redesign the prek badge and refresh logo details (#2818)

Contributors

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.5

Released on 2026-10-05.

Enhancements

  • Add Nushell completion generation (#2785)
  • Add ppc64le wheel and binary builds (#2809)

Performance

  • Avoid JSON imports when querying Python interpreters (#2790)
  • Avoid duplicate diffs after hooks rewrite files (#2815)
  • Batch file reads in shebang checks (#2793)
  • Check cached hook environments concurrently (#2797)
  • Overlap Git discovery with worktree status checks (#2821)
  • Query staged additions only for case conflicts (#2802)
  • Reduce worker overhead in XML and pygrep checks (#2789)
  • Reuse Git worktree state during hook startup (#2787)
  • Reuse intent-to-add paths when saving unstaged changes (#2788)
  • Run Git queries concurrently for case-conflict checks (#2792)
  • Share Bun and Deno version queries across environments (#2795)
  • Share Lua runtime probes across hook environments (#2796)
  • Share Ruby version queries across hook environments (#2794)
  • Share mise version queries across hook environments (#2798)
  • Skip site initialization in Python interpreter probes (#2822)
  • Skip untracked files in destroyed symlink checks (#2799)
  • Skip unused file input for always-run hooks (#2813)

Bug fixes

  • Preserve staged and unstaged changes on conflicted stash restore (#2803)
  • Default missing core.fileMode in shebang checks (#2832)
  • Match protected branch patterns from the start (#2829)
  • Normalize explicit paths in shebang index checks (#2831)
  • Preserve empty trailing-whitespace character sets (#2830)
  • Reject empty files in check-json (#2826)
  • Reject trailing data in check-json (#2828)
  • Round up file sizes in check-added-large-files (#2827)

Documentation

  • Redesign the prek badge and refresh logo details (#2818)

Contributors

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the pip group with 4 updates
a5d1505 
Bumps the pip group with 4 updates: [mypy](https://github.com/python/mypy), [ruff](https://github.com/astral-sh/ruff), [semgrep](https://github.com/semgrep/semgrep) and [prek](https://github.com/j178/prek).


Updates `mypy` from 2.3.1 to 2.4.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.1...v2.4.0)

Updates `ruff` from 0.16.9 to 0.16.10
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/0.16.10/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.9...0.16.10)

Updates `semgrep` from 1.178.0 to 1.179.0
- [Release notes](https://github.com/semgrep/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md)
- [Commits](semgrep/semgrep@v1.178.0...v1.179.0)

Updates `prek` from 0.5.4 to 0.5.5
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.5.4...v0.5.5)

---
updated-dependencies:
- dependency-name: mypy
  dependency-version: 2.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: ruff
  dependency-version: 0.16.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: semgrep
  dependency-version: 1.179.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: prek
  dependency-version: 0.5.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 13, 2026
@C3EQUALZz
C3EQUALZz merged commit 030ef9a into main Oct 17, 2026
2 checks passed
@C3EQUALZz
C3EQUALZz deleted the dependabot/uv/pip-4ca012f316 branch October 17, 2026 09:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@C3EQUALZz