Bump the python-requirements group across 1 directory with 7 updates

[dependabot]

Updates the requirements on python-fsutil, python-slugify, python-benedict, coverage, mypy, pytest and tox to permit the latest version.
Updates python-fsutil from 0.16.1 to 0.17.0

Release notes

Sourced from python-fsutil's releases.

0.17.0

• Add support for file-like objects in get_file_hash.
• Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. #186 (thanks to @​SAY-5)
• Harden Content-Disposition filename sanitization in download_file to prevent path traversal. #181
• Bump requirements and pre-commit hooks.

Changelog

Sourced from python-fsutil's changelog.

0.17.0 - 2026-07-07

• Add support for file-like objects in get_file_hash.
• Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. #186 (thanks to @​SAY-5)
• Harden Content-Disposition filename sanitization in download_file to prevent path traversal. #181
• Bump requirements and pre-commit hooks.

Commits

• deb6684 Update CHANGELOG and version.
• fc91d14 Add support for file-like objects in get_file_hash.
• e1d342b Bump pre-commit hooks.
• 88a2ed4 Harden Content-Disposition filename sanitization in download_file to preven...
• 0fe73fd Bump the python-requirements group across 1 directory with 7 updates (#188)
• 1429dce Bump the github-actions group across 1 directory with 4 updates (#187)
• 4abb5aa Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. (#186)
• c98dbf6 Bump pre-commit hooks.
• 8854ed2 Fix HIGH-level OpenSSF Scorecard code scanning alerts (VulnerabilitiesID) (#175)
• 8693f3e Update SECURITY.md.
• Additional commits viewable in compare view

Updates python-slugify from 8.0.4 to 9.1.2

Release notes

Sourced from python-slugify's releases.

9.1.2

Performance improvement with unchanged output under both algorithms. Legacy output is unchanged and remains the permanent default.

• Skip the transliteration backend for ASCII-only input under both algorithms, avoiding the ~3 MB text-unidecode table import for the common ASCII case. Output is unchanged, including the frozen legacy differential (Rafael Borja, #201).

Full Changelog: un33k/python-slugify@v9.1.1...v9.1.2

🚀 Generated with Dojo ⛩️

9.1.1

Bug fix in the modern algorithm. Legacy output is unchanged and remains the permanent default.

• Modern mode only: avoid emitting a trailing separator when a hard cut truncates through repeated post-replacement delimiters, keeping the delimiter run with the next word that fits. Legacy output and public smart_truncate are unchanged (曾楚笑, #200).

Full Changelog: un33k/python-slugify@v9.1.0...v9.1.1

🚀 Generated with Dojo ⛩️

9.1.0

Modern-algorithm improvements and fixes. Legacy output is unchanged and remains the permanent default.

• Modern mode only: decode uppercase &#X..; hexadecimal references as HTML allows, in addition to lowercase &#x..; (Rupayon Haldar, #195).
• Modern mode only: preserve post-replacement output when the whole slug already fits max_length, so intentional repeated/trailing delimiters are not collapsed at the length limit. Public smart_truncate is unchanged (emme1t, #193).
• Fix add_uppercase_char to apply insertions atomically, leaving the input list unchanged if iteration fails. Built-in transliteration tables are unaffected (Cristian Ramirez, #194).
• Modern mode only: validate argument types up front, raising TypeError for a bool/non-int max_length or a non-str separator. Legacy behavior is unchanged (Jon Bailey, #196).

Internal: the legacy pipeline is now frozen in slugify/_legacy.py with the public slugify() dispatching by algorithm; tests reorganized under tests/.

Full Changelog: un33k/python-slugify@v9.0.0...v9.1.0

🚀 Generated with Dojo ⛩️

9.0.0

Highlights

• Preserve legacy slug output by default while adding explicit algorithm="modern" opt-in behavior.
• Add explicit transliteration backend and replacement-stage controls, with matching CLI options.
• Add opt-in AnyASCII support while preserving existing dependency and backend-selection behavior.
• Fix CLI regex-pattern forwarding and modern-mode handling for entities, iterables, separators, and delimiters.
• Add Python 3.14 support, packaging modernization, expanded compatibility checks, and migration guidance.

See the changelog and migration guide for details.

PyPI: https://pypi.org/project/python-slugify/9.0.0/

🚀 Created with Dojo ⛩️

Changelog

Sourced from python-slugify's changelog.

9.1.2

• Skip the transliteration backend for ASCII-only input under both algorithms, avoiding the ~3 MB text-unidecode table import for the common ASCII case. Output is unchanged, including the frozen legacy differential (Rafael Borja, #201).

9.1.1

• Modern mode only: avoid emitting a trailing separator when a hard cut truncates through repeated post-replacement delimiters, keeping the delimiter run with the next word that fits. Legacy output and public smart_truncate are unchanged (曾楚笑, #200).

9.1.0

• Modern mode only: decode uppercase &#X..; hexadecimal references as HTML allows, in addition to lowercase &#x..;. Legacy output is unchanged (Rupayon Haldar, #195).
• Modern mode only: preserve post-replacement output when the whole slug already fits max_length, so intentional repeated/trailing delimiters are not collapsed at the length limit. Public smart_truncate is unchanged (emme1t, #193).
• Fix add_uppercase_char to apply insertions atomically, leaving the input list unchanged if iteration fails. Built-in transliteration tables are unaffected (Cristian Ramirez, #194).
• Modern mode only: validate argument types up front, raising TypeError for a bool/non-int max_length (bool is an int subclass) or a non-str separator. Legacy behavior is unchanged and still treats max_length=True as its historical single-character truncation (Jon Bailey, #196).

9.0.0 — unreleased

• Add keyword-only algorithm='legacy' (permanent default) and explicit algorithm='modern' opt-in, plus CLI --algorithm. Preserve historical default entity ordering, numeric handling, iterator consumption, separator truncation, and public smart_truncate behavior.

• Preserve legacy auto backend selection and two-pass replacement defaults; add explicit backend and replacement_stage keyword-only options and matching CLI flags.

• Add opt-in AnyASCII extra without removing or changing the base text-unidecode dependency.

• Forward CLI --regex-pattern (Jacobo de Vera, #176; report by @​peter-bloomfield, #175).

• Modern mode only: decode entities before transliteration; handle invalid numeric references per match, including surrogate references (#178, #181, #187).

• Modern mode only: materialize replacement rules and stopword iterables consistently; preserve bytes/bytearray UTF-8 input with clear rejection of unsupported types (#183, #190).

• Modern mode only: budget internal tokens using emitted separator widths, support empty separators, and preserve literal word characters that match delimiters. Public smart_truncate remains unchanged (#47, #185, #186).

• Add regression coverage for whitespace, ordinals, backend-specific output, replacement stages, CLI execution, and installed artifacts.

• Move package metadata to pyproject.toml, retain the typed marker and source tests, and remove the unsafe publish/upload/tag shortcut.

• Document output changes, backend license distinctions, compatibility limits, and migration precautions in docs/release-9/migration.md.

• Support Python 3.14.

• Drop support for Python 3.9 and lower.

• Use tox for local test runs and in CI.

• Test the project against both unidecode and text_unidecode.

• Fix type annotation issues identified by mypy.

• Run CI against pull requests.

• Fix package build warnings.

Commits

• 18a28da Release 9.1.2: skip transliteration backend for ASCII input (#201)
• cf6cd3d Skip the transliteration backend for ASCII text (#201)
• 2fe6cec Reword Dojo badge to 'maintained with' for a 15-year-old library
• bbfdff2 Recolor Dojo badge to dark slate for readability
• 87ce191 Add 'Built with Dojo' badge to README
• 6aa0b0f Release 9.1.1: fix modern hard-cut trailing delimiter
• 8f9a550 Avoid trailing post-replacement delimiters in modern hard cuts (#200)
• c442cd4 Lead Quickstart examples with algorithm='modern'
• 6e6fc4b Reframe README intro around 9+ modern algorithm, drop PyPI prose
• b9171f7 Use version-agnostic 9.x wording in README
• Additional commits viewable in compare view

Updates python-benedict from 0.36.0 to 0.38.0

Release notes

Sourced from python-benedict's releases.

0.38.0

• Fix keylists / keypaths to handle non-string dict keys holding lists. (by @​Sanjays2402 in #583)
• Fix match to anchor string patterns and consume the full keypath. (by @​gaoflow in #579)
• Fix query-string serializer to accept array/bracketed keys and trailing &. (#586)
• Reject empty keypath_separator. (by @​CodingFeng101 in #580)
• Fix int parsing to catch OverflowError. #578 (#584)
• Bump requirements and pre-commit hooks.

0.37.0

• Add optional schema kwarg support (python-benedict[schema] with pydantic v2) to all from_* and to_* I/O methods. (#565)
• Add indexes=True option to flatten / unflatten for list/tuple flattening with round-trip support. (#561)
• Add deep argument support to filter method to apply the predicate recursively to all nested dicts.
• Add deep argument support to remove method to remove the key(s) at every nesting level.
• Add deep argument support to rename method to rename the key at every nesting level.
• Reduce dependencies making the core installation super lightweight. #567
• Swap uiri/toml encoder for tomli_w. #439
• Fix yaml serializer to use safe_dump and add pickle security warning (CWE-502). (#563)
• Fix orjson and requests requirements to address CVE-2025-67221 and CVE-2024-27454. (#562)
• Add CONTRIBUTING.md.
• Bump requirements and pre-commit hooks.

Changelog

Sourced from python-benedict's changelog.

0.38.0 - 2026-07-07

• Fix keylists / keypaths to handle non-string dict keys holding lists. (by @​Sanjays2402 in #583)
• Fix match to anchor string patterns and consume the full keypath. (by @​gaoflow in #579)
• Fix query-string serializer to accept array/bracketed keys and trailing &. (#586)
• Reject empty keypath_separator. (by @​CodingFeng101 in #580)
• Fix int parsing to catch OverflowError. #578 (#584)
• Bump requirements and pre-commit hooks.

0.37.0 - 2026-05-09

• Add optional schema kwarg support (python-benedict[schema] with pydantic v2) to all from_* and to_* I/O methods. (#565)
• Add indexes=True option to flatten / unflatten for list/tuple flattening with round-trip support. (#561)
• Add deep argument support to filter method to apply the predicate recursively to all nested dicts.
• Add deep argument support to remove method to remove the key(s) at every nesting level.
• Add deep argument support to rename method to rename the key at every nesting level.
• Reduce dependencies making the core installation super lightweight. #567
• Swap uiri/toml encoder for tomli_w. #439
• Fix yaml serializer to use safe_dump and add pickle security warning (CWE-502). (#563)
• Fix orjson and requests requirements to address CVE-2025-67221 and CVE-2024-27454. (#562)
• Add CONTRIBUTING.md.
• Bump requirements and pre-commit hooks.

Commits

• a922d1a Update CHANGELOG and version.
• a87b689 fix: handle non-string dict keys holding lists in keylists/keypaths (#583)
• 1383959 fix: anchor string patterns in match() to consume full keypath. (#579)
• c437b99 Fix query-string: accept array/bracketed keys and trailing & (#586)
• f99b35a Merge branch 'main' of https://github.com/fabiocaccamo/python-benedict
• 479caa1 Reject empty keypaths separator. (#580)
• c987439 Reject empty keypaths separator. (#580)
• c7c934f Apply review fixes for keypaths separator handling (#585)
• f3bc063 Address review comments on PR #578: catch OverflowError in _parse_int and fix...
• 9120d48 Bump python-fsutil.
• Additional commits viewable in compare view

Updates coverage to 7.16.2

Release notes

Sourced from coverage's releases.

7.16.2

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

Changelog

Sourced from coverage's changelog.

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168_.

• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289_.

• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923_.

.. _issue 1923: coveragepy/coveragepy#1923 .. _issue 2168: coveragepy/coveragepy#2168 .. _issue 2289: coveragepy/coveragepy#2289

.. _changes_7-16-1:

Version 7.16.1 — 2026-09-13

• Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

• Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

.. _issue 1563: coveragepy/coveragepy#1563 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Version 7.16.0 — 2026-08-28

• When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

• The :meth:.Coverage.switch_context method now returns the previous context.

• Fix: previously, a [paths] pattern would be replaced everywhere in a file

... (truncated)

Commits

• 5643ae7 docs: prep for 7.16.2
• a3e969f fix: dynamic_context for @​staticmethod and @​classmethod tests (issue 1923) (#...
• 8ad7236 fix: stop counting the try/else line when a with statement raises (#2301)
• c6dab1f fix(debug): debug output doesn't mis-handle odd line separators #2296
• 08fbc32 style: Protocols should use ... for method bodies
• bc7b0e3 refactor: positional-only args are better than pragmas
• 52afd6b Document parallel tox coverage data files (#2284)
• f653aae fix: loop completion arcs on Python 3.14 (#2281)
• cc1ced4 test: PyPy still compiles comprehensions as functions
• 85a9088 chore: make upgrade
• Additional commits viewable in compare view

Updates mypy to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• Additional commits viewable in compare view

Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates tox to 4.64.4

Release notes

Sourced from tox's releases.

v4.64.4

What's Changed

• fix(pip): pass --pre once in the default command by @​Rodrigo-Palma in tox-dev/tox#4097
• fix(cli): parse list-valued defaults by nargs by @​januththedev in tox-dev/tox#4098

New Contributors

• @​januththedev made their first contribution in tox-dev/tox#4098

Full Changelog: tox-dev/tox@4.64.3...4.64.4

Changelog

Sourced from tox's changelog.

Bug fixes - 4.64.4

• Pass --pre once, before the packages, in the default install_command with :ref:pip_pre set to true. (:issue:4097)
• Fix list conversion for command line defaults from environment variables and user configuration files. For example, TOX_LABELS=old;new selects environments labeled old or new, and TOX_LIST_KEYS_ONLY=env_name;deps selects both configuration keys. Support list-valued options without an explicit default or element type, including append actions. (:issue:4098)

---

v4.64.3 (2026-09-26)

---

Bug fixes - 4.64.3

• A set_env written as a list of tables in TOML now keeps every file entry and honors the order of the entries, so merging one environment's set_env into another no longer drops the environment file it referenced (:issue:4093) - by :user:Rodrigo-Palma.

  • Each { file = "..." } entry is read; previously only the last one survived, because the entries were merged into a single table first and a table cannot hold the key twice.
  • A variable set after a file entry wins over the value the file provides, matching the file| form in INI; previously a repeated variable was pulled back to its first position, letting the file override it.
  • A later entry that sets a variable without a marker clears the marker an earlier entry gave it, again matching the INI form. (:issue:4093)

• Create the package build environment change_dir directory before running the build commands, as the documentation already promises. (:issue:4095)

---

v4.64.2 (2026-09-24)

---

Bug fixes - 4.64.2

• A tox environment with env_dir = "{tox_root}/.venv" no longer crashes with FileExistsError after another environment ran (:issue:4090) - by :user:gaborbernat.

  • With :ref:venv_redirect unset, the new default, tox writes the redirect file unless a tox environment lives at .venv; with true, tox fails the run with an error naming that environment.
  • tox deletes a redirect file it wrote where an environment should live, and fails the environment with an error naming any other file there. (:issue:4091)

• The :PEP:832 .venv redirect file now names a deliberate development environment - by :user:gaborbernat.

  • tox picks :ref:venv_redirect_env, else an environment named dev, else the first that installs the project in development mode, and writes nothing without one, so a project that uses tox for tests alone gets no file.

... (truncated)

Commits

• efc4cc3 release 4.64.4
• 75ded6b fix(cli): parse list-valued defaults by nargs (#4098)
• f8bd565 fix(pip): pass --pre once in the default command (#4097)
• f46060e release 4.64.3
• ca35bdb Keep every file entry of a set_env list of tables (#4094)
• 31ed8d9 Create change_dir before running the external package build command (#4095)
• 9cd0f4e release 4.64.2
• c2b87d2 🐛 fix(run): point .venv at a deliberate dev env (#4092)
• a8fa8cc 🐛 fix(run): keep .venv redirect off for a .venv env (#4091)
• e40e8e6 release 4.64.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions