Skip to content

chore(deps): bump the all group with 18 updates - #204

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/all-f274349b3d
Open

chore(deps): bump the all group with 18 updates#204
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/all-f274349b3d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the all group with 18 updates:

Package From To
aiobotocore 3.9.1 3.9.2
aiohttp 3.14.4 3.14.5
earthaccess-auth 0.3.1 0.4.0
fastapi 0.141.1 0.143.0
icechunk 2.2.2 2.3.0
numpy 2.5.3 2.5.4
pydantic 2.13.5 2.14.1
xarray 2026.7.0 2026.9.0
zarr 3.4.0 3.4.1
opentelemetry-exporter-otlp-proto-http 1.45.0 1.45.1
opentelemetry-instrumentation-fastapi 0.66b0 0.66b1
opentelemetry-instrumentation-logging 0.66b0 0.66b1
opentelemetry-sdk 1.45.0 1.45.1
ipykernel 7.3.0 7.4.0
pre-commit 4.6.2 4.7.0
ruff 0.16.9 0.17.0
aws-cdk-lib 2.271.0 2.273.0
python-dotenv 1.2.3 1.2.4

Updates aiobotocore from 3.9.1 to 3.9.2

Release notes

Sourced from aiobotocore's releases.

3.9.2

  • bump botocore dependency specification to support "botocore >= 1.43.101, < 1.43.107" (#1723, #1728, #1734, #1744, #1759, #1764)
  • mirror botocore 1.43.98's StreamingChecksumBody changes: skip checksum validation when no checksum is expected, and expose the new checksum property on streaming checksum bodies (#1744)
  • register the S3_REGION_REDIRECT user-agent feature ID when AioS3RegionRedirectorv2 follows a region redirect, matching botocore 1.43.101 (#1759)
  • fix AIOHTTPSession.close() raising AssertionError: Session was never entered when called on an already-closed session (e.g. a defensive close() inside an async with block), which also masked the user's own exception (#1745)
  • remove unreachable return statements from the AioRefreshableCredentials credential properties (#1762)
Changelog

Sourced from aiobotocore's changelog.

3.9.2 (2026-09-30) ^^^^^^^^^^^^^^^^^^

  • bump botocore dependency specification to support "botocore >= 1.43.101, < 1.43.107" (#1723, #1728, #1734, #1744, #1759, #1764)
  • mirror botocore 1.43.98's StreamingChecksumBody changes: skip checksum validation when no checksum is expected, and expose the new checksum property on streaming checksum bodies (#1744)
  • register the S3_REGION_REDIRECT user-agent feature ID when AioS3RegionRedirectorv2 follows a region redirect, matching botocore 1.43.101 (#1759)
  • fix AIOHTTPSession.close() raising AssertionError: Session was never entered when called on an already-closed session (e.g. a defensive close() inside an async with block), which also masked the user's own exception (#1745)
  • remove unreachable return statements from the AioRefreshableCredentials credential properties (#1762)
Commits
  • 28f26dd Release v3.9.2 (#1765)
  • 30bda7e Bump botocore dependency specification (#1764)
  • 796ec3d build(deps): bump urllib3 from 2.7.0 to 2.8.0 in the uv group across 1 direct...
  • 0f640f6 ci: mirror non-async botocore changes in the sync; base release bumps on ship...
  • ef89cb0 fix: address Code Quality and zizmor findings in aiobotocore's own code (#1762)
  • 595bd83 Bump botocore dependency specification (#1759)
  • 090fa11 feat(evals): add a porting-stage eval that replays historical ports (#1757)
  • c9582d7 feat(evals): rebuild the check-override-drift eval on committed fixtures (#1755)
  • 28a471e chore: move Claude workflows to Opus 5.5 / Sonnet 5.5, refresh prompts and ev...
  • 36935fe test: fix race in test_waiter_table_exists (#1754)
  • Additional commits viewable in compare view

Updates aiohttp from 3.14.4 to 3.14.5
Updates earthaccess-auth from 0.3.1 to 0.4.0

Release notes

Sourced from earthaccess-auth's releases.

v0.4.0

What's Changed

New Contributors

Full Changelog: earthaccess-dev/earthaccess-auth@v0.3.1...v0.4.0

Changelog

Sourced from earthaccess-auth's changelog.

[0.4.0] - 2026-10-06

Added

  • Added adapters.icechunk.earthdata_containers_credentials(repo), which reads an open repository's virtual chunk containers and returns the authorize_virtual_chunk_access mapping for repo.reopen covering those whose bucket CMR references for Earthdata granules. Readers don't have to know which bucket holds the chunks. Containers for any other bucket get no credentials.
Commits
  • 8b46824 docs: minor formatting fixes (#13)
  • 2d94482 feat: authorize a repository's Earthdata containers from its config (#12)
  • 4a6d084 build(deps): bump the uv-dependencies group across 1 directory with 8 updates...
  • 007a3be build(deps): bump the gha-dependencies group across 1 directory with 2 update...
  • 09f4d44 chore: update pre-commit hooks (#11)
  • See full diff in compare view

Updates fastapi from 0.141.1 to 0.143.0

Release notes

Sourced from fastapi's releases.

0.143.0

Automatic OpenTelemetry exporter setup is now opt-in. If you rely on FastAPI to configure exporters from OTEL_* environment variables, set FASTAPI_OTEL_AUTO_CONFIGURE=true or use FastAPI(telemetry={"auto_configure": True}) to retain the previous behavior.

Applications that configure their own providers and exporters require no changes. FastAPI Cloud enables automatic setup for you.

Breaking Changes

  • 💥 Require opt-in for automatic OpenTelemetry exporter setup. PR #16476 by @​tiangolo.

0.142.4

Fixes

0.142.3

Fixes

  • 🐛 Cache OpenTelemetry tracers to preserve warning deduplication. PR #16468 by @​tiangolo.

Docs

Translations

Internal

... (truncated)

Commits

Updates icechunk from 2.2.2 to 2.3.0

Changelog

Sourced from icechunk's changelog.

Python Icechunk Library 2.3.0

Features

  • Requests icechunk makes to the object store now identify themselves in the User-Agent header: the product token is icechunk/<version>, chunk requests add array=<path>; chunk=<coords> and manifest requests add array=<path>. Repository.create, open and open_or_create accept attribution=Attribution(client=..., workload=..., principal=...) to add caller labels to every request (#1799, #1153). With Attribution(client="weatherlib/0.9", workload="nightly-ingest", principal="u_123"), a chunk read on S3 sends:

    aws-sdk-rust/1.3.14 os/linux lang/rust/1.98.0 weatherlib/0.9 icechunk/2.3.0 (workload=nightly-ingest; principal=u_123; array=g/temperature; chunk=0/1/2)

Fixes

  • storage_class, metadata_storage_class and chunks_storage_class now apply to the object_store backends — gcs_storage, azure_storage and s3_object_store_storage. The value is passed to the provider unchanged, so use its own names (#904, #2364).

Performance

  • Decoded virtual chunk locations no longer keep a 1 KiB decompression buffer each, which cuts memory when garbage collection and chunk statistics walk manifests with many virtual chunks (#2436).

Breaking changes

  • Rust only: the minimum supported Rust version is 1.95.0 (#2443).
  • Rust only: Repository::open, Repository::create and Repository::open_or_create take only the storage and return a RepositoryBuilder. Optional settings are set by methods on the builder, followed by .execute().await. Python and JavaScript APIs are unchanged (#2445).

Python Icechunk Library 2.3.0a1

Features

  • Garbage collection and chunk statistics warn when the open file limit is too low (#2413).
  • Garbage collection treats store throttling as back pressure. A congestion controller adapts the number of deletes in flight instead of failing the run (#2408).
  • Garbage collection stops after max_consecutive_delete_failures delete batches fail in a row. Phases that depend on a failed phase are skipped and reported in GCSummary.skipped_phases (#2405).
  • Manifest walks limit the memory of decoded manifests with a second budget, 4 GiB by default (#2407).
  • Wheels are published for free threaded Python 3.14 (#2421).

Performance

  • Session.fork on a session with no changes (the most common case) no longer writes a snapshot. This removes a full snapshot write and a repo metadata update from every fork of a clean session.
  • The snapshot a fork is based on is no longer recorded in the repo metadata.
  • Garbage collection and chunk statistics share a parallel manifest walker. Fetch, decode and per manifest work run in separate worker pools (#2404).
  • Object listing runs on a pool of tasks and deletes run on their own task. On an 8 core in-region instance against S3, listing rises from 130k to about 800k keys per second. A new max_concurrent_listings setting limits the pool (#2406).
  • The garbage collection deleter absorbs completed batches while it waits for the collector (#2415).
  • Nodes are decoded only when they are needed (#2395).

Breaking changes

  • ForkSession.flush now raises. Merge the fork back into the session that created it with Session.merge and flush that one instead. We don't expect anybody was relying on this.
Commits
  • cb52656 Release v2.3.0 (#2459)
  • 425a8df Fix flaky expire cutoff in stateful tests on Linux (#2462)
  • ea0ac5e Pin cc to 1.5.1 in the zarrs upstream build (#2456)
  • 38a3718 Fix xarray backends tests for newer xarray test layout (#2457)
  • 468004a Builder pattern for Repository::open, create and open_or_create (#2445)
  • 1791a92 Attribute object store requests in the User-Agent header (#2440)
  • 1c3d27c chore(deps): bump the actions group across 1 directory with 3 updates (#2417)
  • 9184da0 Bump Rust dependencies, raise MSRV to 1.95.0 (#2443)
  • 64970e5 chore(deps): bump the rust-dependencies group across 1 directory with 11 upda...
  • f3c74d5 ci: test zarr nightly in the upstream-dev job (#2439)
  • Additional commits viewable in compare view

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

  • Many typing fixes and improvements,
  • A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

  • numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

  • Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

  • numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits
  • a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
  • 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
  • 91acd87 REL: Prepare for the NumPy 2.5.4 release.
  • 9cc555b Merge pull request #32956 from charris/backport-typing-1
  • e04b972 TYP: dtype[void].names: allow setting with list (#32943)
  • d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
  • 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
  • 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
  • 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
  • c7bcd2c TYP: place: widen mask (#32926)
  • Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

  • Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
  • Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

... (truncated)

Commits
  • b2212c7 Prepare release v2.14.1
  • 968fb2b Fix docs conversion table
  • 6adc8b3 Support named tuples in Sequence validation
  • 7637fbc Reject out-of-range int inputs for timedelta
  • dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
  • e2456d3 Support closed and extra_items via inheritance in TypedDict
  • 317655d Harden CI security
  • 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
  • 43681ab Bump samuelcolvin/check-python-version action to v5.1
  • d6bc53a Avoid unnecessary extra dict allocation in model validation
  • Additional commits viewable in compare view

Updates xarray from 2026.7.0 to 2026.9.0

Release notes

Sourced from xarray's releases.

v2026.09.0

This release adds read support for Zarr V3 rectilinear (variable-sized) chunks, Arrow PyCapsule export for :py:class:DataArray, a new :py:meth:DataArray.plot.lines plotting method, :py:class:DataTree support in :py:func:apply_ufunc, and flox-accelerated groupby medians. Bottleneck is now disabled by default, the remaining zarr-python 2 compatibility code has been removed, and the minimum h5netcdf version is now 1.8. It also includes many bug fixes.

This is the last xarray release that will support Python 3.11. Future releases will require Python 3.12 or later.

Thanks to the 45 contributors to this release: ANIRUDDHA ADAK, Ahmet Kamer Çivi, Albert Yau, Andrew Scherer, Anirban Mandal, Aryan Singh K., Asish Kumar, Chandan P, Charles Turner, Deepak Cherian, Devraj Pal, Dipak Chaudhari, Eltsefon Mark, Evan Lyall, Illviljan, Joe Hamman, Johnson K C, Jules Chéron, Justus Magin, Kropiunig, Marcus Campbell, Mark Harfouche, Matt Van Horn, Matthew Rocklin, Matthias Schabel, Michael Niklas, Nick Hodgskin, Patrick N. Raanes, Peter Hron, Puneet Dixit, QinXi, Samuel Le Meur-Diebolt, Spencer Clark, Stanley C, Stephan Hoyer, Thomas Kluyver, Tom Nicholas, dsk0425-sketch, genrichez, hushen, imam, omsatpute61-afk, stepit, whn and ✨Sarah Z✨

What's Changed

... (truncated)

Commits
  • 2f3339b Update whats-new for v2026.09.0 release (#11641)
  • f515b4d Add LineCollection plot (#7173)
  • 7b03d82 Update release command in HOW_TO_RELEASE.md (#11640)
  • e75bcf9 Read-only support for Zarr V3 rectilinear (variable-size) chunks (#11592)
  • c125355 Add whats-new entry for scipy backend axis-reorder fix (#11639)
  • a1ded92 fix: preserve stringdtype in zarr v3 round trips (#11474)
  • 5bf7aa2 Fix axis reordering bug in scipy backend outer indexing (#11638)
  • ede38e5 Warn when explicit dims rename tuple-style DataArray coords (#11292)
  • 154bdf6 Fix str.replace(..., n=0) replacing every occurrence instead of none (#11545)
  • 1161f7b Document how to find unlimited_dims via encoding (#11618)
  • Additional commits viewable in compare view

Updates zarr from 3.4.0 to 3.4.1

Release notes

Sourced from zarr's releases.

v3.4.1

What's Changed

Dependency updates

@dependabot
chore(deps): bump the all group with 18 updates
9930267 
---
updated-dependencies:
- dependency-name: aiobotocore
  dependency-version: 3.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: earthaccess-auth
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: fastapi
  dependency-version: 0.143.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: icechunk
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: numpy
  dependency-version: 2.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: xarray
  dependency-version: 2026.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: zarr
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: opentelemetry-exporter-otlp-proto-http
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: opentelemetry-instrumentation-fastapi
  dependency-version: 0.66b1
  dependency-type: direct:production
  dependency-group: all
- dependency-name: opentelemetry-instrumentation-logging
  dependency-version: 0.66b1
  dependency-type: direct:production
  dependency-group: all
- dependency-name: opentelemetry-sdk
  dependency-version: 1.45.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: ipykernel
  dependency-version: 7.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: pre-commit
  dependency-version: 4.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: aws-cdk-lib
  dependency-version: 2.273.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 20, 2026
@github-actions github-actions Bot added the chore label Oct 20, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

chore dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@maxrjones