Skip to content

Bump the uv-updates group with 6 updates - #1870

Merged
nacho merged 1 commit into
mainfrom
dependabot/uv/uv-updates-c38ef84f51
Oct 26, 2026
Merged

Bump the uv-updates group with 6 updates#1870
nacho merged 1 commit into
mainfrom
dependabot/uv/uv-updates-c38ef84f51

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv-updates group with 6 updates:

Package From To
setuptools 84.0.0 84.2.1
cyclopts 5.2.0 5.3.0
pip 26.2.1 26.2.2
prek 0.5.5 0.5.7
tox 4.65.6 4.67.1
pytest-mock 3.16.0 3.17.0

Updates setuptools from 84.0.0 to 84.2.1

Changelog

Sourced from setuptools's changelog.

v84.2.1

Bugfixes

  • Changed wheel tags and stable-ABI validation to use sysconfig data. (#5360)
  • Fixed unimportable extensions on free-threaded Python 3.13 and 3.14 when Extension.py_limited_api is enabled. These builds now use their version-specific extension suffix instead of using the unsupported .abi3t suffix. (#5363)

Improved Documentation

  • Replaced broken link to Python Eggs documentation with an archived version from the Wayback Machine. (#1929)

v84.2.0

Features

  • Added support for building abi3t extensions and abi3.abi3t wheels on Python 3.15 and newer. See :pep:803 and the Python 3.15 "What's New" entry <https://docs.python.org/3.15/whatsnew/3.15.html#pep-803-abi3t-stable-abi-for-free-threaded-builds>_ for more details. (#5193)
  • Updated vendored packaging version to 26.3, which adds support for the abi3t tag from :pep:803. (#5361)

Bugfixes

  • Use target sysconfig data for stable-ABI extension filenames. (#5351)

v84.1.0

Features

  • setuptools.archive_util now raises the new UnsafeMember exception when an archive member would be extracted outside of the extraction directory, where previously such a member was silently skipped. Aborting makes a malicious or malformed archive visible to the caller instead of yielding a quietly incomplete extraction, and matches the behavior of the standard

... (truncated)

Commits

Updates cyclopts from 5.2.0 to 5.3.0

Release notes

Sourced from cyclopts's releases.

v5.3.0

Features

  • Number validator supports Decimal and Fraction. #988

Bug Fixes

Config & Environment Variables

  • Empty config containers now bind for dict, list, tuple, set and dataclass parameters (Any parameters keep the container as-is). #993, #1006
  • A config null is rejected for types that don't allow None. #1004
  • A config array is rejected for single-value types, including a pydantic Model | bool (previously bound True). #1005, #1014
  • A JSON config.Env value containing spaces stays one token. #997
  • Symlinked configuration filenames are preserved. @​ac1982 #995

JSON Parsing

  • dict[str, X] parameters accept a JSON object from the CLI or an env var. #1001
  • A JSON object for a nested pydantic model field no longer crashes with IndexError. #999
  • An explicit empty JSON object reports the missing required fields. #992
  • Errors from config/env JSON list elements name the real parameter instead of --json. #998

Unions With a Class Member

  • Foo | bool supports keyed fields and bare flags, and lists --x/--no-x in help and shell completion. #991, #1013
  • Foo | dict[str, int] no longer silently drops unknown keys; its dict fallback keeps typed keys and input order. #1015, #1019

Other

  • ~3.5 ms faster startup and per-invocation overhead. #989
  • A mistyped command given with --help raises UnknownCommandError. @​BreytMN #994
  • Parameter metadata is honored on dict value types. @​saadkhantareen #1008
  • Pydantic models with validate_by_alias=False accept the field name on pydantic 2.14. #1010
  • The Parameter(name="*") no-default error names the class instead of Annotated. #996
  • resolve_returncode and ConsumeMultipleError are declared in __init__.pyi. @​tarrific #1018

New Contributors

Full Changelog: BrianPugh/cyclopts@v5.2.0...v5.3.0

Commits
  • 7c25873 Merge pull request #1012 from BrianPugh/dependabot/uv/pymdown-extensions-12.2
  • bcbc6c2 Merge pull request #1011 from BrianPugh/dependabot/uv/pre-commit-4.7.0
  • a317674 Merge pull request #1019 from BrianPugh/fix/class-or-dict-typed-keys
  • 0a6fa0b fix: keep typed keys and input order when a class-or-dict union falls back to...
  • d7a96b5 test: add failing tests for typed keys and order in a class-or-dict union's d...
  • 6bb7cf3 Merge pull request #1015 from BrianPugh/fix/class-or-dict-union
  • 83df50f refactor: classify a class-or-dict union's dict member once in post-init
  • 84139d3 fix: bind keys the class doesn't take to the dict member of a class-or-dict...
  • a4564f1 test: add failing tests for dict keys on a class-or-dict union
  • fb50d02 Merge pull request #1014 from BrianPugh/fix/pydantic-union-config-array
  • Additional commits viewable in compare view

Updates pip from 26.2.1 to 26.2.2

Changelog

Sourced from pip's changelog.

26.2.2 (2026-10-20)

Vendored Libraries

  • Upgrade certifi to 2026.10.19
Commits

Updates prek from 0.5.5 to 0.5.7

Release notes

Sourced from prek's releases.

0.5.7

Release Notes

Released on 2026-10-21.

Enhancements

  • Support system Rust toolchains without rustup (#2887)

Performance

  • Use blocking file checks for CPU-heavy builtin hooks (#2910)

Other changes

  • Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)

Contributors

Install prek 0.5.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.7

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.7

Released on 2026-10-21.

Enhancements

  • Support system Rust toolchains without rustup (#2887)

Performance

  • Use blocking file checks for CPU-heavy builtin hooks (#2910)

Other changes

  • Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)

Contributors

0.5.6

Released on 2026-10-19.

Enhancements

  • Add builtin hook check-commit-trailers (#2885)
  • Add builtin hook check-signed-commit (#2725)

Performance

  • Enable PGO for native release builds (#2890)
  • Reduce hook process launches with balanced batches (#2907)
  • Resolve hook commands before batching (#2840)

Bug fixes

  • Accept UTF-8 BOM in check-json (#2879)
  • Preserve unquoted dotted revisions in prek update (#2853)

Documentation

  • Document standalone installer options (#2859)
  • Update benchmarks for prek 0.5.5 (#2786)

Other changes

  • Enable ICF for release builds (#2891)
  • Update uv to 0.13.0 (#2856)

... (truncated)

Commits
  • 8569a4a Bump version to 0.5.7 (#2920)
  • c290bac Bump certifi from 2026.7.22 to 2026.10.19 (#2921)
  • 40287b8 Temporarily skip Aliyun uv download in CI (#2922)
  • 062c8a0 Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)
  • 5b66378 Log download and archive extraction stages (#2917)
  • c369353 Share tar extraction across compression formats (#2916)
  • 1c82a0d Move managed Rust toolchain discovery into the installer (#2914)
  • 2bf1958 Support system Rust toolchains without rustup (#2887)
  • 812e80f Move shared hook helpers and rename run to concurrency (#2911)
  • 615a001 Use blocking file checks for CPU-heavy builtin hooks (#2910)
  • Additional commits viewable in compare view

Updates tox from 4.65.6 to 4.67.1

Release notes

Sourced from tox's releases.

v4.67.1

Bug fixes - 4.67.1

  • Preserve ignore (-) and invert (!) exit code prefixes on commands when referenced via TOML { replace = "ref", ... }. (#4169)
  • Installing from a pylock.toml with no dependency_groups selected now uses the lock file's default-groups, as 751 specifies. Previously packages marked 'default' in dependency_groups (as written by pdm export -f pylock) were skipped - by pcbeingused333. (#4173)
  • A positional {factor:N} label in an env_base now resolves against that table's own factors, so with several env_base tables or an env_list product it no longer expands to an empty string. (#4174)

PyPI release

Full Changelog: tox-dev/tox@4.67.0...4.67.1

v4.67.0

Features - 4.67.0

  • Allow opting in to tox substitutions within TOML positional arguments with substitute = true. (#4165)

Bug fixes - 4.67.0

  • Keep capturing the output of the packaging backend with --no-capture, so tox --no-capture no longer hangs at started backend while waiting for the backend's reply. (#4163)
  • A leading UTF-8 byte order mark in tox.ini, setup.cfg, tox.toml or a TOML pyproject.toml no longer stops the configuration from loading - editors on Windows may add one. (#4166)
  • tox --no-provision <command> no longer treats the command as the JSON output path: a global option placed before a subcommand now keeps it, so tox --no-provision list lists the environments instead of writing a file named list. (#4168)

Improved documentation - 4.67.0

  • Link overridden argparse methods and logging.Handler.name in the plugin API reference. (#4170)

PyPI release

Full Changelog: tox-dev/tox@4.66.0...4.67.0

v4.66.0

Features - 4.66.0

  • set_env environment files accept export KEY=value lines, setting KEY - by RavSinghChandan. (#4161)

Bug fixes - 4.66.0

... (truncated)

Changelog

Sourced from tox's changelog.

Bug fixes - 4.67.1

  • Preserve ignore (-) and invert (!) exit code prefixes on commands when referenced via TOML { replace = "ref", ... }. (:issue:4169)
  • Installing from a pylock.toml with no :ref:dependency_groups selected now uses the lock file's default-groups, as :PEP:751 specifies. Previously packages marked 'default' in dependency_groups (as written by pdm export -f pylock) were skipped - by :user:pcbeingused333. (:issue:4173)
  • A positional {factor:N} label in an env_base now resolves against that table's own factors, so with several env_base tables or an env_list product it no longer expands to an empty string. (:issue:4174)

v4.67.0 (2026-10-17)

Features - 4.67.0

  • Allow opting in to tox substitutions within TOML positional arguments with substitute = true. (:issue:4165)

Bug fixes - 4.67.0

  • Keep capturing the output of the packaging backend with --no-capture, so tox --no-capture no longer hangs at started backend while waiting for the backend's reply. (:issue:4163)
  • A leading UTF-8 byte order mark in tox.ini, setup.cfg, tox.toml or a TOML pyproject.toml no longer stops the configuration from loading - editors on Windows may add one. (:issue:4166)
  • tox --no-provision <command> no longer treats the command as the JSON output path: a global option placed before a subcommand now keeps it, so tox --no-provision list lists the environments instead of writing a file named list. (:issue:4168)

Improved documentation - 4.67.0

  • Link overridden argparse methods and logging.Handler.name in the plugin API reference. (:issue:4170)

v4.66.0 (2026-10-16)

Features - 4.66.0

  • set_env environment files accept export KEY=value lines, setting KEY - by :user:RavSinghChandan. (:issue:4161)

Bug fixes - 4.66.0

  • Remember a failed interpreter lookup for a virtualenv environment instead of repeating the full PATH scan for

... (truncated)

Commits
  • 129a377 release 4.67.1
  • 21d01be fix(config): resolve factor labels per env_base (#4174)
  • 7a77f76 🐛 fix(pylock): use default-groups when no dependency group is selected (#4173)
  • 59d3c99 fix(config): keep exit-code prefixes on TOML command references (#4172)
  • 1de497f release 4.67.0
  • 375a807 fix(config): read a UTF-8 BOM in the ini and TOML config sources (#4166)
  • ba393c1 Allow opt-in substitution of TOML positional arguments (#4167)
  • fa16bde fix(cli): --no-provision swallows the subcommand that follows it (#4168)
  • e352fbe ♻️ refactor(docs): use public Sphinx hooks (#4171)
  • 1d054ab 📝 docs(api): link overridden stdlib members (#4170)
  • Additional commits viewable in compare view

Updates pytest-mock from 3.16.0 to 3.17.0

Release notes

Sourced from pytest-mock's releases.

v3.17.0

2026-10-17

  • #641: Failures of mock assertions such as assert_called_with are again reported only once, instead of two or three times with the original error from the mock module chained before them.
  • #642: Mock assertion failures no longer show misleading introspection when they are not about the arguments of the last call: assert_called, assert_called_once, assert_not_called, assert_any_call, their await counterparts, and assert_called_once_with/assert_awaited_once_with when the mock was not called (awaited) exactly once. The introspection also no longer reports arguments passed by position versus by keyword as different for autospecced mocks, and no longer shows empty Args:/Kwargs: sections when assertion rewriting is not available.
  • #643: assert_has_calls and assert_has_awaits failures no longer show pytest introspection, which compared the expected and actual calls position by position and so reported differences between unrelated calls. The mock's own message, listing the expected and actual calls, is still shown.

v3.16.1

2026-10-17

  • #617: Fixed assert_has_calls raising ValueError instead of AssertionError (or showing misleading introspection) when the expected calls are plain tuples rather than call(...) objects, such as (args, kwargs) entries of another mock's call_args_list, (args,), (kwargs,), (name, args) or (name, kwargs).
  • #621: Fixed mocker.stop() sometimes stopping the wrong mock, for example with mocks from mocker.create_autospec.
  • #621: mocker.stop() now undoes the most recent patch first when the same object is used in several patches.
  • #623: Fixed misleading introspection in assert_has_awaits failures, and assert_has_calls/assert_has_awaits raising IndexError instead of AssertionError when calls is passed by keyword.
  • #624: Clear spy_return_iter after a spied synchronous or asynchronous function raises, matching spy_return.
  • #627: Document async_stub await assertions and the distinction between call and await tracking.
  • #629: Fixed mocker.resetall() skipping the mocks patched with mocker.patch.multiple(), both the ones it creates and the ones passed explicitly.
  • #630: mocker.resetall() now also resets spy_return and spy_exception of spies, like it already did for spy_return_list and spy_return_iter, and no longer overwrites attributes with these names on mocks that are not spies.
  • #633: Fixed spies on classmethod, staticmethod, builtins and classes returning a MagicMock instead of calling the spied code after mocker.resetall(side_effect=True). Resetting a spy's side_effect now goes back to calling the spied code, also clearing any side_effect set on the spy.
Changelog

Sourced from pytest-mock's changelog.

3.17.0

2026-10-17

  • [#641](https://github.com/pytest-dev/pytest-mock/issues/641) <https://github.com/pytest-dev/pytest-mock/pull/641>_: Failures of mock assertions such as assert_called_with are again reported only once, instead of two or three times with the original error from the mock module chained before them.
  • [#642](https://github.com/pytest-dev/pytest-mock/issues/642) <https://github.com/pytest-dev/pytest-mock/pull/642>_: Mock assertion failures no longer show misleading introspection when they are not about the arguments of the last call: assert_called, assert_called_once, assert_not_called, assert_any_call, their await counterparts, and assert_called_once_with/assert_awaited_once_with when the mock was not called (awaited) exactly once. The introspection also no longer reports arguments passed by position versus by keyword as different for autospecced mocks, and no longer shows empty Args:/Kwargs: sections when assertion rewriting is not available.
  • [#643](https://github.com/pytest-dev/pytest-mock/issues/643) <https://github.com/pytest-dev/pytest-mock/pull/643>_: assert_has_calls and assert_has_awaits failures no longer show pytest introspection, which compared the expected and actual calls position by position and so reported differences between unrelated calls. The mock's own message, listing the expected and actual calls, is still shown.

3.16.1

2026-10-17

  • [#617](https://github.com/pytest-dev/pytest-mock/issues/617) <https://github.com/pytest-dev/pytest-mock/pull/617>_: Fixed assert_has_calls raising ValueError instead of AssertionError (or showing misleading introspection) when the expected calls are plain tuples rather than call(...) objects, such as (args, kwargs) entries of another mock's call_args_list, (args,), (kwargs,), (name, args) or (name, kwargs).
  • [#621](https://github.com/pytest-dev/pytest-mock/issues/621) <https://github.com/pytest-dev/pytest-mock/pull/621>_: Fixed mocker.stop() sometimes stopping the wrong mock, for example with mocks from mocker.create_autospec.
  • [#621](https://github.com/pytest-dev/pytest-mock/issues/621) <https://github.com/pytest-dev/pytest-mock/pull/621>_: mocker.stop() now undoes the most recent patch first when the same object is used in several patches.
  • [#623](https://github.com/pytest-dev/pytest-mock/issues/623) <https://github.com/pytest-dev/pytest-mock/pull/623>_: Fixed misleading introspection in assert_has_awaits failures, and assert_has_calls/assert_has_awaits raising IndexError instead of AssertionError when calls is passed by keyword.
  • [#624](https://github.com/pytest-dev/pytest-mock/issues/624) <https://github.com/pytest-dev/pytest-mock/pull/624>_: Clear spy_return_iter after a spied synchronous or asynchronous function raises, matching spy_return.
  • [#627](https://github.com/pytest-dev/pytest-mock/issues/627) <https://github.com/pytest-dev/pytest-mock/pull/627>_: Document async_stub await assertions and the distinction between call and await tracking.
  • [#629](https://github.com/pytest-dev/pytest-mock/issues/629) <https://github.com/pytest-dev/pytest-mock/pull/629>_: Fixed mocker.resetall() skipping the mocks patched with mocker.patch.multiple(), both the ones it creates and the ones passed explicitly.
  • [#630](https://github.com/pytest-dev/pytest-mock/issues/630) <https://github.com/pytest-dev/pytest-mock/pull/630>_: mocker.resetall() now also resets spy_return and spy_exception of spies, like it already did for spy_return_list and spy_return_iter, and no longer overwrites attributes with these names on mocks that are not spies.
  • [#633](https://github.com/pytest-dev/pytest-mock/issues/633) <https://github.com/pytest-dev/pytest-mock/pull/633>_: Fixed spies on classmethod, staticmethod, builtins and classes returning a MagicMock instead of calling the spied code after mocker.resetall(side_effect=True). Resetting a spy's side_effect now goes back to calling the spied code, also clearing any side_effect set on the spy.
Commits
  • 5c2f207 Release 3.17.0
  • 9625271 Bump the minor version for releases that change existing behavior
  • 34b87ae Drop introspection from assert_has_calls and assert_has_awaits (#643)
  • 866520f Only show introspection for failures about the call arguments (#642)
  • 5ab41c1 Do not chain the original mock error to wrapped assertion failures (#641)
  • 1916b14 Merge pull request #635 from nicoddemus/docs-contributing-resetall
  • 212fcd9 Document resetall, the changelog format and running tests with tox
  • 9374b2c Merge pull request #634 from pytest-dev/release-3.16.1
  • fab730d Release 3.16.1
  • d26d41b Merge pull request #627 from xiehuanyi/docs/async-stub-awaits-20261012-r2
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the uv-updates group with 6 updates
2053740 
Bumps the uv-updates group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [setuptools](https://github.com/pypa/setuptools) | `84.0.0` | `84.2.1` |
| [cyclopts](https://github.com/BrianPugh/cyclopts) | `5.2.0` | `5.3.0` |
| [pip](https://github.com/pypa/pip) | `26.2.1` | `26.2.2` |
| [prek](https://github.com/j178/prek) | `0.5.5` | `0.5.7` |
| [tox](https://github.com/tox-dev/tox) | `4.65.6` | `4.67.1` |
| [pytest-mock](https://github.com/pytest-dev/pytest-mock) | `3.16.0` | `3.17.0` |


Updates `setuptools` from 84.0.0 to 84.2.1
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v84.0.0...v84.2.1)

Updates `cyclopts` from 5.2.0 to 5.3.0
- [Release notes](https://github.com/BrianPugh/cyclopts/releases)
- [Commits](BrianPugh/cyclopts@v5.2.0...v5.3.0)

Updates `pip` from 26.2.1 to 26.2.2
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@26.2.1...26.2.2)

Updates `prek` from 0.5.5 to 0.5.7
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/main/CHANGELOG.md)
- [Commits](j178/prek@v0.5.5...v0.5.7)

Updates `tox` from 4.65.6 to 4.67.1
- [Release notes](https://github.com/tox-dev/tox/releases)
- [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst)
- [Commits](tox-dev/tox@4.65.6...4.67.1)

Updates `pytest-mock` from 3.16.0 to 3.17.0
- [Release notes](https://github.com/pytest-dev/pytest-mock/releases)
- [Changelog](https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-mock@v3.16.0...v3.17.0)

---
updated-dependencies:
- dependency-name: setuptools
  dependency-version: 84.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-updates
- dependency-name: cyclopts
  dependency-version: 5.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv-updates
- dependency-name: pip
  dependency-version: 26.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv-updates
- dependency-name: prek
  dependency-version: 0.5.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv-updates
- dependency-name: tox
  dependency-version: 4.67.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv-updates
- dependency-name: pytest-mock
  dependency-version: 3.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@nacho
nacho merged commit b1c92f8 into main Oct 26, 2026
8 checks passed
@nacho
nacho deleted the dependabot/uv/uv-updates-c38ef84f51 branch October 26, 2026 08:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nacho nacho nacho approved these changes

Assignees

No one assigned

Labels

skip-changelog

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nacho