Skip to content

chore(deps)(deps): Bump the python-minor-patch group with 3 updates#125

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-e876d7e532
Open

chore(deps)(deps): Bump the python-minor-patch group with 3 updates#125
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-e876d7e532

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 11, 2026

Bumps the python-minor-patch group with 3 updates: urllib3, pydantic and ty.

Updates urllib3 from 2.6.3 to 2.7.0

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

  • Decompression-bomb safeguards of the streaming API were bypassed:

    1. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @​Cycloctane)
    2. During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @​kimkou2024)

    See GHSA-mf9v-mfxr-j63j for details.

  • HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @​christos-spearbit)

Deprecations and Removals

  • Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)
  • Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)
  • Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)
  • Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

  • Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)
  • Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)
  • Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)
  • Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)
  • Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)
  • Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)
Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

  • Decompression-bomb safeguards of the streaming API were bypassed:

    1. When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.
    2. During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

    See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

  • HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

  • Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)
  • Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)
  • Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)
  • Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

  • Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)
  • Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

Updates pydantic from 2.13.3 to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Fixes

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Fixes

Commits
  • cf67d4b Fix linting
  • f0d8a21 Prepare release v2.13.4
  • 5e3fe1d Check for pydantic tag pattern in CI
  • 7f9edcc Document tagging conventions
  • b46a0c9 Adapt pydantic-core linker flags on macOS
  • 50629c8 Update to PyPy 7.3.22
  • 8522ebb Preserve RootModel core metadata
  • a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
  • 909259a Remove Logfire example in documentation
  • 2c4174c Bump libc from 0.2.155 to 0.2.185
  • See full diff in compare view

Updates ty from 0.0.34 to 0.0.35

Release notes

Sourced from ty's releases.

0.0.35

Release Notes

Released on 2026-05-10.

Bug fixes

  • Allow ParamSpec specialization through unioned generic classes (#24826)
  • Fix cross-file find-references for keyword arguments (#25043)
  • Fix comparison between negative and positive literal integers (#25023)
  • Reject dataclass decorator parameters based on supported Python version (#25029)

LSP server

  • Adjust start of block folding range to preserve visible header for character-precise LSP clients. (#24917)
  • Emit folding ranges from the language server for multi-line block headers. (#24978)
  • Skip global search for references if identifier is not externally visible (#25033)
  • Speed-up find-references by using multithreading for cross-file searches (#25042)

CLI

  • Include severity in JUnit diagnostics (#25080)

Core type checking

  • Check non-generic overload implementations (#24936)
  • Expand support for narrowing within walruses (#24968)
  • Filter overloads based on return type for ParamSpec mapping (#24769)
  • Improve support for recursive types (#24773)
  • Include TypedDict type context when inferring mixed constructors (#25039)
  • Include TypedDict type context when inferring string keys (#25037)
  • Preserve NewType and TypeAliasType in implicit aliases (#25072)
  • Provide type cntext for generator expression yields (#25069)
  • Provide type context for boolean operands (#25070)
  • Selectively promote a union of homogeneous fixed-length tuples to a single variadic tuple (#24705)
  • Support narrowing on __class__ checks (#24997)
  • Use more precise exception types when catching a union (#25076)

Diagnostics

  • Include error context for overload consistency diagnostics (#24950)

Performance

  • Cache results in desperate module resolution (#24977)
  • Lazily initialize builder when transforming a union type (#24929)
  • Project reachability constraints before narrowing (#24982)
  • Skip parameter accumulation for object variadics (#24976)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.35

Released on 2026-05-10.

Bug fixes

  • Allow ParamSpec specialization through unioned generic classes (#24826)
  • Fix cross-file find-references for keyword arguments (#25043)
  • Fix comparison between negative and positive literal integers (#25023)
  • Reject dataclass decorator parameters based on supported Python version (#25029)

LSP server

  • Adjust start of block folding range to preserve visible header for character-precise LSP clients. (#24917)
  • Emit folding ranges from the language server for multi-line block headers. (#24978)
  • Skip global search for references if identifier is not externally visible (#25033)
  • Speed-up find-references by using multithreading for cross-file searches (#25042)

CLI

  • Include severity in JUnit diagnostics (#25080)

Core type checking

  • Check non-generic overload implementations (#24936)
  • Expand support for narrowing within walruses (#24968)
  • Filter overloads based on return type for ParamSpec mapping (#24769)
  • Improve support for recursive types (#24773)
  • Include TypedDict type context when inferring mixed constructors (#25039)
  • Include TypedDict type context when inferring string keys (#25037)
  • Preserve NewType and TypeAliasType in implicit aliases (#25072)
  • Provide type cntext for generator expression yields (#25069)
  • Provide type context for boolean operands (#25070)
  • Selectively promote a union of homogeneous fixed-length tuples to a single variadic tuple (#24705)
  • Support narrowing on __class__ checks (#24997)
  • Use more precise exception types when catching a union (#25076)

Diagnostics

  • Include error context for overload consistency diagnostics (#24950)

Performance

  • Cache results in desperate module resolution (#24977)
  • Lazily initialize builder when transforming a union type (#24929)
  • Project reachability constraints before narrowing (#24982)
  • Skip parameter accumulation for object variadics (#24976)

Contributors

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): Bump the python-minor-patch group with 3 updates
4cb3daf 
Bumps the python-minor-patch group with 3 updates: [urllib3](https://github.com/urllib3/urllib3), [pydantic](https://github.com/pydantic/pydantic) and [ty](https://github.com/astral-sh/ty).


Updates `urllib3` from 2.6.3 to 2.7.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.6.3...2.7.0)

Updates `pydantic` from 2.13.3 to 2.13.4
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.4/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.3...v2.13.4)

Updates `ty` from 0.0.34 to 0.0.35
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.34...0.0.35)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pydantic
  dependency-version: 2.13.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: ty
  dependency-version: 0.0.35
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 11, 2026

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants