Skip to content

chore(deps-dev): bump the python-minor-and-patch group across 1 directory with 12 updates - #431

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-and-patch-3c92ed4c8d
Open

chore(deps-dev): bump the python-minor-and-patch group across 1 directory with 12 updates#431
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-minor-and-patch-3c92ed4c8d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 12 updates in the / directory:

Package From To
semgrep 1.169.0 1.172.0
coverage 7.15.0 7.15.2
cyclonedx-bom 7.3.0 7.3.1
diff-cover 10.3.0 10.4.1
hypothesis 6.156.6 6.164.0
mutmut 3.6.0 3.7.0
pip-tools 7.5.3 7.6.0
pre-commit 4.6.0 4.6.1
ruff 0.15.21 0.16.1
rust-just 1.56.0 1.57.0
wemake-python-styleguide 1.6.2 1.7.1
zizmor 1.26.1 1.28.0

Updates semgrep from 1.169.0 to 1.172.0

Release notes

Sourced from semgrep's releases.

Release v1.172.0

1.172.0 - 2026-07-28

### Added

  • Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

  • Updated the Ruby parser to tree-sitter-ruby v0.23.1, improving support for !=, case/when expressions with line breaks, and element references that take a block. (LANG-206)
  • The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

  • Semgrep will now print richer error messages on segfaults when --debug is NOT passed, matching the segfault error output when --debug is passed (engine-segv)
  • Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix)
  • Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty cycle pacing. (ocaml_gc_pacing_fix)
  • Improved the Scan Status output when no code rules will run (e.g. a Secrets-only or Supply-Chain-only scan). The summary line no longer reports a confusing "0 Code rules", and the "Code Rules" section now states explicitly either that code scanning is not enabled or that there are no code rules to run, instead of printing an empty table. (ENGINE-2878)
  • Fixed lockfileless Gradle dependency resolution failing with "Parsing dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The github-dependency-graph-gradle-plugin used during resolution was fetched unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is now pinned to 1.4.1. (sc-3738)

Release v1.171.0

1.171.0 - 2026-07-22

### Added

  • Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

  • The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

  • Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix)
  • Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.172.0 - 2026-07-28

### Added

  • Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

  • Updated the Ruby parser to tree-sitter-ruby v0.23.1, improving support for !=, case/when expressions with line breaks, and element references that take a block. (LANG-206)
  • The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

  • Semgrep will now print richer error messages on segfaults when --debug is NOT passed, matching the segfault error output when --debug is passed (engine-segv)
  • Fixed a source of rare, nondeterministic crashes and incorrect results caused by an OCaml compiler bug. Semgrep now builds against a compiler fork that backports the upstream fix. (ocaml_codegen_fix)
  • Fixed excessive heap growth after explicit major garbage collections. Semgrep now builds against an OCaml compiler that improves garbage collection duty cycle pacing. (ocaml_gc_pacing_fix)
  • Improved the Scan Status output when no code rules will run (e.g. a Secrets-only or Supply-Chain-only scan). The summary line no longer reports a confusing "0 Code rules", and the "Code Rules" section now states explicitly either that code scanning is not enabled or that there are no code rules to run, instead of printing an empty table. (ENGINE-2878)
  • Fixed lockfileless Gradle dependency resolution failing with "Parsing dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The github-dependency-graph-gradle-plugin used during resolution was fetched unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is now pinned to 1.4.1. (sc-3738)

1.170.0 - 2026-07-15

### Added

  • Pro C/C++ scans now skip code inside statically-dead preprocessor branches (for example, #if 0 ... #else ... #endif). Patterns that would otherwise match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)
  • Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV) (obackward)
  • semgrep install-semgrep-pro now sends usage metrics so that installation errors can be tracked. Metrics can be disabled with --metrics off or SEMGREP_SEND_METRICS=off. Metrics payloads also now include the method used to install the Semgrep CLI (pip, homebrew, docker, or unknown), detected heuristically. See metrics.md for more details of what exactly is sent. (engine-2858)

### Changed

  • Increased the timeout for dynamic dependency resolution subprocesses from

... (truncated)

Commits
  • 651f37e chore: release 1.172.0
  • 9273440 chore(ruby): bump semgrep-ruby to C API scanner (tree-sitter 0.26.3) (semgrep...
  • d154edb atd: invert exclude_binary_files → optional include_binary_files (semgrep/sem...
  • 5f976e2 chore(testo): remove testo pin and bump to 0.5.0 (semgrep/semgrep-proprietar...
  • 2515f3asemgrep/semgrep-proprietary#6803
  • e086f55semgrep/semgrep-proprietary#6705
  • 51cf5a9 fix(CLI): Only print non-zero product fragments (semgrep/semgrep-proprietary#...
  • 914b610semgrep/semgrep-proprietary#6775
  • d6fad57 fix(metrics): improve install-semgrep-pro error reporting (semgrep/semgrep-pr...
  • 7182c0asemgrep/semgrep-proprietary#6791
  • Additional commits viewable in compare view

Updates coverage from 7.15.0 to 7.15.2

Release notes

Sourced from coverage's releases.

7.15.2

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

7.15.1

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare.
  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213, 2214, 2215, 2216, 2218, 2220, and 2221.

➡️  PyPI page: coverage 7.15.1. :arrow_right:  To install: python3 -m pip install coverage==7.15.1

Changelog

Sourced from coverage's changelog.

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213 .. _pull 2214: coveragepy/coveragepy#2214 .. _pull 2215: coveragepy/coveragepy#2215 .. _pull 2216: coveragepy/coveragepy#2216 .. _pull 2218: coveragepy/coveragepy#2218 .. _pull 2220: coveragepy/coveragepy#2220 .. _pull 2221: coveragepy/coveragepy#2221 .. _pull 2224: coveragepy/coveragepy#2224

.. _changes_7-15-0:

Commits
  • 50d8659 docs: sample HTML for 7.15.2
  • b5eed20 docs: prep for 7.15.2
  • 78cab6e fix: reduce memory use during reporting. #2229 (#2231)
  • b4c1fda build: bump version to 7.15.2
  • da63bed docs: sample HTML for 7.15.1
  • bc35e64 docs: prep for 7.15.1
  • 182b010 perf: resolve sysmon branch events lazily, one pair at a time (#2221)
  • ee271ee perf: compute multiline maps cheaply in the sysmon core (#2220)
  • 1441b96 chore: bump the action-dependencies group with 6 updates (#2225)
  • dd80635 fix: escape context labels in html report inline script block (#2224)
  • Additional commits viewable in compare view

Updates cyclonedx-bom from 7.3.0 to 7.3.1

Release notes

Sourced from cyclonedx-bom's releases.

v7.3.1 (2026-07-23)

Bug Fixes

  • Improve error message for non-PEP 621 pyproject.toml (#1080, 6715bd9)

Documentation

What's Changed

New Contributors

Full Changelog: CycloneDX/cyclonedx-python@v7.3.0...v7.3.1

Changelog

Sourced from cyclonedx-bom's changelog.

v7.3.1 (2026-07-23)

Bug Fixes

  • Improve error message for non-PEP 621 pyproject.toml (#1080, 6715bd9)

Documentation

Commits
  • 5172a90 chore(release): 7.3.1
  • 6715bd9 fix: improve error message for non-PEP 621 pyproject.toml (#1080)
  • b830c67 chore(deps): Bump actions/setup-python from 6.2.0 to 6.3.0 (#1069)
  • 0b65166 chore(deps-dev): Update uv requirement from 0.11.8 to 0.11.17 (#1062)
  • ac491ab chore(deps): Bump actions/checkout from 6.0.2 to 7.0.0 (#1067)
  • d5ece1b chore(deps): Bump snok/install-poetry from 1.4.1 to 1.4.2 (#1063)
  • 95d4630 chore(deps): Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#1068)
  • b7abcd5 chore(ci): comments for pinned actions (#1061)
  • 78abbc5 Update CONTRIBUTING.md
  • 3c92172 Update PULL_REQUEST_TEMPLATE.md
  • Additional commits viewable in compare view

Updates diff-cover from 10.3.0 to 10.4.1

Release notes

Sourced from diff-cover's releases.

Version 10.4.1

What's Changed

Dependencies

Full Changelog: Bachmann1234/diff_cover@v10.4.0...v10.4.1

Version 10.4.0

What's Changed

Dependency bumps

New Contributors

Full Changelog: Bachmann1234/diff_cover@v10.3.0...v10.4.0

Changelog

Sourced from diff-cover's changelog.

8/06/2026 v10.4.2

7/23/2026 v10.4.1

7/21/2026 v10.4.0

  • Add --branch-coverage flag to diff-cover to treat partially covered branches in Cobertura XML reports as uncovered PR 608 Thanks @​mofr

05/30/2026 v10.3.0

  • Add --show-covered flag to highlight covered diff lines in HTML report PR 600 Thanks @​duxiaocheng

  • Update readme with cli flags PR 601 Thanks me

05/23/2026 v10.2.1

01/08/2026 v10.2.0

12/30/2025 v10.1.0

  • Add support for floating-point total percentage in reports PR 565 thanks @​tilaven

12/09/2025 v10.0.0

  • Remove python 3.9 support
  • Add python 3.14 support
  • Normalize exlude/include in pyproject.toml to support string or list

11/10/2025 v9.7.2

09/25/2025 v9.7.1

  • Revert the change to attempt to support ruff >=0.12.9 (@​YeeaahMan caught the error)

09/23/2025 v9.7.0

... (truncated)

Commits

Updates hypothesis from 6.156.6 to 6.164.0

Commits
  • 4b8467b Bump hypothesis version to 6.164.0 and update changelog
  • 47bb9d1 Merge pull request #4833 from Zac-HD/claude/hypothesis-issue-4149-16nmgw
  • b2b77ec Bump hypothesis version to 6.163.1 and update changelog
  • bc2af6c Merge pull request #4832 from Zac-HD/claude/hypothesis-nocover-cleanup-1yu7ao
  • cef8c21 ignore mock xp namespace warning
  • 65022c4 fix parents
  • 0c45285 clean up tests, simplify configs, parse complex constants
  • 13ccc11 be explicit in allowed types
  • f3b6dfe Exclude test code from the combined coverage report
  • 71b7bc0 Recognize zipimported stdlib when filtering explanations
  • Additional commits viewable in compare view

Updates mutmut from 3.6.0 to 3.7.0

Changelog

Sourced from mutmut's changelog.

3.7.0


* Fix the trampoline dropping a generator's return value, so ``yield from`` on a mutated generator no longer yields ``None`` instead of its result

    

  • 

    Fix async generators, so that aclose()/athrow() are handled by the except/finally blocks of the mutated function instead of being swallowed by the trampoline
    

    • 

  • 

    Fix max_stack_depth when a test changes the working directory (for example via a tmpdir fixture)
    

    • 

  • 

    Fix type_check_command reporting type errors in copied files that have no mutants
    

    • 

  • 

    Per-function source hashing for incremental cache invalidation — only re-test mutants in functions that changed
    

    • 

  • 

    Cross-call dependency tracking — invalidate mutants in callers when a called function changes
    

    • 

  • 

    Use git to detect non-Python dependency file changes; falls back to a curated file list when git is unavailable
    

    • 

  • 

    Add cache_invalidation_exclude config to suppress noisy files from change detection
    

    • 

  • 

    Add use_git_change_detection config (default true) to opt out of git-based detection
    

    • 

  • 

    Add uv.lock, poetry.lock, Pipfile.lock, and pdm.lock to the list of files copied by default
    

    • 

  • 

    Invalidate cached results automatically when result-affecting config fields change
    

    • 

  • 

    Make mutmut browse, show and apply much faster and use far less memory, by storing where each mutant is in the mutated file instead of parsing the whole file to find it

Commits

Updates pip-tools from 7.5.3 to 7.6.0

Release notes

Sourced from pip-tools's releases.

v7.6.0

2026-07-13

Features

  • The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by @​Dzhud.

    PRs and issues: #1142

  • Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by @​miettal.

    PRs and issues: #2288

  • pip-tools is now compatible with pip 26.1 -- @​gaborbernat.

    PRs and issues: #2379

Improved documentation

  • Fixed the contents sidebar for the index doc -- by @​sirosen.

    PRs and issues: #2169

  • pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

    Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

    PRs and issues: #2318

  • pip-tools' documentation now features a section titled "Reference" covering the CLI commands and configuration. Configuration documentation has been removed from the readme.

    -- by @​sirosen

Contributor-facing changes

  • CI testing now runs on Intel and ARM macOS runners, and is pinned to a specific macOS version -- by @​sirosen.

    PRs and issues: #2079, #2132, #2348

  • pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

    Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

    PRs and issues: #2278, #2318

  • Started running {pypi}zizmor as a part of CI pipelines to improve security of how we configure GitHub Actions CI/CD -- by @​webknjaz.

    PRs and issues: #2327

  • pip-tools docs now support GitHub Flavored Markdown admonition blocks -- by @​webknjaz.

... (truncated)

Changelog

Sourced from pip-tools's changelog.

v7.6.0

2026-07-13

Features

  • The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by {user}Dzhud.

    PRs and issues: {issue}1142

  • Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by {user}miettal.

    PRs and issues: {issue}2288

  • pip-tools is now compatible with pip 26.1 -- {user}gaborbernat.

    PRs and issues: {issue}2379

Improved documentation

  • Fixed the contents sidebar for the index doc -- by {user}sirosen.

    PRs and issues: {issue}2169

  • pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by {user}sirosen.

    Thanks to {user}0cjs, {user}gpshead, {user}mr-c, {user}samdoran, {user}webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

    PRs and issues: {issue}2318

  • pip-tools' documentation now features a section titled "Reference" covering the CLI commands and configuration. Configuration documentation has been removed from the readme.

    -- by {user}sirosen

Contributor-facing changes

  • CI testing now runs on Intel and ARM macOS runners, and is pinned to a specific macOS version -- by {user}sirosen.

    PRs and issues: {issue}2079, {issue}2132, {issue}2348

... (truncated)

Commits
  • 27f6a96 Merge pull request #2420 from sirosen/release/v7.6.0
  • cbe77f0 Apply suggestions from code review
  • 015146e Update changelog for version 7.6.0
  • 9a2d2c1 Merge pull request #2414 from jazzband/pre-commit-ci-update-config
  • fc3f877 Merge pull request #2418 from jazzband/dependabot/pip/docs/soupsieve-2.8.4
  • 5247a6b [pre-commit.ci] pre-commit autoupdate
  • 3d1faf6 Bump soupsieve from 2.8.3 to 2.8.4 in /docs
  • 57637db Merge pull request #2419 from sirosen/fix-test-failure
  • 4695c37 Fix the fake_with_deps test package
  • 24f4230 Merge pull request #2413 from webknjaz/maintenance/nested-zizmor-gha-workflow...
  • Additional commits viewable in compare view

Updates pre-commit from 4.6.0 to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

Commits
  • 242ce8a v4.6.1
  • 766e550 Merge pull request #3727 from pre-commit/dedupe
  • 1558d06 Merge pull request #3726 from pre-commit/exists-faster
  • 8a1c47a avoid duplicate files in --all-files during conflict
  • 2e01c99 faster check of rev existing locally as a commit
  • 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
  • 1d811d9 Return an error for invalid --repo
  • 374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
  • 1e7994f set JULIA_DEPOT_PATH
  • b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
  • Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

Documentation

  • Cover pycon Markdown formatting (#27153)
  • [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
  • [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
  • [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

  • Reduce syntax error noise by swallowing dedents like indents (#27170)
  • Vendor latest annotate-snippets (#27033)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

@dependabot
chore(deps-dev): bump the python-minor-and-patch group across 1 direc…
a52012c 
…tory with 12 updates

Bumps the python-minor-and-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [semgrep](https://github.com/semgrep/semgrep) | `1.169.0` | `1.172.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.0` | `7.15.2` |
| [cyclonedx-bom](https://github.com/CycloneDX/cyclonedx-python) | `7.3.0` | `7.3.1` |
| [diff-cover](https://github.com/Bachmann1234/diff-cover) | `10.3.0` | `10.4.1` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.156.6` | `6.164.0` |
| [mutmut](https://github.com/boxed/mutmut) | `3.6.0` | `3.7.0` |
| [pip-tools](https://github.com/jazzband/pip-tools) | `7.5.3` | `7.6.0` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.0` | `4.6.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.16.1` |
| [rust-just](https://github.com/gnpaone/rust-just) | `1.56.0` | `1.57.0` |
| [wemake-python-styleguide](https://github.com/wemake-services/wemake-python-styleguide) | `1.6.2` | `1.7.1` |
| [zizmor](https://github.com/zizmorcore/zizmor) | `1.26.1` | `1.28.0` |



Updates `semgrep` from 1.169.0 to 1.172.0
- [Release notes](https://github.com/semgrep/semgrep/releases)
- [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md)
- [Commits](semgrep/semgrep@v1.169.0...v1.172.0)

Updates `coverage` from 7.15.0 to 7.15.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.0...7.15.2)

Updates `cyclonedx-bom` from 7.3.0 to 7.3.1
- [Release notes](https://github.com/CycloneDX/cyclonedx-python/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-python/blob/main/CHANGELOG.md)
- [Commits](CycloneDX/cyclonedx-python@v7.3.0...v7.3.1)

Updates `diff-cover` from 10.3.0 to 10.4.1
- [Release notes](https://github.com/Bachmann1234/diff-cover/releases)
- [Changelog](https://github.com/Bachmann1234/diff_cover/blob/main/CHANGELOG)
- [Commits](Bachmann1234/diff_cover@v10.3.0...v10.4.1)

Updates `hypothesis` from 6.156.6 to 6.164.0
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.156.6...v6.164.0)

Updates `mutmut` from 3.6.0 to 3.7.0
- [Changelog](https://github.com/boxed/mutmut/blob/main/HISTORY.rst)
- [Commits](boxed/mutmut@3.6.0...3.7.0)

Updates `pip-tools` from 7.5.3 to 7.6.0
- [Release notes](https://github.com/jazzband/pip-tools/releases)
- [Changelog](https://github.com/jazzband/pip-tools/blob/main/CHANGELOG.md)
- [Commits](jazzband/pip-tools@v7.5.3...v7.6.0)

Updates `pre-commit` from 4.6.0 to 4.6.1
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.0...v4.6.1)

Updates `ruff` from 0.15.21 to 0.16.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.21...0.16.1)

Updates `rust-just` from 1.56.0 to 1.57.0
- [Release notes](https://github.com/gnpaone/rust-just/releases)
- [Changelog](https://github.com/gnpaone/rust-just/blob/master/CHANGELOG.md)
- [Commits](gnpaone/rust-just@1.56.0...1.57.0)

Updates `wemake-python-styleguide` from 1.6.2 to 1.7.1
- [Release notes](https://github.com/wemake-services/wemake-python-styleguide/releases)
- [Changelog](https://github.com/wemake-services/wemake-python-styleguide/blob/master/CHANGELOG.md)
- [Commits](wemake-services/wemake-python-styleguide@1.6.2...1.7.1)

Updates `zizmor` from 1.26.1 to 1.28.0
- [Release notes](https://github.com/zizmorcore/zizmor/releases)
- [Changelog](https://github.com/zizmorcore/zizmor/blob/main/docs/release-notes.md)
- [Commits](zizmorcore/zizmor@v1.26.1...v1.28.0)

---
updated-dependencies:
- dependency-name: semgrep
  dependency-version: 1.172.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: coverage
  dependency-version: 7.15.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: cyclonedx-bom
  dependency-version: 7.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: diff-cover
  dependency-version: 10.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: hypothesis
  dependency-version: 6.164.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: mutmut
  dependency-version: 3.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pip-tools
  dependency-version: 7.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pre-commit
  dependency-version: 4.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.16.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: rust-just
  dependency-version: 1.57.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: wemake-python-styleguide
  dependency-version: 1.7.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: zizmor
  dependency-version: 1.28.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 7, 2026
@dependabot
dependabot Bot requested a review from douglasmonsky as a code owner August 7, 2026 17:06
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@douglasmonsky douglasmonsky Awaiting requested review from douglasmonsky douglasmonsky is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants