Bump the python-packages group with 8 updates

[dependabot]

Bumps the python-packages group with 8 updates:

Package	From	To
mkdocs-material	9.6.18	9.6.21
twine	6.1.0	6.2.0
coverage[toml]	7.10.6	7.10.7
cryptography	45.0.7	46.0.2
mypy	1.17.1	1.18.2
pytest	8.4.1	8.4.2
ruff	0.12.11	0.13.2
uvicorn	0.35.0	0.37.0

Updates mkdocs-material from 9.6.18 to 9.6.21

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.6.21

• Updated Serbian translations
• Fixed #8458: Temporary pin of click dependency

mkdocs-material-9.6.20

• Fixed #8446: Deprecation warning as of Python 3.14 in Emoji extension
• Fixed #8440: & character not escaped in search highlighting
• Fixed #8439: FontAwesome icons color not set in social cards (regression)

mkdocs-material-9.6.19

• Added support for Python 3.14
• Updated Bahasa Malaysia translations

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.6.21 (2025-09-30)

• Updated Serbian translations
• Fixed #8458: Temporary pin of click dependency

mkdocs-material-9.6.20 (2025-09-15)

• Fixed #8446: Deprecation warning as of Python 3.14 in Emoji extension
• Fixed #8440: & character not escaped in search highlighting
• Fixed #8439: FontAwesome icons color not set in social cards (regression)

mkdocs-material-9.6.19 (2025-09-07)

• Added support for Python 3.14
• Updated Bahasa Malaysia translations

mkdocs-material-9.6.18 (2025-08-22)

• Updated Azerbaijani translations
• Fixed last compat issues with [minijinja], now 100% compatible

mkdocs-material-9.6.17 (2025-08-15)

• Fixed #8396: Videos do not autoplay when inside a content tab
• Fixed #8394: Stroke width not effective in Mermaid.js diagrams
• Fixed disappearing version selector when hiding page title

mkdocs-material-9.6.16 (2025-07-26)

• Fixed #8349: Info plugin doesn't correctly detect virtualenv in some cases
• Fixed #8334: Find-in-page detects matches in hidden search result list

mkdocs-material-9.6.15 (2025-07-01)

• Updated Mongolian translations
• Improved semantic markup of "edit this page" button
• Improved info plugin virtual environment resolution
• Fixed #8291: Large font size setting throws of breakpoints in JavaScript

mkdocs-material-9.6.14 (2025-05-13)

• Fixed #8215: Social plugin crashes when CairoSVG is updated to 2.8

mkdocs-material-9.6.13 (2025-05-10)

• Fixed #8204: Annotations showing list markers in print view
• Fixed #8153: Improve style of cardinality symbols in Mermaid.js ER diagrams

mkdocs-material-9.6.12 (2025-04-17)

... (truncated)

Commits

• f7cacc0 Prepare 9.6.21 release
• 6f715fb Unpinned click
• 97e275c Updated Serbian languages (#8445)
• f0b0b59 Prepare 9.6.20 release
• 900981b Fixed deprecation warning as of Python 3.14 in Emoji extension
• ed00263 Documentation (#8443)
• a4f42bb Updated Premium sponsors
• 63d7e74 Fixed FontAwesome icons having fill attributes
• ee67845 Fixed & not escaped in search highlighting
• 2fe55ee Prepare 9.6.19 release
• Additional commits viewable in compare view

Updates twine from 6.1.0 to 6.2.0

Changelog

Sourced from twine's changelog.

twine 6.2.0 (2025-09-04)

Features ^^^^^^^^

• Automatically refresh short-lived PyPI token in long running Trusted Publishing uploads.

  In the event that a trusted publishing upload job is taking longer than the validity period of a trusted publishing token (15 minutes at the time of this writing), and we are already 10 minutes into that validity period, we will begin to attempt to replace the token on each subsequent request. ([#1246](https://github.com/pypa/twine/issues/1246) <https://github.com/pypa/twine/issues/1246>_)

Bugfixes ^^^^^^^^

• Fix compatibility kludge for invalid License-File metadata entries emitted by build backends to work also with packaging version 24.0. ([#1217](https://github.com/pypa/twine/issues/1217) <https://github.com/pypa/twine/issues/1217>_)
• Fix a couple of incorrectly rendered error messages. ([#1224](https://github.com/pypa/twine/issues/1224) <https://github.com/pypa/twine/issues/1224>_)
• twine now enforces keyring >= 21.2.0, which was previously implicitly required by API usage. ([#1229](https://github.com/pypa/twine/issues/1229) <https://github.com/pypa/twine/issues/1229>_)
• twine now catches configparser.Error to prevent accidental leaks of secret tokens or passwords to the user's console. ([#1240](https://github.com/pypa/twine/issues/1240) <https://github.com/pypa/twine/issues/1240>_)

Deprecations and Removals ^^^^^^^^^^^^^^^^^^^^^^^^^

• Remove hacks that support --skip-existing for indexes other than PyPI and TestPyPI.

  To date, these hacks continue to accrue and there have been numerous issues with them, not the least of which being that every time we update them, the paid index providers change things to break the compatibility we implement for them. Beyond that, these hacks do not work when text is internationalized in the response from the index provider.

  For a sample of past issues, see:

  • pypa/twine#1251

  • pypa/twine#918

  • pypa/twine#856

  • pypa/twine#693

  • pypa/twine#332 ([#1251](https://github.com/pypa/twine/issues/1251) <https://github.com/pypa/twine/issues/1251>_)

... (truncated)

Commits

• 14ceb29 Update changelog for 6.2.0 (#1264)
• 60e377b build(deps): bump actions/checkout from 4.2.2 to 5.0.0 (#1263)
• 88821f2 feat(package): remove MD5 hashing entirely (#1262)
• ce5fe53 build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0
• 6a696ed PEP 639 compliance
• 9175334 rename 1247.misc.rst to changelog/1247.misc.rst
• d94a475 fix(tests): update expected error message
• c1c02d1 Remove --skip-existing support for non-PyPI indices
• a24d308 Set trusted publishing logging to INFO/WARN (#1247)
• becf1a8 Fix py3.9 mypy error in __init__ around PackageMetadata
• Additional commits viewable in compare view

Updates coverage[toml] from 7.10.6 to 7.10.7

Release notes

Sourced from coverage[toml]'s releases.

7.10.7

Version 7.10.7 — 2025-09-21

• Performance: with branch coverage in large files, generating HTML, JSON, or LCOV reports could take far too long due to some quadratic behavior when creating the function and class index pages. This is now fixed, closing issue 2048. Thanks to Daniel Diniz for help diagnosing the problem.
• Most warnings and a few errors now have links to a page in the docs explaining the specific message. Closes issue 1921.

➡️  PyPI page: coverage 7.10.7. :arrow_right:  To install: python3 -m pip install coverage==7.10.7

Changelog

Sourced from coverage[toml]'s changelog.

Version 7.10.7 — 2025-09-21

• Performance: with branch coverage in large files, generating HTML, JSON, or LCOV reports could take far too long due to some quadratic behavior when creating the function and class index pages. This is now fixed, closing issue 2048_. Thanks to Daniel Diniz for help diagnosing the problem.

• Most warnings and a few errors now have links to a page in the docs explaining the specific message. Closes issue 1921_.

.. _issue 1921: nedbat/coveragepy#1921 .. _issue 2048: nedbat/coveragepy#2048

.. _changes_7-10-6:

Commits

• 92a2af5 docs: sample HTML for 7.10.7
• 952afda docs: prep for 7.10.7
• a301761 build: riscv64 wheels (#2055)
• 5daff8d docs: now source is formatted with ruff
• 04bbc3a docs: discuss cog in the contributing docs
• c181b93 build: use cog --check-fail-msg to instruct devs
• 33c4ba1 chore: make upgrade
• 0744b73 chore: bump the action-dependencies group across 1 directory with 2 updates (...
• 0d5a112 perf: bulk narrowing to avoid N**2. #2048
• a868ed9 docs: mention Python Discord on the index page
• Additional commits viewable in compare view

Updates cryptography from 45.0.7 to 46.0.2

Changelog

Sourced from cryptography's changelog.

46.0.2 - 2025-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.
.. _v46-0-1:
46.0.1 - 2025-09-16

• Fixed an issue where users installing via pip on Python 3.14 development versions would not properly install a dependency.
• Fixed an issue building the free-threaded macOS 3.14 wheels.

.. _v46-0-0:

46.0.0 - 2025-09-16

* **BACKWARDS INCOMPATIBLE:** Support for Python 3.7 has been removed.
* Support for OpenSSL < 3.0 is deprecated and will be removed in the next
  release.
* Support for ``x86_64`` macOS (including publishing wheels) is deprecated
  and will be removed in two releases. We will switch to publishing an
  ``arm64`` only wheel for macOS.
* Support for 32-bit Windows (including publishing wheels) is deprecated
  and will be removed in two releases. Users should move to a 64-bit
  Python installation.
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.3.
* We now build ``ppc64le`` ``manylinux`` wheels and publish them to PyPI.
* We now build ``win_arm64`` (Windows on Arm) wheels and publish them to PyPI.
* Added support for free-threaded Python 3.14.
* Removed the deprecated ``get_attribute_for_oid`` method on
  :class:`~cryptography.x509.CertificateSigningRequest`. Users should use
  :meth:`~cryptography.x509.Attributes.get_attribute_for_oid` instead.
* Removed the deprecated ``CAST5``, ``SEED``, ``IDEA``, and ``Blowfish``
  classes from the cipher module. These are still available in
  :doc:`/hazmat/decrepit/index`.
* In X.509, when performing a PSS signature with a SHA-3 hash, it is now
  encoded with the official NIST SHA3 OID.
.. _v45-0-7:

Commits

• 99efe5a bump version for 46.0.2 (#13531)
• e735cfc release 46.0.1 (#13450)
• 4e457ff Explicitly specify python in mac uv build invocation (#13447)
• 2726efd Depend on CFFI 2.0.0 or newer on Python > 3.8 (#13448)
• 6223062 release 46.0.0 (#13446)
• 563c491 Update comment for pyopenssl-release tag (#13445)
• d2f6f7f Bump downstream dependencies in CI (#13439)
• e7ab02b we'll ship this with 3.5.3 why not (#13442)
• 0b68a4b Another pair of bump dependencies fix (#13444)
• e076d08 Attempt to fix commit message for bump downstreams (#13440)
• Additional commits viewable in compare view

Updates mypy from 1.17.1 to 1.18.2

Changelog

Sourced from mypy's changelog.

Mypy 1.18.2

• Fix crash on recursive alias (Ivan Levkivskyi, PR 19845)
• Add additional guidance for stubtest errors when runtime is object.__init__ (Stephen Morton, PR 19733)
• Fix handling of None values in f-string expressions in mypyc (BobTheBuidler, PR 19846)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Ali Hamdan
• Anthony Sottile
• BobTheBuidler
• Brian Schubert
• Chainfire
• Charlie Denton
• Christoph Tyralla
• CoolCat467
• Daniel Hnyk
• Emily
• Emma Smith
• Ethan Sarp
• Ivan Levkivskyi
• Jahongir Qurbonov
• Jelle Zijlstra
• Joren Hammudoglu
• Jukka Lehtosalo
• Marc Mueller
• Omer Hadari
• Piotr Sawicki
• PrinceNaroliya
• Randolf Scholz
• Robsdedude
• Saul Shanabrook
• Shantanu
• Stanislav Terliakov
• Stephen Morton
• wyattscarpenter

I’d also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 1.17

We’ve just uploaded mypy 1.17 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

... (truncated)

Commits

• df05f05 remove +dev from version
• 01a7a12 Update changelog for 1.18.2 (#19873)
• ca5abf0 Typeshed cherry-pick: Make type of unitest.mock.Any a subclass of Any (#1...
• 9d794b5 [mypyc] fix: inappropriate Nones in f-strings (#19846)
• 2c0510c stubtest: additional guidance on errors when runtime is object.init (#19733)
• 2f3f03c Bump version to 1.18.2+dev for point release
• 7669841 Fix crash on recursive alias in indirection.py (#19845)
• 03fbaa9 bump version to 1.18.1 due to wheels failure
• b44a1fb removed +dev from version
• 7197a99 Removed Unreleased in the Changelog for Release 1.18 (#19827)
• Additional commits viewable in compare view

Updates pytest from 8.4.1 to 8.4.2

Release notes

Sourced from pytest's releases.

8.4.2

pytest 8.4.2 (2025-09-03)

Bug fixes

• #13478: Fixed a crash when using console_output_style{.interpreted-text role="confval"} with times and a module is skipped.

• #13530: Fixed a crash when using pytest.approx{.interpreted-text role="func"} and decimal.Decimal{.interpreted-text role="class"} instances with the decimal.FloatOperation{.interpreted-text role="class"} trap set.

• #13549: No longer evaluate type annotations in Python 3.14 when inspecting function signatures.

  This prevents crashes during module collection when modules do not explicitly use from __future__ import annotations and import types for annotations within a if TYPE_CHECKING: block.

• #13559: Added missing [int]{.title-ref} and [float]{.title-ref} variants to the [Literal]{.title-ref} type annotation of the [type]{.title-ref} parameter in pytest.Parser.addini{.interpreted-text role="meth"}.

• #13563: pytest.approx{.interpreted-text role="func"} now only imports numpy if NumPy is already in sys.modules. This fixes unconditional import behavior introduced in [8.4.0]{.title-ref}.

Improved documentation

• #13577: Clarify that pytest_generate_tests is discovered in test modules/classes; other hooks must be in conftest.py or plugins.

Contributor-facing changes

• #13480: Self-testing: fixed a few test failures when run with -Wdefault or a similar override.
• #13547: Self-testing: corrected expected message for test_doctest_unexpected_exception in Python 3.14.
• #13684: Make pytest's own testsuite insensitive to the presence of the CI environment variable -- by ogrisel{.interpreted-text role="user"}.

Commits

• bfae422 Prepare release version 8.4.2
• 8990538 Fix passenv CI in tox ini and make tests insensitive to the presence of the C...
• ca676bf Merge pull request #13687 from pytest-dev/patchback/backports/8.4.x/e63f6e51c...
• 975a60a Merge pull request #13686 from pytest-dev/patchback/backports/8.4.x/12bde8af6...
• 7723ce8 Merge pull request #13683 from even-even/fix_Exeption_to_Exception_in_errorMe...
• b7f0568 Merge pull request #13685 from CoretexShadow/fix/docs-pytest-generate-tests
• 2c94c4a add missing colon (#13640) (#13641)
• c3d7684 Merge pull request #13606 from pytest-dev/patchback/backports/8.4.x/5f9938563...
• dc6e3be Merge pull request #13605 from The-Compiler/training-update-2025-07
• f87289c Fix crash with times output style and skipped module (#13573) (#13579)
• Additional commits viewable in compare view

Updates ruff from 0.12.11 to 0.13.2

Release notes

Sourced from ruff's releases.

0.13.2

Release Notes

Released on 2025-09-25.

Preview features

• [flake8-async] Implement blocking-path-method (ASYNC240) (#20264)
• [flake8-bugbear] Implement map-without-explicit-strict (B912) (#20429)
• [flake8-bultins] Detect class-scope builtin shadowing in decorators, default args, and attribute initializers (A003) (#20178)
• [ruff] Implement logging-eager-conversion (RUF065) (#19942)
• Include .pyw files by default when linting and formatting (#20458)

Bug fixes

• Deduplicate input paths (#20105)
• [flake8-comprehensions] Preserve trailing commas for single-element lists (C409) (#19571)
• [flake8-pyi] Avoid syntax error from conflict with PIE790 (PYI021) (#20010)
• [flake8-simplify] Correct fix for positive maxsplit without separator (SIM905) (#20056)
• [pyupgrade] Fix UP008 not to apply when __class__ is a local variable (#20497)
• [ruff] Fix B004 to skip invalid hasattr/getattr calls (#20486)
• [ruff] Replace -nan with nan when using the value to construct a Decimal (FURB164 ) (#20391)

Documentation

• Add 'Finding ways to help' to CONTRIBUTING.md (#20567)
• Update import path to ruff-wasm-web (#20539)
• [flake8-bandit] Clarify the supported hashing functions (S324) (#20534)

Other changes

• [playground] Allow hover quick fixes to appear for overlapping diagnostics (#20527)
• [playground] Fix non‑BMP code point handling in quick fixes and markers (#20526)

Contributors

• @​BurntSushi
• @​mtshiba
• @​second-ed
• @​danparizher
• @​ShikChen
• @​PieterCK
• @​GDYendell
• @​RazerM
• @​TaKO8Ki
• @​amyreese
• @​ntbre
• @​MichaReiser

Install ruff 0.13.2

... (truncated)

Changelog

Sourced from ruff's changelog.

0.13.2

Released on 2025-09-25.

Preview features

• [flake8-async] Implement blocking-path-method (ASYNC240) (#20264)
• [flake8-bugbear] Implement map-without-explicit-strict (B912) (#20429)
• [flake8-bultins] Detect class-scope builtin shadowing in decorators, default args, and attribute initializers (A003) (#20178)
• [ruff] Implement logging-eager-conversion (RUF065) (#19942)
• Include .pyw files by default when linting and formatting (#20458)

Bug fixes

• Deduplicate input paths (#20105)
• [flake8-comprehensions] Preserve trailing commas for single-element lists (C409) (#19571)
• [flake8-pyi] Avoid syntax error from conflict with PIE790 (PYI021) (#20010)
• [flake8-simplify] Correct fix for positive maxsplit without separator (SIM905) (#20056)
• [pyupgrade] Fix UP008 not to apply when __class__ is a local variable (#20497)
• [ruff] Fix B004 to skip invalid hasattr/getattr calls (#20486)
• [ruff] Replace -nan with nan when using the value to construct a Decimal (FURB164 ) (#20391)

Documentation

• Add 'Finding ways to help' to CONTRIBUTING.md (#20567)
• Update import path to ruff-wasm-web (#20539)
• [flake8-bandit] Clarify the supported hashing functions (S324) (#20534)

Other changes

• [playground] Allow hover quick fixes to appear for overlapping diagnostics (#20527)
• [playground] Fix non‑BMP code point handling in quick fixes and markers (#20526)

Contributors

• @​BurntSushi
• @​mtshiba
• @​second-ed
• @​danparizher
• @​ShikChen
• @​PieterCK
• @​GDYendell
• @​RazerM
• @​TaKO8Ki
• @​amyreese
• @​ntbre
• @​MichaReiser

0.13.1

... (truncated)

Commits

• b0bdf03 Bump 0.13.2 (#20576)
• 7331d39 Update rooster to 0.1.0 (#20575)
• 529e5fa [ty] Ecosystem analyzer: timing report (#20571)
• efbb80f [ty] Remove hack in protocol satisfiability check (#20568)
• 9f3cffc Add 'Finding ways to help' to CONTRIBUTING.md (#20567)
• 21be94a [ty] Explicitly test assignability/subtyping between unions of nominal types ...
• b7d5dc9 [ty] Add tests for interactions of @classmethod, @staticmethod, and proto...
• e1bb74b [ty] Match variadic argument to variadic parameter (#20511)
• edeb458 [ty] fallback to resolve_real_module in file_to_module (#20461)
• bea92c8 [ty] More precise type inference for dictionary literals (#20523)
• Additional commits viewable in compare view

Updates uvicorn from 0.35.0 to 0.37.0

Release notes

Sourced from uvicorn's releases.

Version 0.37.0

What's Changed

• Add --timeout-worker-healthcheck setting by @​Kludex in Kludex/uvicorn#2711
• Add os.PathLike[str] type to ssl_ca_certs by @​rnv812 in Kludex/uvicorn#2676

New Contributors

• @​LincolnPuzey made their first contribution in Kludex/uvicorn#2669
• @​rnv812 made their first contribution in Kludex/uvicorn#2676

Full Changelog: Kludex/uvicorn@0.36.1...0.37.0

Version 0.36.1

What's Changed

• Raise an exception when calling removed Config.setup_event_loop() by @​Kludex in Kludex/uvicorn#2709

Full Changelog: Kludex/uvicorn@0.36.0...0.36.1

Version 0.36.0

Added

• Support custom IOLOOPs by @​gnir-work in Kludex/uvicorn#2435
• Allow to provide importable string in --http, --ws and --loop by @​Kludex in Kludex/uvicorn#2658

---

New Contributors

• @​gnir-work made their first contribution in Kludex/uvicorn#2435
• @​musicinmybrain made their first contribution in Kludex/uvicorn#2659
• @​secrett2633 made their first contribution in Kludex/uvicorn#2684

Full Changelog: Kludex/uvicorn@0.35.0...0.36.0

Changelog

Sourced from uvicorn's changelog.

0.37.0 (September 23, 2025)

Added

• Add --timeout-worker-healthcheck option (#2711)
• Add os.PathLike[str] type to ssl_ca_certs (#2676)

0.36.1 (September 23, 2025)

Fixed

• Raise an exception when calling removed Config.setup_event_loop() (#2709)

0.36.0 (September 20, 2025)

Added

• Support custom IOLOOPs (#2435)
• Allow to provide importable string in --http, --ws and --loop (#2658)

Commits

• 4098bca Version 0.37.0 (#2712)
• 8c057fa Add os.PathLike[str] type to ssl_ca_certs (#2676)
• bbe119e Add note about --timeout-keep-alive being measured in seconds (#2669)
• 2744f14 Add --timeout-worker-healthcheck setting (#2711)
• 1dfb0bd Version 0.36.1 (#2710)
• 3d0d46a Raise an exception when calling removed Config.setup_event_loop() (#2709)
• ad9e5b9 docs: redirect uvicorn.org to uvicorn.dev (#2705)
• 0e3b18c Version 0.36.0 (#2704)
• f84661d chore: drop mention to scripts/publish (#2696)
• dcd7e6c docs: replace uvicorn.org by uvicorn.dev (#2703)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cclauss]

Upgrade ruff with...

@dependabot rebase

[dependabot]

Sorry, only users with push access can use that command.

[cclauss]

@lovelydinosaur, is there a reason to hold this up? Some of these upgrades seem vital for Py3.14.

@ilovelinux