Skip to content

Bump the python-requirements group across 1 directory with 7 updates - #258

Merged
fabiocaccamo merged 1 commit into
mainfrom
dependabot/pip/python-requirements-89b6d24c94
Sep 2, 2026
Merged

Bump the python-requirements group across 1 directory with 7 updates#258
fabiocaccamo merged 1 commit into
mainfrom
dependabot/pip/python-requirements-89b6d24c94

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on fonttools, pillow, python-fsutil, coverage, mypy, pre-commit and tox to permit the latest version.
Updates fonttools from 4.62.1 to 4.63.0

Release notes

Sourced from fonttools's releases.

4.63.0

  • [ttLib] Add support for Apple Color Emoji bgcl table (#4065).
  • [ttLib] Add support for IFT and IFTX tables (Incremental Font Transfer, PatchMapFormat2) (#4070, #4072).
  • [otData] Introduce FieldSpec dataclass for OpenType table schema definitions, replacing raw tuples in otData.py (#4076).
  • [Feat] Show name table strings as comments next to label IDs in TTX output, matching the convention used by fvar, STAT, trak (#4089).
  • [cu2qu] Fix Cython complex-division rounding difference in split_cubic_into_three that could cause ±1 off-curve coordinate shifts (#3928, #4083).
  • [designspaceLib] Fix map_backwardgooglefonts/ufo2ft#978#4085).
  • [OS/2] Fix setUnicodeRanges to accept reserved bits 123-127, restoring round-trip with getUnicodeRanges and fixing recalcUnicodeRanges crash in the subsetter (#4087, #4088).
  • [cython] Declare Cython extensions as free-threading compatible on Python 3.13+, so that importing them on free-threaded Python no longer re-enables the GIL (#4073, #4090).
Changelog

Sourced from fonttools's changelog.

4.63.0 (released 2026-05-14)

  • [ttLib] Add support for Apple Color Emoji bgcl table (#4065).
  • [ttLib] Add support for IFT and IFTX tables (Incremental Font Transfer, PatchMapFormat2) (#4070, #4072).
  • [otData] Introduce FieldSpec dataclass for OpenType table schema definitions, replacing raw tuples in otData.py (#4076).
  • [Feat] Show name table strings as comments next to label IDs in TTX output, matching the convention used by fvar, STAT, trak (#4089).
  • [cu2qu] Fix Cython complex-division rounding difference in split_cubic_into_three that could cause ±1 off-curve coordinate shifts (#3928, #4083).
  • [designspaceLib] Fix map_backward for many-to-one (flat-segment) axis maps that silently dropped entries via dict comprehension googlefonts/ufo2ft#978#4085).
  • [OS/2] Fix setUnicodeRanges to accept reserved bits 123-127, restoring round-trip with getUnicodeRanges and fixing recalcUnicodeRanges crash in the subsetter (#4087, #4088).
  • [cython] Declare Cython extensions as free-threading compatible on Python 3.13+, so that importing them on free-threaded Python no longer re-enables the GIL (#4073, #4090).
Commits
  • 978d9ed Release 4.63.0
  • 6b40ecb Add changelog entries for 4.63.0
  • 382a35f Merge pull request #4090 from fonttools/fix-freethreading-compat
  • 0e999b5 Declare Cython extensions as free-threading compatible
  • 9e55ea5 Merge pull request #4089 from fonttools/graphite-feat-labels
  • e84db3a Merge pull request #4088 from fonttools/fix-setUnicodeRanges-bits-123-127
  • d6eabd1 Feat: show name table strings as comments next to label IDs in ttx
  • 7d0902b OS/2: fix setUnicodeRanges round-trip for reserved bits 123-127
  • 06e266c Merge pull request #4085 from fonttools/fix-map-backward-non-injective
  • 6d64598 Add more tests for map_backward with many-to-one axis maps
  • Additional commits viewable in compare view

Updates pillow from 12.2.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Documentation

Dependencies

Testing

... (truncated)

Commits
  • bb1d8e8 12.3.0 version bump
  • e63fc48 Add release notes for SBOM and performance improvements (#9747)
  • 13b701b Add release notes for #9679
  • 5564ca7 List methods
  • a0920fd Speed up ImageChops operations (#9738)
  • 07e9a6c Speed up Image.filter() (#9736)
  • a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
  • 53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
  • af03747 Speed up Image.resample() (#9739)
  • 5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
  • Additional commits viewable in compare view

Updates python-fsutil from 0.16.1 to 0.17.0

Release notes

Sourced from python-fsutil's releases.

0.17.0

  • Add support for file-like objects in get_file_hash.
  • Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. #186 (thanks to @​SAY-5)
  • Harden Content-Disposition filename sanitization in download_file to prevent path traversal. #181
  • Bump requirements and pre-commit hooks.
Changelog

Sourced from python-fsutil's changelog.

0.17.0 - 2026-07-07

  • Add support for file-like objects in get_file_hash.
  • Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. #186 (thanks to @​SAY-5)
  • Harden Content-Disposition filename sanitization in download_file to prevent path traversal. #181
  • Bump requirements and pre-commit hooks.
Commits
  • deb6684 Update CHANGELOG and version.
  • fc91d14 Add support for file-like objects in get_file_hash.
  • e1d342b Bump pre-commit hooks.
  • 88a2ed4 Harden Content-Disposition filename sanitization in download_file to preven...
  • 0fe73fd Bump the python-requirements group across 1 directory with 7 updates (#188)
  • 1429dce Bump the github-actions group across 1 directory with 4 updates (#187)
  • 4abb5aa Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. (#186)
  • c98dbf6 Bump pre-commit hooks.
  • 8854ed2 Fix HIGH-level OpenSSF Scorecard code scanning alerts (VulnerabilitiesID) (#175)
  • 8693f3e Update SECURITY.md.
  • Additional commits viewable in compare view

Updates coverage to 7.16.0

Release notes

Sourced from coverage's releases.

7.16.0

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
  • The Coverage.switch_context() method now returns the previous context.
  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
  • Fixes to validation of options and configuration settings:
    • Negative precision settings now always cause useful error messages (pull 2261).
    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

Changelog

Sourced from coverage's changelog.

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

  • The :meth:.Coverage.switch_context method now returns the previous context.

  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

  • Fixes to validation of options and configuration settings:

    • Negative precision settings now always cause useful error messages (pull 2261_).

    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with "Can't combine statement coverage data with branch data". Each named concurrency library is now properly considered (pull 2270_).

  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265_).

.. _pull 2261: coveragepy/coveragepy#2261 .. _pull 2262: coveragepy/coveragepy#2262 .. _pull 2263: coveragepy/coveragepy#2263 .. _pull 2265: coveragepy/coveragepy#2265 .. _issue 2266: coveragepy/coveragepy#2266 .. _pull 2268: coveragepy/coveragepy#2268

... (truncated)

Commits
  • 3e9fc16 docs: prep for 7.16.0
  • 38be8d1 build: control check-manifest explicitly
  • 8eb1266 docs(build): no longer commit sample_html
  • 1a8b3fa docs: remove sample_html
  • aeaa79b docs: linklint is now sphinx-linklint
  • d5eaf3f test: a branchless way to re-add extensions
  • 57e52fd docs: adjust CHANGES for #2270
  • b9d304d fix: check for multiprocessing in a --concurrency list (#2270)
  • a6ef928 chore: make upgrade
  • 070461f chore: bump the action-dependencies group with 4 updates (#2271)
  • Additional commits viewable in compare view

Updates mypy to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

  • Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
  • Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
  • Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
  • Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • Agriya Khetarpal
  • Ethan Sarp
  • Ivan Levkivskyi
  • Jingchen Ye
  • Jukka Lehtosalo
  • Piotr Sawicki
  • Shantanu
  • Tom Bannink
  • Viktor Szépe
  • ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits
  • d642c44 Bump version to 2.3.1
  • a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
  • 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
  • 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
  • 6dfa06d Fix crash when unpacking return value from overload (#21830)
  • a385746 Bump version to 2.3.1+dev
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • Additional commits viewable in compare view

Updates pre-commit to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

4.6.1 - 2026-07-21

Fixes

4.6.0 - 2026-04-21

Features

  • pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.

Fixes

4.5.1 - 2025-12-16

Fixes

  • Fix language: python with repo: local without additional_dependencies.

... (truncated)

Commits
  • 9767b6c v4.6.2
  • 42ee3ff Merge pull request #3743 from pre-commit/npm-build-scripts-11-x
  • 3056619 fix language: node for hooks with build scripts and npm 11.x
  • 242ce8a v4.6.1
  • 766e550 Merge pull request #3727 from pre-commit/dedupe
  • 1558d06 Merge pull request #3726 from pre-commit/exists-faster
  • 8a1c47a avoid duplicate files in --all-files during conflict
  • 2e01c99 faster check of rev existing locally as a commit
  • 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
  • 1d811d9 Return an error for invalid --repo
  • Additional commits viewable in compare view

Updates tox to 4.61.1

Release notes

Sourced from tox's releases.

v4.61.1

What's Changed

Full Changelog: tox-dev/tox@4.61.0...4.61.1

Changelog

Sourced from tox's changelog.

Bug fixes - 4.61.1

  • Publish a JSON Schema that compiles under SchemaStore's validator again, so editors pick up the configuration keys added since 4.56 - by :user:gaborbernat. (:issue:4051)

Contributor-facing changes - 4.61.1

  • Check tox's JSON Schema with SchemaStore's own validator on every pull request that changes it, and again before the release sync opens a pull request there - by :user:gaborbernat. (:issue:4051)

v4.61.0 (2026-08-28)


Features - 4.61.0

  • A labeled factor group can now declare a default for {factor:label} to fall back on when no factor of that group is active in the environment name. Setting TOX_FACTOR_<label> resolves that label to a given value for a single run - by :user:gaborbernat. (:issue:4045)
  • A factor range now takes a label when you nest it under one, as in factors = [{ py_version = { prefix = "3.", start = 12, stop = 14 } }], which makes {factor:py_version} available for ranges - by :user:gaborbernat. (:issue:4046)

Bug fixes - 4.61.0

  • Values passed via --override/-x or TOX_OVERRIDE now resolve substitutions such as {posargs}, {env:VAR} and {env_name}, instead of reaching the environment as literal text - by :user:gaborbernat. (:issue:4047)

Improved documentation - 4.61.0

  • Point the virtualenv discovery link in the explanation documentation at its current location. (:issue:4042)

Contributor-facing changes - 4.61.0

  • Replace the deprecated load_module call in the documentation configuration, which Python 3.15 removes - by :user:gaborbernat. (:issue:4043)

v4.60.1 (2026-08-25)


Bug fixes - 4.60.1

... (truncated)

Commits
  • c8c010a release 4.61.1
  • cd8c1fa 🐛 fix(schema): declare prefix in the labeled factor group's not clause (#4051)
  • aa8f46c release 4.61.0
  • 8ef0326 ✨ feat(toml): declare factor group defaults and per-run overrides (#4050)
  • e489adb 🐛 fix(config): substitute inside override values (#4048)
  • c1af929 ✨ feat(toml): allow labeling a range factor group (#4049)
  • 930190c Replace deprecated load_module in docs conf (#4043)
  • 2a4a215 docs: fix dead virtualenv discovery link in explanation.rst (#4042)
  • e91ca3b release 4.60.1
  • 59e984f Report an empty TOML command value as a handled error (#4041)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 1, 2026
Updates the requirements on [fonttools](https://github.com/fonttools/fonttools), [pillow](https://github.com/python-pillow/Pillow), [python-fsutil](https://github.com/fabiocaccamo/python-fsutil), [coverage](https://github.com/coveragepy/coveragepy), [mypy](https://github.com/python/mypy), [pre-commit](https://github.com/pre-commit/pre-commit) and [tox](https://github.com/tox-dev/tox) to permit the latest version.

Updates `fonttools` from 4.62.1 to 4.63.0
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.62.1...4.63.0)

Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.2.0...12.3.0)

Updates `python-fsutil` from 0.16.1 to 0.17.0
- [Release notes](https://github.com/fabiocaccamo/python-fsutil/releases)
- [Changelog](https://github.com/fabiocaccamo/python-fsutil/blob/main/CHANGELOG.md)
- [Commits](fabiocaccamo/python-fsutil@0.16.1...0.17.0)

Updates `coverage` to 7.16.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.13.0...7.16.0)

Updates `mypy` to 2.3.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.20.0...v2.3.1)

Updates `pre-commit` to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.5.0...v4.6.2)

Updates `tox` to 4.61.1
- [Release notes](https://github.com/tox-dev/tox/releases)
- [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst)
- [Commits](tox-dev/tox@4.52.0...4.61.1)

---
updated-dependencies:
- dependency-name: coverage
  dependency-version: 7.15.2
  dependency-type: direct:production
  dependency-group: python-requirements
- dependency-name: fonttools
  dependency-version: 4.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:production
  dependency-group: python-requirements
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: pre-commit
  dependency-version: 4.6.1
  dependency-type: direct:production
  dependency-group: python-requirements
- dependency-name: python-fsutil
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: tox
  dependency-version: 4.58.0
  dependency-type: direct:production
  dependency-group: python-requirements
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/python-requirements-89b6d24c94 branch from ee89a1d to 2b1c21c Compare September 2, 2026 09:59
@fabiocaccamo
fabiocaccamo merged commit c7d48fe into main Sep 2, 2026
17 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/python-requirements-89b6d24c94 branch September 2, 2026 10:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant