Bump the uv group across 1 directory with 7 updates by dependabot[bot] · Pull Request #3812 · OpenC3/cosmos

dependabot · 2026-09-02T22:36:56Z

Bumps the uv group with 7 updates in the /openc3/python directory:

Package	From	To
boto3	`1.43.65`	`1.43.83`
orjson	`3.11.9`	`3.12.0`
lxml	`6.1.1`	`6.1.2`
iroh	`1.0.0`	`1.1.0`
coverage	`7.15.4`	`7.16.0`
fakeredis	`2.37.0`	`2.37.1`
ruff	`0.16.1`	`0.16.5`

Updates boto3 from 1.43.65 to 1.43.83

Commits

77e6582 Merge branch 'release-1.43.83'
bdb0f45 Bumping version to 1.43.83
950987a Add changelog entries from botocore
156b04a Merge branch 'release-1.43.82'
dfc3447 Merge branch 'release-1.43.82' into develop
e6c550f Bumping version to 1.43.82
94d6577 Add changelog entries from botocore
18a131c Bump https://github.com/astral-sh/ruff-pre-commit (#4835)
1ee61ff Merge branch 'release-1.43.81'
d3a3a52 Merge branch 'release-1.43.81' into develop
Additional commits viewable in compare view

Updates orjson from 3.11.9 to 3.12.0

Release notes

Sourced from orjson's releases.

3.12.0

Changed

Serialization implementation substantially rewritten.

Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).

No longer publish PyPI wheels for ppc64le and s390x.

Changelog

Sourced from orjson's changelog.

3.12.0 - 2026-08-14

Changed

Serialization implementation substantially rewritten.

Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).

No longer publish PyPI wheels for ppc64le and s390x.

Commits

6737895 3.12.0
c2a6e8f JsonWriter, iterators
6a2d7a7 yyjson 1ea2fb0
97bf170 build update
See full diff in compare view

Updates lxml from 6.1.1 to 6.1.2

Changelog

Sourced from lxml's changelog.

6.1.2 (2026-08-18)

GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo.

Some minor corrections for error handling cases.

Other changes

Built with Cython 3.2.9.

Commits

f2874e9 Update release date.
687a295 Build: Exclude Py3.8 from windows-arm builds.
acadc56 Build: Remove outdated build target.
59f93eb Build: Split old-Linux and other-Py3.8 builds.
923df83 Build: Fix manylinux2014 build.
975cc83 Build: Fix Px3.8 build setup.
09e5d3e Build: Fix cibuildwheel version.
998cf50 Build: Build Py3.8 wheels only once, not in every build job.
5567037 Build: Exclude Py3.15 from 32bit builds.
904db40 Build: Update cibuildwheel to include Py3.15.
Additional commits viewable in compare view

Updates iroh from 1.0.0 to 1.1.0

Changelog

Sourced from iroh's changelog.

1.1.0 - 2026-08-25

⛰️ Features

(iroh) Add metrics for relay connections (#4477) - (fc1fc21)

(iroh-relay, iroh) Inform clients when they are rate-limited and warn log in iroh (#4455) - (e68dbda)

🐛 Bug Fixes

(iroh) Keep answering priority messages during relay reconnect backoff delay (#4444) - (0458319)

(iroh) Route net_report HTTP probes through the configured proxy (#4463) - (de24dae)

(iroh) Drain relay tasks with join_next instead of join_all (#4460) - (09a0aca)

(iroh-dns-server) Enable TCP keepalive on HTTP listeners (#4462) - (735958f)

Bind iroh-dns-server to both IPv4 and IPv6 (#4432) - (bbc82b6)

[breaking] Fix serialization of CustomAddr so that the data serializes the same as a Vec (#4465) - (4706ec9)

Use random mapped addrs instead of a counter. (#4469) - (a05c9c4)

🚜 Refactor

Don't send SNI (#4473) - (6d7f68c)

📚 Documentation

Explain read_to_end termination (#4391) - (94835be)

🧪 Testing

(iroh) Update patchbay to 0.7.0 (#4445) - (7d8c9bf)

(iroh) Disable flaky patchbay test for now (#4449) - (d27d430)

(iroh) Add patchbay tests for relay connectivity (#4434) - (8455111)

⚙️ Miscellaneous Tasks

()* Update noq and net-tools dependencies (#4487) - (1960e73)

(ci) Pin sccache to 0.16 on windows due to cli len limit (#4456) - (0438766)

(iroh-dns-server) Replace mainline with n0-mainline and update lru (#4470) - (82eed32)

(secruity) Hardening + lock files + dependabot cooldown (#4480) - (89ed3bf)

Run daily flaky CI even 2h earlier (#4431) - (e080db7)

Changelog

All notable changes to iroh will be documented in this file.

1.0.3 - 2026-07-20

🐛 Bug Fixes

(ci) Move android test back to self hosted nodes (#4413) - (5e994a7)

(iroh) Error when connecting with an empty ALPN (#4427) - (cc876c7)

Add pkarr resolver to n0 preset (#4412) - (3e1e4b7)

... (truncated)

Commits

fddf1a4 chore: Release
1960e73 chore(*): update noq and net-tools dependencies (#4487)
2b9f441 Merge commit from fork
09a0aca fix(iroh): drain relay tasks with join_next instead of join_all (#4460)
eba4877 chore(deps): bump taiki-e/install-action from 2.85.11 to 2.85.13 in the githu...
a05c9c4 fix: Use random mapped addrs instead of a counter. (#4469)
89ed3bf ci(secruity): hardening + lock files + dependabot cooldown (#4480)
fc1fc21 feat(iroh): Add metrics for relay connections (#4477)
94835be docs: explain read_to_end termination (#4391)
6d7f68c refactor: Don't send SNI (#4473)
Additional commits viewable in compare view

Updates coverage from 7.15.4 to 7.16.0

Release notes

Sourced from coverage's releases.

7.16.0

Version 7.16.0 — 2026-08-28

When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.

The Coverage.switch_context() method now returns the previous context.

Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.

Fixes to validation of options and configuration settings:

Negative precision settings now always cause useful error messages (pull 2261).

An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).

Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).

coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).

Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️ PyPI page: coverage 7.16.0. :arrow_right: To install: python3 -m pip install coverage==7.16.0

Changelog

Sourced from coverage's changelog.

Version 7.16.0 — 2026-08-28

When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

The :meth:.Coverage.switch_context method now returns the previous context.

Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

Fixes to validation of options and configuration settings:

Negative precision settings now always cause useful error messages (pull 2261_).

An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with "Can't combine statement coverage data with branch data". Each named concurrency library is now properly considered (pull 2270_).

Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265_).

.. _pull 2261: coveragepy/coveragepy#2261 .. _pull 2262: coveragepy/coveragepy#2262 .. _pull 2263: coveragepy/coveragepy#2263 .. _pull 2265: coveragepy/coveragepy#2265 .. _issue 2266: coveragepy/coveragepy#2266 .. _pull 2268: coveragepy/coveragepy#2268

... (truncated)

Commits

3e9fc16 docs: prep for 7.16.0
38be8d1 build: control check-manifest explicitly
8eb1266 docs(build): no longer commit sample_html
1a8b3fa docs: remove sample_html
aeaa79b docs: linklint is now sphinx-linklint
d5eaf3f test: a branchless way to re-add extensions
57e52fd docs: adjust CHANGES for #2270
b9d304d fix: check for multiprocessing in a --concurrency list (#2270)
a6ef928 chore: make upgrade
070461f chore: bump the action-dependencies group with 4 updates (#2271)
Additional commits viewable in compare view

Updates fakeredis from 2.37.0 to 2.37.1

Release notes

Sourced from fakeredis's releases.

v2.37.1

What's Changed

🐛 Bug Fixes

fix: honor the FILTER-EF (max filtering effort) option in VSIM — the value was previously parsed but ignored, so a low FILTER-EF could return filter matches that real Redis skips

fix: ZPOPMIN/ZPOPMAX in RESP3 now return a flat [member, score] pair when no count is given (an array of pairs is only returned when an explicit count is passed), matching real Redis

fix: ZPOPMIN/ZPOPMAX now reject a negative count with value is out of range, must be positive

fix: ZPOPMIN/ZPOPMAX/BZPOPMIN/BZPOPMAX/ZMPOP/BZMPOP now delete the sorted set key once its last member is popped

fix: LTRIM now signals the key as modified even when the trim is a no-op, so a WATCH on that key correctly aborts the following transaction, matching real Redis

fix: align stream group errors with Redis — XPENDING on a missing key or unknown group now raises NOGROUP instead of returning 0/an empty array, and neither XPENDING nor XINFO GROUPS creates the key as a side effect (#532)

🧰 Maintenance

perf: VADD/VSIM keep a row-oriented matrix of the vector set resident and reuse it, instead of restacking every stored vector on each call; re-adding an existing member now replaces its row rather than leaving a stale one

perf: cache compiled JSONPath objects in the JSON stack mixin (#538)

build: drop Python 3.9, target Python 3.10+ (#534)

Update to redis-py 8.1

refactor: modernize typing for Ruff 0.16 defaults (#533)

test: refactor hypothesis tests

New Contributors

@emerardd made their first contribution in cunla/fakeredis-py#532

@flowln made their first contribution in cunla/fakeredis-py#538

Full Changelog: cunla/fakeredis-py@v2.37.0...v2.37.1

Commits

0f2b05a fix: update changelog with recent fixes and performance improvements
1bafdc9 chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 (#539)
ce4db1b openspec
fbb004c openspec
f62d010 chore:update deps
36ff68c docs: ratify project constitution v1.0.0
275ebec chore:update deps
97e659f Cache JSONPath objects in the JSON stack mixin (#538)
ecf28cf fix: align stream group errors with Redis (#532)
1b5f75f fix: update dependencies and improve test configurations
Additional commits viewable in compare view

Updates ruff from 0.16.1 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

Allow rules without codes (#28049)

Introduce category selectors (#27666)

Update preview default rules and categories (#27877)

Bug fixes

[flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)

[flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)

[flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

Document rule acceptance guidelines (#27910)

Document the new category selectors (#27906)

Contributors

@AlexWaygood

@sharkdp

@jelle-openai

@charliermarsh

@ntBre

@aarushkandukoori

Install ruff 0.16.5

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"
Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

Allow rules without codes (#28049)

Introduce category selectors (#27666)

Update preview default rules and categories (#27877)

Bug fixes

[flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)

[flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)

[flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

Document rule acceptance guidelines (#27910)

Document the new category selectors (#27906)

Contributors

@AlexWaygood

@sharkdp

@jelle-openai

@charliermarsh

@ntBre

@aarushkandukoori

0.16.4

Released on 2026-08-20.

Preview features

[flake8-use-pathlib] Add autofix for PTH116 (#26460)

[refurb] Restrict delete-full-slice to lists (FURB131) (#27711)

[refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)

[pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)

[pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

... (truncated)

Commits

9e4938c Bump 0.16.5 (#28110)
aad0e90 Allow rules without codes (#28049)
5fdab73 Update preview default rules and categories (#27877)
29c8e5b Document rule acceptance guidelines (#27910)
50a4d7f Document the new category selectors (#27906)
ada8795 Introduce category selectors (#27666)
d894723 [ty] Infer lambda parameters through callable type aliases (#28109)
2685fde [ty] Narrow functional enum members in == and match (#28103)
efcffd2 [ty] Intersection simplifications with subtype-related generic specialization...
eb78048 [ty] Bump ecosystem-analyzer for HTML escaping (#28104)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the uv group with 7 updates in the /openc3/python directory: | Package | From | To | | --- | --- | --- | | [boto3](https://github.com/boto/boto3) | `1.43.65` | `1.43.83` | | [orjson](https://github.com/ijl/orjson) | `3.11.9` | `3.12.0` | | [lxml](https://github.com/lxml/lxml) | `6.1.1` | `6.1.2` | | [iroh](https://github.com/n0-computer/iroh) | `1.0.0` | `1.1.0` | | [coverage](https://github.com/coveragepy/coveragepy) | `7.15.4` | `7.16.0` | | [fakeredis](https://github.com/cunla/fakeredis-py) | `2.37.0` | `2.37.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.1` | `0.16.5` | Updates `boto3` from 1.43.65 to 1.43.83 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.65...1.43.83) Updates `orjson` from 3.11.9 to 3.12.0 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.9...3.12.0) Updates `lxml` from 6.1.1 to 6.1.2 - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](lxml/lxml@lxml-6.1.1...lxml-6.1.2) Updates `iroh` from 1.0.0 to 1.1.0 - [Release notes](https://github.com/n0-computer/iroh/releases) - [Changelog](https://github.com/n0-computer/iroh/blob/main/CHANGELOG.md) - [Commits](n0-computer/iroh@v1.0.0...v1.1.0) Updates `coverage` from 7.15.4 to 7.16.0 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.15.4...7.16.0) Updates `fakeredis` from 2.37.0 to 2.37.1 - [Release notes](https://github.com/cunla/fakeredis-py/releases) - [Commits](cunla/fakeredis-py@v2.37.0...v2.37.1) Updates `ruff` from 0.16.1 to 0.16.5 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.1...0.16.5) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.43.83 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv - dependency-name: orjson dependency-version: 3.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: lxml dependency-version: 6.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: uv - dependency-name: iroh dependency-version: 1.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: uv - dependency-name: coverage dependency-version: 7.16.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: uv - dependency-name: fakeredis dependency-version: 2.37.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: uv - dependency-name: ruff dependency-version: 0.16.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-09-02T22:37:28Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	License
pypi/orjson@3.11.9 ⏵ 3.12.0
pypi/lxml@6.1.1 ⏵ 6.1.2	⁺¹	^-19
pypi/coverage@7.15.4 ⏵ 7.16.0	⁺¹
pypi/boto3@1.43.65 ⏵ 1.43.83
pypi/fakeredis@2.37.0 ⏵ 2.37.1	⁺¹
pypi/ruff@0.16.1 ⏵ 0.16.5	⁺¹
pypi/iroh@1.0.0 ⏵ 1.1.0

View full report

sonarqubecloud · 2026-09-02T22:38:30Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot · 2026-09-09T15:34:43Z

Looks like these dependencies are no longer updatable, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 2, 2026

dependabot Bot closed this Sep 9, 2026

dependabot Bot deleted the dependabot/uv/openc3/python/uv-c874dc0e51 branch September 9, 2026 15:34

Navigation Menu

Uh oh!

Bump the uv group across 1 directory with 7 updates - #3812

Bump the uv group across 1 directory with 7 updates#3812
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/openc3/python/uv-c874dc0e51

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 2, 2026

Uh oh!

sonarqubecloud Bot commented Sep 2, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3.12.0

Changed

3.12.0 - 2026-08-14

Changed

6.1.2 (2026-08-18)

Other changes

1.1.0 - 2026-08-25

⛰️ Features

🐛 Bug Fixes

🚜 Refactor

📚 Documentation

🧪 Testing

⚙️ Miscellaneous Tasks

Changelog

1.0.3 - 2026-07-20

🐛 Bug Fixes

7.16.0

Version 7.16.0 — 2026-08-28

Version 7.16.0 — 2026-08-28

v2.37.1

What's Changed

🐛 Bug Fixes

🧰 Maintenance

New Contributors

0.16.5

Release Notes

Preview features

Bug fixes

Server

Documentation

Contributors

Install ruff 0.16.5

Install prebuilt binaries via shell script

Install prebuilt binaries via powershell script

Download ruff 0.16.5

0.16.5

Preview features

Bug fixes

Server

Documentation

Contributors

0.16.4

Preview features

Bug fixes

Uh oh!

socket-security Bot commented Sep 2, 2026

Uh oh!

sonarqubecloud Bot commented Sep 2, 2026

Quality Gate passed

Uh oh!

dependabot Bot commented on behalf of github Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading