build(deps): bump the python-deps group across 1 directory with 9 updates

[dependabot]

Bumps the python-deps group with 9 updates in the /apps/api directory:

Package	From	To
pydantic-settings	2.14.2	2.15.0
jsonschema-rs	0.49.6	0.52.0
cryptography	50.0.0	50.0.1
globus-sdk	4.8.1	4.9.0
diff-cover	10.4.1	10.5.1
ruff	0.16.1	0.16.5
httpx2	2.9.1	2.12.0
pre-commit	4.6.1	4.6.2
hypothesis	6.165.2	6.165.10

Updates pydantic-settings from 2.14.2 to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

Highlights

Behavior changes

• case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.
• Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.
• Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.

New features

• Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.
• PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.
• toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.
• Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.
• GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.

Bug fixes

• Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.
• Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.
• Fix AliasPath on nested model fields not JSON-decoding env values (#898).
• Fix case-insensitive matching for optional nested models (#905).
• Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.
• Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).
• Fix Secret subclasses crashing when loaded from the environment (#920).
• Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).
• An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).
• NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).
• GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.
• AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).

Documentation

• Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).
• Recommend an async settings loading pattern (#908).
• Clarify behavior when an unprefixed value is present in a dotenv file (#895).
• Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).

What's Changed

• Update documentation link for Pydantic settings by @​hramezani in pydantic/pydantic-settings#863
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#865
• docs: clarify environment variable helper descriptions by @​vip892766gma in pydantic/pydantic-settings#867
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#870
• Bump the python-packages group with 4 updates by @​dependabot[bot] in pydantic/pydantic-settings#875
• Skip list_secrets call when case_sensitive=True by @​ecerulm in pydantic/pydantic-settings#862
• GoogleSecretManagerSettingsSource: read project_id from previous sources by @​ecerulm in pydantic/pydantic-settings#878

... (truncated)

Commits

• f725ca1 Prepare release 2.15.0 (#930)
• 28f35c2 Bump the python-packages group with 4 updates (#929)
• 9056db0 test: move function-local imports to the top of test modules (#927)
• f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
• ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
• 798dcea Bump the python-packages group with 4 updates (#924)
• a190041 Bump the github-actions group with 4 updates (#925)
• 5d93332 Bump the python-packages group with 4 updates (#921)
• d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
• 2256a4e Bump the python-packages group with 3 updates (#915)
• Additional commits viewable in compare view

Updates jsonschema-rs from 0.49.6 to 0.52.0

Release notes

Sourced from jsonschema-rs's releases.

[CLI] Release 0.52.0

No release notes provided.

[Python] Release 0.52.0

Added

• The offline argument, refusing to fetch references outside registry.

Fixed

• Canonicalization not idempotent where a patternProperties $ref matches a key properties names.
• Type stubs omitting ValidationError.absolute_keyword_location.
• The draft argument and the Draft201909Validator / Draft202012Validator classes gating keywords on the vocabularies of the $schema they override, so the validator accepted every instance.
• is_valid disagreeing with validate, iter_errors, and evaluate on a schema that reaches its own $ref twice, one of them under not.

[Ruby] Release 0.52.0

Added

• The offline: keyword argument, refusing to fetch references outside registry:.

Fixed

• Canonicalization not idempotent where a patternProperties $ref matches a key properties names.
• The draft: keyword argument and the Draft201909Validator / Draft202012Validator classes gating keywords on the vocabularies of the $schema they override, so the validator accepted every instance.
• valid? disagreeing with validate!, each_error, and evaluate on a schema that reaches its own $ref twice, one of them under not.

[Rust] Release 0.52.0

Added

• Evaluation::is_valid.
• Location::is_empty.
• Display for ErrorEntry.
• ValidationOptions::offline and canonical::CanonicalizeOptions::offline, refusing to fetch references outside the registry.
• idna Cargo feature, enabled by default, gating the idn-hostname and idn-email formats. #1313
• CLI: the --offline flag of jsonschema validate, jsonschema bundle and jsonschema dereference.

Changed

• ValidationErrors' Display gained the instance path of each error.
• BREAKING: With default-features = false, the idn-hostname and idn-email formats now require the new idna feature. Without it they are unknown formats, which are accepted by default, or rejected at build time under should_ignore_unknown_formats(false). Add idna to the feature list to keep the previous behavior.

Fixed

• Canonicalization not idempotent where a patternProperties $ref matches a key properties names.
• is_valid disagreeing with validate, iter_errors, and evaluate on a schema that reaches its own $ref twice, one of them under not.
• format: email and format: idn-email rejecting an empty quoted string as the local part (it should be accepted).
• format: email and format: idn-email rejecting an address literal whose IPv6: tag is not written in that exact case (the tag is case-insensitive).
• format: email accepting a non-ASCII character in the local part (it should be rejected).
• ValidationOptions::with_draft gating keywords on the vocabularies of the $schema it overrides, so the validator accepted every instance.

... (truncated)

Changelog

Sourced from jsonschema-rs's changelog.

[0.52.0] - 2026-08-26

Added

• Evaluation::is_valid.
• Location::is_empty.
• Display for ErrorEntry.
• ValidationOptions::offline and canonical::CanonicalizeOptions::offline, refusing to fetch references outside the registry.
• idna Cargo feature, enabled by default, gating the idn-hostname and idn-email formats. #1313
• CLI: the --offline flag of jsonschema validate, jsonschema bundle and jsonschema dereference.

Changed

• ValidationErrors' Display gained the instance path of each error.
• BREAKING: With default-features = false, the idn-hostname and idn-email formats now require the new idna feature. Without it they are unknown formats, which are accepted by default, or rejected at build time under should_ignore_unknown_formats(false). Add idna to the feature list to keep the previous behavior.

Fixed

• Canonicalization not idempotent where a patternProperties $ref matches a key properties names.
• is_valid disagreeing with validate, iter_errors, and evaluate on a schema that reaches its own $ref twice, one of them under not.
• format: email and format: idn-email rejecting an empty quoted string as the local part (it should be accepted).
• format: email and format: idn-email rejecting an address literal whose IPv6: tag is not written in that exact case (the tag is case-insensitive).
• format: email accepting a non-ASCII character in the local part (it should be rejected).
• ValidationOptions::with_draft gating keywords on the vocabularies of the $schema it overrides, so the validator accepted every instance.

Performance

• iter_errors collects into a single buffer instead of allocating and re-boxing an iterator at every schema node.

[0.51.0] - 2026-08-23

Added

• ValidationOptions::with_vocabulary and the vocabularies attribute on jsonschema::validator, declaring support for a vocabulary this crate does not implement.
• The --vocabulary flag of jsonschema validate.

Changed

• Vocabulary gained the FormatAssertion variant, which its Draft 2020-12 URI parses to instead of Vocabulary::Custom, and is marked non_exhaustive.

Fixed

• The uniqueItems length ceiling not reading an items or contains schema written as a $ref.
• The Draft 2020-12 Format-Assertion vocabulary read as an annotation, so a meta-schema requiring it accepted values its format rejects.
• An unrecognized format accepted under a meta-schema requiring the Format-Assertion vocabulary (it should be rejected).
• A meta-schema requiring a vocabulary this crate does not implement accepted (it should be rejected).
• The Draft 2019-09 Format vocabulary declared true read as an annotation, so a meta-schema requiring it accepted values its format rejects.
• The bundled https://json-schema.org/draft/2020-12/meta/format-assertion meta-schema not declaring its vocabulary, so a schema written against it annotated format instead of asserting it.
• A meta-schema without $id keeping its $vocabulary unread, so a schema written against it got every Draft 2020-12 vocabulary.
• A schema naming a bundled vocabulary meta-schema as its $schema rejected as an unknown meta-schema (it should build).

... (truncated)

Commits

• edeb4f2 chore(ruby): Release 0.52.0
• c308025 chore(rust): Release 0.52.0
• 7d8465c feat(cli): the --offline flag of jsonschema validate, jsonschema bundle...
• 5015aa6 docs: Update docs
• 84048dd fix: is_valid disagreeing with validate, iter_errors, and evaluate on...
• 610aa6b fix(python): Type stubs omitting ValidationError.absolute_keyword_location
• 63b8dfa fix: ValidationOptions::with_draft gating keywords on the vocabularies of t...
• 8fc6ff7 fix: Canonicalization not idempotent where a patternProperties $ref match...
• 7368dcf test: Generate random json schemas with hegel
• e6e8b8d fix: Misc email format fixes
• Additional commits viewable in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates globus-sdk from 4.8.1 to 4.9.0

Release notes

Sourced from globus-sdk's releases.

4.9.0

Added

• Add Web Input-related methods to the FlowsClient class. (#1410) The new methods are: list_web_inputs, get_web_input, and respond_to_web_input.

• Added a new flag, sweep, to GlobusApp.logout(). Use logout(sweep=True) to ask the app to clear all tokens found in the app's storage, not only the ones currently in use by the app. The default behavior, sweep=False, is unchanged. (#1417)

Changed

• The resource_server attribute of the clients for Auth, Compute, Flows, Groups, Search, Timers, and Transfer is now annotated as str, rather than the inherited type of str | None. (#1414)

Documentation

• Remove the SpecificFlowClient.run_flow and .update_run methods' label parameter length constraint documentation. (#1408)

• Update the URL to the Flows API documentation. (#1409)

Security

• GitHub Actions security is now checked with zizmor (#1402)

Development

• globus-sdk testing now leverages Sphinx doctest to make select examples testable. (#1406)

Changelog

Sourced from globus-sdk's changelog.

v4.9.0 (2026-08-10)

Added

• Add Web Input-related methods to the FlowsClient class. (:pr:1410)

  The new methods are: list_web_inputs, get_web_input, and respond_to_web_input.

• Added a new flag, sweep, to GlobusApp.logout(). Use logout(sweep=True) to ask the app to clear all tokens found in the app's storage, not only the ones currently in use by the app. The default behavior, sweep=False, is unchanged. (:pr:1417)

Changed

• The resource_server attribute of the clients for Auth, Compute, Flows, Groups, Search, Timers, and Transfer is now annotated as str, rather than the inherited type of str | None. (:pr:1414)

Documentation

• Remove the SpecificFlowClient.run_flow and .update_run methods' label parameter length constraint documentation. (:pr:1408)

• Update the URL to the Flows API documentation. (:pr:1409)

Security

• GitHub Actions security is now checked with zizmor <https://zizmor.sh>_ (:pr:1402)

Development

• globus-sdk testing now leverages Sphinx doctest to make select examples testable. (:pr:1406)

.. _changelog-4.8.1:

Commits

• 68229cc Release v4.9.0 (#1418)
• 4872dc3 (actions) update PR references
• 227c770 Update the auth management example scripts (#1417)
• 3e5a748 Update the create-and-run-flow example scripts (#1416)
• 3f45ff2 Inline FlowsClient construction in examples
• 7b08829 Update the auth management example scripts
• 6736880 Update the create-and-run-flow example scripts
• a3aed17 Introduce GlobusApp.logout(sweep=True) (#1415)
• 297d710 Introduce GlobusApp.logout(sweep=True)
• b5142ae (actions) update PR references
• Additional commits viewable in compare view

Updates diff-cover from 10.4.1 to 10.5.1

Release notes

Sourced from diff-cover's releases.

Vesion 10.5.1

What's Changed

• perf: index the Clover file lookup instead of rescanning per source path by @​Eljees in Bachmann1234/diff_cover#618
• fix: report a missing git instead of an unhandled FileNotFoundError by @​Eljees in Bachmann1234/diff_cover#620

Full Changelog: Bachmann1234/diff_cover@v10.5.0...v10.5.1

Version 10.5.0

What's Changed

• Support PHPUnit clover reports (silently reported as zero coverage) by @​Eljees in Bachmann1234/diff_cover#617

New Contributors

• @​Eljees made their first contribution in Bachmann1234/diff_cover#617

Full Changelog: Bachmann1234/diff_cover@v10.4.2...v10.5.0

Version 10.4.2

What's Changed

• fix(config): honor format option from config file by @​Sanjays2402 in Bachmann1234/diff_cover#612
• fix(plugins): accept reports/options in diff_cover_report_quality hookspec by @​Sanjays2402 in Bachmann1234/diff_cover#613

New Contributors

• @​Sanjays2402 made their first contribution in Bachmann1234/diff_cover#612

Dependencies

• Bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in Bachmann1234/diff_cover#616
• Bump ruff from 0.15.20 to 0.16.0 by @​dependabot[bot] in Bachmann1234/diff_cover#615
• Bump actions/setup-python from 6 to 7 by @​dependabot[bot] in Bachmann1234/diff_cover#614

Full Changelog: Bachmann1234/diff_cover@v10.4.1...v10.4.2

Changelog

Sourced from diff-cover's changelog.

8/16/2026 v10.5.1

• Improve performance by indexing clover files PR 618 Thanks @​Eljees
• Fixes unclear error when git is not on path PR 620 Thanks @​Eljees

8/08/2026 v10.5.0

• Support PHPUnit clover reports PR 617 Thanks @​Eljees

8/06/2026 v10.4.2

• Honor format option from config file- PR 612 Thanks @​Sanjays2402

• Accept reports/options in diff_cover_report_quality hookspec- PR 613 Thanks @​Sanjays2402

7/23/2026 v10.4.1

• Handle low confidence chardet detection for undeclared encodings. Fixes a failing test for chardet 7 and upgrades the tested suite to chardet7 PR 611 (bachmann1234)

7/21/2026 v10.4.0

• Add --branch-coverage flag to diff-cover to treat partially covered branches in Cobertura XML reports as uncovered PR 608 Thanks @​mofr

05/30/2026 v10.3.0

• Add --show-covered flag to highlight covered diff lines in HTML report PR 600 Thanks @​duxiaocheng

• Update readme with cli flags PR 601 Thanks me

05/23/2026 v10.2.1

• Fix --help hiding most CLI options in diff-cover/diff-quality PR 599 Thanks @​duxiaocheng

01/08/2026 v10.2.0

• Fixes issue where diff quality could not be run from subfolders PR 574 Issue 573 Thanks @​eacherkan-via

12/30/2025 v10.1.0

• Add support for floating-point total percentage in reports PR 565 thanks @​tilaven

12/09/2025 v10.0.0

• Remove python 3.9 support
• Add python 3.14 support
• Normalize exlude/include in pyproject.toml to support string or list

11/10/2025 v9.7.2

... (truncated)

Commits

• 14f114d Version 10.5.1
• b360113 fix: report a missing git instead of an unhandled FileNotFoundError (#620)
• 46e8b53 perf: index the Clover file lookup instead of rescanning per source path (#618)
• e34eec3 Version 10.5.0
• 5fc9e82 Support PHPUnit clover reports (silently reported as zero coverage) (#617)
• f6a43b7 Version 10.4.2
• 3fdbf40 fix(plugins): accept reports/options in diff_cover_report_quality hookspec (#...
• 4c44508 fix(config): honor format option from config file (#612)
• b490adc Bump actions/setup-python from 6 to 7 (#614)
• 19da277 Bump ruff from 0.15.20 to 0.16.0 (#615)
• Additional commits viewable in compare view

Updates ruff from 0.16.1 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

... (truncated)

Commits

• 9e4938c Bump 0.16.5 (#28110)
• aad0e90 Allow rules without codes (#28049)
• 5fdab73 Update preview default rules and categories (#27877)
• 29c8e5b Document rule acceptance guidelines (#27910)
• 50a4d7f Document the new category selectors (#27906)
• ada8795 Introduce category selectors (#27666)
• d894723 [ty] Infer lambda parameters through callable type aliases (#28109)
• 2685fde [ty] Narrow functional enum members in == and match (#28103)
• efcffd2 [ty] Intersection simplifications with subtype-related generic specialization...
• eb78048 [ty] Bump ecosystem-analyzer for HTML escaping (#28104)
• Additional commits viewable in compare view

Updates httpx2 from 2.9.1 to 2.12.0

Release notes

Sourced from httpx2's releases.

v2.12.0

Highlights

🛡️ Bounded response decompression

httpx2 now decodes gzip, deflate, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (pydantic/httpx2#1126).

📦 Shared Zstandard API

Python 3.13 and earlier now use backports.zstd, which provides the same bounded incremental decompression API as compression.zstd on Python 3.14 and later (pydantic/httpx2#1146).

httpx2

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier by @​Kludex in pydantic/httpx2#1146

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails by @​Kludex in pydantic/httpx2#1126

httpcore2

No changes since 2.11.0. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.11.0...v2.12.0

v2.11.0

Highlights

🌐 Public origin API

httpx2 now includes an immutable and hashable Origin value object, available through URL.origin. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (pydantic/httpx2#1134).

🛠️ Request compatibility and validation

• Explicit Transfer-Encoding headers now take precedence over body-derived Content-Length headers (pydantic/httpx2#1137).
• Deprecated status code aliases are available again (pydantic/httpx2#1135).
• Multipart part headers are validated before serialization (pydantic/httpx2#1142).

httpx2

Added

• Add the public Origin value object and URL.origin property by @​Kludex in pydantic/httpx2#1134

Changed

• Require Brotli 1.2.0 or later for the brotli extra by @​Kludex in pydantic/httpx2#1141

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.12.0 (August 18th, 2026)

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier. (#1146)

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails. (#1126)

2.11.0 (August 18th, 2026)

Added

• Add the public Origin value object and URL.origin property for normalized, hashable origin comparisons. (#1134)

Changed

• Require Brotli 1.2.0 or later for the brotli extra. (#1141)

Fixed

• Restore deprecated status code aliases. (#1135)
• Extract HTTP/2 release notes from changelog headings correctly. (#1136)
• Respect explicit Transfer-Encoding headers and expose buffered request body lengths to WSGI applications. (#1137)
• Validate multipart part header names and values before serialization. (#1142)

2.10.0 (August 9th, 2026)

Added

• Add support for running on WebAssembly / Emscripten via Pyodide, using a JavaScript fetch-based transport defined in httpx2-jsfetch. (#1119)
• Add max_event_size to cap SSE event buffering. (#1071)
• Add RFC 9110 status code constants. (#1069)
• Add support for Python 3.15. (#1090)

Changed

• Improve SSE chunk buffering performance. (#1117)
• Skip cookie extraction for responses without Set-Cookie headers. (#1107)
• Return str | None instead of Any from Headers.get. (#1121)

Fixed

... (truncated)

Commits

• 71ae23b Version 2.12.0 (#1147)
• 4fd0c70 Decode compressed response bodies incrementally (#1126)
• d588e52 Use backports.zstd on Python 3.13 and earlier (#1146)
• 344589d Version 2.11.0 (#1143)
• de96d81 Validate multipart part headers (#1142)
• 51c3269 Require brotli 1.2.0 in the brotli extra (#1141)
• 829b93a Respect explicit Transfer-Encoding headers (#1137)
• 4fa6c8e Fix changelog extraction regex for H2 release headings (#1136)
• 8a6f370 Restore deprecated status code aliases (#1135)
• d03f1ec Add public Origin API (#1134)
• Additional commits viewable in compare view

Updates pre-commit from 4.6.1 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

• Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.
  • Regressed in 4.6.1.
  • #3737 issue by @​mheiges.
  • #3743 PR by @​asottile.

Commits

• 9767b6c v4.6.2
• 42ee3ff Merge pull request #3743 from pre-commit/npm-build-scripts-11-x
• 3056619 fix language: node for hooks with build scripts and npm 11.x
• See full diff in compare view

Updates hypothesis from 6.165.2 to 6.165.10

Commits

• 6384dee Bump hypothesis version to 6.165.10 and update changelog
• c7ca59d Merge pull request #4864 from dgutson/claude-stateful-and-example
• 3fc38f1 claude: teach /hypothesis about stateful tests and @​example
• 16f24b7 Merge pull request #4862 from Zac-HD/claude/upstream-regex-issues-fkke9q
• 48ce446 Bump hypothesis version to 6.165.9 and update changelog
• d559a69 Merge pull request #4860 from Liam-DeVoe/optimize-single-branch-one-of
• 3a19d89 fix context flag restoration
• 2408c99 drop unecessary empty check
• 3f94912 Clarify re.ASCII wording in changelog entry
• 9d0a9a8 Fix from_regex handling of negative classes, re.ASCII, and zero-min repeats
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.