Bump the python-requirements group across 1 directory with 4 updates by dependabot[bot] · Pull Request #179 · fabiocaccamo/python-fsutil

dependabot · 2026-05-08T09:38:51Z

Updates the requirements on mypy, pre-commit, tox and urllib3 to permit the latest version.
Updates mypy to 2.0.0

Changelog

Mypy Release Notes

Next Release

Mypy 2.0

We’ve just uploaded mypy 2.0.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. There are also changes to options and defaults. You can install it as follows:
python3 -m pip install -U mypy
You can read the full documentation for this release on Read the Docs.

Enable --local-partial-types by Default

This flag affects the inference of types based on assignments in other scopes. For now, explicitly disabling this continues to be supported, but this support will be removed in the future as the legacy behaviour is hard to support with other current and future features in mypy, like the daemon or the new implementation of flexible redefinitions.

Contributed by Ivan Levkivskyi, Jukka Lehtosalo, Shantanu in PR 21163.

Enable --strict-bytes by Default

Per PEP 688, mypy no longer treats bytearray and memoryview values as assignable to the bytes type.

Contributed by Shantanu in PR 18371.

New Behavior for --allow-redefinition

The --allow-redefinition flag now behaves like --allow-redefinition-new in mypy 1.20 and earlier. The new behavior is generally more flexible. For example, you can have different types for a variable in different blocks:
# mypy: allow-redefinition
def foo(cond: bool) -> None:
if cond:
for x in ["a", "b"]:
# Type of "x" is "str" here
...
else:
for x in [1, 2]:
# Type of "x" is "int" here
...

... (truncated)

Commits

7a76500 Remove +dev from version
5a3ab3b Changelog for mypy 2.0 (#21422)
f9c86e2 Some changelog updates for 2.0 (#21413)
519eaf1 Bump librt to 0.10.0 (#21415)
158a620 Fix negative narrowing for containers (#21411)
e556eb9 Try fixing mypy mypyc wheels (#21392)
f2c9797 Expose --num-workers and --native-parser (#21387)
db0cb2f Bump ast-serialize cache version (#21388)
1090ca6 Bump ast-serialize version to 0.3.0 only (#21391)
714ca9f [mypyc] Add note about librt.strings thread safety (#21383)
Additional commits viewable in compare view

Updates pre-commit to 4.6.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.0

Features

pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.

#3662 PR by @asottile.

Fixes

pre-commit hook-impl: --hook-type is required.

#3661 PR by @asottile.

Changelog

Sourced from pre-commit's changelog.

4.6.0 - 2026-04-21

Features

pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.

#3662 PR by @asottile.

Fixes

pre-commit hook-impl: --hook-type is required.

#3661 PR by @asottile.

4.5.1 - 2025-12-16

Fixes

Fix language: python with repo: local without additional_dependencies.

#3597 PR by @asottile.

4.5.0 - 2025-11-22

Features

Add pre-commit hazmat.

#3585 PR by @asottile.

4.4.0 - 2025-11-08

Features

Add --fail-fast option to pre-commit run.

#3528 PR by @JulianMaurin.

Upgrade ruby-build / rbenv.

#3566 PR by @asottile.

#3565 issue by @MRigal.

Add language: unsupported / language: unsupported_script as aliases for language: system / language: script (which will eventually be deprecated).

#3577 PR by @asottile.

Add support docker-in-docker detection for cgroups v2.

#3535 PR by @br-rhrbacek.

#3360 issue by @JasonAlt.

Fixes

Handle when docker gives SecurityOptions: null.

#3537 PR by @asottile.

#3514 issue by @jenstroeger.

Fix error context for invalid stages in .pre-commit-config.yaml.

#3576 PR by @asottile.

... (truncated)

Commits

f35134b v4.6.0
2a51ffc Merge pull request #3662 from pre-commit/hook-impl-optional-hook-dir
d7dee32 make --hook-dir optional for hook-impl
965aeb1 Merge pull request #3661 from pre-commit/hook-impl-required
2eacc06 --hook-type is required for hook-impl
f5678bf Merge pull request #3657 from pre-commit/pre-commit-ci-update-config
054cc5b [pre-commit.ci] pre-commit autoupdate
5c0f302 Merge pull request #3652 from pre-commit/pre-commit-ci-update-config
a5d9114 [pre-commit.ci] pre-commit autoupdate
129a1f5 Merge pull request #3641 from pre-commit/mxr-patch-1
Additional commits viewable in compare view

Updates tox to 4.53.1

Release notes

Sourced from tox's releases.

v4.53.1

What's Changed

🐛 fix(security): harden user-facing logs and untrusted inputs by @gaborbernat in tox-dev/tox#3924

🐛 fix(type): correct argparse override signatures for ty 0.0.33 by @gaborbernat in tox-dev/tox#3932

fix: allow deps arrays in TOML schema by @cyphercodes in tox-dev/tox#3931

New Contributors

@cyphercodes made their first contribution in tox-dev/tox#3931

Full Changelog: tox-dev/tox@4.53.0...4.53.1

Changelog

Sourced from tox's changelog.

Bug fixes - 4.53.1

Hardening pass on user-facing logging and config parsing:

Mask secret-looking --key=value flag values in command logs (terminal warnings, .tox/<env>/log/*.log, and Outcome __repr__) using the same keyword regex previously applied to environment variable values.

Resolve PEP 723 script paths and reject any that escape tox_root; cap the script read at 5 MiB so a symlink to /dev/zero cannot exhaust memory.

Replace eval() of a constructed Literal[...] string in the CLI parser with a direct Literal[tuple(action.choices)] subscript.

Pass timeout=30 to urlopen when fetching a remote requirements file so a slow or unresponsive mirror cannot hang tox indefinitely. (:issue:3924)

Allow the generated TOML schema to validate array values for deps. (:issue:3929)

Correct type annotations for ArgumentParser.parse_args and parse_known_args overrides following typeshed PR [#15613](https://github.com/tox-dev/tox/issues/15613) <https://github.com/python/typeshed/pull/15613>_, which widened the args parameter from Sequence[str] to Iterable[str]. The narrower type in tox's overrides violated the Liskov substitution principle and caused invalid-method-override errors with ty 0.0.33. Also correct the option_spec annotation in docs/tox_conf.py to ClassVar[dict[str, Callable[[str], Any]]] matching the docutils stubs type. (:issue:3932)

v4.53.0 (2026-04-14)

Features - 4.53.0

TOML env_list now accepts bare range dicts ({ prefix = "3.", start = 12, stop = 14 }) and bare labeled dicts ({ ecosystem = ["oci", "python"] }) as top-level items, removing the { product = [...] } wrapper when there is only a single factor group - by :user:gaborbernat. (:issue:3923)

Bug fixes - 4.53.0

Nesting a range or labeled dict inside a product factor-group list now raises a clear error pointing at the un-nesting fix, instead of silently producing a malformed environment name - by :user:gaborbernat. (:issue:3923)

v4.52.1 (2026-04-09)

Bug fixes - 4.52.1

Changing a resolution-affecting environment variable via set_env (e.g. PIP_INDEX_URL) now invalidates the install cache and triggers a reinstall, rather than incorrectly reusing the cached environment - by :user:gaborbernat. (:issue:3917)

Use normalize_isa from python-discovery for architecture factor matching, supporting aliases like i686 →

... (truncated)

Commits

2b17791 release 4.53.1
86234dd fix: allow deps arrays in TOML schema (#3931)
dd305fe 🐛 fix(type): correct argparse override signatures for ty 0.0.33 (#3932)
3aa3cd5 [pre-commit.ci] pre-commit autoupdate
59b6cd2 build(deps): bump astral-sh/setup-uv from 8.0.0 to 8.1.0 (#3928)
3765fcd [pre-commit.ci] pre-commit autoupdate (#3927)
b76c383 build(deps): bump actions/cache from 5.0.4 to 5.0.5 (#3926)
7b0ad94 build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#3925)
4dcde44 🐛 fix(security): harden user-facing logs and untrusted inputs (#3924)
4c584f2 release 4.53.0
Additional commits viewable in compare view

Updates urllib3 to 2.7.0

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @Cycloctane)

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @kimkou2024)

See GHSA-mf9v-mfxr-j63j for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @christos-spearbit)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3764)

Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)

Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)

Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)

Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)

Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)

Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)

Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)

Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3764](https://github.com/urllib3/urllib3/issues/3764) <https://github.com/urllib3/urllib3/issues/3764>__)

Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)

Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)

Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

9a950b9 Release 2.7.0
5ec0de4 Merge commit from fork
2bdcc44 Merge commit from fork
f45b0df Fix a misleading example for ProxyManager (#4970)
577193c Switch to nightly PyPy3.11 in CI for now (#4984)
e90af45 Avoid infinite loop in HTTPResponse.read_chunked when amt=0 (#4974)
67ed74f Bump dev dependencies (#4972)
3abd481 Upgrade mypy to version 1.20.2 (#4978)
2b8725d Drop support for EOL PyPy3.10 (#4979)
2944b2a Upgrade setup-chrome and setup-firefox to fix warnings (#4973)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Updates the requirements on [mypy](https://github.com/python/mypy), [pre-commit](https://github.com/pre-commit/pre-commit), [tox](https://github.com/tox-dev/tox) and [urllib3](https://github.com/urllib3/urllib3) to permit the latest version. Updates `mypy` to 2.0.0 - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v1.20.0...v2.0.0) Updates `pre-commit` to 4.6.0 - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md) - [Commits](pre-commit/pre-commit@v4.5.0...v4.6.0) Updates `tox` to 4.53.1 - [Release notes](https://github.com/tox-dev/tox/releases) - [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst) - [Commits](tox-dev/tox@4.52.0...4.53.1) Updates `urllib3` to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.6.0...2.7.0) --- updated-dependencies: - dependency-name: mypy dependency-version: 2.0.0 dependency-type: direct:production dependency-group: python-requirements - dependency-name: pre-commit dependency-version: 4.6.0 dependency-type: direct:production dependency-group: python-requirements - dependency-name: tox dependency-version: 4.53.1 dependency-type: direct:production dependency-group: python-requirements - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production dependency-group: python-requirements ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels May 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the python-requirements group across 1 directory with 4 updates#179

Bump the python-requirements group across 1 directory with 4 updates#179
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/python-requirements-4f25127653

dependabot Bot commented on behalf of github May 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 8, 2026

Mypy Release Notes

Next Release

Mypy 2.0

Enable --local-partial-types by Default

Enable --strict-bytes by Default

New Behavior for --allow-redefinition

pre-commit v4.6.0

Features

Fixes

4.6.0 - 2026-04-21

Features

Fixes

4.5.1 - 2025-12-16

Fixes

4.5.0 - 2025-11-22

Features

4.4.0 - 2025-11-08

Features

Fixes

v4.53.1

What's Changed

New Contributors

Bug fixes - 4.53.1

Features - 4.53.0

Bug fixes - 4.53.0

Bug fixes - 4.52.1

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

Security

Deprecations and Removals

Bugfixes

2.7.0 (2026-05-07)

Security

Deprecations and Removals

Bugfixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Enable `--local-partial-types` by Default

Enable `--strict-bytes` by Default

New Behavior for `--allow-redefinition`