Skip to content

Bump the python-packages group with 7 updates - #708

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-packages-34aa15cbe5
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-packages-34aa15cbe5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-packages group with 7 updates:

Package From To
pillow 12.3.0 13.0.0
tyro 1.0.16 1.0.17
gradio 6.31.0 7.0.0.dev0
ruff 0.17.3 0.17.4
ty 0.0.95 0.0.99
ipython 9.18.0 9.18.1
pip 26.2.2 26.3

Updates pillow from 12.3.0 to 13.0.0

Release notes

Sourced from pillow's releases.

13.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Removals

Deprecations

Documentation

Dependencies

... (truncated)

Commits
  • 293218a 13.0.0 version bump
  • 262e8e4 Update release notes for Pillow 13.0.0 (#10223)
  • af56ace Validate TIFF tag values against libtiff's own field definition before TIFFSe...
  • 570df03 Validate TIFF tag values against libtiff's own field definition before TIFFSe...
  • 53318b5 Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)
  • 0a87417 Bound retained TIFF tag data by stream size (#10225)
  • 11582e5 Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)
  • 8501adc Fix test
  • ec5f1cb Take libtiff scanline geometry tags from the image, not tiffinfo/exif
  • 4b63dff Share TIFF tag data budget across frames
  • Additional commits viewable in compare view

Updates tyro from 1.0.16 to 1.0.17

Release notes

Sourced from tyro's releases.

v1.0.17

What's Changed

New Contributors

Full Changelog: brentyi/tyro@v1.0.16...v1.0.17

Commits

Updates gradio from 6.31.0 to 7.0.0.dev0

Release notes

Sourced from gradio's releases.

gradio@7.0.0-dev.0

Features

Fixes

Changelog

Sourced from gradio's changelog.

gradio

Commits
  • e039237 chore: update versions (dev) (#14054)
  • c2cdf0a Enter changesets pre mode for Gradio 7.0 dev releases
  • c9fed9f Merge main into 7.0-dev
  • 2f8693a Add GitHub-installed CLI extensions (#14042)
  • 29ba706 Require login for the MCP server when the app uses auth, and make queued MCP ...
  • 7907372 Fix MCP prompts/get running the wrong endpoint and ignoring listed prompt nam...
  • 2d1a0bd Fix randomized Slider going below minimum and skipping the last decimal step ...
  • ebccfcf workflows: handle depth estimation (#14017)
  • fa3f296 Run a deferred always_last event with its own event data (#13991)
  • e6f0dd4 Print a HuggingChat link for MCP servers launched with share=True (#14038)
  • Additional commits viewable in compare view

Updates ruff from 0.17.3 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

  • [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
  • [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

  • Accept a bare raise before a semicolon (#29761)
  • Allow match identifiers after a semicolon (#29760)
  • Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
  • [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

  • Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

  • Coalesce source slices when formatting attributes (#29841)
  • Collect return statements with a statement-only visitor (#29911)
  • [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
  • Format node fields directly when comment handling is unnecessary (#29853)
  • Reduce formatter source-slice overhead (#29855)
  • Reuse a callee's qualified name across lint rules (#29916)
  • Skip invalid string character checks when the source contains none (#29883)
  • Use a Bloom filter for formatter comment lookups (#29852)
  • Use a concrete buffer for ordinary writes (#29819)

CLI

  • Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
  • Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

  • Correct the documented version and src defaults for ruff-action (#29880)
  • [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
  • [flake8-no-pep420] Document preview behavior (INP001) (#29764)
  • [isort] Expand I001 documentation (#29843)

Other changes

  • [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

  • [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
  • [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

  • Accept a bare raise before a semicolon (#29761)
  • Allow match identifiers after a semicolon (#29760)
  • Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
  • [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

  • Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

  • Coalesce source slices when formatting attributes (#29841)
  • Collect return statements with a statement-only visitor (#29911)
  • [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
  • Format node fields directly when comment handling is unnecessary (#29853)
  • Reduce formatter source-slice overhead (#29855)
  • Reuse a callee's qualified name across lint rules (#29916)
  • Skip invalid string character checks when the source contains none (#29883)
  • Use a Bloom filter for formatter comment lookups (#29852)
  • Use a concrete buffer for ordinary writes (#29819)

CLI

  • Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
  • Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

  • Correct the documented version and src defaults for ruff-action (#29880)
  • [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
  • [flake8-no-pep420] Document preview behavior (INP001) (#29764)
  • [isort] Expand I001 documentation (#29843)

Other changes

  • [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits
  • 05cdc36 Bump version to 0.17.4 (#30073)
  • c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
  • 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
  • 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
  • 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
  • 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
  • c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
  • c9150f0 Add project walltime benchmarks for Ruff (#30061)
  • 64989ec [ty] Report invalid module globs once per override pattern (#30031)
  • 367a563 [ty] Fix conditional type and tuple annotations (#29987)
  • Additional commits viewable in compare view

Updates ty from 0.0.95 to 0.0.99

Release notes

Sourced from ty's releases.

0.0.99

Release Notes

Released on 2026-11-06.

Bug fixes

  • Handle output errors when generating shell completions (#29997)
  • Invalidate aliased conditions across loop iterations (#30074)

LSP server

  • Add support for workspace/willRenameFiles LSP request (#28330)

Other changes

  • Bound comparisons of wide builtin literal unions (#30052)
  • Fix call argument validation for variadic parameters (#30086)
  • Freshen method typevars before owner specialization (#29543)
  • Inform call specializations compatibility through type context (#29932)
  • Keep source place IDs out of the use-def map (#30077)
  • Preserve type structure during typevar freshening (#29803)
  • Preserve typevars when mapping leaves their bounds unchanged (#29547)
  • Preserve unions inferred during fixpoint iteration (#29927)
  • Record lexical place IDs with their uses (#29956)
  • Skip existing release artifacts when retrying mirror uploads (#4937)
  • Skip fixpoint iteration for simple generic calls (#30054)
  • Solve generic call type context through constraint sets (#26680)

Contributors

Install ty 0.0.99

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ty/releases/download/0.0.99/ty-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ty/releases/download/0.0.99/ty-installer.ps1 | iex"
</tr></table> 

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.99

Released on 2026-11-06.

Bug fixes

  • Handle output errors when generating shell completions (#29997)
  • Invalidate aliased conditions across loop iterations (#30074)

LSP server

  • Add support for workspace/willRenameFiles LSP request (#28330)

Other changes

  • Bound comparisons of wide builtin literal unions (#30052)
  • Fix call argument validation for variadic parameters (#30086)
  • Freshen method typevars before owner specialization (#29543)
  • Inform call specializations compatibility through type context (#29932)
  • Keep source place IDs out of the use-def map (#30077)
  • Preserve type structure during typevar freshening (#29803)
  • Preserve typevars when mapping leaves their bounds unchanged (#29547)
  • Preserve unions inferred during fixpoint iteration (#29927)
  • Record lexical place IDs with their uses (#29956)
  • Skip existing release artifacts when retrying mirror uploads (#4937)
  • Skip fixpoint iteration for simple generic calls (#30054)
  • Solve generic call type context through constraint sets (#26680)

Contributors

0.0.98

Released on 2026-11-05.

Bug fixes

  • Avoid cubic narrowing for enum OR patterns (#30019)
  • Avoid duplicate warnings for unknown rules and override sections (#30028)
  • Fix class-pattern exhaustiveness after class identity checks (#30045)
  • Fix conditional type and tuple annotations (#29987)
  • Prefer active unnamed Conda and Pixi environments (#29974)
  • Preserve baseline matches when a rule is renamed (#30040)
  • Preserve exception types after tuple truthiness checks (#30018)

... (truncated)

Commits

Updates ipython from 9.18.0 to 9.18.1

Commits

Updates pip from 26.2.2 to 26.3

Changelog

Sourced from pip's changelog.

26.3 (2026-11-02)

Improved Documentation

  • Clarify in the security policy that pip has never considered installing untrusted wheels safe. This is because Python's import system is dynamic, so pip cannot guarantee that installing a wheel will not execute third-party code. ([#14412](https://github.com/pypa/pip/issues/14412) <https://github.com/pypa/pip/issues/14412>_)

Deprecations and Removals

  • Block unexpected imports during installation, warn about unsafe imports afterward, and improve recovery from interrupted installations. ([#13842](https://github.com/pypa/pip/issues/13842) <https://github.com/pypa/pip/issues/13842>_)

Features

  • Show build backend warnings for local source directories and log them at debug level for other sources. ([#14372](https://github.com/pypa/pip/issues/14372) <https://github.com/pypa/pip/issues/14372>_)
  • Add support for selecting extras in pylock.toml files with -r pylock.toml[extra1,extra2]. ([#14205](https://github.com/pypa/pip/issues/14205) <https://github.com/pypa/pip/issues/14205>_)
  • Allow --group to select non-default groups from local pylock files, e.g. --group pylock.toml:docs. ([#14390](https://github.com/pypa/pip/issues/14390) <https://github.com/pypa/pip/issues/14390>_)
  • Support --no-binary with -r pylock.toml. Before, pip would get the sdist from the index instead of the locked URL, or fail if no wheel were available in the lock file. ([#14187](https://github.com/pypa/pip/issues/14187) <https://github.com/pypa/pip/issues/14187>_)
  • Speed up installing a wheel with console scripts by not resolving every PATH entry. ([#14235](https://github.com/pypa/pip/issues/14235) <https://github.com/pypa/pip/issues/14235>_)
  • Clarify the warning for ~-prefixed leftover distribution directories. ([#11849](https://github.com/pypa/pip/issues/11849) <https://github.com/pypa/pip/issues/11849>_)

Bug Fixes

  • Report build-backend import failures as pip errors instead of displaying an uncaught traceback. ([#12248](https://github.com/pypa/pip/issues/12248) <https://github.com/pypa/pip/issues/12248>_)
  • No longer log the "pip is looking at multiple versions of a package" message until pip has looked at at least two versions of that package. ([#12928](https://github.com/pypa/pip/issues/12928) <https://github.com/pypa/pip/issues/12928>_)
  • Fix pip's self version check reporting an outdated version from the environment instead of the running pip when run as a zipapp. ([#13084](https://github.com/pypa/pip/issues/13084) <https://github.com/pypa/pip/issues/13084>_)
  • Fix a fatal error when using the PIP_CONFIG_FILE environment variable with pip config set. ([#13279](https://github.com/pypa/pip/issues/13279) <https://github.com/pypa/pip/issues/13279>_)
  • Avoid misleading error messages that include extra markers such as ; extra == "..." when installing packages. ([#13618](https://github.com/pypa/pip/issues/13618) <https://github.com/pypa/pip/issues/13618>_)
  • When installing to a custom --prefix, use the posix_prefix scheme when running from a Debian patched Python distribution to avoid a superfluous /local/ subdirectory. ([#13634](https://github.com/pypa/pip/issues/13634) <https://github.com/pypa/pip/issues/13634>_)
  • Refuse to follow an HTTP redirect to a file: URL. ([#14171](https://github.com/pypa/pip/issues/14171) <https://github.com/pypa/pip/issues/14171>_)
  • Prevent wheel cache origin mismatch warnings from exposing URL credentials. ([#14232](https://github.com/pypa/pip/issues/14232) <https://github.com/pypa/pip/issues/14232>_)
  • Report the incomplete-download error on Windows, not a PermissionError. ([#14237](https://github.com/pypa/pip/issues/14237) <https://github.com/pypa/pip/issues/14237>_)
  • Fix the global configuration location on macOS in virtual environments created from Homebrew Python. ([#14303](https://github.com/pypa/pip/issues/14303) <https://github.com/pypa/pip/issues/14303>_)
  • Reject extra arguments to pip config edit instead of silently ignoring them. ([#14347](https://github.com/pypa/pip/issues/14347) <https://github.com/pypa/pip/issues/14347>_)
  • Honor supplied hashes when using --no-require-hashes. ([#14355](https://github.com/pypa/pip/issues/14355) <https://github.com/pypa/pip/issues/14355>_)

... (truncated)

Commits
  • 191854f Bump for release
  • 063058b Update AUTHORS.txt
  • d1a81c8 Merge pull request #14233 from carrerasdarren-cell/fix/cache-origin-redact-auth
  • 942a415 Merge pull request #14423 from notatallshaw/fix/pkg-resources-deadline-20261102
  • f424f1a Merge pull request #14424 from notatallshaw/vendor/msgpack-1.2.4-20261102
  • 720a89a Merge branch 'main' into fix/cache-origin-redact-auth
  • 8e3414c Merge pull request #14247 from notatallshaw/enforce-import-block
  • 5156e03 Upgrade msgpack to 1.2.4
  • 95e2e6b Merge branch 'main' into enforce-import-block
  • 3859fd1 Defer pkg_resources metadata errors until pip 27.0
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-packages group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [pillow](https://github.com/python-pillow/Pillow) | `12.3.0` | `13.0.0` |
| [tyro](https://github.com/brentyi/tyro) | `1.0.16` | `1.0.17` |
| [gradio](https://github.com/gradio-app/gradio) | `6.31.0` | `7.0.0.dev0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.3` | `0.17.4` |
| [ty](https://github.com/astral-sh/ty) | `0.0.95` | `0.0.99` |
| [ipython](https://github.com/ipython/ipython) | `9.18.0` | `9.18.1` |
| [pip](https://github.com/pypa/pip) | `26.2.2` | `26.3` |


Updates `pillow` from 12.3.0 to 13.0.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.3.0...13.0.0)

Updates `tyro` from 1.0.16 to 1.0.17
- [Release notes](https://github.com/brentyi/tyro/releases)
- [Commits](brentyi/tyro@v1.0.16...v1.0.17)

Updates `gradio` from 6.31.0 to 7.0.0.dev0
- [Release notes](https://github.com/gradio-app/gradio/releases)
- [Changelog](https://github.com/gradio-app/gradio/blob/main/CHANGELOG.md)
- [Commits](https://github.com/gradio-app/gradio/compare/gradio@6.31.0...gradio@7.0.0-dev.0)

Updates `ruff` from 0.17.3 to 0.17.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.3...0.17.4)

Updates `ty` from 0.0.95 to 0.0.99
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.95...0.0.99)

Updates `ipython` from 9.18.0 to 9.18.1
- [Release notes](https://github.com/ipython/ipython/releases)
- [Commits](ipython/ipython@9.18.0...9.18.1)

Updates `pip` from 26.2.2 to 26.3
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@26.2.2...26.3)

---
updated-dependencies:
- dependency-name: pillow
  dependency-version: 13.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-packages
- dependency-name: tyro
  dependency-version: 1.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: gradio
  dependency-version: 7.0.0.dev0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-packages
- dependency-name: ruff
  dependency-version: 0.17.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: ty
  dependency-version: 0.0.99
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: ipython
  dependency-version: 9.18.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: pip
  dependency-version: '26.3'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dev Workflows, docker, etc. label Nov 11, 2026
@coderabbitai

coderabbitai Bot commented Nov 11, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Repository UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: f0452bdd-2af7-49c6-8b11-d77302753575

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@codecov

codecov Bot commented Nov 11, 2026 •

Copy link
Copy Markdown

❌ 1 Tests Failed:

Tests completed Failed Passed Skipped
1 1 0 0
View the top 1 failed test(s) by shortest run time
tests/test_preset_utils.py::tests.test_preset_utils
Stack Traces | 0s run time
ImportError while importing test module '.../zea/tests/test_preset_utils.py'.
Hint: make sure your test modules/packages have valid Python names.
Traceback:
.../usr/lib/python3.12/importlib/__init__.py:90: in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
tests/test_preset_utils.py:15: in <module>
    import httpx
E   ModuleNotFoundError: No module named 'httpx'

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

@invisiblefix-bot

Copy link
Copy Markdown

Hey! I'm InvisibleFix, a bot that helps maintainers land dependency and security updates. I saw this PR's CI is red, so I came to help. This group of 7 updates is stuck: on this branch pytest stops before running any test.

Your CI broke because gradio 7 switched to httpx2, so httpx is no longer installed and tests/test_preset_utils.py can't import it. ty 0.0.99 also reports 3 new errors. I fixed it in #709, which adds httpx to the tests group only, plus one type annotation and two # ty: ignore comments. Nothing changes at runtime.

✗ This PR: pytest stops at collection, so no test runs, and ty reports 3 errors (CI run)
✓ With the fix: all 3,794 tests pass (the same 43 skip as on main), and ty is clean (CI run on our fork)

Review fix PR #709 → I opened it to help; if it's not useful, just close it. GitHub Actions may need your approval to run.

How I checked
  • I ran your full unit suite (3,837 tests) twice on main, twice on this PR and twice with the fix.
  • With the fix, every test has the same result as on main. No test was changed, skipped or removed.
  • Setup: Ubuntu 22.04, Python 3.12.16, uv sync --frozen as in your CI. Commits: ba022cd (main) / 8c564d7 (this PR) / 7497d2b0 (fix).

About InvisibleFix · Need this on another Dependabot PR? Mention @invisiblefix-bot fix.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dev Workflows, docker, etc.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants