Skip to content

Bump the python-dependencies group with 7 updates#73

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/uv/python-dependencies-c0f14c67d1
Open

Bump the python-dependencies group with 7 updates#73
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/uv/python-dependencies-c0f14c67d1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 2, 2026

Bumps the python-dependencies group with 7 updates:

Package From To
pydantic 2.12.5 2.13.3
fastapi 0.135.3 0.136.1
zensical 0.0.32 0.0.36
uvicorn 0.44.0 0.46.0
ruff 0.15.9 0.15.12
mypy 1.20.0 1.20.2
pyinstaller 6.19.0 6.20.0

Updates pydantic from 2.12.5 to 2.13.3

Release notes

Sourced from pydantic's releases.

v2.13.3 2026-04-20

v2.13.3 (2026-04-20)

What's Changed

Fixes

Full Changelog: pydantic/pydantic@v2.13.2...v2.13.3

v2.13.2 2026-04-17

v2.13.2 (2026-04-17)

What's Changed

Fixes

  • Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

Full Changelog: pydantic/pydantic@v2.13.1...v2.13.2

v2.13.1 2026-04-15

v2.13.1 (2026-04-15)

What's Changed

Fixes

Full Changelog: pydantic/pydantic@v2.13.0...v2.13.1

v2.13.0 2026-04-13

v2.13.0 (2026-04-13)

The highlights of the v2.13 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release contains the updated pydantic.v1 namespace, matching version 1.10.26 which includes support for Python 3.14.

What's Changed

See the beta releases for all changes sinces 2.12.

Packaging

  • Add zizmor for GitHub Actions workflow linting by @​Viicos in #13039
  • Update jiter to v0.14.0 to fix a segmentation fault on musl Linux by @​Viicos in #13064

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

  • Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

GitHub release

What's Changed

Fixes

v2.13.0 (2026-04-13)

GitHub release

The highlights of the v2.13 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release contains the updated pydantic.v1 namespace, matching version 1.10.26 which includes support for Python 3.14.

What's Changed

See the beta releases for all changes sinces 2.12.

New Features

  • Allow default factories of private attributes to take validated model data by @​Viicos in #13013

Changes

... (truncated)

Commits
  • 9e9a111 Fix backported test
  • 1ec8c6a Prepare release v2.13.3
  • fb4f204 Handle AttributeError subclasses with from_attributes
  • ca3ddd1 Prepare release v2.13.2
  • 000e823 Fix ValidationInfo.field_name missing with model_validate_json()
  • d45d8be Prepare release 2.13.1
  • 54aca60 Fix ValidationInfo.data missing with model_validate_json()
  • 46bf4fa Fix Pydantic release workflow (#13067)
  • 1b359ed Prepare release v2.13.0 (#13065)
  • b1bf194 Fix model equality when using runtime extra configuration (#13062)
  • Additional commits viewable in compare view

Updates fastapi from 0.135.3 to 0.136.1

Release notes

Sourced from fastapi's releases.

0.136.1

Upgrades

Internal

0.136.0

Upgrades

0.135.4

Refactors

Internal

Commits

Updates zensical from 0.0.32 to 0.0.36

Release notes

Sourced from zensical's releases.

0.0.36

Summary

This version adds the missing update of the user interface that should've been included with v0.0.35.

Changelog

Bug fixes

  • d4d88f8 ui – update ui to v0.0.15

0.0.35

[!WARNING]

Please update to v0.0.36 – this version is missing some changes to the user interface for the new features.

Summary

This version adds native support for GLightbox, a JavaScript lightbox library to add zoom and gallery features to images. Images can be automatically annotated with the new glightbox Markdown extension. Add the following to zensical.toml:

[project.markdown_extensions.zensical.extensions.glightbox]

[!NOTE]

In order to integrate with configuration in mkdocs.yml, where GLightbox is implemented as a plugin, a compatibility shim is included, so no re-configuration is necessary if you're already using the plugin. Note that our extension is more efficient and faster than the plugin, as it does not re-parse the entire HTML of each page, but instead uses Python Markdown's native extension API.

HTML in the table of contents

Additionally, section titles in the table of contents will now render with HTML markup, so you can use emojis and other inline features in section titles and have them render correctly in the table of contents. In Material for MkDocs, this functionality was implemented with the typeset plugin. Zensical now supports this natively.

Relative links in raw HTML

Relative links in raw HTML are now correctly resolved. Initially, we carried over the link processing and resolution logic from MkDocs, which does not support relative links in raw HTML to this day. We implemented a Python Markdown postprocessor, to ensure that relative links in raw HTML are handled as well.

Changelog

Features

  • 5519730 zensical, compat – render section title with markup in table of contents
  • db8518d compat – add plugin compatibility shim for glightbox
  • 057da7c compat – add support for image galleries using glightbox (#290)

Bug fixes

... (truncated)

Commits
  • 5081de2 chore: release v0.0.36 (#576)
  • d4d88f8 fix: update ui to v0.0.15
  • ca9743a chore: release v0.0.35
  • 676bfe2 chore: fix mypy linter error
  • 64f3f33 fix: relative links in raw HTML not correctly resolved (#258)
  • 87abb2a fix: remove img attributes moved to parent in GLightboxExtension
  • 5795fc8 Merge pull request #569 from zensical/fix/lightbox-extension
  • f7531af fix: images in raw HTML are double-processed by GLightboxExtension
  • 1d8dc83 fix: ensure None attributes are not added by GlightboxExtension
  • 7c977a8 refactor: move GLightbox extension to regular Postprocessor
  • Additional commits viewable in compare view

Updates uvicorn from 0.44.0 to 0.46.0

Release notes

Sourced from uvicorn's releases.

Version 0.46.0

What's Changed

Full Changelog: Kludex/uvicorn@0.45.0...0.46.0

Version 0.45.0

What's Changed

New Contributors

Full Changelog: Kludex/uvicorn@0.44.0...0.45.0

Changelog

Sourced from uvicorn's changelog.

0.46.0 (April 23, 2026)

Added

  • Support ws_max_size in wsproto implementation (#2915)
  • Support ws_ping_interval and ws_ping_timeout in wsproto implementation (#2916)

Changed

  • Use bytearray for incoming WebSocket message buffer in websockets-sansio (#2917)

0.45.0 (April 21, 2026)

Added

  • Add --reset-contextvars flag to isolate ASGI request context (#2912)
  • Accept os.PathLike for log_config (#2905)
  • Accept log_level strings case-insensitively (#2907)

Changed

  • Revert "Emit http.disconnect on server shutdown for streaming responses" (#2913)
  • Revert "Explicitly start ASGI run with empty context" (#2911)

Fixed

  • Preserve forwarded client ports in proxy headers middleware (#2903)
  • Raise helpful ImportError when PyYAML is missing for YAML log config (#2906)
Commits
  • b224045 Version 0.46.0 (#2918)
  • 7375b5b Use bytearray for incoming WebSocket message buffer in websockets-sansio (#...
  • d438fb1 Support ws_ping_interval and ws_ping_timeout in wsproto implementation ...
  • 3e6b964 Support ws_max_size in wsproto implementation (#2915)
  • 2c423bd Version 0.45.0 (#2914)
  • 7f027f8 Revert "Emit http.disconnect on server shutdown for streaming responses" (#...
  • 73a80c3 Add --reset-contextvars flag to isolate ASGI request context (#2912)
  • 45c0b56 Revert empty context for ASGI runs (#2911)
  • 850d926 Raise helpful ImportError when PyYAML is missing for YAML log config (#2906)
  • fdcacb4 Accept log_level strings case-insensitively (#2907)
  • Additional commits viewable in compare view

Updates ruff from 0.15.9 to 0.15.12

Release notes

Sourced from ruff's releases.

0.15.12

Release Notes

Released on 2026-04-24.

Preview features

  • Implement #ruff:file-ignore file-level suppressions (#23599)
  • Implement #ruff:ignore logical-line suppressions (#23404)
  • Revert preview changes to displayed diagnostic severity in LSP (#24789)
  • [airflow] Implement task-branch-as-short-circuit (AIR004) (#23579)
  • [flake8-bugbear] Fix break/continue handling in loop-iterator-mutation (B909) (#24440)
  • [pylint] Fix PLC2701 for type parameter scopes (#24576)

Rule changes

  • [pandas-vet] Suggest .array as well in PD011 (#24805)

CLI

  • Respect default Unix permissions for cache files (#24794)

Documentation

  • [pylint] Fix PLR0124 description not to claim self-comparison always returns the same value (#24749)
  • [pyupgrade] Expand docs on reusable TypeVars and scoping (UP046) (#24153)
  • Improve rules table accessibility (#24711)

Contributors

Install ruff 0.15.12

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.12/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.12

Released on 2026-04-24.

Preview features

  • Implement #ruff:file-ignore file-level suppressions (#23599)
  • Implement #ruff:ignore logical-line suppressions (#23404)
  • Revert preview changes to displayed diagnostic severity in LSP (#24789)
  • [airflow] Implement task-branch-as-short-circuit (AIR004) (#23579)
  • [flake8-bugbear] Fix break/continue handling in loop-iterator-mutation (B909) (#24440)
  • [pylint] Fix PLC2701 for type parameter scopes (#24576)

Rule changes

  • [pandas-vet] Suggest .array as well in PD011 (#24805)

CLI

  • Respect default Unix permissions for cache files (#24794)

Documentation

  • [pylint] Fix PLR0124 description not to claim self-comparison always returns the same value (#24749)
  • [pyupgrade] Expand docs on reusable TypeVars and scoping (UP046) (#24153)
  • Improve rules table accessibility (#24711)

Contributors

0.15.11

Released on 2026-04-16.

Preview features

  • [ruff] Ignore RUF029 when function is decorated with asynccontextmanager (#24642)
  • [airflow] Implement airflow-xcom-pull-in-template-string (AIR201) (#23583)
  • [flake8-bandit] Fix S103 false positives and negatives in mask analysis (#24424)

... (truncated)

Commits
  • 66f93cf Bump 0.15.12 (#24815)
  • 476a4d0 [ty] Complete support for more detailed diagnostics on possibly unbound error...
  • ed669ea Implement #ruff:file-ignore file-level suppressions (#23599)
  • e73d952 [ty] Include inferred type in invalid-key concise diagnostic for union/inte...
  • 80feb29 [ty] report only dead annotation-only locals as unused (#24811)
  • 0fbf2bc Drop deprecated license classifier (#24808)
  • 43b174c [ty] Infer lambda parameter types with Callable type context (#24317)
  • 4f449ae [ty] Add error context for intersection types (#24772)
  • 5b4e753 [ty] Add support for goto in literal enum member inlay hint (#24792)
  • e7cc762 [ty] Add error context for TypedDict assignments (#24790)
  • Additional commits viewable in compare view

Updates mypy from 1.20.0 to 1.20.2

Changelog

Sourced from mypy's changelog.

Mypy 1.20.2

  • Use WAL with SQLite cache and fix close (Shantanu, PR 21154)
  • Adjust SQLite journal mode (Ivan Levkivskyi, PR 21217)
  • Correctly aggregate narrowing information on parent expressions (Shantanu, PR 21206)
  • Fix regression related to generic callables (Shantanu, PR 21208)
  • Fix regression by avoiding widening types in some contexts (Shantanu, PR 21242)
  • Fix slicing in non-strict optional mode (Shantanu, PR 21282)
  • mypyc: Fix match statement semantics for "or" pattern (Shantanu, PR 21156)
  • mypyc: Fix issue with module dunder attributes (Piotr Sawicki, PR 21275)
  • Initial support for Python 3.15.0a8 (Marc Mueller, PR 21255)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • A5rocks
  • Aaron Wieczorek
  • Adam Turner
  • Ali Hamdan
  • asce
  • BobTheBuidler
  • Brent Westbrook
  • Brian Schubert
  • bzoracler
  • Chris Burroughs
  • Christoph Tyralla
  • Colin Watson
  • Donghoon Nam
  • E. M. Bray
  • Emma Smith
  • Ethan Sarp
  • George Ogden
  • getzze
  • grayjk
  • Gregor Riepl
  • Ivan Levkivskyi
  • James Hilliard
  • James Le Cuirot
  • Jeremy Nimmer
  • Joren Hammudoglu
  • Kai (Kazuya Ito)
  • kaushal trivedi
  • Kevin Kannammalil
  • Lukas Geiger
  • Łukasz Langa
  • Marc Mueller
  • Michael R. Crusoe
  • michaelm-openai
  • Neil Schemenauer
  • Piotr Sawicki

... (truncated)

Commits

Updates pyinstaller from 6.19.0 to 6.20.0

Release notes

Sourced from pyinstaller's releases.

v6.20.0

Please see the v6.20.0 section of the changelog for a list of the changes since v6.19.0.

Changelog

Sourced from pyinstaller's changelog.

6.20.0 (2026-04-22)

Bugfix


* (Linux) Fix binary dependency analysis in Termux environment; previously,
  no binary dependencies would be reported due to mismatched ``ldd`` output
  pattern. (:issue:`9402`)
* (Linux) Fix compatibility issues with Termux python 3.13, caused by
  platform being now reported as "android" instead of "linux" (PEP 738).
  (:issue:`9398`)
* (macOS) Fix built-time error when trying to create an .app bundle with
  data collected from a directory that contains symlinked elements.
  (:issue:`9375`)
* Fix the ``forkserver`` spawn mode of ``multiprocessing`` under python
  3.13.13, 3.14.4, and the upcoming 3.15. (:issue:`9423`)
* Remove warning about non-existing ``tclX`` module directory; in some Tcl
  distributions (e.g., Debian-packaged Tcl), this directory is located
  under the main library/data directory, and therefore the stand-alone
  directory neither exists nor needs to be explicitly collected.
  (:issue:`9401`)

Hooks


* Prevent the run-time hook for ``gi.repository.GLib`` from overriding
  the implicit default value of the ``XDG_DATA_DIRS`` environment
  variable (i.e., ``/usr/local/share/:/usr/share/``) when adding the
  frozen application's top-level directory to the list of data directories.
  (:issue:`9422`)
* Update ``gi.repository.Gio`` hook to collect corresponding platform-specific
  typelib (``GioWin32`` or ``GioUnix``), and add hooks for these modules.
  This aims to prevent potential run-time errors, either because the typelib
  is missing, or because it was opportunistically loaded from the run-time
  system and happens to be of incompatible version. (:issue:`9410`)
* Update ``gi.repository.GLib`` hook to collect corresponding platform-specific
  typelib (``GLibWin32`` or ``GLibUnix``), and add hooks for these modules.
  This aims to prevent potential run-time errors, either because the typelib
  is missing, or because it was opportunistically loaded from the run-time
  system and happens to be of incompatible version. (:issue:`9410`)

Bootloader
</code></pre>
<ul>
<li>(Windows) Add new option to the <code>waf</code> build script, <code>--no-cfg</code>,
that allows bootloader to be built without Control Flow Guard (CFG)
enabled. Applicable only when building with MSVC toolchain. (:issue:<code>9352</code>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>

<ul>
<li><a href="https://github.com/pyinstaller/pyinstaller/commit/8a6172796b56aa428980c3628663ba08e77ad81e&quot;&gt;&lt;code&gt;8a61727&lt;/code&gt;&lt;/a> Release v6.20.0. [skip ci]</li>
<li><a href="https://github.com/pyinstaller/pyinstaller/commit/151ff76940748960452b3186b6885758d94841dc&quot;&gt;&lt;code&gt;151ff76&lt;/code&gt;&lt;/a> Tests: Requirements: Scheduled weekly dependency update for week 16 (<a href="https://redirect.github.com/pyinstaller/pyinstaller/issues/9431&quot;&gt;#9431&lt;/a&gt;)&lt;/li>
<li><a href="https://github.com/pyinstaller/pyinstaller/commit/4d28a528f8ab8632f7cfa7662fc6fcc45881e741&quot;&gt;&lt;code&gt;4d28a52&lt;/code&gt;&lt;/a> Tests: Requirements: Scheduled weekly dependency update for week 15 (<a href="https://redirect.github.com/pyinstaller/pyinstaller/issues/9429&quot;&gt;#9429&lt;/a&gt;)&lt;/li>
<li><a href="https://github.com/pyinstaller/pyinstaller/commit/881ee26d446a574c9bed14d4e8fd40628c7c1a93&quot;&gt;&lt;code&gt;881ee26&lt;/code&gt;&lt;/a> tests: test_path_encodings: ensure that custom tmp dir exists</li>
<li><a href="https://github.com/pyinstaller/pyinstaller/commit/b42c9421158d9a6069274f1af848549cc527afb7&quot;&gt;&lt;code&gt;b42c942&lt;/code&gt;&lt;/a> tests: test_bundled_shell_script: fix for Termux without /usr symlink</li>
<li><a href="https://github.com/pyinstaller/pyinstaller/commit/afc1b27baac552e985bd3f365eac401db1ca8189&quot;&gt;&lt;code&gt;afc1b27&lt;/code&gt;&lt;/a> ci: termux: use primary mirror and perform initial package upgrade</li>
<li><a href="https://github.com/pyinstaller/pyinstaller/commit/1c29fab7926c3ee4d185587f29ea015b41b955b5&quot;&gt;&lt;code&gt;1c29fab&lt;/code&gt;&lt;/a> Fix multiprocessing with forkserver in python 3.13.13 and 3.14.4</li>
<li><a href="https://github.com/pyinstaller/pyinstaller/commit/3eab93a1c006c9fd2e45174d9f54b8a981cc319d&quot;&gt;&lt;code&gt;3eab93a&lt;/code&gt;&lt;/a> ci: have setup-python check for latest version of python</li>
<li><a href="https://github.com/pyinstaller/pyinstaller/commit/929b186d3f451317deac6eae7663ba2e8726f75f&quot;&gt;&lt;code&gt;929b186&lt;/code&gt;&lt;/a> rthook: do not overwrite XDG_DATA_DIRS fallback value (<a href="https://redirect.github.com/pyinstaller/pyinstaller/issues/9422&quot;&gt;#9422&lt;/a&gt;)&lt;/li>
<li><a href="https://github.com/pyinstaller/pyinstaller/commit/722dbd189a7e8e572af6133848e6057aa44e945f&quot;&gt;&lt;code&gt;722dbd1&lt;/code&gt;&lt;/a> Tests: Requirements: Scheduled weekly dependency update for week 14 (<a href="https://redirect.github.com/pyinstaller/pyinstaller/issues/9419&quot;&gt;#9419&lt;/a&gt;)&lt;/li>
<li>Additional commits viewable in <a href="https://github.com/pyinstaller/pyinstaller/compare/v6.19.0...v6.20.0&quot;&gt;compare view</a></li>
</ul>
</details>

<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [pydantic](https://github.com/pydantic/pydantic) | `2.12.5` | `2.13.3` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.135.3` | `0.136.1` |
| [zensical](https://github.com/zensical/zensical) | `0.0.32` | `0.0.36` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.44.0` | `0.46.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.9` | `0.15.12` |
| [mypy](https://github.com/python/mypy) | `1.20.0` | `1.20.2` |
| [pyinstaller](https://github.com/pyinstaller/pyinstaller) | `6.19.0` | `6.20.0` |


Updates `pydantic` from 2.12.5 to 2.13.3
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.12.5...v2.13.3)

Updates `fastapi` from 0.135.3 to 0.136.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.135.3...0.136.1)

Updates `zensical` from 0.0.32 to 0.0.36
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.32...v0.0.36)

Updates `uvicorn` from 0.44.0 to 0.46.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.44.0...0.46.0)

Updates `ruff` from 0.15.9 to 0.15.12
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.9...0.15.12)

Updates `mypy` from 1.20.0 to 1.20.2
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.20.0...v1.20.2)

Updates `pyinstaller` from 6.19.0 to 6.20.0
- [Release notes](https://github.com/pyinstaller/pyinstaller/releases)
- [Changelog](https://github.com/pyinstaller/pyinstaller/blob/develop/doc/CHANGES.rst)
- [Commits](pyinstaller/pyinstaller@v6.19.0...v6.20.0)

---
updated-dependencies:
- dependency-name: pydantic
  dependency-version: 2.13.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: fastapi
  dependency-version: 0.136.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: zensical
  dependency-version: 0.0.36
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: uvicorn
  dependency-version: 0.46.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.15.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: mypy
  dependency-version: 1.20.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pyinstaller
  dependency-version: 6.20.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 2, 2026
@dependabot dependabot Bot requested a review from angela-tarantula as a code owner May 2, 2026 00:30
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 2, 2026
@dependabot dependabot Bot had a problem deploying to codecov-automation May 2, 2026 00:30 Failure
@dependabot dependabot Bot deployed to dependabot-automation May 2, 2026 00:30 Active
@dependabot dependabot Bot had a problem deploying to codecov-automation May 2, 2026 00:30 Failure
@dependabot dependabot Bot had a problem deploying to codecov-automation May 2, 2026 00:30 Failure
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 2, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

License Issues

uv.lock

PackageVersionLicenseIssue Type
pydantic2.13.3NullUnknown License
Allowed Licenses: Apache-2.0, ISC, MIT, MIT-0, BSD-2-Clause, BSD-3-Clause, MPL-2.0, 0BSD, Python-2.0, Python-2.0.1, CNRI-Python, GPL-1.0-or-later, GPL-2.0-or-later
Excluded from license check: pkg:pypi/click@8.3.2, pkg:pypi/fastapi@0.135.3, pkg:pypi/griffelib@2.0.2, pkg:pypi/iregexp-check@0.1.4, pkg:pypi/jsonpointer@3.1.1, pkg:pypi/mkdocs-autorefs@1.4.4, pkg:pypi/mkdocs-get-deps@0.2.2, pkg:pypi/mkdocstrings@1.0.3, pkg:pypi/mkdocstrings-python@2.0.3, pkg:pypi/mypy@1.20.0, pkg:pypi/pymdown-extensions@10.21.2, pkg:pypi/pytest@9.0.3, pkg:pypi/pytest-cov@7.1.0, pkg:pypi/python-dateutil@2.9.0.post0, pkg:pypi/ruff@0.15.9, pkg:pypi/starlette@1.0.0, pkg:pypi/uvicorn@0.44.0, pkg:pypi/pyinstaller@6.19.0, pkg:pypi/python-jsonpath@2.0.2, pkg:pypi/pyinstaller-hooks-contrib@2026.4, pkg:pypi/regex@2026.4.4, pkg:pypi/uv@0.10.12

OpenSSF Scorecard

PackageVersionScoreDetails
pip/fastapi 0.136.1 UnknownUnknown
pip/mypy 1.20.2 UnknownUnknown
pip/pydantic 2.13.3 UnknownUnknown
pip/pydantic-core 2.46.3 🟢 6.6
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 9Found 22/24 approved changesets -- score normalized to 9
Maintained🟢 1030 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Branch-Protection🟢 4branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/pyinstaller 6.20.0 UnknownUnknown
pip/ruff 0.15.12 UnknownUnknown
pip/tomli 2.4.1 UnknownUnknown
pip/uvicorn 0.46.0 UnknownUnknown
pip/zensical 0.0.36 UnknownUnknown

Scanned Files

  • uv.lock

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants