Bump the uv group across 5 directories with 18 updates

[dependabot]

Bumps the uv group with 15 updates in the /examples/data-quality-patterns directory:

Package	From	To
dagster	1.12.7	1.13.1
pytest	9.0.2	9.0.3
cryptography	46.0.3	48.0.1
dbt-common	1.37.2	1.37.3
deepdiff	8.6.1	8.6.2
filelock	3.20.1	3.20.3
idna	3.11	3.15
mistune	3.2.0	3.3.0
msgpack	1.1.2	1.2.1
orjson	3.11.5	3.11.6
protobuf	6.33.2	6.33.5
pyjwt	2.10.1	2.13.0
python-dotenv	1.2.1	1.2.2
starlette	0.50.0	1.3.1
urllib3	2.6.2	2.7.0

Bumps the uv group with 9 updates in the /examples/project_databricks_and_snowflake/deployments/local directory:

Package	From	To
dagster	1.12.6	1.13.1
cryptography	46.0.3	48.0.1
filelock	3.20.1	3.20.3
idna	3.11	3.15
protobuf	6.33.2	6.33.5
pyjwt	2.10.1	2.13.0
python-dotenv	1.2.1	1.2.2
starlette	0.50.0	1.3.1
urllib3	2.6.2	2.7.0

Bumps the uv group with 11 updates in the /examples/project_databricks_and_snowflake/projects/databricks-delta directory:

Package	From	To
dagster	1.12.6	1.13.1
pytest	9.0.2	9.0.3
cryptography	46.0.3	48.0.1
filelock	3.20.1	3.20.3
idna	3.11	3.15
protobuf	6.33.2	6.33.5
pyjwt	2.10.1	2.13.0
python-dotenv	1.2.1	1.2.2
starlette	0.50.0	1.3.1
urllib3	2.6.2	2.7.0
pyarrow	22.0.0	23.0.1

Bumps the uv group with 14 updates in the /examples/project_databricks_and_snowflake/projects/snowflake-medallion directory:

Package	From	To
dagster	1.12.6	1.13.1
pytest	9.0.2	9.0.3
cryptography	46.0.3	48.0.1
dbt-common	1.37.2	1.37.3
deepdiff	8.6.1	8.6.2
filelock	3.20.1	3.20.3
idna	3.11	3.15
msgpack	1.1.2	1.2.1
orjson	3.11.5	3.11.6
protobuf	6.33.2	6.33.5
pyjwt	2.10.1	2.13.0
python-dotenv	1.2.1	1.2.2
starlette	0.50.0	1.3.1
urllib3	2.6.2	2.7.0

Bumps the uv group with 3 updates in the /python_modules/libraries/dagster-airflow directory: cryptography, idna and pyjwt.

Updates dagster from 1.12.7 to 1.13.1

Changelog

Sourced from dagster's changelog.

1.13.13 (core) / 0.29.13 (libraries)

New

• [ui] The asset launch dialog now automatically expands the warnings section when alerts are present.

Bugfixes

• Fixed an issue where a fresh installation of dagster could resolve an incompatible version of grpcio-health-checking, breaking code server imports due to a protobuf version conflict.
• [ui] Fixed an error that occurred when viewing tick details for declarative automation runs.

1.13.12 (core) / 0.29.12 (libraries)

New

• [ui] Improved the performance of the runs feed for runs that target large numbers of assets and asset checks. The feed now fetches a bounded preview of the selection and loads the full lists on demand.
• [dagster-aws] Added a dashboard_refresh_interval parameter to PipesEMRServerlessClient and increased its default so that Spark UI URLs are no longer invalidated prematurely during a run. (Thanks, @​noy-solvin!)

Bugfixes

• Fixed a bug where a partitioned asset check with its own automation condition could raise a CheckError and halt the entire automation tick when it was requested on a tick that did not materialize the asset it targets.
• Fixed a bug where a code location could be left stuck in an error state after a transient gRPC failure during refresh (common during Kubernetes rolling deployments). The gRPC server watcher now periodically retries refresh for locations whose load error is a DagsterUserCodeUnreachableError. (Thanks, @​jmoldow!)
• [ui] Fixed an issue where long pool names could overflow their container; they are now truncated, and the run pools dialog wraps and scrolls when there are many pools.
• [dagster-dbt] Fixed a KeyError on failures when converting dbt run results to Dagster events for runs that omit that key (such as dbt Fusion).

1.13.11 (core) / 0.29.11 (libraries)

New

• [ui] The asset catalog page now renders as a single virtualized list, so workspaces with many asset groups or code locations no longer freeze the UI when expanding those sections.
• [dagster-dbt] Added a new "insights" option to DbtProjectComponent's include_metadata field, enabling Dagster+ Insights tracking from YAML config.
• [dagster-graphql] Added an optional limit argument and new assetSelectionCount / assetCheckSelectionCount fields to the Run GraphQL type, so clients can render a bounded preview of a run's asset/check selection alongside the true totals.

Bugfixes

• Asset check history is now cleared when an asset or its partitions are wiped; stale entries no longer linger in the Execution History and Partitions views.
• [ui] The run detail page header now displays the asset-check count for asset-job runs, and the count is now read from the execution plan rather than by scanning the full run event log.
• [ui] The "View asset lineage" item in the run actions menu now correctly scopes to the assets in that run.
• [dagster-dbt] .with_insights() now logs a warning instead of raising when called against an unsupported adapter.

Documentation

• Added a new page documenting Dagster+ code-location snapshot size limits, with a script you can run locally to estimate snapshot sizes before deploying.
• Documented the "Run concurrency" Insights metric.
• Fixed an invalid pool config in the "Preventing concurrent dbt snapshots" DbtProjectComponent example.

1.13.10 (core) / 0.29.10 (libraries)

Bugfixes

... (truncated)

Commits

• 00e2ef7 1.13.1
• 1c95173 Adds changelog for 1.13.1 (#22830)
• 2c86620 Add dynamic partition escaping to SnowflakePolarsTypeHandler (#22903)
• a428f90 Add serverside killswitch for legacy freshness policy resolvers (#22891)
• a2210de [perf] fast-path all partition subset for multi partition assets
• 5ca5f93 Add PipesCompositeMessageReader for multi-writer pipes sessions (#22819)
• 6ca4c26 [docs] add migration guide for 1.13.0 (#22800)
• d82cc48 Add lastObservationTimestamp to GraphQL schema [FE-1106] (#22776)
• dd45863 Revert "Add lastObservationTimestamp to asset health, expand catalog sort opt...
• c82656e Update Serverless job location info (#22752)
• Additional commits viewable in compare view

Updates pytest from 9.0.2 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

• #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

• #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

  Previously this resulted in an internal assertion failure during plugin loading.

  Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

• #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

• #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

• #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

• #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
• #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
• #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
• #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

• #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

  -- by aleguy02

Commits

• a7d58d7 Prepare release version 9.0.3
• 089d981 Merge pull request #14366 from bluetech/revert-14193-backport
• 8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
• 99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
• ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
• 74eac69 doc: Update training info (#14298) (#14301)
• f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
• 7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
• 37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
• c34bfa3 Add explanation for string context diffs (#14257) (#14266)
• Additional commits viewable in compare view

Updates cryptography from 46.0.3 to 48.0.1

Changelog

Sourced from cryptography's changelog.

48.0.1 - 2026-06-09

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.
.. _v48-0-0:
48.0.0 - 2026-05-04

• BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed. cryptography now requires Python 3.9 or later.

• BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm now raises ValueError. Previously, such CRLs were parsed successfully and only rejected during signature validation.

• Added support for :doc:/hazmat/primitives/asymmetric/mlkem and :doc:/hazmat/primitives/asymmetric/mldsa when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels.

  • Note: Going forward, we do not guarantee that all functionality in cryptography will be available when building against OpenSSL. See :doc:/statements/state-of-openssl for more information.

.. _v47-0-0:

47.0.0 - 2026-04-24

* Support for Python 3.8 is deprecated and will be removed in the next
  ``cryptography`` release.
* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves
  (``SECT*`` classes) has been removed. These curves are rarely used and
  have additional security considerations that make them undesirable.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.
  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
  continue to be supported.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1.
* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or
  keys with unsupported explicit curve encodings now raises
  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of
  ``ValueError``. This change affects
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,
  and :meth:`~cryptography.x509.Certificate.public_key` when called on
  certificates with unsupported public key algorithms.
</tr></table> 

... (truncated)

Commits

• de987ce 48.0.1 version bump and changelog (#14996)
• 8e03e30 bump for 48.0.0 release (#14796)
• 295e0d2 Add AGENTS.md with CLAUDE.md symlink (#14794)
• 104a2de Bump BoringSSL, OpenSSL, AWS-LC in CI (#14793)
• 67ec1e5 call check_length early on AesSiv::encrypt (#14792)
• b2da57a changelog for mldsa/mlkem for openssl (#14791)
• 3cf44ad ML-KEM OpenSSL support (#14781)
• 2e31639 ML-DSA OpenSSL support (#14773)
• 5affe5a fix rust nightly clippy (#14790)
• 2e73ca4 bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (#1...
• Additional commits viewable in compare view

Updates dbt-common from 1.37.2 to 1.37.3

Changelog

Sourced from dbt-common's changelog.

dbt-common 1.37.3 - March 02, 2026

Security

• Replace os.path.commonprefix() with os.path.commonpath() to preventpath traversal via sibling directories with matching prefixes. (#1)

Commits

• See full diff in compare view

Updates deepdiff from 8.6.1 to 8.6.2

Release notes

Sourced from deepdiff's releases.

8.6.2 - Fix (CVE-2025-58367)

Commits

• 0d07ec2 Merge commit from fork
• 791f5aa updating CVE number
• a6aafea updating docs
• a0950ab Bump version: 8.6.1 → 8.6.2
• 887128a Fix (CVE-2025-58367)
• See full diff in compare view

Updates filelock from 3.20.1 to 3.20.3

Release notes

Sourced from filelock's releases.

3.20.3

What's Changed

• Fix TOCTOU symlink vulnerability in SoftFileLock by @​gaborbernat in tox-dev/filelock#465

Full Changelog: tox-dev/filelock@3.20.2...3.20.3

3.20.2

What's Changed

• Support Unix systems without O_NOFOLLOW by @​mwilliamson in tox-dev/filelock#463
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in tox-dev/filelock#464

New Contributors

• @​mwilliamson made their first contribution in tox-dev/filelock#463

Full Changelog: tox-dev/filelock@3.20.1...3.20.2

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

3.30.0 (2026-07-16)

---

• Add context_error_policy to surface body and release failures as a :exc:BaseExceptionGroup. :pr:618
• Add close_error_policy to control an :func:os.close failure after the OS unlock. :pr:619
• Add :func:~filelock.lock_descriptor and :func:~filelock.unlock_descriptor to lock a caller-owned file descriptor. :pr:620
• Add fallback_to_soft to fail closed instead of downgrading to :class:~filelock.SoftFileLock on ENOSYS. :pr:622
• Add preserve_lock_file so native locks keep the lock pathname on release. :pr:624
• Add an on_acquired hook that runs a callback on the locked descriptor once the lock is held. :pr:625
• Add StrictSoftFileLock, which treats every marker it did not publish as contention, and SoftFileLease, whose claim expires and whose holder learns through on_compromise when it is lost. SoftFileLock(lifetime=...) now warns and names them. Both publish a record SoftFileLock evicts, so do not mix contracts on one path. :pr:636
• Add StrictSoftFileLock and AsyncStrictSoftFileLock with owner-specific hard-linked claims. Strict mode fails closed on claim damage, exposes each recovery token, and requires an exact claim name for a force break. :pr:637
• Ignore lifetime on native locks with a warning; only :class:~filelock.SoftFileLock honors it. :pr:593
• Stop mutating the Unix lock file before :func:fcntl.flock is held. :pr:594
• Bind the Windows reparse-point check to the locked handle to close a symlink-swap race. :pr:596
• Evict a non-regular soft lock file without reading it. :pr:597
• Write a soft lock's holder record atomically so a short write cannot create overlapping holders. :pr:614
• Make native lock release transactional so a failed unlock is retried, not dropped. :pr:615
• Open the Windows lock file via NtCreateFile so a real access denial is raised, not reported as a timeout. :pr:617
• Canonicalize singleton keys so equivalent path spellings share an instance, without following a final symlink. :pr:621
• Preserve parent lock ownership across fork(). A child closes an inherited descriptor only while its identity still matches, so it neither unlocks nor unlinks the parent's lock. It clears inherited ownership state and singleton caches, then requires a new lock instance before acquiring. Fork-time construction replaces inherited cache mutexes and omits an instance whose construction crossed into the child from the cache. If fstat() cannot establish the identity, child cleanup skips the descriptor number because an earlier fork callback may have reused it. Descriptor tracking also covers third-party backends that fail after assigning a descriptor. :pr:634
• Open a SQLite connection per outer acquisition and close it on final release, so a forked child can no longer close its parent's handle. A child rejects inherited databases until exec(), and a PyPy child rejects read-write locks once the parent has used SQLite. :pr:635
• Keep executor-backed lock operations alive until they finish when a caller cancels. Serialize acquisitions on the same async lock so cancellation rollback cannot release a later caller's hold. Roll back acquisitions that finish after cancellation and surface release failures. SQLite read-write locks keep their state until rollback ends the transaction; callers can retry cleanup with release(force=True) or another acquisition. :pr:640
• Reject negative and non-finite lifetime values during lock construction and assignment. :pr:644
• Read the saved Windows process-probe error before deciding that a soft-lock holder has exited. :pr:645
• Reject non-default lock options that a narrow subclass constructor cannot honor, and forward all options through subclasses that accept arbitrary keyword arguments. :pr:646
• Release now removes the path identity that acquisition recorded instead of resolving a symlinked parent again. When acquisition raises, its rollback no longer deletes the holder's deadlock record. :pr:647

... (truncated)

Commits

• 41b42dd Fix TOCTOU symlink vulnerability in SoftFileLock (#465)
• f2e7d40 [pre-commit.ci] pre-commit autoupdate (#464)
• 5088854 Support Unix systems without O_NOFOLLOW (#463)
• See full diff in compare view

Updates idna from 3.11 to 3.15

Changelog

Sourced from idna's changelog.

3.15 (2026-05-12)

• Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.
• Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.
• Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.
• Allow flit_core 4.x in the build backend.
• Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.
• Add Dependabot configuration for GitHub Actions.
• Convert README and HISTORY from reStructuredText to Markdown.
• Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

• Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

3.13 (2026-04-22)

• Correct classification error for codepoint U+A7F1

3.12 (2026-04-21)

• Update to Unicode 17.0.0.
• Issue a deprecation warning for the transitional argument.
• Added lazy-loading to provide some performance improvements.
• Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.

Thanks to Rodrigo Nogueira for contributions to this release.

Commits

• af30a09 Release 3.15
• 30314d4 Pre-release 3.15rc0
• 05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown
• 2987fdb Convert README and HISTORY from reStructuredText to Markdown
• 59fa800 Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333ea
• def6983 Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea
• bbd8004 Merge pull request #234 from StanFromIreland/patch-1
• edd07c0 Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group
• 5557db0 Merge branch 'master' into patch-1
• f11746c Merge pull request #235 from StanFromIreland/patch-2
• Additional commits viewable in compare view

Updates mistune from 3.2.0 to 3.3.0

Release notes

Sourced from mistune's releases.

v3.3.0

   🐞 Bug Fixes

• Resolve O(n^2) DoS in parse_link_text (CWE-400)  -  by bhanugoudm041 (b6b49)
• Resolve O(n^2) DoS in parse_link_text (CWE-400)-Type handling/testing done  -  by bhanugoudm041 (b3af8)
• block: Avoid quadratic ref link scans  -  by @​lepture (2b04d)
• cli: Add entrypoint and utf-8 output  -  by @​lepture (2f244)
• directives: Constrain include targets  -  by @​lepture (1bef3)
• formatting: Avoid quadratic marker scans  -  by @​lepture (96d0f)
• image: Validate figure width option  -  by @​lepture (e3e51)
• inline: Avoid bracket parsing DoS  -  by @​lepture (25f25)
• math: Reject currency patterns and cross-line matches in inline math  -  by @​geopanther (566e1)
• math: Support display and backtick math  -  by @​lepture (1141e)
• renderer: Render plugin list and table nodes  -  by @​lepture (614b0)
• renderer: Block encoded unsafe URL schemes  -  by @​lepture (c7101)
• toc: Avoid generated id collisions  -  by @​lepture (c4093)

   🏎 Performance

• Improve performance  -  by @​lepture (bf95c)

    View changes on GitHub

v3.2.1

   🐞 Bug Fixes

• Resolve Windows compatibility issues in file inclusion and tests  -  by @​Yuki9814 (25471)
• Escape html text  -  by @​lepture (a3cb6)
• Update link reference  -  by @​lepture (85eb5)
• Handle escaped dollar signs in inline math  -  by @​saschabuehrle in lepture/mistune#370 (7bd57)
• Escape id of toc  -  by @​lepture (04880)
• Escape id of headings  -  by @​lepture (28556)
• Remove double-encoding of image alt text  -  by @​lawrence3699 (0d6f3)
• Escape xml for math plugin  -  by @​lepture (5fa09)
• Use strict regex for image's height and width  -  by @​lepture (8d0cb)

    View changes on GitHub

Changelog

Sourced from mistune's changelog.

Version 3.3.0

Released on Jun 21, 2026

• Improve CommonMark compatibility and parser performance.
• Add command line entrypoint with UTF-8 output.
• Support display and backtick math.
• Render plugin list and table nodes in Markdown renderer.
• Escape leading block markers in Markdown renderer.
• Fix RST renderer for block quotes nested in lists.
• Avoid generated heading ID collisions in TOC.
• Harden URL, image, figure, and include directive handling.
• Fix quadratic scans in inline links, reference links, and formatting markers.
• Fix math escaping, currency pattern matching, and cross-line matching.

Version 3.2.1

Released on May 3, 2026

• Escape link in render_toc_ul.
• Escape text in math plugin.
• Fix regex for math plugin.
• Escape heading's ID attribute.
• Fix LINK_TITLE_RE to prevent DoS.
• Escape class attribute for admonition directive.
• Remove double-encoding of image alt text.
• Escape class attribute for image directive.
• Fix width/height attribute for image directive.

Commits

• 15c3b79 chore: release 3.3.0
• bdc01ad tests: increase run time on pypy
• 7cf1814 tests: increase run time for pypy
• 6dfdc3d tests: add more tests
• 17c50f6 chore: fix mypy issues
• 63abe4b chore: use ruff check and format
• e6c1b18 chore: resolve mypy issues
• dcf8902 test(math): cover escaped math output
• c4093c4 fix(toc): avoid generated id collisions
• e3e51de fix(image): validate figure width option
• Additional commits viewable in compare view

Updates msgpack from 1.1.2 to 1.2.1

Release notes

Sourced from msgpack's releases.

v1.2.1

What's Changed

• Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies group by @​dependabot[bot] in msgpack/msgpack-python#694
• release v1.2.1 by @​methane in msgpack/msgpack-python#698

Full Changelog: msgpack/msgpack-python@v1.2.0...v1.2.1

v1.2.0

What's Changed

• relax setuptools version by @​methane in msgpack/msgpack-python#652
• update setuptools requirements to >=78.1.1 by @​methane in msgpack/msgpack-python#653
• cython: freethreading_compatible by @​methane in msgpack/msgpack-python#654
• drop Python 3.9 by @​methane in msgpack/msgpack-python#656
• update cython and cibuildwheel by @​methane in msgpack/msgpack-python#658
• ci: add riscv64 manylinux/musllinux wheels by @​justeph in msgpack/msgpack-python#664
• fix: check unpack_callback_uint32 result by @​KowalskiThomas in msgpack/msgpack-python#666
• fix: re-raise existing exception when available by @​KowalskiThomas in msgpack/msgpack-python#667
• fix: check return code in unpack_callback_int64 by @​KowalskiThomas in msgpack/msgpack-python#665
• Fixed README example by @​vallsv in msgpack/msgpack-python#668
• Bump the all-dependencies group with 6 updates by @​dependabot[bot] in msgpack/msgpack-python#669
• ci: use ubuntu-slim for lint by @​methane in msgpack/msgpack-python#670
• fix: enforce strict_map_key with object_pairs_hook by @​KowalskiThomas in msgpack/msgpack-python#673
• Raise DEFAULT_RECURSE_LIMIT from 511 to 1024 by @​Copilot in msgpack/msgpack-python#676
• fix: properly handle return codes in pack_timestamp by @​KowalskiThomas in msgpack/msgpack-python#672
• fix: avoid memory leak when decoding invalid nested arrays by @​KowalskiThomas in msgpack/msgpack-python#671
• Add missing autoreset in Packer.pack_ext_type by @​bysiber in msgpack/msgpack-python#663
• Add no-GIL interpreter support by @​clin1234 in msgpack/msgpack-python#641
• skip recursion limit test on free-threaded CPython builds by @​methane in msgpack/msgpack-python#679
• Fix Timestamp.from_datetime returning wrong value for pre-epoch datetimes by @​bysiber in msgpack/msgpack-python#662
• Add 3.15 to CI by @​clin1234 in msgpack/msgpack-python#678
• fix: use-after-free in get_data_from_buffer by @​KowalskiThomas in msgpack/msgpack-python#677
• change changelog format to markdown by @​methane in msgpack/msgpack-python#680
• Bump the all-dependencies group with 2 updates by @​dependabot[bot] in msgpack/msgpack-python#684
• Bump sys.setrecursionlimit within test_nest_limit_1024 by @​clin1234 in msgpack/msgpack-python#682
• Guard Packer buffer protocol hooks with Cython critical sections by @​Copilot in msgpack/msgpack-python#686
• Harden Unpacker.__init__ re-entry cleanup to prevent buffer/context leaks by @​Copilot in msgpack/msgpack-python#687
• release v1.2.0rc1 by @​methane in msgpack/msgpack-python#681
• Wheels CI hangs for MacOS Intel by @​crusaderky in msgpack/msgpack-python#689
• Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 in the all-dependencies group by @​dependabot[bot] in msgpack/msgpack-python#691
• release v1.2.0 by @​methane in msgpack/msgpack-python#692

New Contributors

• @​justeph made their first contribution in msgpack/msgpack-python#664
• @​KowalskiThomas made their first contribution in msgpack/msgpack-python#666
• @​vallsv made their first contribution in msgpack/msgpack-python#668
• @​dependabot[bot] made their first contribution in msgpack/msgpack-python#669
• @​Copilot made their first contribution in msgpack/msgpack-python#676
• @​bysiber made their first contribution in msgpack/msgpack-python#663
• @​clin1234 made their first contribution in msgpack/msgpack-python#641

... (truncated)

Changelog

Sourced from msgpack's changelog.

1.2.1

Release Date: 2026-06-19

Fix a segfault when calling Unpacker.unpack() or Unpacker.skip() after an unpacking failure. But note that reusing the same Unpacker instance after an unpacking failure is not supported. Please create a new Unpacker instance instead. GHSA-6v7p-g79w-8964

1.2.0

Release Date: 2026-06-11

• Support free threaded Python. #654, #686
• Dropped support for Python 3.9. #656
• Fix missing error checks in C code. #665, #666, #667, #672
• Fix strict_map_key option didn't work for object_pairs_hook. #673
• Increase DEFAULT_RECURSE_LIMIT of Unpacker to 1024. #676
• Fix memory leak when Unpacker returns error for invalid input. #671
• Fix Packer.pack_ext_type() ignored autoreset option. #663
• Fix Timestamp.from_datetime() returning wrong value for pre-epoch datetimes. #662
• Fix use-after-free in unpackb() and Unpacker.unpack() for non-contiguous input. #677
• Fix possible memory leak when calling Unpacker.__init__() several times. #687

Commits

• 448d43f release v1.2.1 (#698)
• 2c56ddb Merge commit from fork
• 0f4f350 Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies group (#694)
• 11ed0a5 release v1.2.0 (#692)
• c410a38 Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 (#691)
• 97ba6ca skip ci: remove unneeded CIBW_SKIP option
• cdde1b0 Wheels CI hangs for MacOS Intel (#689)
• 5eb57e1 release v1.2.0rc1 (#681)
• 77395c1 Harden Unpacker.__init__ re-entry cleanup to prevent buffer/context leaks (...
• 7df7136 Guard Packer buffer protocol hooks with Cython critical sections (#686)
• Additional commits viewable in compare view

Updates orjson from 3.11.5 to 3.11.6

Release notes

Sourced from orjson's releases.

3.11.6

Changed

• orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).
• Drop support for Python 3.9.
• ABI compatibility with CPython 3.15 alpha 5.
• Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

• Fix sporadic crash serializing deeply nested list of dict.

Changelog

Sourced from orjson's changelog.

3.11.6 - 2026-01-29

Changed

• orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).
• Drop support for Python 3.9.
• ABI compatibility with CPython 3.15 alpha 5.
• Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

• Fix sporadic crash serializing deeply nested list of dict.

Commits

• ec02024 3.11.6
• d581687 build, clippy misc
• 4105b29 writer::num
• 62bb185 Fix sporadic crash on serializing object close
• d860078 PyRef idiom refactors
• 343ae2f Deserializer, Utf8Buffer
• 7835f58 PyBytesRef and other input refactor
• 71e0516 PyStrRef
• 1096df4 MSRV 1.89
• b718e75 Drop support for python3.9
• Additional commits viewable in compare view

Updates protobuf from 6.33.2 to 6.33.5

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

• This version includes breaking changes to: C++, Objective-C, PHP, Python.
• [Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)
• [C++] Make generator headers private (protocolbuffers/protobuf@3a2af35)
• [C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (protocolbuffers/protobuf@7a75898)
• [C++] Add [[nodiscard]] to many APIs. (https://github.com/protocolbuff...

  Description has been truncated

[greptile-apps]

Greptile Summary

This is an automated dependabot bump of 18 packages across 5 directories (examples/data-quality-patterns, examples/project_databricks_and_snowflake/deployments/local, examples/project_databricks_and_snowflake/projects/databricks-delta, examples/project_databricks_and_snowflake/projects/snowflake-medallion, and python_modules/libraries/dagster-airflow). The changes update both uv.lock files and corresponding pyproject.toml lower-bound constraints.

• Several security fixes are included: idna 3.15 (CVE-2026-45409 ReDoS bypass), deepdiff 8.6.2 (CVE-2025-58367), filelock 3.20.3 (TOCTOU symlink fix), pytest 9.0.3 (CVE-2025-71176 insecure temp dir), mistune 3.3.0 (multiple DoS fixes), msgpack 1.2.1 (GHSA-6v7p-g79w-8964 segfault), and dbt-common 1.37.3 (path traversal fix).
• dagster is bumped from 1.12.x → 1.13.1 and starlette moves from 0.50.0 → 1.3.1 (a 0.x → 1.x milestone release); both are indirect/co-dependent updates driven by the core dagster upgrade.
• pyarrow in databricks-delta moves from >=14.0.0 to >=23.0.1 in pyproject.toml, a very aggressive lower-bound tightening that may surprise users who copy the example into a project with older Arrow environments.

Confidence Score: 4/5

Safe to merge; all changes are automated lock-file and constraint updates, predominantly security patch releases.

The bulk of changes are security-motivated patch bumps (idna, deepdiff, filelock, pytest, mistune, msgpack, dbt-common) with no API-breaking risk. The starlette 0.50.0 → 1.3.1 jump is large but is driven by the dagster 1.13.1 upgrade, which already declares compatibility. The one mildly surprising change is the pyarrow lower-bound in databricks-delta jumping from >=14 to >=23, which could affect users who install the example outside the lock file, but it does not break the repository itself.

examples/project_databricks_and_snowflake/projects/databricks-delta/pyproject.toml — the pyarrow minimum constraint tightening is worth a second look.

Important Files Changed

Filename	Overview
examples/data-quality-patterns/pyproject.toml	Bumps dagster lower bound to >=1.13.1 and pytest to >=9.0.3; straightforward example constraint update.
examples/project_databricks_and_snowflake/projects/databricks-delta/pyproject.toml	Bumps dagster to >=1.13.1 and jumps pyarrow lower bound from >=14.0.0 to >=23.0.1, a very aggressive minimum that skips 9 major versions.
examples/project_databricks_and_snowflake/deployments/local/pyproject.toml	Bumps dagster lower bound to >=1.13.1; minor constraint update with no concerns.
examples/project_databricks_and_snowflake/projects/snowflake-medallion/pyproject.toml	Bumps dagster lower bound to >=1.13.1; minor constraint update with no concerns.
examples/data-quality-patterns/uv.lock	Lock file updated with 15 package bumps including starlette 0.50.0→1.3.1, cryptography 46.0.3→48.0.1, and multiple security patch releases.
python_modules/libraries/dagster-airflow/uv.lock	Lock file receives cryptography 48.0.0→48.0.1 patch, idna 3.14→3.15 (CVE-2026-45409), and pyjwt 2.12.1→2.13.0.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[dependabot bump PR] --> B[5 directories updated]
    B --> C[examples/data-quality-patterns]
    B --> D[examples/project_databricks_and_snowflake/deployments/local]
    B --> E[examples/project_databricks_and_snowflake/projects/databricks-delta]
    B --> F[examples/project_databricks_and_snowflake/projects/snowflake-medallion]
    B --> G[python_modules/libraries/dagster-airflow]
    C --> C1[15 packages bumped: dagster 1.12.7→1.13.1, starlette 0.50.0→1.3.1, cryptography 46→48, idna CVE-2026-45409, mistune DoS fix, msgpack GHSA fix, deepdiff CVE-2025-58367]
    D --> D1[9 packages bumped: dagster 1.12.6→1.13.1, cryptography / idna / starlette etc.]
    E --> E1[11 packages bumped: dagster 1.12.6→1.13.1, pyarrow 22→23, min constraint 14→23]
    F --> F1[14 packages bumped: dagster 1.12.6→1.13.1, dbt-common path traversal fix]
    G --> G1[3 packages bumped: cryptography 48.0.0→48.0.1, idna 3.14→3.15, pyjwt 2.12.1→2.13.0]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[dependabot bump PR] --> B[5 directories updated]
    B --> C[examples/data-quality-patterns]
    B --> D[examples/project_databricks_and_snowflake/deployments/local]
    B --> E[examples/project_databricks_and_snowflake/projects/databricks-delta]
    B --> F[examples/project_databricks_and_snowflake/projects/snowflake-medallion]
    B --> G[python_modules/libraries/dagster-airflow]
    C --> C1[15 packages bumped: dagster 1.12.7→1.13.1, starlette 0.50.0→1.3.1, cryptography 46→48, idna CVE-2026-45409, mistune DoS fix, msgpack GHSA fix, deepdiff CVE-2025-58367]
    D --> D1[9 packages bumped: dagster 1.12.6→1.13.1, cryptography / idna / starlette etc.]
    E --> E1[11 packages bumped: dagster 1.12.6→1.13.1, pyarrow 22→23, min constraint 14→23]
    F --> F1[14 packages bumped: dagster 1.12.6→1.13.1, dbt-common path traversal fix]
    G --> G1[3 packages bumped: cryptography 48.0.0→48.0.1, idna 3.14→3.15, pyjwt 2.12.1→2.13.0]

Loading

_{Reviews (1): Last reviewed commit: "Bump the uv group across 5 directories w..." | Re-trigger Greptile}

[greptile-apps]

Aggressive pyarrow lower-bound tightening

The minimum pyarrow constraint jumps from >=14.0.0 to >=23.0.1, skipping nine major versions. While the lock file pins the exact resolved version, anyone who copies this example into their own project (or installs it without the lock file) will now require a very recent Arrow release. PyArrow 23 is current as of this PR, but this means the example becomes incompatible with any environment that has pyarrow 14–22 already installed. Consider whether a less aggressive lower bound (e.g. >=20.0.0) better reflects the actual compatibility range.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!