Skip to content

deps(deps): bump the uv-minor-patch group across 1 directory with 14 updates - #260

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-minor-patch-1751d75cde
Closed

deps(deps): bump the uv-minor-patch group across 1 directory with 14 updates#260
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-minor-patch-1751d75cde

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the uv-minor-patch group with 14 updates in the / directory:

Package From To
pydantic 2.13.4 2.13.5
xarray 2026.4.0 2026.7.0
numpy 2.4.6 2.5.2
rioxarray 0.22.0 0.23.0
cf-xarray 0.11.1 0.11.3
typing-extensions 4.15.0 4.16.0
s3fs 2026.4.0 2026.7.0
pytest 9.0.3 9.1.1
pyright 1.1.410 1.1.411
pre-commit 4.6.0 4.6.2
titiler-xarray 2.0.2 2.2.1
mkdocs-material 9.7.6 9.7.7
matplotlib 3.11.0 3.11.1
nbformat 5.10.4 5.11.1

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates xarray from 2026.4.0 to 2026.7.0

Release notes

Sourced from xarray's releases.

v2026.07.0

This release adds support for Dask's query-optimizing expression arrays, along with new day_of_week and day_of_year datetime accessor attributes. It also includes a number of bug fixes, notably for a performance regression in :py:meth:Coordinates.to_index, Zarr fill_value round-tripping, and excessive memory use in drop_encoding.

Thanks to the 25 contributors to this release: Davis Bennett, Deepak Cherian, Ian Hunt-Isaak, Illviljan, Jonathan Dung, Julia Signell, Justus Magin, Kai Mühlbauer, MJSHANG, Mark Harfouche, Mathias Hauser, Matt Van Horn, Matthew Rocklin, Max Jones, Maximilian Roos, Nick Hodgskin, S Anand, Spencer Clark, Sreekant Baheti, Timothy Hodson, Tom Nicholas, Vincent Gao, Wali Reheman, Wei Ji and eeshsaxena

What's Changed

... (truncated)

Commits

Updates numpy from 2.4.6 to 2.5.2

Release notes

Sourced from numpy's releases.

v2.5.2 (Aug 9, 2026)

NumPy 2.5.2 Release Notes

The NumPy 2.5.2 is a patch release that fixes bugs discovered after the 2.5.1 release. The big news is that it includes wheels for the newly released Python 3.15.0rc1.

This release supports Python versions 3.12-3.15

C API changes

PyArray_StringDTypeObject is opaque under the abi3t stable ABI

The PyArray_StringDTypeObject was accidentally exposed in NumPy 2.5 when targeting the free-threading-compatible stable ABI (Py_TARGET_ABI3T). PyArray_StringDTypeObject is now an opaque struct: extensions compiled that way cannot access its fields, since the struct layout depends on the size of the object header. Any code that accessed PyArray_StringDTypeObject fields in an abi3t build would have crashed, so we are making this API change in a bugfix release.

The NpyString allocator API remains usable by passing the descriptor object pointer, e.g. NpyString_acquire_allocator((PyArray_StringDTypeObject *)descr).

(gh-31771)

Contributors

A total of 16 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Abhijeetsingh Meena +
  • Charalampos Stratakis
  • Charles Harris
  • Chris Ninham +
  • David Woods
  • Geonho +
  • Gopu Yeshwanth Reddy +
  • Iason Krommydas
  • Ijtihed Kilani
  • Jelle Zijlstra +
  • Joren Hammudoglu
  • Kumar Aditya
  • Mike Boyle
  • Nathan Goldbaum
  • Raghuveer Devulapalli
  • Sebastian Berg

... (truncated)

Commits
  • 48fecee REL: Prepare for the NumPy 2.5.2 release (#32226)
  • ecf599c Merge pull request #32221 from charris/backport-32151
  • 3c7ac97 Merge pull request #32220 from charris/backport-32205
  • 23b30f4 BUG: avoid segfaults when legacy copyswap slot is not defined (#32151)
  • 4964ca8 TYP: isclose shape-typing fix for 2d array-likes (#32205)
  • c37ed94 MAINT: Skip limited_api tests on some platforms. (#32214)
  • 5cfd73b Merge pull request #32206 from charris/update-cibuildwheel
  • d8262bc MAINT: Update cibuildwheel to v4.2.0
  • 988d94d Merge pull request #32158 from charris/backport-32133
  • b2e4f97 BUG: avoid possible stack overflow in arraydescr_dealloc (#32133)
  • Additional commits viewable in compare view

Updates rioxarray from 0.22.0 to 0.23.0

Release notes

Sourced from rioxarray's releases.

0.23.0

What's Changed

Full Changelog: vylor/rioxarray@0.22.0...0.23.0

Changelog

Sourced from rioxarray's changelog.

0.23.0

  • ENH: Add write support for Zarr spatial and proj conventions
Commits
  • 4be23c4 DOC: Update version to 0.23
  • c0f9783 MNT: Version 0.23
  • dc21bdb TST: Update test_interpolate_na_veris for scipy 1.18 (#934)
  • f71f280 Bump actions/setup-python from 6 to 7 (#933)
  • eb61ade MNT: several updates to pyproject.toml, ignore uv.lock (#927)
  • cdc1092 Bump actions/checkout from 6 to 7 (#930)
  • 403caf2 Bump codecov/codecov-action from 6 to 7 (#928)
  • 67e7b63 DOC: Add missing ipython docs dependency (#926)
  • 43de28c Fix various documentation errors and warnings (#925)
  • 90fc4af Bump mamba-org/setup-micromamba from 2 to 3 (#922)
  • Additional commits viewable in compare view

Updates cf-xarray from 0.11.1 to 0.11.3

Release notes

Sourced from cf-xarray's releases.

v0.11.3

What's Changed

Full Changelog: xarray-contrib/cf-xarray@v0.11.2...v0.11.3

v0.11.2

More claude powered perf fixes

What's Changed

Full Changelog: xarray-contrib/cf-xarray@v0.11.1...v0.11.2

Commits
  • 09b5701 Include UGRID topology vars when subsetting with .cf (#648)
  • 730f59d Bump codecov/codecov-action from 6.0.0 to 6.0.1 (#643)
  • 09a675e Bump idna from 3.10 to 3.15 (#641)
  • a62696e Bump starlette from 0.49.1 to 1.0.1 (#644)
  • 5d01fd2 Avoid DataArray construction when scanning for cell_measures (#647)
  • 93511ee Memoize CRS construction in grid_mappings
  • 87fa240 Include topology vars when subsetting with .cf (#640)
  • See full diff in compare view

Updates typing-extensions from 4.15.0 to 4.16.0

Release notes

Sourced from typing-extensions's releases.

4.16.0

No changes since 4.16.0rc2.

Changes since 4.15.0:

  • Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
  • Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
  • Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
  • Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
  • Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
  • Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
  • Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
  • Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
  • Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
  • Add support for pickling sentinels.
  • Sentinels now preserve their identity when copied or deep-copied.
  • Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
  • The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
  • Deprecate arbitrary attribute assignments to sentinels.
  • Deprecate subclassing sentinels.
  • Add support for Python 3.15.
  • Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

4.16.0rc2

Changes since 4.16.0rc1:

  • Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

Changes since 4.15.0:

  • Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
  • Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
  • Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
  • Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
  • Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
  • Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
  • Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
  • Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
  • Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
  • Add support for pickling sentinels.
  • Sentinels now preserve their identity when copied or deep-copied.
  • Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
  • The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
  • Deprecate arbitrary attribute assignments to sentinels.
  • Deprecate subclassing sentinels.
  • Add support for Python 3.15.

4.16.0rc1

  • Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
  • Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.

... (truncated)

Changelog

Sourced from typing-extensions's changelog.

Release 4.16.0 (July 2, 2025)

No user-facing changes since 4.16.0rc2.

Release 4.16.0rc2 (June 25, 2026)

  • Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

Release 4.16.0rc1 (June 24, 2026)

  • Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
  • Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
  • Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
  • Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
  • Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
  • Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
  • Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
  • Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
  • Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
  • Add support for pickling sentinels.
  • Sentinels now preserve their identity when copied or deep-copied.
  • Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
  • The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
  • Deprecate arbitrary attribute assignments to sentinels.
  • Deprecate subclassing sentinels.
  • Add support for Python 3.15.
Commits

Updates s3fs from 2026.4.0 to 2026.7.0

Commits

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

  • #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
  • #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
  • #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
  • #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

  • #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

    If this is undesirable, move the fixture definition to a conftest.py file if possible.

    Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

  • #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

    See 10819 and 14011.

  • #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

    See dynamic-fixture-request-during-teardown for details.

  • #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

    These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

    See parametrize-iterators for details and suggestions.

  • #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

    See config-inicfg for more details.

  • #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits
  • cf470ec Prepare release version 9.1.1
  • e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
  • 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
  • 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
  • b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
  • 9a567e0 [automated] Update plugin list (#14617) (#14618)
  • ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
  • 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
  • 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
  • 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
  • Additional commits viewable in compare view

Updates pyright from 1.1.410 to 1.1.411

Commits

Updates pre-commit from 4.6.0 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

pre-commit v4.6.1

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

4.6.1 - 2026-07-21

Fixes

Commits
  • 9767b6c v4.6.2
  • 42ee3ff Merge pull request #3743 from pre-commit/npm-build-scripts-11-x
  • 3056619 fix language: node for hooks with build scripts and npm 11.x
  • 242ce8a v4.6.1
  • 766e550 Merge pull request #3727 from pre-commit/dedupe
  • 1558d06 Merge pull request #3726 from pre-commit/exists-faster
  • 8a1c47a avoid duplicate files in --all-files during conflict
  • 2e01c99 faster check of rev existing locally as a commit
  • 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
  • 1d811d9 Return an error for invalid --repo
  • Additional commits viewable in compare view

Updates titiler-xarray from 2.0.2 to 2.2.1

Release notes

Sourced from titiler-xarray's releases.

v2.2.1

2.2.1 (2026-07-29)

What's Changed

Full Changelog: developmentseed/titiler@2.2.0...2.2.1

v2.2.0

2.2.0 (2026-07-24)

What's Changed

New Contributors

Full Changelog: developmentseed/titiler@2.1.1...2.2.0

helm-2.1.1

No release notes provided.

v2.1.1

2.1.1 (2026-07-22)

What's Changed

Full Changelog: developmentseed/titiler@2.1.0...2.1.1

v2.1.0

2.1.0 (2026-07-20)

What's Changed

@dependabot
deps(deps): bump the uv-minor-patch group across 1 directory with 14 …
de55dea 
…updates

Bumps the uv-minor-patch group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [xarray](https://github.com/pydata/xarray) | `2026.4.0` | `2026.7.0` |
| [numpy](https://github.com/numpy/numpy) | `2.4.6` | `2.5.2` |
| [rioxarray](https://github.com/corteva/rioxarray) | `0.22.0` | `0.23.0` |
| [cf-xarray](https://github.com/xarray-contrib/cf-xarray) | `0.11.1` | `0.11.3` |
| [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` |
| [s3fs](https://github.com/fsspec/s3fs) | `2026.4.0` | `2026.7.0` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` |
| [pyright](https://github.com/RobertCraigie/pyright-python) | `1.1.410` | `1.1.411` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.0` | `4.6.2` |
| [titiler-xarray](https://github.com/developmentseed/titiler) | `2.0.2` | `2.2.1` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.6` | `9.7.7` |
| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.0` | `3.11.1` |
| [nbformat](https://github.com/jupyter/nbformat) | `5.10.4` | `5.11.1` |



Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `xarray` from 2026.4.0 to 2026.7.0
- [Release notes](https://github.com/pydata/xarray/releases)
- [Commits](pydata/xarray@v2026.04.0...v2026.07.0)

Updates `numpy` from 2.4.6 to 2.5.2
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.4.6...v2.5.2)

Updates `rioxarray` from 0.22.0 to 0.23.0
- [Release notes](https://github.com/corteva/rioxarray/releases)
- [Changelog](https://github.com/corteva/rioxarray/blob/master/docs/history.rst)
- [Commits](vylor/rioxarray@0.22.0...0.23.0)

Updates `cf-xarray` from 0.11.1 to 0.11.3
- [Release notes](https://github.com/xarray-contrib/cf-xarray/releases)
- [Commits](xarray-contrib/cf-xarray@v0.11.1...v0.11.3)

Updates `typing-extensions` from 4.15.0 to 4.16.0
- [Release notes](https://github.com/python/typing_extensions/releases)
- [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md)
- [Commits](python/typing_extensions@4.15.0...4.16.0)

Updates `s3fs` from 2026.4.0 to 2026.7.0
- [Changelog](https://github.com/fsspec/s3fs/blob/main/release-procedure.md)
- [Commits](fsspec/s3fs@2026.4.0...2026.7.0)

Updates `pytest` from 9.0.3 to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.3...9.1.1)

Updates `pyright` from 1.1.410 to 1.1.411
- [Release notes](https://github.com/RobertCraigie/pyright-python/releases)
- [Commits](RobertCraigie/pyright-python@v1.1.410...v1.1.411)

Updates `pre-commit` from 4.6.0 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.0...v4.6.2)

Updates `titiler-xarray` from 2.0.2 to 2.2.1
- [Release notes](https://github.com/developmentseed/titiler/releases)
- [Changelog](https://github.com/developmentseed/titiler/blob/main/CHANGES.md)
- [Commits](developmentseed/titiler@2.0.2...2.2.1)

Updates `mkdocs-material` from 9.7.6 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.6...9.7.7)

Updates `matplotlib` from 3.11.0 to 3.11.1
- [Release notes](https://github.com/matplotlib/matplotlib/releases)
- [Commits](matplotlib/matplotlib@v3.11.0...v3.11.1)

Updates `nbformat` from 5.10.4 to 5.11.1
- [Release notes](https://github.com/jupyter/nbformat/releases)
- [Changelog](https://github.com/jupyter/nbformat/blob/main/CHANGELOG.md)
- [Commits](jupyter/nbformat@v5.10.4...v5.11.1)

---
updated-dependencies:
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: xarray
  dependency-version: 2026.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: numpy
  dependency-version: 2.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: rioxarray
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: cf-xarray
  dependency-version: 0.11.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: typing-extensions
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: s3fs
  dependency-version: 2026.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: pyright
  dependency-version: 1.1.411
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: titiler-xarray
  dependency-version: 2.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: matplotlib
  dependency-version: 3.11.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
- dependency-name: nbformat
  dependency-version: 5.11.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 9, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: developmentseed/data-model-developers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 9, 2026
@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Security Audit Report

View workflow run

Bandit — Static Security Analysis (Security tab)

12 issue(s) found: 12 low

✅ No issues at or above HIGH severity.

12 low issue(s) below threshold not shown in table.

pip-audit — Dependency Vulnerabilities (Security tab)

Package Version ID Fix Versions Description
tornado 6.5.7 GHSA-wwv5-g3v4-889x 6.5.8 ## Summary The CVE-2026-35536 fix added a validation loop that rejects [\x00-\x20\x3b\x7f], but only for the hardcoded
tornado 6.5.7 GHSA-8423-8fgw-73vq 6.5.8 ## Description ### Summary parse_multipart_form_data (httputil.py:34) calls data.split(b"--"+boundary+b"\r\n") **b
tornado 6.5.7 CVE-2026-82397 6.5.8 ## Summary Tornado parses application/x-www-form-urlencoded bodies with urllib.parse.parse_qs and does not pass `ma

3 vulnerability/vulnerabilities found (3 fixable) across 1 package(s).

Result: ❌ Blocking issues found — see details above.

@lhoupert lhoupert mentioned this pull request Sep 10, 2026
Merged
1 task done
lhoupert added a commit that referenced this pull request Sep 10, 2026
@lhoupert @claude
deps: bump Python dependencies and pinned GitHub Actions (#264)
86202d7 
* deps: bump all Python dependencies to latest

Refresh the whole `uv.lock` with `uv lock --upgrade`, superseding the open
Dependabot PRs #260, #259, #255, #252, #241, #234, #228 and #227. pyright
1.1.414 narrows the `MISSING` sentinel more precisely than 1.1.410 did, so two
call sites gain the same `reportArgumentType` ignore the neighbouring line
already carries.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JEbpfA8CPcBQJzMpVJBViF

* ci(deps): bump pinned GitHub Actions

Supersedes Dependabot PR #225. Same SHAs it proposed, with the two stale
`# v6` comments on `actions/setup-python` corrected to `# v7.0.0`.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01JEbpfA8CPcBQJzMpVJBViF

---------

Co-authored-by: Claude Opus 5 <[email protected]>
@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 10, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/uv-minor-patch-1751d75cde branch September 10, 2026 15:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants