Skip to content

build(deps-dev): bump the uv-minor-patch group with 2 updates - #332

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/dev/uv-minor-patch-2567fca429
Open

build(deps-dev): bump the uv-minor-patch group with 2 updates#332
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/dev/uv-minor-patch-2567fca429

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv-minor-patch group with 2 updates: maturin and pydantic.

Updates maturin from 1.15.0 to 1.16.0

Release notes

Sourced from maturin's releases.

v1.16.0

What's Changed

New Contributors

Full Changelog: PyO3/maturin@v1.15.0...v1.16.0

Changelog

Sourced from maturin's changelog.

1.16.0

  • Update version mapping for GraalPy 3.13 (#3297)
  • Properly normalize / validate abiflags and include in environment signature (#3299)
  • Fix MinGW stable ABI library names in generated PyO3 config (#3298)
  • Fix: lossy-decode external command output in interpreter discovery (#3302)
  • Build(deps): update rustls for RUSTSEC-2026-0285 (#3308)
  • Ci: run conda tests one at a time (#3311)
  • Include SOABI_PLATFORM in Python 3.15 stable ABI extension filenames (#3305)
  • Sort compressed tag sets (#3315)
  • Update manylinux/musllinux policies to the latest main (#3322)
  • Docs: recommend declaring the Rust MSRV (#3317)
  • Emit a WASI platform tag for non-bin extension wheels (#3321)
  • Don't include the cargo target directory or cache directories in wheels built from sdists (#3320)
  • Fix: avoid global uv fallback in pixi environments (#3306)
  • Fix the cargo-deny advisories that fail Lint (#3328)
  • Find versioned interpreter names like pypy3.11 on Windows (#3325)
  • Update pyo3-introspection to 0.30 (#3329)
  • Ignore unreachable zip extract advisories in cargo deny (#3334)
  • Normalize Provides-Extra names from project.optional-dependencies (#3333)
  • Join a multi-line description into a single-line Summary (#3332)
  • Update https cert bundle for the eMudhra CA compromise (#3337)
  • Fix: use the toolchain pyodide-build expects (#3338)
  • Feat: upload emscripten wheels to pypi (#3340)
  • Use system ca certificates instead of ureq's WebPki when building with native-tls (#3341)
  • Put all License-File entries at the sdist root (#3331)
  • Pass macosx_deployment_target to zigbuild (#3313)
  • Use the pp80 ABI tag for PyPy 3.12 in the bundled sysconfig (#3343)
  • Fix: normalize Git Bash virtualenv paths on Windows (#3307)
  • Feat: add configurable PGO dependency group (#3278) (#3310)
  • Fix: update rustix to 1.1.5 (#3344)
Commits
  • 3bec0a3 Update maximum Python & PyPy version
  • b3e440d Release v1.16.0 (#3350)
  • f2cefaa fix: update rustix to 1.1.5 (#3344)
  • 3eb4add feat: add configurable PGO dependency group (#3278) (#3310)
  • 9375cf3 fix: normalize Git Bash virtualenv paths on Windows (#3307)
  • f8428c1 Use the pp80 ABI tag for PyPy 3.12 in the bundled sysconfig (#3343)
  • b6fb2f0 Pass macosx_deployment_target to zigbuild (#3313)
  • 979aad0 Put all License-File entries at the sdist root (#3331)
  • 323b38d use system ca certificates instead of ureq's WebPki when building with native...
  • d6ecbc0 feat: upload emscripten wheels to pypi (#3340)
  • Additional commits viewable in compare view

Updates pydantic from 2.14.1 to 2.14.2

Release notes

Sourced from pydantic's releases.

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.

Packaging

Performance

Fixes

  • Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

    JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

    from pydantic import BaseModel, ConfigDict
from pydantic.alias_generators import to_camel
class Page(BaseModel):
model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
page_size: int = 10

Page.model_validate_json('{"page_size": 50}')
Before: Page(page_size=10)
After: ValidationError (extra_forbidden)

    See the pull request for the full list of behavior changes. This change addresses GHSA-qpmf-fgh3-ff25.

  • Ignore extra data matching a field name in TypedDict and dataclasses with extra=allow by @​Viicos in #14090. Addresses GHSA-3r8g-cqwr-jr29.

  • Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

  • Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

  • Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

  • Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

  • Implement recursion guard for validate_strings() by @​Viicos in #14029

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.2 (2026-10-29)

GitHub release

What's Changed

Packaging

Performance

Fixes

  • Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

    JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

    from pydantic import BaseModel, ConfigDict
from pydantic.alias_generators import to_camel
class Page(BaseModel):
model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
page_size: int = 10

Page.model_validate_json('{"page_size": 50}')
Before: Page(page_size=10)
After: ValidationError (extra_forbidden)

    See the pull request for the full list of behavior changes.

  • Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

  • Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

  • Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

  • Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

  • Implement recursion guard for validate_strings() by @​Viicos in #14029

  • Support named tuples in Sequence serialization by @​Viicos in #14033

... (truncated)

Commits
  • aa540ac Update changelog for v2.14.2
  • 6cde12f Update changelog for v2.14.2
  • 2db7c25 Fix deep copy of self-referential models
  • d783154 Update changelog for v2.14.2
  • df49b6c Avoid heap allocation for small JSON model field buffers
  • cd93e69 Skip decorator field checks when no field decorators exist
  • 2771e57 Make JSON validation by iteration consistent with Python approach
  • 8102e3f Avoid Python tuple allocation during model fields validation
  • dd139b5 Bump pydantic.v1 namespace to v1.10.27
  • 66155f9 Prepare release v2.14.2
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the uv-minor-patch group with 2 updates
928cc4d 
Bumps the uv-minor-patch group with 2 updates: [maturin](https://github.com/pyo3/maturin) and [pydantic](https://github.com/pydantic/pydantic).


Updates `maturin` from 1.15.0 to 1.16.0
- [Release notes](https://github.com/pyo3/maturin/releases)
- [Changelog](https://github.com/PyO3/maturin/blob/main/Changelog.md)
- [Commits](PyO3/maturin@v1.15.0...v1.16.0)

Updates `pydantic` from 2.14.1 to 2.14.2
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.14.2/HISTORY.md)
- [Commits](pydantic/pydantic@v2.14.1...v2.14.2)

---
updated-dependencies:
- dependency-name: maturin
  dependency-version: 1.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv-minor-patch
- dependency-name: pydantic
  dependency-version: 2.14.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 8, 2026
singlerider
singlerider approved these changes Nov 9, 2026
View reviewed changes

@singlerider singlerider left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 pydantic 2.14.2 fixes two medium validation bypasses (extra keys in JSON model validation, aliased fields in TypedDict and dataclasses). Worth taking since cloudcheck parses provider JSON into models. maturin 1.16 is build-only: abiflags and stable-ABI naming fixes, plus a rustls RUSTSEC bump. The auto-merge failure is only the job waiting on review. All tests are green across 3.11 to 3.15.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@singlerider singlerider singlerider approved these changes

Assignees

@liquidsec liquidsec

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@singlerider @liquidsec