Skip to content

chore(deps-dev): bump the python-dependencies group across 1 directory with 8 updates - #120

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-2c706e521b
Open

chore(deps-dev): bump the python-dependencies group across 1 directory with 8 updates#120
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-2c706e521b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown

Bumps the python-dependencies group with 8 updates in the / directory:

Package From To
aiohttp 3.14.1 3.14.3
google-genai 2.10.0 2.16.0
mcp 1.28.1 2.0.0
coverage 7.14.3 7.15.2
mypy 2.1.0 2.3.0
pip 26.1.2 26.2
pre-commit 4.6.0 4.6.1
ruff 0.15.20 0.16.1

Updates aiohttp from 3.14.1 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

  • Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

    Related issues and pull requests on GitHub: :issue:13180.

  • Fixed error message construction in the C HTTP parser -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:13222.

3.14.2 (2026-07-20)

Bug fixes

  • Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

    Related issues and pull requests on GitHub: :issue:5303.

  • Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

    Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

Updates google-genai from 2.10.0 to 2.16.0

Release notes

Sourced from google-genai's releases.

v2.16.0

2.16.0 (2026-07-29)

Features

  • Add environment resource (615b6c3)
  • Support GoogleMaps Tool grounding_types places and routing (95a335d)
  • Wire environment service into genai sdk (361292e)

Documentation

  • Communicate on upcoming updates in the next major version (f63b366)
  • Regenerate docs for 2.15.0 (7c0e1bb)

v2.15.0

2.15.0 (2026-07-28)

Features

  • [GenerateContentConfig] Add GenerationConfig.audio_transcription_config and Part.audio_transcription. (0f775f1)
  • Add flat language_codes field to AudioTranscriptionConfig. (fc282b3)
  • Allow api key + proj/location for enterprise mode (e8714ca)

Documentation

  • Regenerate docs for 2.14.0 (3d3850a)

v2.14.0

2.14.0 (2026-07-22)

Features

  • [GenerateContentConfig] Add GenerationConfig.audio_transcription_config and Part.audio_transcription. (dc3d78d)

Bug Fixes

  • Add deprecation warnings to Imagen generate_images, edit_images, generate_videos (if using prompt/text/image args), LiveConnectConfig.GenerationConfig which will be removed in the next major version (4905918)

Documentation

  • Regenerate docs for 2.13.0 (097a99e)

v2.13.0

... (truncated)

Changelog

Sourced from google-genai's changelog.

2.16.0 (2026-07-29)

Features

  • Add environment resource (615b6c3)
  • Support GoogleMaps Tool grounding_types places and routing (95a335d)
  • Wire environment service into genai sdk (361292e)

Documentation

  • Communicate on upcoming updates in the next major version (f63b366)
  • Regenerate docs for 2.15.0 (7c0e1bb)

2.15.0 (2026-07-28)

Features

  • [GenerateContentConfig] Add GenerationConfig.audio_transcription_config and Part.audio_transcription. (0f775f1)
  • Add flat language_codes field to AudioTranscriptionConfig. (fc282b3)
  • Allow api key + proj/location for enterprise mode (e8714ca)

Documentation

  • Regenerate docs for 2.14.0 (3d3850a)

2.14.0 (2026-07-22)

Features

  • [GenerateContentConfig] Add GenerationConfig.audio_transcription_config and Part.audio_transcription. (dc3d78d)

Bug Fixes

  • Add deprecation warnings to Imagen generate_images, edit_images, generate_videos (if using prompt/text/image args), LiveConnectConfig.GenerationConfig which will be removed in the next major version (4905918)

Documentation

  • Regenerate docs for 2.13.0 (097a99e)

2.13.0 (2026-07-21)

Features

... (truncated)

Commits
  • a6ffb75 chore(main): release 2.16.0 (#2789)
  • 95a335d feat: Support GoogleMaps Tool grounding_types places and routing
  • 3b321ac chore: internal change
  • 361292e feat: Wire environment service into genai sdk
  • 615b6c3 feat: add environment resource
  • f63b366 docs: Communicate on upcoming updates in the next major version
  • 7c0e1bb docs: Regenerate docs for 2.15.0
  • e56e064 chore(main): release 2.15.0 (#2767)
  • fc282b3 feat: Add flat language_codes field to AudioTranscriptionConfig.
  • 0e38b63 test: update embedding, tuning tests
  • Additional commits viewable in compare view

Updates mcp from 1.28.1 to 2.0.0

Release notes

Sourced from mcp's releases.

v2.0.0

MCP Python SDK v2 Stable Release

This is v2.0.0, the stable v2 release of the MCP Python SDK. It supports the 2026-07-28 revision of the Model Context Protocol and serves every earlier revision from the same server. pip install mcp now installs 2.x.

pip install "mcp[cli]"
# or
uv add "mcp[cli]"

Documentation Rewrite

The documentation has the full tutorial and API reference. Coming from v1? What's new in v2 is the tour of what changed and why, and the migration guide lists every breaking change with before-and-after code.

V1 Maintenance mode

v1.x is in maintenance mode and will only receive security fixes from now on The 1.x line lives on the v1.x branch, continues to receive critical bug fixes and security patches, and is documented at https://py.sdk.modelcontextprotocol.io/v1/. If your project is not ready to migrate, keep a <2 upper bound on your requirement (for example mcp>=1.28,<2).

Highlights

One SDK, both protocol eras

v2 speaks the 2026-07-28 revision (stateless requests with no handshake, server/discover, subscriptions/listen, multi-round-trip requests) and still serves every 2025-era client from the same MCPServer, over Streamable HTTP and stdio, with nothing to configure. Client(target) negotiates the version automatically.

FastMCP is now MCPServer, and there is a first-class Client

The decorator API is unchanged; the low-level Server is rebuilt around a shared dispatcher engine, and one Client object replaces v1's transport-plus-ClientSession-plus-initialize() layering. It connects to a URL, a stdio subprocess, a custom transport, or straight to a server object in memory for tests.

Multi-round-trip requests and resolver dependency injection

At 2026-07-28 the server can no longer call the client, so tools return the question instead. A Resolve(fn) parameter is filled by your function invisibly to the model and can put a question to the user; one tool body serves both eras.

Extension APIs, OpenTelemetry, and a standalone types package

Servers and clients compose protocol extensions through pluggable extension APIs (MCP Apps built in); OpenTelemetry tracing ships on by default; every protocol type is its own package, mcp-types (imported as mcp_types), published in lock-step with mcp.

Hardened stdio and auth

stdio servers keep handler subprocesses and stray prints off the wire, and stdout is diverted to stderr while serving. OAuth adds RFC 9207 issuer validation, the SEP-990 identity-assertion flow, and the client-credentials extension.

Coming from a v2 pre-release

Since the last release candidate: the per-version wire packages are private (mcp_types._v*), mcp.types is a permanent alias for mcp_types, the auth registration request model is split from the registered-client record, cancelled requests are no longer answered, and log notifications are gated on the per-request log-level opt-in at 2026-07-28. Since the betas: Client(cache=False) is now cache=None with CacheConfig() the default; Context.client_id, RFC7523OAuthClientProvider, and OAuthClientProvider(timeout=) are removed; the client-credentials providers take scope=; message_handler receives notifications and exceptions only; FileResource(is_binary=) becomes encoding; MCP_* env vars are gone with pydantic-settings; Streamable HTTP servers reject bodies over 4 MiB with HTTP 413. The migration guide covers all of it.

Known gaps

The tasks extension (SEP-2663) is not part of this release. On the client, the DPoP proof binding (SEP-1932) and the workload-identity jwt-bearer grant are not implemented; both are additive and can land in 2.x.

Feedback

... (truncated)

Commits
  • 6f69a37 Present v2 as the stable release across the README, docs, and policies (#3178)
  • 78e6fbb Serve v2 docs at the site root, with permanent per-major paths (#3176)
  • af06330 Remove unused StreamableHTTPTransport.get_session_id() (#3205)
  • 68ca87e Document the two-line release process for stable v2 (#3179)
  • c9c431b Expose the middleware chain on MCPServer and stop sending unrequested change ...
  • 528e366 Fail fast on server-to-client requests in JSON-response mode instead of hangi...
  • 27f5cc7 Remove unused mcpserver.exceptions.ValidationError (#3199)
  • 89c5e70 Gate log notifications on the per-request log-level opt-in at 2026-07-28 (#3198)
  • b61ce38 docs: fix off-by-one hl_lines in apps.md (#3196)
  • b7c9a91 Add mcp.types as a permanent alias for mcp_types (#3190)
  • Additional commits viewable in compare view

Updates coverage from 7.14.3 to 7.15.2

Release notes

Sourced from coverage's releases.

7.15.2

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

7.15.1

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare.
  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213, 2214, 2215, 2216, 2218, 2220, and 2221.

➡️  PyPI page: coverage 7.15.1. :arrow_right:  To install: python3 -m pip install coverage==7.15.1

7.15.0

Version 7.15.0 — 2026-07-02

  • Since 7.14.0, reporting commands implicitly combine parallel data files. Now those commands have a new option --keep-combined to retain the data files after combining them instead of the default, which is to delete them. Finishes issue 2198.
  • Fix: the LCOV report would incorrectly count excluded functions as uncovered, as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen.
  • When running your program, coverage now correctly sets yourmodule.__spec__.loader as strongly recommended, avoiding the deprecation warning described in issue 2208. Thanks, A5rocks.
  • Fix: with Python 3.10, running with the -I (isolated mode) option didn’t correctly omit the current directory from the module search path, as described in issue 2103. That is now fixed thanks to Ilia Sorokin.

➡️  PyPI page: coverage 7.15.0. :arrow_right:  To install: python3 -m pip install coverage==7.15.0

Changelog

Sourced from coverage's changelog.

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213 .. _pull 2214: coveragepy/coveragepy#2214 .. _pull 2215: coveragepy/coveragepy#2215 .. _pull 2216: coveragepy/coveragepy#2216 .. _pull 2218: coveragepy/coveragepy#2218 .. _pull 2220: coveragepy/coveragepy#2220 .. _pull 2221: coveragepy/coveragepy#2221 .. _pull 2224: coveragepy/coveragepy#2224

.. _changes_7-15-0:

Version 7.15.0 — 2026-07-02

  • Since 7.14.0, reporting commands implicitly combine parallel data files. Now those commands have a new option --keep-combined to retain the data files after combining them instead of the default, which is to delete them. Finishes issue 2198_.

  • Fix: the LCOV report would incorrectly count excluded functions as uncovered, as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen <pull 2206_>.

  • When running your program, coverage now correctly sets

... (truncated)

Commits
  • 50d8659 docs: sample HTML for 7.15.2
  • b5eed20 docs: prep for 7.15.2
  • 78cab6e fix: reduce memory use during reporting. #2229 (#2231)
  • b4c1fda build: bump version to 7.15.2
  • da63bed docs: sample HTML for 7.15.1
  • bc35e64 docs: prep for 7.15.1
  • 182b010 perf: resolve sysmon branch events lazily, one pair at a time (#2221)
  • ee271ee perf: compute multiline maps cheaply in the sysmon core (#2220)
  • 1441b96 chore: bump the action-dependencies group with 6 updates (#2225)
  • dd80635 fix: escape context labels in html report inline script block (#2224)
  • Additional commits viewable in compare view

Updates mypy from 2.1.0 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

  • Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
  • Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
  • Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
  • Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
  • Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
  • 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
  • 24c237d [mypyc] Improve documentation of Final (#21713)
  • b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
  • cbcb51a Narrow for frozendict membership check (#21709)
  • af2bc0f Sync typeshed (#21707)
  • Additional commits viewable in compare view

Updates pip from 26.1.2 to 26.2

Changelog

Sourced from pip's changelog.

26.2 (2026-07-29)

Deprecations and Removals

  • Newly published packages will no longer be immediately visible to pip if the index uses caching. To install a newly published package, use --refresh-package. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

  • Drop support for detecting legacy, non-:pep:405, virtualenv (< 20) environments. ([#14062](https://github.com/pypa/pip/issues/14062) <https://github.com/pypa/pip/issues/14062>_)

  • Constraints files, including PIP_CONSTRAINT, no longer affect isolated build environments. Use --build-constraint or the PIP_BUILD_CONSTRAINT environment variable to constrain build dependencies instead.

    The --use-feature=build-constraint flag is now always enabled and has no effect. ([#14094](https://github.com/pypa/pip/issues/14094) <https://github.com/pypa/pip/issues/14094>_)

Features

  • Declare support for Python 3.15 ([#14208](https://github.com/pypa/pip/issues/14208) <https://github.com/pypa/pip/issues/14208>_)

  • Support self-referential extras officially. pip has supported this by accident since version 21.2. ([#11296](https://github.com/pypa/pip/issues/11296) <https://github.com/pypa/pip/issues/11296>_)

  • Add --only-deps flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with --no-deps, -r, --group, or --requirements-from-script. ([#11440](https://github.com/pypa/pip/issues/11440) <https://github.com/pypa/pip/issues/11440>_)

  • Cache simple responses in accordance to their Cache-Control header instead of always revalidating on every request. To refresh cached package index responses and ensure newly published packages are found, use --refresh-package <package>. ([#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680>_)

  • Add --no-require-hashes to disable automatic enablement of --require-hashes when encountering a requirement with hashes. ([#14169](https://github.com/pypa/pip/issues/14169) <https://github.com/pypa/pip/issues/14169>_)

  • Honor --only-final when sourcing requirements with -r pylock.toml. ([#13950](https://github.com/pypa/pip/issues/13950) <https://github.com/pypa/pip/issues/13950>_)

  • Add support for pylock.toml upload-time field, so --uploaded-prior-to works with -r pylock.toml. ([#14168](https://github.com/pypa/pip/issues/14168) <https://github.com/pypa/pip/issues/14168>_)

  • Better error messages in case of conflicts with requirements from -r pylock.toml. ([#13963](https://github.com/pypa/pip/issues/13963) <https://github.com/pypa/pip/issues/13963>_)

  • Add experimental support for isolating build subprocesses by creating standard virtual environments. This will fix most (if not all) subtle isolation issues that can lead to broken builds exclusive to pip. The feature can be enabled via --use-feature=venv-isolation and will be enabled by default in a future release.

    Note that the feature has limited compatibility with --use-feature=inprocess-build-deps. While most builds should work with both features enabled, there are known edge cases. inprocess-build-deps will not be enabled by default until they are fixed. ([#14070](https://github.com/pypa/pip/issues/14070) <https://github.com/pypa/pip/issues/14070>_)

  • Present more informative diagnostic errors on uncaught network errors. ([#14115](https://github.com/pypa/pip/issues/14115) <https://github.com/pypa/pip/issues/14115>_)

  • Allow opting out of Git partial clones with PIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER. ([#11043](https://github.com/pypa/pip/issues/11043) <https://github.com/pypa/pip/issues/11043>_)

  • Add a --no-proxy-env (or --proxy "") option to ignore proxies configured via non-pip environment variables or configuration files. A proxy set with --proxy is still used. ([#5378](https://github.com/pypa/pip/issues/5378) <https://github.com/pypa/pip/issues/5378>_)

  • Add support for pulling username from keyring subprocess provider ([#12543](https://github.com/pypa/pip/issues/12543) <https://github.com/pypa/pip/issues/12543>_)

  • Speedup tab autocompletion by lazy-importing certain modules. ([#4768](https://github.com/pypa/pip/issues/4768) <https://github.com/pypa/pip/issues/4768>_)

... (truncated)

Commits
  • 4b6ae5c Bump for release
  • 50b6d3c Update AUTHORS.txt
  • dbddfbd Tweak news entries for pip 26.2 (#14212)
  • 6576b75 Merge pull request #14165 from sbidoul/refactor-pylock-hanling-sbi
  • 0090e00 Address a variety of typos detected in code review
  • e12ddd9 Add support for --uploaded-prior-to with -r pylock.toml
  • 5eefdbc Better conflict report for requirements from -r pylock.toml
  • 6d71ff8 Test --only-final with -r pylock.toml
  • e7d6eb9 Refactor -r pylock.toml
  • 756506d Add TODO about pylock.select and --no-binary
  • Additional commits viewable in compare view

Updates pre-commit from 4.6.0 to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

Commits
  • 242ce8a v4.6.1
  • 766e550 Merge pull request #3727 from pre-commit/dedupe
  • 1558d06 Merge pull request #3726 from pre-commit/exists-faster
  • 8a1c47a avoid duplicate files in --all-files during conflict
  • 2e01c99 faster check of rev existing locally as a commit
  • 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
  • 1d811d9 Return an error for invalid --repo
  • 374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
  • 1e7994f set JULIA_DEPOT_PATH
  • b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
  • Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Commits
  • 80790b3 Bump 0.16.1 (#27330)
  • 63830f3 [ty] Borrow from constraint set storage less often (#27328)
  • f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
  • 0d80497 Lint TOML files in the LSP (#26862)
  • d91586b Update prek dependencies (#27293)
  • 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
  • b20daf7 [ty] refactor: add helper function to send partial results (#27249)
  • 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
  • 7c3e2db [ty] Fix enum class container assignability (#27318)
  • d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the python-dependencies group across 1 director…
b0fb9eb 
…y with 8 updates

Bumps the python-dependencies group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.14.1` | `3.14.3` |
| [google-genai](https://github.com/googleapis/python-genai) | `2.10.0` | `2.16.0` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.28.1` | `2.0.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.3` | `7.15.2` |
| [mypy](https://github.com/python/mypy) | `2.1.0` | `2.3.0` |
| [pip](https://github.com/pypa/pip) | `26.1.2` | `26.2` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.0` | `4.6.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.16.1` |



Updates `aiohttp` from 3.14.1 to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.14.1...v3.14.3)

Updates `google-genai` from 2.10.0 to 2.16.0
- [Release notes](https://github.com/googleapis/python-genai/releases)
- [Changelog](https://github.com/googleapis/python-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/python-genai@v2.10.0...v2.16.0)

Updates `mcp` from 1.28.1 to 2.0.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.28.1...v2.0.0)

Updates `coverage` from 7.14.3 to 7.15.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.3...7.15.2)

Updates `mypy` from 2.1.0 to 2.3.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.1.0...v2.3.0)

Updates `pip` from 26.1.2 to 26.2
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@26.1.2...26.2)

Updates `pre-commit` from 4.6.0 to 4.6.1
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.0...v4.6.1)

Updates `ruff` from 0.15.20 to 0.16.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.16.1)

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: google-genai
  dependency-version: 2.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: mcp
  dependency-version: 2.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: coverage
  dependency-version: 7.15.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: pip
  dependency-version: '26.2'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: pre-commit
  dependency-version: 4.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.16.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants