build(deps): bump the uv group across 2 directories with 9 updates by dependabot[bot] · Pull Request #3413 · BoundaryML/baml

dependabot · 2026-04-25T02:34:27Z

Bumps the uv group with 7 updates in the /integ-tests/python directory:

Package	From	To
pytest	`8.3.3`	`8.4.2`
python-dotenv	`1.0.1`	`1.2.1`
flask	`3.0.3`	`3.1.3`
requests	`2.32.3`	`2.32.5`
pip	`25.1.1`	`26.0.1`
h11	`0.14.0`	`0.16.0`
pyasn1	`0.6.1`	`0.6.3`

Bumps the uv group with 1 update in the /integ-tests/python-v1 directory: pydantic.

Updates pytest from 8.3.3 to 8.4.2

Release notes

Sourced from pytest's releases.

8.4.2

pytest 8.4.2 (2025-09-03)

Bug fixes

#13478: Fixed a crash when using console_output_style{.interpreted-text role="confval"} with times and a module is skipped.

#13530: Fixed a crash when using pytest.approx{.interpreted-text role="func"} and decimal.Decimal{.interpreted-text role="class"} instances with the decimal.FloatOperation{.interpreted-text role="class"} trap set.

#13549: No longer evaluate type annotations in Python 3.14 when inspecting function signatures.

This prevents crashes during module collection when modules do not explicitly use from __future__ import annotations and import types for annotations within a if TYPE_CHECKING: block.

#13559: Added missing [int]{.title-ref} and [float]{.title-ref} variants to the [Literal]{.title-ref} type annotation of the [type]{.title-ref} parameter in pytest.Parser.addini{.interpreted-text role="meth"}.

#13563: pytest.approx{.interpreted-text role="func"} now only imports numpy if NumPy is already in sys.modules. This fixes unconditional import behavior introduced in [8.4.0]{.title-ref}.

Improved documentation

#13577: Clarify that pytest_generate_tests is discovered in test modules/classes; other hooks must be in conftest.py or plugins.

Contributor-facing changes

#13480: Self-testing: fixed a few test failures when run with -Wdefault or a similar override.

#13547: Self-testing: corrected expected message for test_doctest_unexpected_exception in Python 3.14.

#13684: Make pytest's own testsuite insensitive to the presence of the CI environment variable -- by ogrisel{.interpreted-text role="user"}.

8.4.1

pytest 8.4.1 (2025-06-17)

Bug fixes

#13461: Corrected _pytest.terminal.TerminalReporter.isatty to support being called as a method. Before it was just a boolean which could break correct code when using -o log_cli=true).

#13477: Reintroduced pytest.PytestReturnNotNoneWarning{.interpreted-text role="class"} which was removed by accident in pytest [8.4]{.title-ref}.

This warning is raised when a test functions returns a value other than None, which is often a mistake made by beginners.

See return-not-none{.interpreted-text role="ref"} for more information.

#13497: Fixed compatibility with Twisted 25+.

Improved documentation

#13492: Fixed outdated warning about faulthandler not working on Windows.

8.4.0

pytest 8.4.0 (2025-06-02)

... (truncated)

Commits

bfae422 Prepare release version 8.4.2
8990538 Fix passenv CI in tox ini and make tests insensitive to the presence of the C...
ca676bf Merge pull request #13687 from pytest-dev/patchback/backports/8.4.x/e63f6e51c...
975a60a Merge pull request #13686 from pytest-dev/patchback/backports/8.4.x/12bde8af6...
7723ce8 Merge pull request #13683 from even-even/fix_Exeption_to_Exception_in_errorMe...
b7f0568 Merge pull request #13685 from CoretexShadow/fix/docs-pytest-generate-tests
2c94c4a add missing colon (#13640) (#13641)
c3d7684 Merge pull request #13606 from pytest-dev/patchback/backports/8.4.x/5f9938563...
dc6e3be Merge pull request #13605 from The-Compiler/training-update-2025-07
f87289c Fix crash with times output style and skipped module (#13573) (#13579)
Additional commits viewable in compare view

Updates python-dotenv from 1.0.1 to 1.2.1

Release notes

Sourced from python-dotenv's releases.

v1.2.1

What's Changed

Support reading .env from FIFOs (Unix) by @sidharth-sudhir in theskumar/python-dotenv#586

Update CI to use trusted publishing on PyPI

New Contributors

@sidharth-sudhir made their first contribution in theskumar/python-dotenv#586

Full Changelog: theskumar/python-dotenv@v1.2.0...v1.2.1

v1.2.0

What's Changed

style: upgrade to use ruff by @theskumar in theskumar/python-dotenv#567

Use sys.exit() instead of exit() by @theskumar in theskumar/python-dotenv#568

feat: add PYTHON_DOTENV_DISABLED flag to disable load_dotenv (fixes #510) by @matthewfranglen in theskumar/python-dotenv#569

Added Python@3.14: Github CI & tox.ini by @23f3001135 in theskumar/python-dotenv#579

ocs: clarify what load_dotenv() does in README by @cybercoded in theskumar/python-dotenv#575

Bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in theskumar/python-dotenv#577

Move project metadata and config to pyproject.toml by @EpicWink in theskumar/python-dotenv#583

New Contributors

@matthewfranglen made their first contribution in theskumar/python-dotenv#569

@23f3001135 made their first contribution in theskumar/python-dotenv#579

@cybercoded made their first contribution in theskumar/python-dotenv#575

@EpicWink made their first contribution in theskumar/python-dotenv#583

Full Changelog: theskumar/python-dotenv@v1.1.1...v1.2.0

v1.1.1

What's Changed

fix: ensure find_dotenv work reliably on python 3.13 by @theskumar in theskumar/python-dotenv#563

fix(cli): issue with execvpe on Windows by @wrongontheinternet in theskumar/python-dotenv#566

New Contributors

@wrongontheinternet made their first contribution in theskumar/python-dotenv#566

Full Changelog: theskumar/python-dotenv@v1.1.0...v1.1.1

v1.1.0

What's Changed

Add a security policy by @bbc2 in theskumar/python-dotenv#512

Keep GitHub Actions up to date with GitHub's Dependabot by @cclauss in theskumar/python-dotenv#506

ci: fix multiline string in test.yml & use fail-fast strategy by @cclauss in theskumar/python-dotenv#514

Enhance dotenv run: Switch to execvpe for better resource management and signal handling by @eekstunt in theskumar/python-dotenv#523

ci: add py3.13 to test.yml by @waketzheng in theskumar/python-dotenv#527

Add Python 3.13 trove classifier by @edgarrmondragon in theskumar/python-dotenv#535

Bump the github-actions group with 2 updates by @dependabot in theskumar/python-dotenv#529

Add support for python 3.13 and drop 3.8 by @theskumar in theskumar/python-dotenv#551

docs: Update README.md by @chapeupreto in theskumar/python-dotenv#516

Some more s/Python-dotenv/python-dotenv/ by @theskumar in theskumar/python-dotenv#552

... (truncated)

Changelog

Sourced from python-dotenv's changelog.

[1.2.1] - 2025-10-26

Move more config to pyproject.toml, removed setup.cfg

Add support for reading .env from FIFOs (Unix) by [@sidharth-sudhir] in #586

[1.2.0] - 2025-10-26

Upgrade build system to use PEP 517 & PEP 518 to use build and pyproject.toml by [@EpicWink] in #583

Add support for Python 3.14 by [@23f3001135] in #579

Add support for disabling of load_dotenv() using PYTHON_DOTENV_DISABLED env var. by [@matthewfranglen] in #569

[1.1.1] - 2025-06-24

Fixed

CLI: Ensure find_dotenv work reliably on python 3.13 by [@theskumar] in #563

CLI: revert the use of execvpe on Windows by [@wrongontheinternet] in #566

[1.1.0] - 2025-03-25

Added

Add support for python 3.13

Enhance dotenv run, switch to execvpe for better resource management and signal handling (#523) by [@eekstunt]

Fixed

find_dotenv and load_dotenv now correctly looks up at the current directory when running in debugger or pdb (#553 by [@randomseed42])

Misc

Drop support for Python 3.8

Commits

eaf2a91 Do not remove .coverage file
8716196 Bump version: 1.2.0 → 1.2.1
b87807f Update changelog
3af77d3 Support reading .env from FIFOs (Unix) (#586)
467ee22 Fix test failures after moving config to pyproject.toml
76999e7 Move more config pyproject.toml
222ce2c Update to use trusted publisher on pypi
8ed4f79 Update docs requirements
5bf8822 Bump version: 1.1.1 → 1.2.0
1fe11cc upadate changelog
Additional commits viewable in compare view

Updates flask from 3.0.3 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

stream_with_context does not fail inside async views. #5774

When using follow_redirects in the test client, the final state of session is correct. #5786

Relax type hint for passing bytes IO to send_file. #5776

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. #5645

flask --help loads the app and plugins first to make sure all commands are shown. #5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI: https://pypi.org/project/Flask/3.1.0/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0 Milestone: https://github.com/pallets/flask/milestone/33?closed=1

Drop support for Python 3.8. #5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. #5624, #5633

Provide a configuration option to control automatic option responses. #5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. #5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation about resource limits to the security page. #5625

Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. #5472

-e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. #5628

Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. #5621

Fix how setting host_matching=True or subdomain_matching=False interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to only that domain. #5553

Request.trusted_hosts is checked during routing, and can be set through the TRUSTED_HOSTS config. #5636

Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

stream_with_context does not fail inside async views. :issue:5774

When using follow_redirects in the test client, the final state of session is correct. :issue:5786

Relax type hint for passing bytes IO to send_file. :issue:5776

Version 3.1.1

Released 2025-05-13

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. :issue:5645

flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659

Version 3.1.0

Released 2024-11-13

Drop support for Python 3.8. :pr:5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633

Provide a configuration option to control automatic option responses. :pr:5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. :issue:5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added

... (truncated)

Commits

22d9247 release version 3.1.3
089cb86 Merge commit from fork
c17f379 request context tracks session access
27be933 start version 3.1.3
4e652d3 Abort if the instance folder cannot be created (#5903)
3d03098 Abort if the instance folder cannot be created
407eb76 document using gevent for async (#5900)
ac5664d document using gevent for async
4f79d5b Increase required flit_core version to 3.11 (#5865)
fe3b215 Increase required flit_core version to 3.11
Additional commits viewable in compare view

Updates pytest from 8.3.3 to 8.4.2

Release notes

Sourced from pytest's releases.

8.4.2

pytest 8.4.2 (2025-09-03)

Bug fixes

#13478: Fixed a crash when using console_output_style{.interpreted-text role="confval"} with times and a module is skipped.

#13530: Fixed a crash when using pytest.approx{.interpreted-text role="func"} and decimal.Decimal{.interpreted-text role="class"} instances with the decimal.FloatOperation{.interpreted-text role="class"} trap set.

#13549: No longer evaluate type annotations in Python 3.14 when inspecting function signatures.

This prevents crashes during module collection when modules do not explicitly use from __future__ import annotations and import types for annotations within a if TYPE_CHECKING: block.

#13559: Added missing [int]{.title-ref} and [float]{.title-ref} variants to the [Literal]{.title-ref} type annotation of the [type]{.title-ref} parameter in pytest.Parser.addini{.interpreted-text role="meth"}.

#13563: pytest.approx{.interpreted-text role="func"} now only imports numpy if NumPy is already in sys.modules. This fixes unconditional import behavior introduced in [8.4.0]{.title-ref}.

Improved documentation

#13577: Clarify that pytest_generate_tests is discovered in test modules/classes; other hooks must be in conftest.py or plugins.

Contributor-facing changes

#13480: Self-testing: fixed a few test failures when run with -Wdefault or a similar override.

#13547: Self-testing: corrected expected message for test_doctest_unexpected_exception in Python 3.14.

#13684: Make pytest's own testsuite insensitive to the presence of the CI environment variable -- by ogrisel{.interpreted-text role="user"}.

8.4.1

pytest 8.4.1 (2025-06-17)

Bug fixes

#13461: Corrected _pytest.terminal.TerminalReporter.isatty to support being called as a method. Before it was just a boolean which could break correct code when using -o log_cli=true).

#13477: Reintroduced pytest.PytestReturnNotNoneWarning{.interpreted-text role="class"} which was removed by accident in pytest [8.4]{.title-ref}.

This warning is raised when a test functions returns a value other than None, which is often a mistake made by beginners.

See return-not-none{.interpreted-text role="ref"} for more information.

#13497: Fixed compatibility with Twisted 25+.

Improved documentation

#13492: Fixed outdated warning about faulthandler not working on Windows.

8.4.0

pytest 8.4.0 (2025-06-02)

... (truncated)

Commits

bfae422 Prepare release version 8.4.2
8990538 Fix passenv CI in tox ini and make tests insensitive to the presence of the C...
ca676bf Merge pull request #13687 from pytest-dev/patchback/backports/8.4.x/e63f6e51c...
975a60a Merge pull request #13686 from pytest-dev/patchback/backports/8.4.x/12bde8af6...
7723ce8 Merge pull request #13683 from even-even/fix_Exeption_to_Exception_in_errorMe...
b7f0568 Merge pull request #13685 from CoretexShadow/fix/docs-pytest-generate-tests
2c94c4a add missing colon (#13640) (#13641)
c3d7684 Merge pull request #13606 from pytest-dev/patchback/backports/8.4.x/5f9938563...
dc6e3be Merge pull request #13605 from The-Compiler/training-update-2025-07
f87289c Fix crash with times output style and skipped module (#13573) (#13579)
Additional commits viewable in compare view

Updates python-dotenv from 1.0.1 to 1.2.1

Release notes

Sourced from python-dotenv's releases.

v1.2.1

What's Changed

Support reading .env from FIFOs (Unix) by @sidharth-sudhir in theskumar/python-dotenv#586

Update CI to use trusted publishing on PyPI

New Contributors

@sidharth-sudhir made their first contribution in theskumar/python-dotenv#586

Full Changelog: theskumar/python-dotenv@v1.2.0...v1.2.1

v1.2.0

What's Changed

style: upgrade to use ruff by @theskumar in theskumar/python-dotenv#567

Use sys.exit() instead of exit() by @theskumar in theskumar/python-dotenv#568

feat: add PYTHON_DOTENV_DISABLED flag to disable load_dotenv (fixes #510) by @matthewfranglen in theskumar/python-dotenv#569

Added Python@3.14: Github CI & tox.ini by @23f3001135 in theskumar/python-dotenv#579

ocs: clarify what load_dotenv() does in README by @cybercoded in theskumar/python-dotenv#575

Bump the github-actions group across 1 directory with 2 updates by @dependabot[bot] in theskumar/python-dotenv#577

Move project metadata and config to pyproject.toml by @EpicWink in theskumar/python-dotenv#583

New Contributors

@matthewfranglen made their first contribution in theskumar/python-dotenv#569

@23f3001135 made their first contribution in theskumar/python-dotenv#579

@cybercoded made their first contribution in theskumar/python-dotenv#575

@EpicWink made their first contribution in theskumar/python-dotenv#583

Full Changelog: theskumar/python-dotenv@v1.1.1...v1.2.0

v1.1.1

What's Changed

fix: ensure find_dotenv work reliably on python 3.13 by @theskumar in theskumar/python-dotenv#563

fix(cli): issue with execvpe on Windows by @wrongontheinternet in theskumar/python-dotenv#566

New Contributors

@wrongontheinternet made their first contribution in theskumar/python-dotenv#566

Full Changelog: theskumar/python-dotenv@v1.1.0...v1.1.1

v1.1.0

What's Changed

Add a security policy by @bbc2 in theskumar/python-dotenv#512

Keep GitHub Actions up to date with GitHub's Dependabot by @cclauss in theskumar/python-dotenv#506

ci: fix multiline string in test.yml & use fail-fast strategy by @cclauss in theskumar/python-dotenv#514

Enhance dotenv run: Switch to execvpe for better resource management and signal handling by @eekstunt in theskumar/python-dotenv#523

ci: add py3.13 to test.yml by @waketzheng in theskumar/python-dotenv#527

Add Python 3.13 trove classifier by @edgarrmondragon in theskumar/python-dotenv#535

Bump the github-actions group with 2 updates by @dependabot in theskumar/python-dotenv#529

Add support for python 3.13 and drop 3.8 by @theskumar in theskumar/python-dotenv#551

docs: Update README.md by @chapeupreto in theskumar/python-dotenv#516

Some more s/Python-dotenv/python-dotenv/ by @theskumar in theskumar/python-dotenv#552

... (truncated)

Changelog

Sourced from python-dotenv's changelog.

[1.2.1] - 2025-10-26

Move more config to pyproject.toml, removed setup.cfg

Add support for reading .env from FIFOs (Unix) by [@sidharth-sudhir] in #586

[1.2.0] - 2025-10-26

Upgrade build system to use PEP 517 & PEP 518 to use build and pyproject.toml by [@EpicWink] in #583

Add support for Python 3.14 by [@23f3001135] in #579

Add support for disabling of load_dotenv() using PYTHON_DOTENV_DISABLED env var. by [@matthewfranglen] in #569

[1.1.1] - 2025-06-24

Fixed

CLI: Ensure find_dotenv work reliably on python 3.13 by [@theskumar] in #563

CLI: revert the use of execvpe on Windows by [@wrongontheinternet] in #566

[1.1.0] - 2025-03-25

Added

Add support for python 3.13

Enhance dotenv run, switch to execvpe for better resource management and signal handling (#523) by [@eekstunt]

Fixed

find_dotenv and load_dotenv now correctly looks up at the current directory when running in debugger or pdb (#553 by [@randomseed42])

Misc

Drop support for Python 3.8

Commits

eaf2a91 Do not remove .coverage file
8716196 Bump version: 1.2.0 → 1.2.1
b87807f Update changelog
3af77d3 Support reading .env from FIFOs (Unix) (#586)
467ee22 Fix test failures after moving config to pyproject.toml
76999e7 Move more config pyproject.toml
222ce2c Update to use trusted publisher on pypi
8ed4f79 Update docs requirements
5bf8822 Bump version: 1.1.1 → 1.2.0
1fe11cc upadate changelog
Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.32.5

Release notes

Sourced from requests's releases.

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

v2.32.4

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file. (#6965)

Improvements

Numerous documentation improvements

Deprecations

Added support for pypy 3.11 for Linux and macOS. (#6926)

Dropped support for pypy 3.9 following its end of support. (#6926)

Changelog

Sourced from requests's changelog.

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

Improvements

Numerous documentation improvements

Deprecations

Added support for pypy 3.11 for Linux and macOS.

Dropped support for pypy 3.9 following its end of support.

Commits

b25c87d v2.32.5
131e506 Merge pull request #7010 from psf/dependabot/github_actions/actions/checkout-...
b336cb2 Bump actions/checkout from 4.2.0 to 5.0.0
46e939b Update publish workflow to use artifact-id instead of name
4b9c546 Merge pull request #6999 from psf/dependabot/github_actions/step-security/har...
7618dbe Bump step-security/harden-runner from 2.12.0 to 2.13.0
2edca11 Add support for Python 3.14 and drop support for Python 3.8 (#6993)
fec96cd Update Makefile rules (#6996)
d58d8aa docs: clarify timeout parameter uses seconds in Session.request (#6994)
91a3eab Bump github/codeql-action from 3.28.5 to 3.29.0
Additional commits viewable in compare view

Updates pip from 25.1.1 to 26.0.1

Changelog

Sourced from pip's changelog.

26.0.1 (2026-02-04)

Bug Fixes

Fix --pre not being respected from the command line when a requirement file includes an option e.g. -extra-index-url. ([#13788](https://github.com/pypa/pip/issues/13788) <https://github.com/pypa/pip/issues/13788>_)

26.0 (2026-01-30)

Deprecations and Removals

Remove support for non-bare project names in egg fragments. Affected users should use the Direct URL requirement syntax <https://packaging.python.org/en/latest/specifications/version-specifiers/#direct-references>. ([#13157](https://github.com/pypa/pip/issues/13157) <https://github.com/pypa/pip/issues/13157>)

Features

Display pip's command-line help in colour, if possible. ([#12134](https://github.com/pypa/pip/issues/12134) <https://github.com/pypa/pip/issues/12134>_)

Support installing dependencies declared with inline script metadata (:pep:723) with --requirements-from-script. ([#12891](https://github.com/pypa/pip/issues/12891) <https://github.com/pypa/pip/issues/12891>_)

Add --all-releases and --only-final options to control pre-release and final release selection during package installation. ([#13221](https://github.com/pypa/pip/issues/13221) <https://github.com/pypa/pip/issues/13221>_)

Add --uploaded-prior-to option to only consider packages uploaded prior to a given datetime when the upload-time field is available from a remote index. ([#13625](https://github.com/pypa/pip/issues/13625) <https://github.com/pypa/pip/issues/13625>_)

Add --use-feature inprocess-build-deps to request that build dependencies are installed within the same pip install process. This new mechanism is faster, supports --no-clean and --no-cache-dir reliably, and supports prompting for authentication.

Enabling this feature will also enable --use-feature build-constraints. This feature will become the default in a future pip version. ([#9081](https://github.com/pypa/pip/issues/9081) <https://github.com/pypa/pip/issues/9081>_)

pip cache purge and pip cache remove now clean up empty directories and legacy files left by older pip versions. ([#9058](https://github.com/pypa/pip/issues/9058) <https://github.com/pypa/pip/issues/9058>_)

Bug Fixes

Fix selecting pre-release versions when only pre-releases match. For example, package>1.0 with versions 1.0, 2.0rc1 now installs 2.0rc1 instead of failing. ([#13746](https://github.com/pypa/pip/issues/13746) <https://github.com/pypa/pip/issues/13746>_)

Revisions in version control URLs now must be percent-encoded. For example, use git+https://example.com/repo.git@issue%231 to specify the branch issue#1. If you previously used a branch name containing a % character in a version control URL, you now need to replace it with %25 to ensure correct percent-encoding. ([#13407](https://github.com/pypa/pip/issues/13407) <https://github.com/pypa/pip/issues/13407>_)

Preserve original casing when a path is displayed. ([#6823](https://github.com/pypa/pip/issues/6823) <https://github.com/pypa/pip/issues/6823>_)

Fix bash completion when the $IFS variable has been modified from its default. ([#13555](https://github.com/pypa/pip/issues/13555) <https://github.com/pypa/pip/issues/13555>_)

Precompute Python requirements on each candidate, reducing time of long resolutions. ([#13656](https://github.com/pypa/pip/issues/13656) <https://github.com/pypa/pip/issues/13656>_)

Skip redundant work converting version objects to strings when using the

... (truncated)

Commits

5fe4ea4 Bump for release
bea3cbe windows fix tests
ed22252 News Entry
af13274 Match release control behavior to the same as format control behavior
2f4d4a8 Merge pull request #13779 from notatallshaw/fix-26.0-news
04307a4 fix 26.0 news
6ec7b0a Merge pull request #13775 from notatallshaw/release/26.0
4104356 Bump for release
58be883 Update AUTHORS.txt
66f2dec Merge pull request #13778 from ichard26/docs/groups
Additional commits viewable in compare view

Updates h11 from 0.14.0 to 0.16.0

Commits

1c5b075 this time for surer
d9c3699 this time for sure...
d91b9dd blacken
5a4683c Soothe mypy
9c9567f Bump version to 0.16.0
114803a Merge commit from fork
9462006 Bump version to 0.15.0
70a96be Merge pull request #181 from Julien00859/Julien00859/get_int_max_str_digits
60782ad Reject Content-Length longer 1 billion TB
dff7cc3 Validate Chunked-Encoding chunk footer
Additional commits viewable in compare view

Updates pyasn1 from 0.6.1 to 0.6.3

Release notes

Sourced from pyasn1's releases.

Release 0.6.3

It's a minor release.

Added nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (CVE-2026-30922).

Fixed OverflowError from oversized BER length field.

Fixed DeprecationWarning stacklevel for deprecated attributes.

Fixed asDateTime incorrect fractional seconds parsing.

All changes are noted in the CHANGELOG.

Release 0.6.2

It's a minor release.

Fixed continuation octet limits in OID/RELATIVE-OID decoder (CVE-2026-23490).

Added support for Python 3.14.

Added SECURITY.md policy.

Migrated to pyproject.toml packaging.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.3, released 16-03-2026

CVE-2026-30922 (GHSA-jr27-m4p2-rc6r): Added nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (thanks for reporting, romanticpragmatism)

Fixed OverflowError from oversized BER length field [issue #54](pyasn1/pyasn1#54) [pr #100](pyasn1/pyasn1#100)

Fixed DeprecationWarning stacklevel for deprecated attributes [issue

Bumps the uv group with 7 updates in the /integ-tests/python directory: | Package | From | To | | --- | --- | --- | | [pytest](https://github.com/pytest-dev/pytest) | `8.3.3` | `8.4.2` | | [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.0.1` | `1.2.1` | | [flask](https://github.com/pallets/flask) | `3.0.3` | `3.1.3` | | [requests](https://github.com/psf/requests) | `2.32.3` | `2.32.5` | | [pip](https://github.com/pypa/pip) | `25.1.1` | `26.0.1` | | [h11](https://github.com/python-hyper/h11) | `0.14.0` | `0.16.0` | | [pyasn1](https://github.com/pyasn1/pyasn1) | `0.6.1` | `0.6.3` | Bumps the uv group with 1 update in the /integ-tests/python-v1 directory: [pydantic](https://github.com/pydantic/pydantic). Updates `pytest` from 8.3.3 to 8.4.2 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@8.3.3...8.4.2) Updates `python-dotenv` from 1.0.1 to 1.2.1 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.0.1...v1.2.1) Updates `flask` from 3.0.3 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@3.0.3...3.1.3) Updates `pytest` from 8.3.3 to 8.4.2 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@8.3.3...8.4.2) Updates `python-dotenv` from 1.0.1 to 1.2.1 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.0.1...v1.2.1) Updates `requests` from 2.32.3 to 2.32.5 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.3...v2.32.5) Updates `pip` from 25.1.1 to 26.0.1 - [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst) - [Commits](pypa/pip@25.1.1...26.0.1) Updates `h11` from 0.14.0 to 0.16.0 - [Commits](python-hyper/h11@v0.14.0...v0.16.0) Updates `pyasn1` from 0.6.1 to 0.6.3 - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.1...v0.6.3) Updates `werkzeug` from 3.0.6 to 3.1.8 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@3.0.6...3.1.8) Updates `pytest` from 8.3.3 to 8.4.2 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@8.3.3...8.4.2) Updates `pydantic` from 1 to 1.10.13 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v1.0...v1.10.13) Updates `pydantic` from 1 to 1.10.13 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v1.0...v1.10.13) Updates `pydantic` from 1 to 1.10.13 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v1.0...v1.10.13) --- updated-dependencies: - dependency-name: pytest dependency-version: 8.4.2 dependency-type: direct:production dependency-group: uv - dependency-name: python-dotenv dependency-version: 1.2.1 dependency-type: direct:production dependency-group: uv - dependency-name: flask dependency-version: 3.1.3 dependency-type: direct:production dependency-group: uv - dependency-name: pytest dependency-version: 8.4.2 dependency-type: direct:production dependency-group: uv - dependency-name: python-dotenv dependency-version: 1.2.1 dependency-type: direct:production dependency-group: uv - dependency-name: requests dependency-version: 2.32.5 dependency-type: direct:production dependency-group: uv - dependency-name: pip dependency-version: 26.0.1 dependency-type: direct:production dependency-group: uv - dependency-name: h11 dependency-version: 0.16.0 dependency-type: indirect dependency-group: uv - dependency-name: pyasn1 dependency-version: 0.6.3 dependency-type: indirect dependency-group: uv - dependency-name: werkzeug dependency-version: 3.1.8 dependency-type: indirect dependency-group: uv - dependency-name: pytest dependency-version: 8.4.2 dependency-type: direct:production dependency-group: uv - dependency-name: pydantic dependency-version: 1.10.13 dependency-type: direct:production dependency-group: uv - dependency-name: pydantic dependency-version: 1.10.13 dependency-type: direct:production dependency-group: uv - dependency-name: pydantic dependency-version: 1.10.13 dependency-type: direct:production dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-04-25T02:34:32Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
beps	Ready	Preview, Comment	Apr 25, 2026 2:53am
promptfiddle	Ready	Preview, Comment	Apr 25, 2026 2:53am

github-actions · 2026-04-25T02:44:01Z

Binary size checks passed

✅ 7 passed

	Artifact	Platform	Gzip	Baseline	Delta	Status
✅	`bridge_cffi`	Linux	6.0 MB	5.7 MB	+363.6 KB (+6.4%)	OK
✅	`bridge_cffi-stripped`	Linux	6.0 MB	5.7 MB	+333.8 KB (+5.9%)	OK
✅	`bridge_cffi`	macOS	5.0 MB	4.6 MB	+346.2 KB (+7.5%)	OK
✅	`bridge_cffi-stripped`	macOS	4.9 MB	4.7 MB	+277.6 KB (+5.9%)	OK
✅	`bridge_cffi`	Windows	5.0 MB	4.6 MB	+350.7 KB (+7.6%)	OK
✅	`bridge_cffi-stripped`	Windows	5.0 MB	4.7 MB	+290.5 KB (+6.2%)	OK
✅	`bridge_wasm`	WASM	3.3 MB	3.2 MB	+42.2 KB (+1.3%)	OK

Generated by cargo size-gate · workflow run

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Apr 25, 2026

dependabot Bot mentioned this pull request Apr 25, 2026

build(deps): bump the uv group across 2 directories with 9 updates #3391

Closed

vercel Bot deployed to Preview – beps April 25, 2026 02:35 View deployment

vercel Bot deployed to Preview – promptfiddle April 25, 2026 02:53 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the uv group across 2 directories with 9 updates#3413

build(deps): bump the uv group across 2 directories with 9 updates#3413
dependabot[bot] wants to merge 1 commit intocanaryfrom
dependabot/uv/baml_language/integ_tests/python/uv-e37e8c431e

dependabot Bot commented on behalf of github Apr 25, 2026

Uh oh!

vercel Bot commented Apr 25, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 25, 2026

8.4.2

pytest 8.4.2 (2025-09-03)

Bug fixes

Improved documentation

Contributor-facing changes

8.4.1

pytest 8.4.1 (2025-06-17)

Bug fixes

Improved documentation

8.4.0

pytest 8.4.0 (2025-06-02)

v1.2.1

What's Changed

New Contributors

v1.2.0

What's Changed

New Contributors

v1.1.1

What's Changed

New Contributors

v1.1.0

What's Changed

[1.2.1] - 2025-10-26

[1.2.0] - 2025-10-26

[1.1.1] - 2025-06-24

Fixed

[1.1.0] - 2025-03-25

Added

Fixed

Misc

3.1.3

3.1.2

3.1.1

3.1.0

Version 3.1.3

Version 3.1.2

Version 3.1.1

Version 3.1.0

8.4.2

pytest 8.4.2 (2025-09-03)

Bug fixes

Improved documentation

Contributor-facing changes

8.4.1

pytest 8.4.1 (2025-06-17)

Bug fixes

Improved documentation

8.4.0

pytest 8.4.0 (2025-06-02)

v1.2.1

What's Changed

New Contributors

v1.2.0

What's Changed

New Contributors

v1.1.1

What's Changed

New Contributors

v1.1.0

What's Changed

[1.2.1] - 2025-10-26

[1.2.0] - 2025-10-26

[1.1.1] - 2025-06-24

Fixed

[1.1.0] - 2025-03-25

Added

Fixed

Misc

v2.32.5

2.32.5 (2025-08-18)

v2.32.4

2.32.4 (2025-06-10)

2.32.5 (2025-08-18)

2.32.4 (2025-06-10)

26.0.1 (2026-02-04)

Bug Fixes

26.0 (2026-01-30)

Deprecations and Removals

vercel Bot commented Apr 25, 2026 •

edited

Loading