Skip to content

Bump the patch group with 2 updates - #314

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/patch-32a9a33ff4
Open

Bump the patch group with 2 updates#314
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/patch-32a9a33ff4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026

Copy link
Copy Markdown
Contributor

Bumps the patch group with 2 updates: pymongo and ty.

Updates pymongo from 4.18.2 to 4.18.3

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.3

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-3-released/344145

CVE-2026-106435

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.3 (2026/10/08)

Version 4.18.3 is a bug fix release.

  • Hardened BSON regex decoding against malformed documents (PYTHON-6110_).

.. _PYTHON-6110: https://jira.mongodb.org/browse/PYTHON-6110

Issues Resolved ...............

See the PyMongo 4.18.3 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.3 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52955

Commits
  • 5479af6 PYTHON-6155 Prep 4.18.3 release (#3108)
  • bb8d4e1 PYTHON-6110 Bound Regex element scans to the remaining document bytes (#3109)
  • 98f444b PYTHON-6140 [v4.18] [Build Failure] TestBSON.test_encode_size_limit MemoryErr...
  • 7376a3e PYTHON-6104 [v4.18] Remove mod_wsgi testing from Evergreen (#3091)
  • dac0e76 PYTHON-6083 [v4.18] Latest server binary downloads require private S3 (#3080)
  • 9ee37df Update changelog to include CVEs (#3067)
  • eda87d6 BUMP 4.18.3.dev0
  • See full diff in compare view

Updates ty from 0.0.85 to 0.0.86

Release notes

Sourced from ty's releases.

0.0.86

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ty wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

  • Infer empty collection branches from nonempty literals (#29131)
  • Invalidate dependency metadata when environments change (#29126)
  • Preserve final attribute restrictions on composite types (#29135)
  • Preserve recursive structure in Annotated values (#29058)
  • Specialize inherited dataclass field converters (#29192)

LSP server

  • Show documentation for annotation operators on hover (#29185)

Core type checking

  • Check attribute and property override types (#28556)
  • Narrow tuple unions through truthiness and type checks (#29125)
  • Preserve literal types when consuming dictionary literals (#29145)
  • Preserve non-boolean comparison results for intersections (#28045)
  • Preserve receiver specializations when calling unions of bound methods (#29015)
  • Represent uninhabited truthiness explicitly (#28843)
  • Solve validity type context through constraint sets (#28909)

Performance

  • Avoid recursion guards for non-generic nominal targets (#29202)
  • Check exact exclusions before intersection positives (#29195)

Memory usage improvements

  • Share constraints in retained sequent maps (#28966)

Other changes

  • Update the default Python version to 3.15 (#28792)
  • Update to Unicode 17 (#21229, #28784)
  • Always show fixes in the CLI (#27810)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.86

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ty wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

  • Infer empty collection branches from nonempty literals (#29131)
  • Invalidate dependency metadata when environments change (#29126)
  • Preserve final attribute restrictions on composite types (#29135)
  • Preserve recursive structure in Annotated values (#29058)
  • Specialize inherited dataclass field converters (#29192)

LSP server

  • Show documentation for annotation operators on hover (#29185)

Core type checking

  • Check attribute and property override types (#28556)
  • Narrow tuple unions through truthiness and type checks (#29125)
  • Preserve literal types when consuming dictionary literals (#29145)
  • Preserve non-boolean comparison results for intersections (#28045)
  • Preserve receiver specializations when calling unions of bound methods (#29015)
  • Represent uninhabited truthiness explicitly (#28843)
  • Solve validity type context through constraint sets (#28909)

Performance

  • Avoid recursion guards for non-generic nominal targets (#29202)
  • Check exact exclusions before intersection positives (#29195)

Memory usage improvements

  • Share constraints in retained sequent maps (#28966)

Other changes

  • Update the default Python version to 3.15 (#28792)
  • Update to Unicode 17 (#21229, #28784)
  • Always show fixes in the CLI (#27810)

Contributors

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the patch group with 2 updates
94b7b57 
Bumps the patch group with 2 updates: [pymongo](https://github.com/mongodb/mongo-python-driver) and [ty](https://github.com/astral-sh/ty).


Updates `pymongo` from 4.18.2 to 4.18.3
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.3/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.18.2...4.18.3)

Updates `ty` from 0.0.85 to 0.0.86
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.85...0.0.86)

---
updated-dependencies:
- dependency-name: pymongo
  dependency-version: 4.18.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch
- dependency-name: ty
  dependency-version: 0.0.86
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from r-barton as a code owner October 18, 2026 00:53
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@r-barton r-barton Awaiting requested review from r-barton r-barton is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants