Skip to content

deps(deps): update zarr[cast-value-rs] requirement from <3.4.0,>=3.2.0 to >=3.2.0,<3.5.0 - #273

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/zarr-cast-value-rs--gte-3.2.0-and-lt-3.5.0
Closed

deps(deps): update zarr[cast-value-rs] requirement from <3.4.0,>=3.2.0 to >=3.2.0,<3.5.0#273
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/zarr-cast-value-rs--gte-3.2.0-and-lt-3.5.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on zarr[cast-value-rs] to permit the latest version.

Release notes

Sourced from zarr[cast-value-rs]'s releases.

v3.4.0

zarr 3.4.0. Highlights are in the release blog post; the full per-change list is in the release notes. This release adds a required dependency on msgspec>=0.19.

What's Changed

... (truncated)

Changelog

Sourced from zarr[cast-value-rs]'s changelog.

3.4.0 (2026-09-15)

Features

  • JSON metadata validation now delegates to msgspec.convert for the type coercions it supports (Literal membership, int / bool strictness, list-to-tuple), replacing the per-field hand-written parse_* logic. User-defined attributes retain their existing JSON handling. A latent generator-exhaustion bug in parse_storage_transformers is also fixed. See #3285.

    As a result some metadata inputs are now parsed more strictly. The previous per-field checks compared values with ==, which accepts any numerically equal object, so a float such as 2.0 was accepted as zarr_format; it is now rejected because it is not an int. Booleans are likewise no longer accepted where an int is expected, since bool is an int subclass. Metadata that conforms to the Zarr specification is unaffected. (#4063)

  • zarr.registry.get_codec_class now raises zarr.errors.UnknownCodecError instead of KeyError when no implementation is registered for a codec, and zarr.core.config.BadConfigError instead of KeyError when the implementation named in config["codecs"][name] is not registered. zarr.registry.get_numcodec raises UnknownCodecError instead of the ValueError numcodecs raises for an unregistered Zarr format 2 codec id (numcodecs.errors.UnknownCodecError on numcodecs 0.15.1 and later). All of these are subclasses of ValueError, so except ValueError is unaffected, but except KeyError and except numcodecs.errors.UnknownCodecError are.

    These errors now name Python packages known to provide the codec, so that a user who cannot read an array learns what to install:

    An implementation for codec 'wavpack' is not available. Register one explicitly using the codec
registry (see ...), or install a Python package that registers a codec implementation with
numcodecs. Known packages supporting this codec: wavpack-numcodecs.

    The tables covering this live in src/zarr/registry.py, one per Zarr format, and include the codecs numcodecs gates behind its own optional dependencies (zfpy, pcodec, crc32c, msgpack2). Codec authors can add their published package to them.

    A codec whose from_dict raises KeyError on a malformed configuration now surfaces as zarr.errors.MetadataValidationError naming the codec and the missing key. Previously it was reported as UnknownCodecError: Unknown codec: '<configuration key>', presenting a configuration key as though it were a codec name, and on the zarr.open path a bare KeyError could be swallowed by the array-then-group fallback and reported as an unrelated group error.

    zarr.errors.UnknownCodecError is now exported from zarr.errors. (#4277)

  • zarr.create_array, Group.create_array, zarr.from_array, and the entry points built on them now accept a numpy array as the chunks or shards specification, alongside ints, tuples, and numpy integer scalars. This is new for that API: it has never accepted numpy arrays in any 3.x release, because each entry point compared the specification to the "auto" or "keep" sentinel string before normalizing it, and for a numpy array that comparison raised numpy's ambiguous-truth-value ValueError. Those sentinel checks are now guarded so array-like specifications reach the normalizer, bringing this API in line with the legacy zarr.create / zarr.array / zarr.open_array functions, which have accepted numpy arrays since 2.x. (#4329)

Bugfixes

... (truncated)

Commits
  • 292aeb4 docs: 3.4.0 release notes (#4360)
  • 4484a60 docs(blog): zarr 3.4.0 release post (#4355)
  • 4c61dcf refactor(store): polish the LocalStore rename retry from #4358 (#4359)
  • 6947dd8 fix(store): retry the LocalStore rename when the destination is busy (#4358)
  • 0de6077 fix(indexing): delegate source tokenization to Dask (#4348)
  • 34dd17c fix(indexing): validate index-array bounds during JSON loading (#4347)
  • 1f13742 test(indexing): broaden planner property coverage (#4346)
  • 8ff7cb1 fix(indexing): audit factual contracts and close validation gaps (#4345)
  • 5d60db6 fix: complete imagecodecs codec package hints (#4351)
  • ba883a5 fix(zarr-indexing): reject overflowing integer selectors (#4333)
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

Assignees

The following users could not be added as assignees: developmentseed/data-model-developers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 23, 2026
@emmanuelmathot emmanuelmathot mentioned this pull request Sep 24, 2026
Merged
3 of 4 tasks
@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot can't resolve your Python dependency files. Because of this, Dependabot cannot update this pull request.

@dependabot
dependabot Bot force-pushed the dependabot/uv/zarr-cast-value-rs--gte-3.2.0-and-lt-3.5.0 branch from 29e0847 to a2b9bdb Compare September 28, 2026 11:50
@dependabot
dependabot Bot force-pushed the dependabot/uv/zarr-cast-value-rs--gte-3.2.0-and-lt-3.5.0 branch from a2b9bdb to 36b8f0b Compare October 1, 2026 21:26
@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Security Audit Report

View workflow run

Bandit — Static Security Analysis (Security tab)

12 issue(s) found: 12 low

✅ No issues at or above HIGH severity.

12 low issue(s) below threshold not shown in table.

pip-audit — Dependency Vulnerabilities (Security tab)

Package Version ID Fix Versions Description
urllib3 2.7.0 PYSEC-2026-4177 2.8.0 ## Impact urllib3's streaming API is d
urllib3 2.7.0 PYSEC-2026-4176 2.8.0 ### Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in
urllib3 2.7.0 PYSEC-2026-4175 2.8.0 ## Impact urllib3 supports configuring TLS independently for an HTTPS proxy and the target server. proxy_ssl_context
tornado 6.5.8 GHSA-chx6-46f5-w4vp 6.5.9 An unbounded memory accumulation (decompression bomb) in tornado.curl_httpclient.CurlAsyncHTTPClient — the client-side
tornado 6.5.8 GHSA-c2m8-h5v5-343r 6.5.9 ### Summary StaticFileHandler allows an unauthenticated attacker to read arbitrary files from the server's filesystem by
tornado 6.5.8 GHSA-3hv7-mjh2-fv65 6.5.9 ## Summary HTTPServerRequest.__init__ in tornado/httputil.py parses the URL query string via parse_qs_bytes() wit
virtualenv 21.7.9 PYSEC-2026-4011 21.7.12 download_wheel() runs pip download and hands the result straight to the seeder, with nothing checking the bytes it g
virtualenv 21.7.9 PYSEC-2026-4012 21.7.11 pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while `PyEnvCfg._re
virtualenv 21.7.9 PYSEC-2026-4014 21.7.12 BatchActivator.quote() returned its input unchanged, the only activator with no escaping at all. --prompt, the `VIRT
virtualenv 21.7.9 PYSEC-2026-4013 21.7.13 The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a position tha
virtualenv 21.7.9 PYSEC-2026-4011 21.7.12 download_wheel() runs pip download and hands the result straight to the seeder, with nothing checking the bytes it g
virtualenv 21.7.9 PYSEC-2026-4012 21.7.11 ### Summary pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write() wrote values verbatim, while
virtualenv 21.7.9 PYSEC-2026-4013 21.7.13 ### Impact The generated activate (bash/zsh) and activate.fish scripts interpolate a shlex.quote-ed value into a
virtualenv 21.7.9 PYSEC-2026-4014 21.7.12 BatchActivator.quote() returned its input unchanged, the only activator with no escaping at all. --prompt, the `VIRT

14 vulnerability/vulnerabilities found (14 fixable) across 3 package(s).

Result: ❌ Blocking issues found — see details above.

@lhoupert lhoupert mentioned this pull request Oct 7, 2026
Merged
1 task done
emmanuelmathot pushed a commit that referenced this pull request Oct 12, 2026
@lhoupert @claude
chore(deps): group pending Dependabot updates (#308)
68d72fd 
* chore(deps): group pending Dependabot updates

Applies #272, #273, #284, #299, #300, #301 and #307 (except xarray,
whose 2026.9.0 breaks coarsen(...).mean(skipna=True); see
pydata/xarray#11686). Raises the urllib3, tornado and virtualenv
security floors to the patched versions.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* ci(dependabot): group major and security updates

Major bumps, requirement widenings (zarr) and security updates each
arrived as one PR per package; give them their own groups. Skip
xarray 2026.9.0 until pydata/xarray#11686 ships.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* chore(deps): bump multidict to 6.9.1

pip-audit blocks on CVE-2026-104874 in multidict 6.8.0, which fails
the security job. Raise its floor with the other security constraints.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
@dependabot @github

dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

Looks like zarr[cast-value-rs] is no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 15, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/zarr-cast-value-rs--gte-3.2.0-and-lt-3.5.0 branch October 15, 2026 08:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants