Skip to content

deps: update numerical and contributor dependencies - #106

Merged
stefan-jansen merged 6 commits into
mainfrom
dependabot/uv/python-dependencies-f2631800de
Oct 25, 2026
Merged

deps: update numerical and contributor dependencies#106
stefan-jansen merged 6 commits into
mainfrom
dependabot/uv/python-dependencies-f2631800de

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited by stefan-jansen
Loading

Copy link
Copy Markdown
Contributor

Update the numerical and contributor dependency lock while retaining the original Dependabot changes and attribution. Use Hypothesis 6.170.8 to fix valid nested unique-collection generation, filelock 4.2.1 to preserve existing lock-file contents, and virtualenv 21.14.13 to fix temporary-cache seeding and Bash prompt expansion vulnerabilities. Identical public failing-base and passing-fix programs reproduce these defects; no health-check suppression or audit exception is added.

Use scikit-learn 1.9.1, the first upstream release supporting Python 3.15, after reproducing the failed 1.9.0 optional-ML installation. All 12 existing installed-wheel matrix cells now install the ML extra and import NumPy, SciPy, scikit-learn, SHAP and LightGBM. This exposed a real macOS prerequisite failure: LightGBM cannot load without libomp. Install the documented OpenMP runtime on macOS before qualifying the wheel, and document the same user prerequisite. Refresh stale published-version and Polars requirements in the existing installation guide.

Runtime source and public dependency declarations are unchanged. Installed-artifact identity, native numerical regression protection, the full supported Python/platform matrix, coverage, types, audits and documentation gates remain required at the final revision. No new package release is proposed: actual hosted wheel runtime payloads and requirement declarations match published 0.2.0.

AI assistance: Codex reviewed upstream changes, reproduced dependency and installation defects, repaired the lock and qualification workflow, and ran checks under maintainer direction. Original Dependabot attribution and release notes are retained below.

Bumps the python-dependencies group with 6 updates in the / directory:

Package From To
numpy 2.5.3 2.5.4
shap 0.53.0 0.54.1
hypothesis 6.169.0 6.170.1
ruff 0.17.0 0.17.1
pre-commit 4.6.2 4.7.0
ty 0.0.86 0.0.89

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

  • Many typing fixes and improvements,
  • A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

  • numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

  • Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

  • numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits
  • a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
  • 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
  • 91acd87 REL: Prepare for the NumPy 2.5.4 release.
  • 9cc555b Merge pull request #32956 from charris/backport-typing-1
  • e04b972 TYP: dtype[void].names: allow setting with list (#32943)
  • d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
  • 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
  • 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
  • 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
  • c7bcd2c TYP: place: widen mask (#32926)
  • Additional commits viewable in compare view

Updates shap from 0.53.0 to 0.54.1

Release notes

Sourced from shap's releases.

0.54.1

SHAP v0.54.1

Highlights

CUDA acceleration with shap-cuda

GPU support now lives in the separate shap-cuda package, providing the CUDA-accelerated backend for shap.GPUTreeExplainer. The GPU wheel workflow builds CUDA-enabled wheels and tests them on AWS GPU runners before publishing. By @​CloseChoice in shap/shap#5140.

The GPU TreeExplainer notebook has also been refreshed by @​RAMitchell in shap/shap#5220.

What's Changed

Enhancements

  • shap.plots.violin now accepts an ax argument and returns the axes, making it easier to customize plots and compose subplots. By @​adt-kmr in shap/shap#5218.

Maintenance

Documentation

New Contributors

Full Changelog: shap/shap@v0.53.0...v0.54.1

Full Changelog: shap/shap@v0.53.0...v0.54.1

Commits
  • 4f8a9c9 CI: fix versioning for releases
  • 7d48b30 ENH: add shap-cuda package and distribute via CI (#5140)
  • a7766a4 Fix typos and update deprecated API in LinearExplainer correlation notebook (...
  • 62c0ca8 DOCS: fix typos in comments, docstring and error message (#5213)
  • c11040e DOCS: Fix typos in "An introduction to explainable AI" notebook (#5225)
  • c61c426 Remove unused global-path-dependent Tree SHAP code (#5223)
  • 1b92ea0 DOCS: Refresh GPU TreeExplainer notebook (#5220)
  • 69b04e2 ENH: accept and return ax in shap.plots.violin (#5218)
  • 7072995 MAINT: Bump actions/cache from 4.3.0 to 6.1.0 (#5193)
  • 833fcab add new bundle
  • Additional commits viewable in compare view

Updates hypothesis from 6.169.0 to 6.170.1

Commits
  • 718686d Bump hypothesis version to 6.170.1 and update changelog
  • ba6c3e3 Merge pull request #4834 from Zac-HD/claude/hypothesis-4458-prototypes-nqza1f
  • 7572cd0 Bump hypothesis version to 6.170.0 and update changelog
  • 1ad039f Merge pull request #4871 from Zac-HD/claude/hypothesis-conformance-tests-c6877l
  • a03eb1b Merge pull request #4895 from TaiSakuma/add-hypothesis-awkward
  • 7219a20 Strengthen provider conformance tests and fix BytestringProvider
  • e7c0eb9 Bump hypothesis version to 6.169.4 and update changelog
  • c3705d2 Merge pull request #4898 from Arjun-Aravind/fix/unresolved-lazy-annotations
  • 6ec54d5 Bump hypothesis version to 6.169.3 and update changelog
  • 37c6420 Merge pull request #4903 from MarcoGorelli/random-seed-signature
  • Additional commits viewable in compare view

Updates ruff from 0.17.0 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Commits
  • 4683270 Bump version to 0.17.1 (#29420)
  • 3514027 [ty] Update typing conformance suite pin (#29417)
  • 8294556 Update referenced PR security-review workflow (#29237)
  • d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
  • 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
  • 83a3afc Fix dedent with multiple leading comments (#29382)
  • b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
  • d01678e [ty] Clarify object attribute write-contract rationale (#29384)
  • 355b42a [ty] Avoid writable override contracts from object (#29373)
  • e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
  • Additional commits viewable in compare view

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

Commits
  • 65bb884 v4.7.0
  • 73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
  • 860d07d don't leak GIT_* env into npm install for language: node
  • 9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
  • 9905e88 use contextlib.chdir
  • 59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
  • 2be1701 remove triple-nested withs for 3.14 coverage
  • 4c8d22a py311+
  • c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
  • f49e251 [pre-commit.ci] pre-commit autoupdate
  • Additional commits viewable in compare view

Updates ty from 0.0.86 to 0.0.89

Release notes

Sourced from ty's releases.

0.0.89

Release Notes

Released on 2026-10-16.

Core type checking

  • Added support for return type inference for unannotated functions and methods (#29253).

    Return type inference is currently disabled by default. Enable it with the analysis.return-type-inference setting in pyproject.toml:

    [tool.ty.analysis]
return-type-inference = "always"

    Or in ty.toml:

    [analysis]
return-type-inference = "always"

    Please share your feedback, especially any problems you encounter, in the return type inference feedback issue.

  • Sync vendored typeshed stubs (#29402). Typeshed diff

Bug fixes

  • Avoid a panic when negating dynamic type aliases (#29427)
  • Widen tuple literal lengths when other collection elements contain nested tuple types (#29147)
  • Report invalid Generic and Protocol arguments containing nested variadic type variables (#29146)

Performance

  • Speed up generic class-pattern narrowing by skipping impossible intersection comparisons (#29240)

Contributors

Install ty 0.0.89

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.89/ty-installer.sh | sh

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.89

Released on 2026-10-16.

Core type checking

  • Added support for return type inference for unannotated functions and methods (#29253).

    Return type inference is currently disabled by default. Enable it with the analysis.return-type-inference setting in pyproject.toml:

    [tool.ty.analysis]
return-type-inference = "always"

    Or in ty.toml:

    [analysis]
return-type-inference = "always"

    Please share your feedback, especially any problems you encounter, in the return type inference feedback issue.

  • Sync vendored typeshed stubs (#29402). Typeshed diff

Bug fixes

  • Avoid a panic when negating dynamic type aliases (#29427)
  • Widen tuple literal lengths when other collection elements contain nested tuple types (#29147)
  • Report invalid Generic and Protocol arguments containing nested variadic type variables (#29146)

Performance

  • Speed up generic class-pattern narrowing by skipping impossible intersection comparisons (#29240)

Contributors

0.0.88

Released on 2026-10-15.

Bug fixes

  • Avoid panics and hangs involving recursive type aliases and intersections (#29057)
  • Fix false invalid-mutable-override errors when overriding object attributes (#29373)

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Dependency updates python Python dependencies labels Oct 19, 2026
@dependabot dependabot Bot changed the title deps: bump the python-dependencies group with 6 updates deps: bump the python-dependencies group across 1 directory with 6 updates Oct 20, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-dependencies-f2631800de branch 3 times, most recently from 5b929f0 to 15cba53 Compare October 21, 2026 05:55
@dependabot
deps: bump the python-dependencies group across 1 directory with 6 up…
fa58dcb 
…dates

Bumps the python-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [numpy](https://github.com/numpy/numpy) | `2.5.3` | `2.5.4` |
| [shap](https://github.com/shap/shap) | `0.53.0` | `0.54.1` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.169.0` | `6.170.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.0` | `0.17.1` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.2` | `4.7.0` |
| [ty](https://github.com/astral-sh/ty) | `0.0.86` | `0.0.89` |



Updates `numpy` from 2.5.3 to 2.5.4
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.5.3...v2.5.4)

Updates `shap` from 0.53.0 to 0.54.1
- [Release notes](https://github.com/shap/shap/releases)
- [Changelog](https://github.com/shap/shap/blob/main/docs/release_notes.rst)
- [Commits](shap/shap@v0.53.0...v0.54.1)

Updates `hypothesis` from 6.169.0 to 6.170.1
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.169.0...v6.170.1)

Updates `ruff` from 0.17.0 to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.0...0.17.1)

Updates `pre-commit` from 4.6.2 to 4.7.0
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.2...v4.7.0)

Updates `ty` from 0.0.86 to 0.0.89
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.86...0.0.89)

---
updated-dependencies:
- dependency-name: hypothesis
  dependency-version: 6.170.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: numpy
  dependency-version: 2.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pre-commit
  dependency-version: 4.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: shap
  dependency-version: 0.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: ty
  dependency-version: 0.0.88
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-dependencies-f2631800de branch from 15cba53 to fa58dcb Compare October 22, 2026 03:41
@stefan-jansen
Merge remote-tracking branch 'origin/main' into dependabot/uv/python-…
381fa8a 
…dependencies-f2631800de
@stefan-jansen
fix(deps): select patched contributor dependencies
c3eae23 
Use Hypothesis 6.170.8 after reproducing 6.170.1 rejecting valid nested unique collections. Update filelock and virtualenv to their audited security fixes, verified with the same failing-base and passing-fix public workflows. Keep dependency declarations and runtime source unchanged.
@stefan-jansen stefan-jansen changed the title deps: bump the python-dependencies group across 1 directory with 6 updates deps: update numerical and contributor dependencies Oct 25, 2026
@stefan-jansen
fix(deps): close remaining virtualenv activation advisory
c3d238c 
The current dependency-review gate found GHSA-cx6f-vjhg-g3cc beyond the advisory data returned by pip-audit. Select 21.14.13 after reproducing the prompt expansion with the public CLI and confirming both prompt and temporary-cache regressions pass on the fixed version.
@stefan-jansen
fix(deps): qualify optional ML dependencies on Python 3.15
297bf27 
Use scikit-learn 1.9.1, the first upstream release with Python 3.15 support, after reproducing a locked ML install attempting an unsupported source build. Install the ML extra and import SHAP with its compiled dependencies in every existing installed-wheel matrix cell. Preserve numerical stress and artifact identity gates.
@stefan-jansen
fix(ci): install macOS OpenMP for optional ML
7506bb5 
The installed ML suite reproduced LightGBM failing to load libomp on macOS. Install the documented system runtime and import LightGBM before the full suite. Document the prerequisite and correct stale Polars and pre-publication guidance in the same installation page.
@stefan-jansen
stefan-jansen merged commit 17e252b into main Oct 25, 2026
49 checks passed
@stefan-jansen
stefan-jansen deleted the dependabot/uv/python-dependencies-f2631800de branch October 25, 2026 16:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency updates python Python dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@stefan-jansen