Skip to content

fix(deps): update all non-major dependencies#78

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major-dependencies
Open

fix(deps): update all non-major dependencies#78
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented May 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
altair ==6.0.0 → ==6.2.1 age confidence minor
certifi ==2026.2.25 → ==2026.5.20 age confidence minor
charset-normalizer (changelog) ==3.4.6 → ==3.4.7 age confidence patch
click (changelog) ==8.3.1 → ==8.4.1 age confidence minor
cryptography (changelog) ==46.0.6 → ==46.0.7 age confidence patch
fonttools ==4.62.1 → ==4.63.0 age confidence minor
gitpython ==3.1.46 → ==3.1.50 age confidence patch
google-auth ==2.49.1 → ==2.53.0 age confidence minor
google-auth ==2.49.1 → ==2.53.0 age confidence project.dependencies minor
google-auth-oauthlib (source) ==1.3.1 → ==1.4.0 age confidence minor
hypothesis (changelog) ==6.151.10 → ==6.155.2 age confidence dependency-groups minor
idna (changelog) ==3.11 → ==3.18 age confidence minor
mypy (changelog) ==1.20.0 → ==1.20.2 age confidence dependency-groups patch
narwhals ==2.18.1 → ==2.22.1 age confidence minor
numpy (changelog) ==2.4.4 → ==2.4.6 age confidence patch
pillow (changelog) ==12.1.1 → ==12.2.0 age confidence minor
pre-commit ==4.5.1 → ==4.6.0 age confidence dependency-groups minor
pydeck (source) ==0.9.1 → ==0.9.2 age confidence patch
pypdfium2 (changelog) ==5.6.0 → ==5.9.0 age confidence minor
pytest (changelog) ==9.0.2 → ==9.0.3 age confidence dependency-groups patch
requests (changelog) ==2.33.1 → ==2.34.2 age confidence minor
requests (changelog) ==2.33.1 → ==2.34.2 age confidence project.dependencies minor
ruff (source, changelog) ==0.15.8 → ==0.15.16 age confidence dependency-groups patch
sigstore/cosign-installer v4.1.1 → v4.1.2 age confidence action patch
streamlit (changelog) ==1.55.0 → ==1.58.0 age confidence minor
streamlit (changelog) ==1.55.0 → ==1.58.0 age confidence project.dependencies minor
tornado (source) ==6.5.5 → ==6.5.7 age confidence patch
urllib3 (changelog) ==2.6.3 → ==2.7.0 age confidence minor

Release Notes

vega/altair (altair)

v6.2.1

Compare Source

What's Changed

Bug Fixes
Maintenance

Full Changelog: vega/altair@v6.2.0...v6.2.1

v6.1.0: Version 6.1.0

Compare Source

What's Changed

There are many exciting improvements in this release! Read on for details and a big thanks to everyone who contributed 🎉

Enhancements
  • feat: Update to Vega-Lite 6.4.1 by @​joelostblom in #​4005. See the Vega-Lite Release Notes for details; a few highlights:
    • Newlines are now supported in tooltips.
    • The default stack order of marks like bars and areas is now aligned with the color domain.
    • Interactive charts automatically change the cursor to pointer to indicate they can be interacted with.
  • feat: auto hoist facet encodings in layer by @​thomascamminady in #​3965
    • This allows layering of simple faceted charts that define the same facet variables, instead of requiring that layering happens before faceting.
  • feat: Accept ZoneInfo(key='UTC') by @​JackKelly in #​3944
  • feat: add pandas 3 compatibility and fix CI (drop Python 3.9, pin polars <1.38) by @​mattijn in #​3950
  • feat: add ensure_ascii option to to_json() with default False by @​RamiNoodle733 in #​3952
Bug Fixes
Documentation
Other Changes

New Contributors

Full Changelog: vega/altair@v6.0.0...v6.1.0

certifi/python-certifi (certifi)

v2026.5.20

Compare Source

v2026.4.22

Compare Source

jawah/charset_normalizer (charset-normalizer)

v3.4.7

Compare Source

Changed
  • Pre-built optimized version using mypy[c] v1.20.
  • Relax setuptools constraint to setuptools>=68,<82.1.
Fixed
  • Correctly remove SIG remnant in utf-7 decoded string. (#​718) (#​716)
pallets/click (click)

v8.4.1

Compare Source

Released 2026-05-21

  • get_parameter_source() is available during eager callbacks and type
    conversion again. :issue:3458 :issue:3484
  • Zsh completion scripts parse correctly on Windows. :issue:3277 :pr:3466
  • Shell completion of Choice Enum values produces a valid completion
    result. :issue:3015
  • Fix empty byte-string handling in echo. :issue:3487
  • Fix closed file error with echo_via_pager. :issue:3449

v8.4.0

Compare Source

Released 2026-05-17

  • :class:ParamType typing improvements. :pr:3371

    • :class:ParamType is now a generic abstract base class,
      parameterized by its converted value type.
    • :meth:~ParamType.convert return types are narrowed on all
      concrete types (str for :class:STRING, int for
      :class:INT, etc.).
    • :meth:~ParamType.to_info_dict returns specific
      :class:~typing.TypedDict subclasses instead of
      dict[str, Any].
    • :class:CompositeParamType and the number-range base are now
      generic with abstract methods.

  • Refactor convert_type to extract type inference into a private
    _guess_type helper, and add :func:typing.overload signatures.
    :pr:3372

  • :class:Parameter typing improvements. :pr:2805

    • :class:Parameter is now an abstract base class, making explicit
      that it cannot be instantiated directly.
    • :attr:Parameter.name is now str instead of str | None.
      When expose_value=False, the name is set to "" instead
      of None.
    • The ctx parameter of :meth:Parameter.get_error_hint is now
      typed as Context | None, matching the runtime behavior.

  • Split string values from default_map for parameters with nargs > 1
    or :class:Tuple type, matching environment variable behavior.
    :issue:2745 :pr:3364

  • Auto-detect type=UNPROCESSED for flag_value of non-basic types
    (not str, int, float, or bool), so programmer-provided
    Python objects like classes and enum members are passed through unchanged
    instead of being stringified. Previously type=click.UNPROCESSED had
    to be set explicitly. :issue:2012 :pr:3363

  • The error hint now uses :meth:Command.get_help_option_names to pick
    non-shadowed help option names, so Try '... -h' no longer points to a
    subcommand option that shadows -h. The longest surviving name is
    shown (--help over -h) for readability. :issue:2790 :pr:3208

  • Fix readline functionality on non-Windows platforms. Prompt text is now
    passed directly to readline instead of being printed separately, allowing
    proper backspace, line editing, and line wrapping behavior. :issue:2968
    :pr:2969

  • Use :func:os.startfile on Windows to open URLs in :func:open_url,
    replacing the start built-in which cannot be invoked without
    shell=True. :issue:3164 :pr:3186

  • Fix Fish shell completion errors when option help text contains newlines.
    :issue:3043 :pr:3126

  • Add :class:NoSuchCommand exception with suggestions for misspelled
    commands. :issue:3107 :pr:3228

  • Use :class:ValueError message when conversion in :class:FuncParamType would
    fail. :issue:3105 :pr:3211

  • Add click.get_pager_file for file-like access to an output
    pager. :pr:1572 :pr:3405

  • :func:~click.formatting.wrap_text now measures line width in visible
    characters, ignoring ANSI escape sequences. :pr:3420

  • Fix :meth:HelpFormatter.write_usage emitting only a blank line when
    called without args. The usage prefix and program name are now
    written even when no arguments follow, and the trailing separator
    space is stripped so the line ends at the program name.
    :issue:3360 :pr:3434

  • Show custom error messages from types when :func:prompt with
    hide_input=True fails validation, instead of always showing a
    generic message. Built-in type messages mask the input value.
    :issue:2809 :pr:3256

  • Add capture parameter to :class:CliRunner with two modes: sys
    (default) and fd. fd redirects file descriptors 1 and 2
    via :func:os.dup2 so output that bypasses sys.stdout (stale stream
    references, C extensions, subprocesses, faulthandler) is captured
    with proper isolation. :issue:854 :issue:2412 :issue:2468
    :issue:2497 :issue:2761 :issue:2827 :issue:2865 :pr:3391

  • Revert the 8.3.3 change that exposed the original file descriptor
    via fileno() on the redirected CliRunner streams in the default
    capture mode. os.dup2(w, sys.stdout.fileno()) calls inside a CLI no
    longer mutate the host runner's stdout, which broke Pytest's fd-level
    capture teardown. C-level consumers that need a real fd should use
    capture="fd". :issue:3384 :pr:3391

  • Mark additional built-in strings with gettext() to extend translation
    coverage. :pr:2902

  • Fix feature switch groups (several flag_value options sharing one
    parameter name) silently dropping an explicit default when a sibling
    option without an explicit default was declared first. Arbitration is now
    source-aware: a more explicit :class:ParameterSource always wins, and
    within ParameterSource.DEFAULT, an option that received an explicit
    default= keyword wins over a sibling whose default was auto-derived.
    The 8.3.x first-wins fallback for remaining ties was reverted to the
    pre-8.3.x last-wins fallback. :issue:3403 :pr:3404

  • Fix missing space between option help text and the (DEPRECATED)
    label, and localize the option label so it matches the command label.
    The label and the DeprecationWarning reason suffix are now produced
    by shared helpers. :pr:3423

  • Document short option stacking (-abc is parsed as -a -b -c) and
    clarify that multi-character short option names are not supported.
    :issue:2779 :pr:3431

v8.3.3

Compare Source

v8.3.2

Compare Source

Released 2026-04-02

  • Fix handling of flag_value when is_flag=False to allow such options to be
    used without an explicit value. :issue:3084 :pr:3152
  • Hide Sentinel.UNSET values as None when using lookup_default().
    :issue:3136 :pr:3199 :pr:3202 :pr:3209 :pr:3212 :pr:3224
  • Prevent _NamedTextIOWrapper from closing streams owned by StreamMixer.
    :issue:824 :issue:2991 :issue:2993 :issue:3110 :pr:3139 :pr:3140
  • Add comprehensive tests for CliRunner stream lifecycle, covering
    logging interaction, multi-threaded safety, and sequential invocation
    isolation. Add high-iteration stress tests behind a stress marker
    with a dedicated CI job. :pr:3139
  • Fix callable flag_value being instantiated when used as a default via
    default=True. :issue:3121 :pr:3201 :pr:3213 :pr:3225
pyca/cryptography (cryptography)

v46.0.7

Compare Source

fonttools/fonttools (fonttools)

v4.63.0

Compare Source

  • [ttLib] Add support for Apple Color Emoji bgcl table (#​4065).
  • [ttLib] Add support for IFT and IFTX tables (Incremental Font Transfer, PatchMapFormat2) (#​4070, #​4072).
  • [otData] Introduce FieldSpec dataclass for OpenType table schema definitions, replacing raw tuples in otData.py (#​4076).
  • [Feat] Show name table strings as comments next to label IDs in TTX output, matching the convention used by fvar, STAT, trak (#​4089).
  • [cu2qu] Fix Cython complex-division rounding difference in split_cubic_into_three that could cause ±1 off-curve coordinate shifts (#​3928, #​4083).
  • [designspaceLib] Fix map_backward for many-to-one (flat-segment) axis maps that silently dropped entries via dict comprehension (googlefonts/ufo2ft#978, #​4085).
  • [OS/2] Fix setUnicodeRanges to accept reserved bits 123-127, restoring round-trip with getUnicodeRanges and fixing recalcUnicodeRanges crash in the subsetter (#​4087, #​4088).
  • [cython] Declare Cython extensions as free-threading compatible on Python 3.13+, so that importing them on free-threaded Python no longer re-enables the GIL (#​4073, #​4090).
gitpython-developers/GitPython (gitpython)

v3.1.50

Compare Source

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.49...3.1.50

v3.1.49: - Security

Compare Source

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.48...3.1.49

v3.1.48: - Security

Compare Source

Accidentally deleted the previous GH release, it did mention the advisory this fixes.

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.47...3.1.48

v3.1.47: - with security fixes

Compare Source

Advisories

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.46...3.1.47

googleapis/google-cloud-python (google-auth-oauthlib)

v1.4.0: google-auth-oauthlib: v1.4.0

Compare Source

Bug Fixes
HypothesisWorks/hypothesis (hypothesis)

v6.155.2: Hypothesis version 6.155.2

Compare Source

This patch rewrites the internal date- and time-drawing helper to use
plain arithmetic instead of branching on the values it draws. The
generated distribution is unchanged, but "dates()", "datetimes()", and
"times()" are now much more efficient under symbolic-execution
backends such as crosshair-tool, which can now solve for a specific
date directly rather than enumerating candidates (issue #​4759).

The canonical version of these notes (with links) is on readthedocs.

v6.155.1: Hypothesis version 6.155.1

Compare Source

Shrinking large floats, strings, and bytestrings is now much faster in
some cases (issue #​4006).

The canonical version of these notes (with links) is on readthedocs.

v6.155.0: Hypothesis version 6.155.0

Compare Source

"from_dtype()" now supports the variable-width string dtype
"numpy.dtypes.StringDType", generating arbitrary strings via "text()"
(issue #​4039).

Additionally, passing a dtype class such as "np.dtypes.StringDType"
where an instance like "np.dtypes.StringDType()" was expected now
raises a clear error, rather than the previous confusing message (or
silent coercion to the object dtype in "arrays()").

The canonical version of these notes (with links) is on readthedocs.

v6.154.2: Hypothesis version 6.154.2

Compare Source

This patch improves the type annotations of "fixed_dictionaries()",
which now accepts a "Mapping" rather than requiring an invariant
"dict". Because the value type is covariant, type-checkers can now
infer the generated type even when the strategies are heterogeneous,
e.g. a "mapping" annotated as "dict[str, SearchStrategy[int] |
SearchStrategy[str]]" (issue #​4665).

The "mapping" and "optional" arguments may now also have different key
and value types, which are unioned in the inferred result.

The canonical version of these notes (with links) is on readthedocs.

v6.154.1: Hypothesis version 6.154.1

Compare Source

This patch fixes a bug where resolving recursive forward references in
"from_type()" (such as "A = list[Union["A", str]]", added in
v6.152.11) could recurse until it hit the interpreter's recursion
limit before falling back to a deferred strategy. Because this
depended on the ambient stack depth, it occasionally surfaced as a
spurious "RecursionError" or other flaky failure. We now break the
cycle eagerly by deferring, so resolution uses a small and constant
amount of stack regardless of how deeply nested the reference is.

The canonical version of these notes (with links) is on readthedocs.

v6.154.0: Hypothesis version 6.154.0

Compare Source

"fixed_dictionaries()" now varies the iteration order of the dicts it
generates, rather than always placing the required keys first, to help
find bugs in code which is sensitive to key order (issue #​3906). If
you need a stable order, we recommend using
"fixed_dictionaries(...).map(stable_sort_function)" or similar.

The canonical version of these notes (with links) is on readthedocs.

v6.153.6: Hypothesis version 6.153.6

Compare Source

The "--hypothesis-show-statistics" report now accounts for the
"Phase.explain" phase separately, rather than including its runtime
and test cases in the "Phase.shrink" phase (issue #​4179).

The canonical version of these notes (with links) is on readthedocs.

v6.153.5: Hypothesis version 6.153.5

Compare Source

This patch dramatically improves the performance of "from_type()" on
hierarchies of abstract classes whose subclasses refer back to the
base class (directly, or via a sibling subclass) in their annotations.
Resolution previously took time cubic in the number of subclasses; we
now resolve each type only once (issue #​4729).

The canonical version of these notes (with links) is on readthedocs.

v6.153.4: Hypothesis version 6.153.4

Compare Source

This patch fixes a bug where fuzz_one_input did not track the
"interesting_origin" of failures (issue #​4420). As a result, it only
saved the single smallest failure to the database rather than the
smallest example of each distinct failure, and the
"interesting_origin" was missing from observability reports.

The canonical version of these notes (with links) is on readthedocs.

v6.153.3: Hypothesis version 6.153.3

Compare Source

This patch fixes a bug where "decimals()" with the "places" argument
could generate values outside the "min_value" and "max_value" bounds,
when those bounds had more fractional digits than "places" (issue
#​4651).

The canonical version of these notes (with links) is on readthedocs.

v6.153.2: Hypothesis version 6.153.2

Compare Source

This patch improves the performance of stateful testing for state
machines with a large number of rules (issue #​4465).

The canonical version of these notes (with links) is on readthedocs.

v6.153.1: Hypothesis version 6.153.1

Compare Source

This patch fixes a bug where we emitted incorrect git patch files when
one file did not have a trailing newline (issue #​4744).

The canonical version of these notes (with links) is on readthedocs.

v6.153.0: Hypothesis version 6.153.0

Compare Source

"event()"'s "payload" is now typed as accepting "Any", matching its
runtime behavior of accepting any string-coercible object.

The canonical version of these notes (with links) is on readthedocs.

v6.152.12: Hypothesis version 6.152.12

Compare Source

When Hypothesis detects that your data generation is flaky and raises
"FlakyStrategyDefinition", the error message now describes what
differed between the two runs - such as a different choice type,
different constraints, or drawing more or less data - as well as the
stack of strategies being drawn from, instead of only reporting that
generation was inconsistent. In stateful tests, it also reports the
steps leading up to the error.

Thanks to Ian Hunt-Isaak for this improvement!

The canonical version of these notes (with links) is on readthedocs.

v6.152.11: Hypothesis version 6.152.11

Compare Source

This patch adds support for recursive forward references in
"from_type()", such as "A = list[Union["A", str]]" (issue #​4542).
Previously, such recursive type aliases would raise a
"ResolutionFailed" error. Now, Hypothesis can automatically resolve
the forward reference by looking it up in the caller's namespace. This
also resolves forward references inside "type[...]", such as
"type["MyClass"]".

The canonical version of these notes (with links) is on readthedocs.

v6.152.10: Hypothesis version 6.152.10

Compare Source

This patch renames our source code directory from "hypothesis-python"
to "hypothesis", and changes our canonical scheme for git tags from
"hypothesis-python-X.Y.Z" to "vX.Y.Z".

We have backfilled git tags in the new "vX.Y.Z" scheme. Any
distributions or build scripts which rely on the git tag scheme should
update to the new scheme.

The canonical version of these notes (with links) is on readthedocs.

v6.152.9

Compare Source

v6.152.8

Compare Source

v6.152.7

Compare Source

v6.152.6

Compare Source

v6.152.5

Compare Source

v6.152.4

Compare Source

v6.152.3

Compare Source

[v6.152.2](https://redirect.githu

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Vancouver)

  • Branch creation
    • "before 4am on the 1st day of the month,before 4am on the 15th day of the month"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/all-non-major-dependencies branch 11 times, most recently from fa8d43b to 4af6d7b Compare May 22, 2026 04:59
@renovate renovate Bot force-pushed the renovate/all-non-major-dependencies branch 10 times, most recently from bc306d4 to 56bd2d8 Compare May 28, 2026 10:14
@renovate renovate Bot force-pushed the renovate/all-non-major-dependencies branch 7 times, most recently from bb2460d to 4bd97dd Compare June 5, 2026 17:00
@renovate renovate Bot force-pushed the renovate/all-non-major-dependencies branch from 4bd97dd to d527bdc Compare June 8, 2026 18:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants