[dependabot]

Bumps the python-minor-patch group with 11 updates in the / directory:

Package	From	To
ruff	0.16.8	0.17.0
mypy	2.3.1	2.4.0
cyclonedx-bom	7.4.0	7.5.0
semgrep	1.177.0	1.180.0
commitizen	4.18.1	4.19.2
langgraph	1.2.11	1.2.15
pydantic	2.13.5	2.14.1
cryptography	50.0.1	50.0.2
sqlalchemy	2.0.54	2.1.4
sentence-transformers	6.0.1	6.1.0
numpy	2.5.3	2.5.4

Updates ruff from 0.16.8 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

  The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

• Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

  The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

• Remove support for ruff-lsp (#28750)

  Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

• lazy-import-mismatch (TID254)
• lazy-import-immediately-resolved (TID255)
• os-path-commonprefix (RUF071)

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits

• 5b27c1c Bump version to 0.17.0 (#29259)
• 8f362bf Integrate vendored Unicode names into Ruff
• 88a50d6 Revert upstream Unicode loose matching
• 276832a Revert upstream Unicode alias normalization
• 26911ca Vendor unicode_names2 from upstream
• 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
• bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
• 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
• dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
• ef23c9c Update default and latest Python versions for 3.15 (#28792)
• Additional commits viewable in compare view

Updates mypy from 2.3.1 to 2.4.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.4

We've just uploaded mypy 2.4.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Python 3.15 Support

Mypy 2.4 supports running on Python 3.15 and type checking most Python 3.15 features. This includes the new builtin sentinel type for sentinel values (PEP 661), which mypy now supports (see below for details). Lazy imports (PEP 810) and unpacking in comprehensions (PEP 798) are also supported. Closed TypedDicts (PEP 728) have been supported since mypy 2.2, but the extra_items TypedDict argument, also introduced in PEP 728, is still unsupported. Support for extra_items will be added in a future mypy release.

Native Parser Enabled by Default

Mypy now uses the new native parser by default. It's based on the Ruff parser, and it's significantly faster than the legacy parser, which uses the stdlib ast module. The native parser also has other benefits:

• You can target newer Python versions and use recent Python syntax even when running mypy on an older Python version. For example, you can use --python-version 3.15 when running mypy on Python 3.14.
• Stub files can use syntax that is newer than the target Python version. For example, stubs can use the PEP 695 generic class syntax (class Box[T]: ...) when running on or targeting Python 3.10.
• Parallel type checking requires the native parser.

The legacy parser is still available through --no-native-parser, or native_parser = False in the config file (native_parser = false under [tool.mypy] in pyproject.toml). We are planning to remove the legacy parser in early 2027. If you run into a problem with the native parser, please report it on the issue tracker.

Unlike the legacy parser, the native parser doesn't support type comments for variables defined by for and with statements. These type comments are silently ignored, and the types of the variables are

... (truncated)

Commits

• 935ba8a Bump version to 2.4.0
• 334a678 Add link for PR 22066 in mypy 2.4 changelog (#22082)
• fe69660 Finalize mypy 2.4 changelog (#22080)
• 541fd87 Various mypy 2.4 changelog updates (#22077)
• b231182 Update native parser docs (#22078)
• 04fe42c Initial Changelog for Mypy 2.4 (#22071)
• 0617494 Quick fix for non UTF-8 encodings with new parser (#22066)
• b2f9b60 Bump librt to 0.16.0 (#22067)
• 9d798dc Sync typeshed (#22054)
• 0861bb6 Reduce max protocol stack size to 20 (#22053)
• Additional commits viewable in compare view

Updates cyclonedx-bom from 7.4.0 to 7.5.0

Release notes

Sourced from cyclonedx-bom's releases.

v7.5.0 (2026-09-29)

Features

• deps: Support chardet v7 (#1110, e1e1040)

---

What's Changed

• chore: fix dep constriants by @​jkowalleck in CycloneDX/cyclonedx-python#1111
• feat(deps): support chardet v7 by @​tamird in CycloneDX/cyclonedx-python#1110
• chore(deps-dev): Update uv requirement from 0.12.10 to 0.12.17 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1108
• chore(deps): Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 by @​dependabot[bot] in CycloneDX/cyclonedx-python#1103

New Contributors

• @​tamird made their first contribution in CycloneDX/cyclonedx-python#1110

Full Changelog: CycloneDX/cyclonedx-python@v7.4.0...v7.5.0

Changelog

Sourced from cyclonedx-bom's changelog.

v7.5.0 (2026-09-29)

Features

• deps: Support chardet v7 (#1110, e1e1040)

Commits

• fc11987 chore(release): 7.5.0
• 963f80f chore(deps): Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#1103)
• 0bcfff0 chore(deps-dev): Update uv requirement from 0.12.10 to 0.12.17 (#1108)
• e1e1040 feat(deps): support chardet v7 (#1110)
• 1a8a953 chore: fix dep constriants (#1111)
• See full diff in compare view

Updates semgrep from 1.177.0 to 1.180.0

Release notes

Sourced from semgrep's releases.

Release v1.180.0

1.180.0 - 2026-10-07

### Added

• Promoted Dart to GA maturity. Pattern matching for Dart now supports type inference for typed declarations (id_type propagation), boolean operator typing (&&/|| as bool), alias-aware import equivalence (a pattern like http.get(...) matches code that imports package:http/http.dart under any local alias), method-chain ellipsis (obj.foo(). ... .bar()), multi-statement patterns (e.g. $V = get(); ...; eval($V);), and class-body ellipsis (class $X { ... }). (dart-ga-types-equivalences)

### Changed

• Removed support for the QL language (the CodeQL query language): --lang ql and the ql language key in rules, and parsing of .ql and .qll targets, are no longer available. (remove-ql)

### Fixed

• Traced scans using the default parallelism mode no longer hang when the telemetry endpoint is unresponsive or unreachable. (CODE-9946)
• Updated the bundled anyio (4.12.1 to 4.14.2) and urllib3 (2.6.3 to 2.8.0) dependencies to versions with fixes for known security advisories. (deps-anyio-urllib3)

Release v1.179.0

1.179.0 - 2026-10-01

### Added

• Semgrep Supply Chain now parses Bun bun.lock lockfiles (text format, lockfileVersion 1) paired with a package.json manifest, including the dependency relationships between packages. The deprecated binary bun.lockb format is still unsupported. (SC-2419)

### Changed

• Pro: Stabilize file processing order in inter-file analysis, which was previously arbitrary but deterministic. We believe this is very unlikely to affect findings but there is a theoretical path by which it could in certain rare cases. (stabilize)

• c grammar update (v0.24.2):

  • No verified user-facing improvements: Agent feature assessment was not run for this grammar.

  (c-v0.24.2)

• cpp grammar update (v0.23.4):

  • C++ target parsing now supports attributes on namespace definitions and preserves their arguments in the AST.
  • C++ target parsing now supports reference typedef declarators, including references to arrays and functions.
  • C++ target parsing now supports C++20 lambda pack init-captures such as [...values = args] and [&...values = args]. Capture-sensitive matching remains an existing limitation.
  • C++ target parsing now supports GNU inline-assembly output operands that are expressions, including pointer dereferences and array accesses.
  • C++ target parsing now supports composite type arguments in alignas declarations, such as alignas(int *), while preserving the alignment argument.
  • C++ target parsing now accepts single-digit hexadecimal escapes in string literals, such as "\xA", while retaining support for longer hexadecimal escapes.

  (cpp-v0.23.4)

• Update the html grammar to v0.23.2. (html-v0.23.2)

• r grammar update (v1.3.0):

  • R target parsing now supports unary and binary help expressions (?) and exponentiation written with **.
  • R target parsing correctly represents hexadecimal fractional and exponent literals, including imaginary forms, and decimal or exponent notation with the L suffix.
  • R target parsing now supports quoted namespace and slot names, such as "base"::"mean" and x@"slot".
  • R parsing preserves else branches placed on a new line within braced expressions.
  • R string parsing preserves literal newlines and excludes raw-string delimiters from string values. Short hexadecimal and Unicode escape spellings are accepted; escape decoding remains unchanged.

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.180.0 - 2026-10-07

### Added

• Promoted Dart to GA maturity. Pattern matching for Dart now supports type inference for typed declarations (id_type propagation), boolean operator typing (&&/|| as bool), alias-aware import equivalence (a pattern like http.get(...) matches code that imports package:http/http.dart under any local alias), method-chain ellipsis (obj.foo(). ... .bar()), multi-statement patterns (e.g. $V = get(); ...; eval($V);), and class-body ellipsis (class $X { ... }). (dart-ga-types-equivalences)

### Changed

• Removed support for the QL language (the CodeQL query language): --lang ql and the ql language key in rules, and parsing of .ql and .qll targets, are no longer available. (remove-ql)

### Fixed

• Traced scans using the default parallelism mode no longer hang when the telemetry endpoint is unresponsive or unreachable. (CODE-9946)
• Updated the bundled anyio (4.12.1 to 4.14.2) and urllib3 (2.6.3 to 2.8.0) dependencies to versions with fixes for known security advisories. (deps-anyio-urllib3)

1.179.0 - 2026-10-01

### Added

• Semgrep Supply Chain now parses Bun bun.lock lockfiles (text format, lockfileVersion 1) paired with a package.json manifest, including the dependency relationships between packages. The deprecated binary bun.lockb format is still unsupported. (SC-2419)

### Changed

• Pro: Stabilize file processing order in inter-file analysis, which was previously arbitrary but deterministic. We believe this is very unlikely to affect findings but there is a theoretical path by which it could in certain rare cases. (stabilize)

• c grammar update (v0.24.2):

  • No verified user-facing improvements: Agent feature assessment was not run for this grammar.

  (c-v0.24.2)

• cpp grammar update (v0.23.4):

  • C++ target parsing now supports attributes on namespace definitions and preserves their arguments in the AST.
  • C++ target parsing now supports reference typedef declarators, including references to arrays and functions.
  • C++ target parsing now supports C++20 lambda pack init-captures such as [...values = args] and [&...values = args]. Capture-sensitive matching remains an existing limitation.
  • C++ target parsing now supports GNU inline-assembly output operands that are expressions, including pointer dereferences and array accesses.
  • C++ target parsing now supports composite type arguments in alignas declarations, such as alignas(int *), while preserving the alignment argument.
  • C++ target parsing now accepts single-digit hexadecimal escapes in string literals, such as "\xA", while retaining support for longer hexadecimal escapes.

  (cpp-v0.23.4)

• Update the html grammar to v0.23.2. (html-v0.23.2)

• r grammar update (v1.3.0):

  • R target parsing now supports unary and binary help expressions (?) and exponentiation written with **.
  • R target parsing correctly represents hexadecimal fractional and exponent literals, including imaginary forms, and decimal or exponent notation with the L suffix.
  • R target parsing now supports quoted namespace and slot names, such as "base"::"mean" and x@"slot".
  • R parsing preserves else branches placed on a new line within braced expressions.
  • R string parsing preserves literal newlines and excludes raw-string delimiters from string values. Short hexadecimal and Unicode escape spellings are accepted; escape decoding remains unchanged.
  • R parsing preserves omitted argument positions in calls and subscripts, and retains the indexed expression for single-index subscripts.

... (truncated)

Commits

• a35fe83 chore: release 1.180.0
• b253ccb metrics: add scan.args.secretssemgrep/semgrep-proprietary#7189
• d4ca45fsemgrep/semgrep-proprietary#7188
• 4802833semgrep/semgrep-proprietary#7166
• 84f4256 test: re-apply disabling automatic maintenance in temporary Git repositories ...
• 0d4e9b1 feat(dart): promote to GA with type/import equivalences (semgrep/semgrep-prop...
• 2cb9a3dsemgrep/semgrep-proprietary#7185
• 5809414semgrep/semgrep-proprietary#7124
• c9ebd1a fix: import OSS commits through destination LFS filters (semgrep/semgrep-prop...
• 3a2e378semgrep/semgrep-proprietary#7179
• Additional commits viewable in compare view

Updates commitizen from 4.18.1 to 4.19.2

Release notes

Sourced from commitizen's releases.

v4.19.2 (2026-10-07)

Fix

• tags: give ignored tag formats precedence over version formats

v4.19.1 (2026-10-03)

Refactor

• bump: use VersionIncrement ordering for bump detection (#2097)

v4.19.0 (2026-09-22)

Feat

• add extensible commit filters

Changelog

Sourced from commitizen's changelog.

v4.19.2 (2026-10-07)

Fix

• tags: give ignored tag formats precedence over version formats

v4.19.1 (2026-10-03)

Refactor

• bump: use VersionIncrement ordering for bump detection (#2097)

v4.19.0 (2026-09-22)

Feat

• add extensible commit filters

Commits

• 57217c3 bump: version 4.19.1 → 4.19.2
• 6ef4a34 fix(tags): give ignored tag formats precedence over version formats
• 2bcb46f ci(deps): bump gitpython from 3.1.59 to 3.1.62 (#2103)
• d7aabd4 ci(deps): bump virtualenv from 21.2.0 to 21.7.13 (#2102)
• b90e2d3 ci(deps): bump urllib3 from 2.7.0 to 2.8.0 (#2101)
• f565e81 docs(cli/screenshots): update CLI screenshots
• b2eb0cb bump: version 4.19.0 → 4.19.1
• 667de74 refactor(bump): use VersionIncrement ordering for bump detection (#2097)
• 642b8be docs: add galaxy provider plugin docs (#2096)
• cc2f522 docs: document additional_dependencies for pre-commit plugin hooks
• Additional commits viewable in compare view

Updates langgraph from 1.2.11 to 1.2.15

Release notes

Sourced from langgraph's releases.

langgraph==1.2.15

Changes since 1.2.14

• release(langgraph): 1.2.15 (#9283)
• fix(langgraph): give every message written to a messages DeltaChannel an id (#9275)
• fix(langgraph): save a cached node's writes like a node that ran (#9259)
• fix(langgraph): stop at an interrupt_before breakpoint when a drain is requested before it (#9281)
• fix(langgraph): keep an exit run from a checkpoint the thread moved past out of its newer branch (#9269)
• fix(langgraph): store an update_state input's writes on the checkpoint it updates (#9258)
• fix(langgraph): read a run's DeltaChannel input back only on its own checkpoints (#9260)
• fix(langgraph): snapshot a DeltaChannel that an update_state Overwrite resets (#9263)
• fix(langgraph): keep a fork's DeltaChannel snapshot from starting nodes that never ran (#9264)
• fix(langgraph): don't save a checkpoint past a failed DeltaChannel write (#9235)
• fix(langgraph,prebuilt): stop ToolNode from swallowing invalid resume values (#9232)
• fix(langgraph): never store exit-mode delta writes under the null task id (#9229)
• fix(langgraph): stop astream_events dropping control/interrupts on v1/v2 (#9219)
• chore(deps): bump notebook from 7.5.7 to 7.6.3 in /libs/langgraph (#9206)
• fix(langgraph): give each bulk_update_state update its own task id (#9128)
• fix(langgraph): replay a resumed exit-mode run's delta writes in live order (#9114)
• fix: order delta channel replay by task path (#8544)

langgraph==1.2.14

Changes since 1.2.13

• release(langgraph): 1.2.14 (#9215)

langgraph==1.2.13

Changes since 1.2.12

• fix(langgraph): fork before replaying an update checkpoint the thread moved past (#9170)
• fix(langgraph): keep an update_state on an older checkpoint out of its other branches (#9165)
• fix(langgraph): keep DeltaChannel counters on every update_state path (#9142)
• release(langgraph): 1.2.13 (#9205)
• fix(langgraph): don't walk history for a DeltaChannel that was never written (#9141)
• fix(langgraph): don't replay an abandoned branch into a DeltaChannel fork (#8548)
• chore(deps): bump notebook from 7.5.6 to 7.5.7 in /libs/langgraph (#9168)
• fix(langgraph): hydrate subgraph delta channels with the caller-resolved saver (#8538)
• fix(langgraph): stop reporting answered interrupts in get_state (#9103)
• chore(deps-dev): bump the minor-and-patch group across 1 directory with 5 updates (#9155)
• chore(deps-dev): bump the minor-and-patch group in /libs/checkpoint-conformance with 2 updates (#9145)
• chore(deps): bump the minor-and-patch group in /libs/sdk-py with 5 updates (#9149)
• chore(deps): bump tornado from 6.5.8 to 6.5.9 in /libs/langgraph (#9160)
• chore(deps-dev): bump types-requests from 2.33.0.20260712 to 2.33.0.20260906 in /libs/langgraph (#9156)
• chore(deps): bump pyjwt from 2.15.0 to 2.15.1 in /libs/langgraph (#9140)
• chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/langgraph (#9138)
• chore(deps): bump pyjwt from 2.14.0 to 2.15.0 in /libs/langgraph (#9139)
• chore(deps): bump pyjwt from 2.13.0 to 2.14.0 in /libs/langgraph (#9126)

langgraph==1.2.12

Changes since 1.2.11

... (truncated)

Commits

• 08a3456 release(langgraph): 1.2.15 (#9283)
• b7d053b fix(langgraph): give every message written to a messages DeltaChannel an id (...
• 395c145 fix(langgraph): save a cached node's writes like a node that ran (#9259)
• 10f1fab fix(langgraph): stop at an interrupt_before breakpoint when a drain is reques...
• 799c2f0 fix(langgraph): keep an exit run from a checkpoint the thread moved past out ...
• b4991f1 fix(langgraph): store an update_state input's writes on the checkpoint it upd...
• 6aa0afb fix(checkpoint): default InMemorySaver delta history to the latest checkpoint...
• 12aeb0f fix(langgraph): read a run's DeltaChannel input back only on its own checkpoi...
• d05236f fix(langgraph): snapshot a DeltaChannel that an update_state Overwrite resets...
• 9d92f33 fix(langgraph): keep a fork's DeltaChannel snapshot from starting nodes that ...
• Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• Additional commits viewable in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.
.. _v50-0-1:

Commits

• 4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
• 70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
• a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
• See full diff in compare view

Updates sqlalchemy from 2.0.54 to 2.1.4

Release notes

Sourced from sqlalchemy's releases.

2.1.4

Released: October 7, 2026

orm

• [orm] [bug] [regression] Fixed regression caused by #13333 where assigning a MetaData object to the metadata attribute of a mapped Declarative class, in order to place that class's Table in a MetaData collection other than that of the _orm.registry, would emit a warning that the attribute name metadata should be left reserved. The warning is now emitted only when the metadata attribute is assigned to an object other than a MetaData.

  References: #13659

engine

• [engine] [bug] [regression] Fixed regression from the 1.4 series where the DBAPI cursor used for a compiled statement that returns no rows, which includes DDL constructs such as CreateTable and DropTable as well as the SAVEPOINT, ROLLBACK TO SAVEPOINT and RELEASE SAVEPOINT statements emitted by _engine.Connection.begin_nested(), was not closed after execution, and was instead left to be released when garbage collected. The cursor is now closed immediately, as was the case in 1.3 and as is already the case for INSERT, UPDATE, DELETE and _sql.text() statements.

  This change is also backported to: 2.0.55

  References: #13640

• [engine] [bug] Fixed issue in the _engine.Connection.execution_options.logging_token option where setting the value to None or another false value would raise AttributeError if a logging token had not already been established on that _engine.Connection, such as on a newly checked out connection, when the option was set at the _engine.Engine level, or when the token was reset to None more than once. Regression introduced in 2.0.30 as part of #11210.

  This change is also backported to: 2.0.55

  References: #13641

• [engine] [bug] [regression] Fixed regression where iterating a Result directly would create reference cycles that prevented the <...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.