Skip to content

chore(pip): bump the python group in /src with 9 updates - #1016

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/src/python-83e90e53fd
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/src/python-83e90e53fd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the python group in /src with 9 updates:

Package From To
bazel-runfiles 2.4.5 2.4.6
docutils 0.22.4 0.23
fonttools 4.67.0 4.68.0
jsonschema-rs 0.52.1 0.60.3
minijinja 2.24.0 3.0.5
pytest 9.1.1 9.2.0
sphinx-mounts 0.2.0 0.3.0
sphinx-needs 8.5.0 9.1.0
websockets 17.3 17.4

Updates bazel-runfiles from 2.4.5 to 2.4.6

Release notes

Sourced from bazel-runfiles's releases.

2.4.6

For more detailed setup instructions, see https://rules-python.readthedocs.io/en/latest/getting-started.html

For the user-facing changelog see here

Using Bzlmod

Add to your MODULE.bazel file:

bazel_dep(name = "rules_python", version = "2.4.6")
python = use_extension("@​rules_python//python/extensions:python.bzl", "python")
python.toolchain(
python_version = "3.14",
)
pip = use_extension("@​rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
hub_name = "pypi",
python_version = "3.14",
requirements_lock = "//:requirements_lock.txt",
)
use_repo(pip, "pypi")

Using WORKSPACE

Paste this snippet into your WORKSPACE file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
http_archive(
name = "rules_python",
sha256 = "4765b9a4a9c6e0fb89f465aac5b5b0ac06589c9477144340859310777ad801a7",
strip_prefix = "rules_python-2.4.6",
url = "https://github.com/bazel-contrib/rules_python/releases/download/2.4.6/rules_python-2.4.6.tar.gz",
)
load("@​rules_python//python:repositories.bzl", "py_repositories")
py_repositories()

Gazelle plugin

Paste this snippet into your WORKSPACE file:

... (truncated)

Changelog

Sourced from bazel-runfiles's changelog.

2.4.6 - 2026-10-29

{#v2-4-6-changed}

Changed

  • (toolchains) Updated default Python toolchains to 3.10.22, 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2, and removed 3.15.0 pre-release toolchains (#4358).

{#v2-4-5}

Commits

Updates docutils from 0.22.4 to 0.23

Commits

Updates fonttools from 4.67.0 to 4.68.0

Release notes

Sourced from fonttools's releases.

4.68.0

  • [feaLib] Escape " and \ when writing names back out with asFea() in FeatureNameStatement, STATNameStatement and CVParametersNameStatement (#4321).
  • [scaleUpem] Also scale the MATH lengths that are not MathValueRecords (DelimitedSubFormulaMinHeight, DisplayOperatorMinHeight, MinConnectorOverlap, etc.) (#4327).
  • [cffLib] Inherit the initial CFF2 vsindex from the Private DICT when decompiling, specializing and instancing charstrings, and fix programToCommands miscounting operands when several blend operators precede the first stem or moveto (#4337, #4339).
  • [instancer] Round CFF2 outlines and stem hints on absolute positions rather than per relative operand, and keep CFF2 Private DICT blend values at full precision until they are written back (#4338, #4341).
  • [cffLib] Preserve CFF2 Private DICT arrays that use more than one blend group (#4346).
  • [feaLib] Raise FeatureLibError instead of looping forever on an unclosed OS/2, BASE or STAT table block (#4347).
  • [designspaceLib] When a variable font overrides some public.fontInfo keys, merge them with the root-level font info instead of replacing it (#4336, #4340).
  • [instancer] Raise an error for FeatureVariations conditions of a format other than the supported axis-range one, instead of silently dropping them (#4348).
  • [filesystem] Don't overwrite an unrelated sibling .zip when writing a .ufoz or other non-.zip archive (#4342).
  • [glyf] Fix exponential running time on composite glyphs that reuse the same component at several nesting levels; getCoordinates now raises TTLibError past 65535 composite points (#4325).
  • [ttLib] Add support for the beyond-64k tables of the final ISO Open Font Format 5th edition: uppercase companion tables (GLYF, GVAR, HMTX, GSUB/GPOS extended layout, FeatureVariations 1.1, TTC 1.1/2.1, DMAP), a ttLib.beyond64k module and CLI, and support in FontBuilder, merge, subset, instancer, qu2cu, removeOverlaps and scaleUpem (#4097, #2678).
  • [VARC] Keep addVarComponent() locations sparse, passing RESET_UNSPECIFIED_AXES via a new keyword-only resetUnspecifiedAxes pen argument (#4349).
  • [woff] Require brotli >= 1.2.1 and brotlicffi >= 1.2.1.0, which fix GHSA-9v8h-qqgm-4m35 (#4365, #4370).
  • Build Windows ARM64 wheels (#4366).
  • [instancer] Fix AttributeError: ElidedFallbackNameID when updating font names of a font with a version 1.0 STAT table; fall back to the subfamily name (#2933, #4371).
Changelog

Sourced from fonttools's changelog.

4.68.0 (released 2026-10-27)

  • [feaLib] Escape " and \ when writing names back out with asFea() in FeatureNameStatement, STATNameStatement and CVParametersNameStatement (#4321).
  • [scaleUpem] Also scale the MATH lengths that are not MathValueRecord\ s (DelimitedSubFormulaMinHeight, DisplayOperatorMinHeight, MinConnectorOverlap, etc.) (#4327).
  • [cffLib] Inherit the initial CFF2 vsindex from the Private DICT when decompiling, specializing and instancing charstrings, and fix programToCommands miscounting operands when several blend operators precede the first stem or moveto (#4337, #4339).
  • [instancer] Round CFF2 outlines and stem hints on absolute positions rather than per relative operand, and keep CFF2 Private DICT blend values at full precision until they are written back (#4338, #4341).
  • [cffLib] Preserve CFF2 Private DICT arrays that use more than one blend group (#4346).
  • [feaLib] Raise FeatureLibError instead of looping forever on an unclosed OS/2, BASE or STAT table block (#4347).
  • [designspaceLib] When a variable font overrides some public.fontInfo keys, merge them with the root-level font info instead of replacing it (#4336, #4340).
  • [instancer] Raise an error for FeatureVariations conditions of a format other than the supported axis-range one, instead of silently dropping them (#4348).
  • [filesystem] Don't overwrite an unrelated sibling .zip when writing a .ufoz or other non-.zip archive (#4342).
  • [glyf] Fix exponential running time on composite glyphs that reuse the same component at several nesting levels; getCoordinates now raises TTLibError past 65535 composite points (#4325).
  • [ttLib] Add support for the beyond-64k tables of the final ISO Open Font Format 5th edition: uppercase companion tables (GLYF, GVAR, HMTX, GSUB/GPOS extended layout, FeatureVariations 1.1, TTC 1.1/2.1, DMAP), a ttLib.beyond64k module and CLI, and support in FontBuilder, merge, subset, instancer, qu2cu, removeOverlaps and scaleUpem (#4097, #2678).
  • [VARC] Keep addVarComponent() locations sparse, passing RESET_UNSPECIFIED_AXES via a new keyword-only resetUnspecifiedAxes pen argument (#4349).
  • [woff] Require brotli >= 1.2.1 and brotlicffi >= 1.2.1.0, which fix GHSA-9v8h-qqgm-4m35 (#4365, #4370).
  • Build Windows ARM64 wheels (#4366).
  • [instancer] Fix AttributeError: ElidedFallbackNameID when updating font names of a font with a version 1.0 STAT table; fall back to the subfamily name (#2933, #4371).
Commits
  • e1013ec Release 4.68.0
  • 1a43bc6 Update NEWS.rst [skip ci]
  • 095c3ed [instancer] Fall back to subfamily name for STAT 1.0 tables (#4371)
  • 1ca5f77 Merge pull request #4372 from fonttools/dependabot/github_actions/pypa/gh-act...
  • 7546d0c Bump pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3
  • bf51d90 [setup.py] Raise woff minimums to brotli 1.2.1, brotlicffi 1.2.1.0 (#4370)
  • 8d3eb2b Update brotli to v1.2.1 (#4365)
  • afaa318 [ci] Build Windows ARM64 wheels (#4366)
  • 2cb9ea7 [VARC] Keep pen component locations sparse (#4349)
  • ceaf0b2 Merge pull request #4097 from fonttools/beyond-64k
  • Additional commits viewable in compare view

Updates jsonschema-rs from 0.52.1 to 0.60.3

Release notes

Sourced from jsonschema-rs's releases.

[Python] Release 0.60.3

Fixed

  • Stack overflow when building validators for unevaluated* schemas with $ref cycles across $id resources.

[Rust] Release 0.60.2

Fixed

  • Stack overflow when building validators for unevaluated* schemas with $ref cycles across $id resources.

[Ruby] Release 0.60.2

Fixed

  • Stack overflow when building validators for unevaluated* schemas with $ref cycles across $id resources.

[Python] Release 0.60.1

Fixed

  • Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000.

Performance

  • Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum taking time growing faster than the square of the digit count, instead of at most the square.
  • Validation of numbers with more than ten thousand digits, written or implied by their exponent, taking time linear in their written length instead of quadratic in their digit count.

[Rust] Release 0.60.1

  • Panic on numbers past f64 in const, enum, minimum, maximum, exclusiveMinimum, exclusiveMaximum and type: integer when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. #1790
  • #[jsonschema::validator] panicking during expansion, or generating code that panics, on schema numbers past f64 when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. Such numbers are compile errors, as without that serde_json feature. #1790
  • const, enum and uniqueItems treating objects with the same members in a different key order as unequal when another crate in the build enables serde_json/preserve_order. #1791
  • Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000, with the arbitrary-precision feature.
  • #[jsonschema::validator] rejecting multipleOf with a positive divisor below the smallest f64, such as 1e-400, with the arbitrary-precision feature.

Performance

  • Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum with the arbitrary-precision feature taking time growing faster than the square of the digit count, instead of at most the square.
  • Validation of numbers with more than ten thousand digits, written or implied by their exponent, with the arbitrary-precision feature taking time linear in their written length instead of quadratic in their digit count.

[Ruby] Release 0.60.1

Fixed

  • Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000.

Performance

  • Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum taking time growing faster than the square of the digit count, instead of at most the square.
  • Validation of numbers with more than ten thousand digits, written or implied by their exponent, taking time linear in their written length instead of quadratic in their digit count.

[Python] Release 0.60.0

Added

... (truncated)

Changelog

Sourced from jsonschema-rs's changelog.

Changelog

[Unreleased]

[0.60.2] - 2026-10-26

Fixed

  • Stack overflow when building validators for unevaluated* schemas with $ref cycles across $id resources.

[0.60.1] - 2026-10-23

Fixed

  • Panic on numbers past f64 in const, enum, minimum, maximum, exclusiveMinimum, exclusiveMaximum and type: integer when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. #1790
  • #[jsonschema::validator] panicking during expansion, or generating code that panics, on schema numbers past f64 when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. Such numbers are compile errors, as without that serde_json feature. #1790
  • const, enum and uniqueItems treating objects with the same members in a different key order as unequal when another crate in the build enables serde_json/preserve_order. #1791
  • Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000, with the arbitrary-precision feature.
  • #[jsonschema::validator] rejecting multipleOf with a positive divisor below the smallest f64, such as 1e-400, with the arbitrary-precision feature.

Performance

  • Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum with the arbitrary-precision feature taking time growing faster than the square of the digit count, instead of at most the square.
  • Validation of numbers with more than ten thousand digits, written or implied by their exponent, with the arbitrary-precision feature taking time linear in their written length instead of quadratic in their digit count.

[0.60.0] - 2026-10-22

Changed

  • ValidationErrorKind::Enum and ValidationErrorKind::Constant holding their values as Arc<Value> shared with the validator, instead of a copy per error. #1777

Performance

  • Validation with unfinished regex matches running each such match once instead of once per run, and comparing errors across runs in linear time instead of quadratic. #1784
  • items and additionalProperties looking up a single-keyword subschema once per array or object instead of once per value.
  • is_valid and validate reading fewer cache lines per subschema, by keeping error locations apart from validators.
  • is_valid on recursive schemas caching only $ref results that took many steps to compute, instead of every one.
  • Error evaluation paths taking memory linear in the $ref nesting depth, not quadratic. #1778

[0.59.0] - 2026-10-16

Added

  • CLI: - as a path reads the schema or an instance from stdin.
  • CLI: -V as the version flag; -v stays as an alias.

Changed

  • CLI: Exit status 3 for errors that prevent a verdict and 2 for usage errors, so 1 always means an invalid instance or schema.
  • CLI: Errors print to stderr instead of stdout.

... (truncated)

Commits
  • 377bc9a chore(python): Release 0.60.3
  • 0c3338f chore(python): Release 0.60.2
  • 1efccf5 chore(ruby): Release 0.60.2
  • 0b657fa chore(rust): Release 0.60.2
  • 7eb6128 fix: Stack overflow on unevaluated* with $ref cycles across $id resources
  • 26aedd9 build(deps): bump CodSpeedHQ/action from 5.5.0 to 5.6.0
  • e9af61d chore(ruby): Release 0.60.1
  • 8aa123d chore(python): Release 0.60.1
  • 4eb7a64 chore(rust): Release 0.60.1
  • 4e90b95 perf: Single scan for the exponent in the digit budget check
  • Additional commits viewable in compare view

Updates minijinja from 2.24.0 to 3.0.5

Changelog

Sourced from minijinja's changelog.

3.0.5

  • Fixed a panic or abort in Rust when buffering an iterator that reports a huge size hint, or when passing a huge count to the batch or slice filters. Filters like list, sort, reverse, map, slice and batch as well as slicing and concatenating sequences now cap how much they preallocate, so [1, 2]|batch(4611686018427387904) is [[1, 2]] instead of failing with "capacity overflow". #483
  • Fixed floats in Go switching to exponent notation from one million up, so 1234567.5 printed as 1.2345675e+06. Like in Rust, a float now prints as its shortest exact decimal without an exponent, so 1234567.5 is 1234567.5 and 1e20 is 100000000000000000000.0. Inside lists and maps, exponent notation is only used below 1e-4 and from 1e16 up, written like 1e20 and 1e-5. NaN now prints as NaN, and infinity inside a list as inf instead of +Inf. #984
  • Fixed %s in the format filter formatting floats with %g rules, so "%s"|format(1234567.5) was 1.23457e+06. Like in Python, floats are now formatted like str() does: 1234567.5, 1e+16, 1e-05 or nan. The 0, + and space flags are ignored for floats and strings with %s, like in Python. This applies to both Rust and Go. #984
  • Fixed the tojson filter in Go writing floats like integers. Like in Rust, a float stays a float in the output, so 1.0|tojson is 1.0 instead of 1, large and small magnitudes use exponent notation (1.5e+16, 2.5e-7) and infinity becomes null instead of an error. The same applies to values rendered with JSON auto-escaping. #983
  • Fixed the upper, lower, capitalize, title and replace filters in Go ignoring values that are not strings. Like in Rust, the value and the replace arguments are converted to strings first, so 1.5|replace(".", ",") is 1,5 and true|upper is TRUE, and a number passed to replace is no longer treated as an empty string. #985
  • Fixed slicing and the in operator on iterables such as range() in Go. Like in Rust, range(5)[:2] is now [0, 1] instead of failing with "cannot slice iterator", and 3 in range(5) is true instead of false. Slicing none or undefined gives an empty list like in Rust. Iterables now also print, compare, serialize with tojson and pprint like lists, so range(2) == [0, 1] is true and [range(2)] prints as [[0, 1]] instead of [<iterator>]. The in operator now also works on custom sequence, iterable and map objects. #986
  • Fixed none in Go not being treated as an empty sequence by the sort, unique, select, reject, map, groupby, join and urlencode filters and the iterable test. Like in Rust, none|sort is now [] and none|join is an empty string instead of None. #987
  • Fixed the odd, even and divisibleby tests in Go ignoring booleans, and divisibleby ignoring a float divisor. Like in Rust, booleans count as 0 and 1, so true is odd is true, and 6.5 is divisibleby(0.5) is true. #988
  • Fixed str.format in pycompat cutting floats to six significant digits when no precision is given. Like in Python, such floats are now formatted like str() does, so '{}'.format(3.14159265) is 3.14159265, '{}'.format(1234567.0) is 1234567.0 instead of 1.23457e+06 and '{}'.format(0.0) is 0.0 instead of 0. #991
  • Fixed the trim filter in Go ignoring values that are not strings and only stripping ASCII spaces, tabs and newlines by default. Like in Rust, 5|trim|length is now 1, and Unicode whitespace such as a non-breaking space is stripped. #989
  • Fixed undefined values not being treated as empty sequences by the sort, unique, select, reject, selectattr, rejectattr, map, batch and groupby filters in Go, and none by batch, selectattr and rejectattr. Like in Rust, undefined|sort is now [] with lenient undefined behavior, while strict and semi-strict undefined behavior still fail except for join and groupby. #990
  • Fixed a panic in compile_expression when the expression contains }} followed by more input, such as }} x. This is now a syntax error, like the same text inside a template. #992

3.0.4

  • Fixed str.count in pycompat looping forever when counting an empty string. Like in Python, 'abc'.count('') is now 4.
  • Fixed str.islower and str.isupper in pycompat returning false for strings with spaces, digits or other uncased characters, and the str.is* predicates returning true for an empty string. They now follow Python, so 'foo bar'.islower() is true and ''.isdigit() is false.
  • Fixed str.find and str.rfind in pycompat returning byte offsets. Like in Python they now return character offsets, so 'über'.find('e') is 2.
  • Fixed integer addition, subtraction and multiplication in Go losing precision above 2**53 and clamping results that overflow 64 bits, because they were computed with floats. They are now exact, and like in Rust a result that doesn't fit 64 bits becomes a big integer, so 9007199254740993 + 0 is 9007199254740993 and 9223372036854775807 + 1 is 9223372036854775808. #981
  • Fixed booleans not being usable as integers in -, *, /, // and % and for repeating strings and sequences in Go. Like in Rust and Jinja2, true - 1 is 0 and "ab" * true is ab.
  • Fixed ** failing with a negative integer exponent in Rust. Like in Jinja2, 2 ** -1 is now 0.5. Zero to a negative power now always fails in Rust and Go like a division by zero, instead of producing inf for floats in Rust and for all numbers in Go. #982
  • Fixed ** on integers in Go being computed with floats. Like in Rust the result is now exact up to 128 bits and fails beyond that, a float base stays a float so 2.0 ** 3 is 8.0, and booleans count as integers.
  • Fixed the sort filter ignoring a comma-separated list of attributes in Go. Like in Rust, sort(attribute="name, state") now sorts by name and then by state instead of leaving the items in their original order. #979
  • Fixed the sort filter comparing strings case-sensitively when sorting by several attributes in Rust and Go. Like in Jinja2, each part of the key is now compared case-insensitively unless case_sensitive is set. An attribute list with whitespace-only entries such as "name, " also no longer sorts by an empty attribute in Rust.
  • Added the attribute and start arguments to the sum filter and the attribute argument to the join filter for Jinja2 compatibility in Rust and Go. Like in Jinja2 the arguments can be passed positionally or by keyword, and the separator of join can also be passed as d. In Go the first positional argument of sum is now the attribute rather than the start value, so sum(100) needs to be written as sum(start=100). Go previously ignored unknown keyword arguments to sum and join and now fails like Rust. Like in Jinja2, sum in Rust can now also concatenate lists when given a list as start. #980
  • Fixed the handling of none arguments to the int, float and round filters in Go. Like in Rust they now count as not given, so 2.5|round(none) is 2.0 instead of an error.
  • Fixed the join filter dropping a separator that is not a string in Go. Like in Rust it is converted to a string, so [1, 2]|join(3) is 132.

3.0.3

  • Re-release of 3.0.2 without code changes. The Python package for 3.0.2 could not be published to PyPI because the 32-bit Linux wheel failed to build on the new Ubuntu 26.04 GitHub Actions runners, so 3.0.3 is the first release with the 3.0.2 changes on PyPI. All other packages are identical to 3.0.2.

3.0.2

  • Macros and variables starting with an underscore are now private and are no longer exported from imported templates in Rust and Go, matching Jinja2. They are not visible as attributes of a module imported with {% import %}, and {% from ... import %} of such a name is a syntax error. State::exports / State.Exports no longer return them either, but they can still be retrieved with lookup. #970
  • Fixed modules imported with {% import %} not being iterable in Go.
  • Fixed the indent filter indenting blank lines of CRLF text when blank is false, in Rust and Go. A blank line ended up as " \r" instead of "\r", leaving trailing whitespace. #972
  • Fixed the wordwrap filter ignoring break_long_words when break_on_hyphens is false. The two arguments are independent in Jinja2, so a word longer than width is still broken unless break_long_words is false. #940
  • Fixed chained integer lookups like foo.1.0 failing with a syntax error in Rust and Go. Like in Jinja2, a number right after a dot is now always read as an item index, so foo.1.0 is foo[1][0] instead of foo followed by the float 1.0. #974
  • Fixed \x and octal string escapes above \x7f producing invalid UTF-8 in Go. Like in Rust they now produce the code point, so '\xe9' is é. Go now also understands the \b and \f escapes and surrogate pairs written as two \u escapes, and rejects a lone surrogate like Rust does. #975
  • Added the method argument to the round filter for Jinja2 compatibility in Rust and Go. It takes common (the default), ceil or floor, and both precision and method can now be passed as keyword arguments. Integers are now rounded to a negative precision like in Jinja2, so 15|round(-1) is 20 rather than 15. #968
  • Fixed Python exceptions leaking into later renders in the Python bindings. An exception that MiniJinja did not report, for instance one raised by an iterator after a {% break %}, was raised in place of the next unrelated error. Exceptions are now attached to the error that carries them. Exceptions raised by a loader are also no longer treated as missing templates, so they are no longer ignored by ignore missing or skipped by an include with a list of templates. #967
  • The Python package is now also published as free-threaded wheels for Linux, macOS and Windows: a version-specific wheel for CPython 3.14t and an abi3t (PEP 803) wheel for CPython 3.15+. #969
  • The Python package metadata includes the readme again, so the PyPI page shows a project description.

3.0.1

  • The Python package is now also published as Pyodide wheels (PEP 783 pyemscripten platform tag) for Pyodide 0.29 and 314 so it can be installed with micropip.

... (truncated)

Commits
  • 68ab5b6 chore(release): 3.0.5
  • fc636f0 fix: report a syntax error instead of panicking on }} in expressions
  • f6f9857 fix(go): iterate undefined as an empty sequence in filters like Rust (#990)
  • 0d0df9d fix(go): make the trim filter convert values and strip Unicode whitespace lik...
  • ce30dad fix(contrib): format floats like str() in str.format when no precision is giv...
  • 0b2e87d test: make huge batch count test portable to 32bit targets
  • feb2f93 fix(go): coerce booleans and floats in the odd, even and divisibleby tests li...
  • e05f317 fix: do not trust size hints when preallocating
  • 9c6fe27 fix(go): treat none as an empty iterable in filters like Rust (#987)
  • 50470a2 fix(go): support slicing and in on iterables like Rust (#986)
  • Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

  • #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

  • #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

    Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

  • #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

    • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
    • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

    pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

  • #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

  • #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

  • #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

    They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

  • #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

  • #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

  • #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
  • #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
  • #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

  • #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits
  • ae1d0ff Prepare release version 9.2.0
  • 143ce31 pre-commit: exclude codespell on generated release announcements
  • 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
  • a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
  • 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
  • 41d12cd docs: clarify typing for yield fixtures
  • b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
  • 16f87a7 docs: improve getting-started.rst test execution description
  • 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
  • ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
  • Additional commits viewable in compare view

Updates sphinx-mounts from 0.2.0 to 0.3.0

Release notes

Sourced from sphinx-mounts's releases.

sphinx-mounts v0.3.0

Changelog: https://sphinx-mounts.readthedocs.io/en/latest/changelog.html#release-0-3-0

What's Changed

Bumps the python group in /src with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [bazel-runfiles](https://github.com/bazel-contrib/rules_python) | `2.4.5` | `2.4.6` |
| [docutils](https://github.com/rtfd/recommonmark) | `0.22.4` | `0.23` |
| [fonttools](https://github.com/fonttools/fonttools) | `4.67.0` | `4.68.0` |
| [jsonschema-rs](https://github.com/Stranger6667/jsonschema) | `0.52.1` | `0.60.3` |
| [minijinja](https://github.com/mitsuhiko/minijinja) | `2.24.0` | `3.0.5` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` |
| [sphinx-mounts](https://github.com/useblocks/sphinx-needs) | `0.2.0` | `0.3.0` |
| [sphinx-needs](https://github.com/useblocks/sphinx-needs) | `8.5.0` | `9.1.0` |
| [websockets](https://github.com/python-websockets/websockets) | `17.3` | `17.4` |


Updates `bazel-runfiles` from 2.4.5 to 2.4.6
- [Release notes](https://github.com/bazel-contrib/rules_python/releases)
- [Changelog](https://github.com/bazel-contrib/rules_python/blob/main/CHANGELOG.md)
- [Commits](bazel-contrib/rules_python@2.4.5...2.4.6)

Updates `docutils` from 0.22.4 to 0.23
- [Changelog](https://github.com/readthedocs/recommonmark/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rtfd/recommonmark/commits)

Updates `fonttools` from 4.67.0 to 4.68.0
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.67.0...4.68.0)

Updates `jsonschema-rs` from 0.52.1 to 0.60.3
- [Release notes](https://github.com/Stranger6667/jsonschema/releases)
- [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md)
- [Commits](Stranger6667/jsonschema@cli-v0.52.1...python-v0.60.3)

Updates `minijinja` from 2.24.0 to 3.0.5
- [Release notes](https://github.com/mitsuhiko/minijinja/releases)
- [Changelog](https://github.com/mitsuhiko/minijinja/blob/main/CHANGELOG.md)
- [Commits](mitsuhiko/minijinja@minijinja-go/v2.24.0...minijinja-go/v3.0.5)

Updates `pytest` from 9.1.1 to 9.2.0
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.1.1...9.2.0)

Updates `sphinx-mounts` from 0.2.0 to 0.3.0
- [Release notes](https://github.com/useblocks/sphinx-needs/releases)
- [Commits](useblocks/sphinx-needs@sphinx-mounts-v0.2.0...sphinx-mounts-v0.3.0)

Updates `sphinx-needs` from 8.5.0 to 9.1.0
- [Release notes](https://github.com/useblocks/sphinx-needs/releases)
- [Commits](useblocks/sphinx-needs@8.5.0...sphinx-needs-v9.1.0)

Updates `websockets` from 17.3 to 17.4
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@17.3...17.4)

---
updated-dependencies:
- dependency-name: bazel-runfiles
  dependency-version: 2.4.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: docutils
  dependency-version: '0.23'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: fonttools
  dependency-version: 4.68.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: jsonschema-rs
  dependency-version: 0.60.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: minijinja
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: sphinx-mounts
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: sphinx-needs
  dependency-version: 9.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: websockets
  dependency-version: '17.4'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 3, 2026
@dependabot
dependabot Bot requested a review from AlexanderLanin as a code owner November 3, 2026 16:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

0 participants