chore(deps): bump the python-dependencies group with 8 updates

[dependabot]

Bumps the python-dependencies group with 8 updates:

Package	From	To
google-crc32c	1.8.0	1.9.0
msgspec	0.21.1	0.22.0
coverage	7.16.1	7.16.2
hypothesis	6.168.1	6.168.3
uv	0.12.18	0.12.21
botocore	1.43.101	1.43.106
ruff	0.16.8	0.16.9
astroid	4.3.1	4.3.3

Updates google-crc32c from 1.8.0 to 1.9.0

Changelog

Sourced from google-crc32c's changelog.

Changelog

PyPI History

Commits

• See full diff in compare view

Updates msgspec from 0.21.1 to 0.22.0

Release notes

Sourced from msgspec's releases.

Version 0.22.0 (2026-09-29)

• BREAKING: Setting gc=False on a struct type that has a weakref slot, whether from weakref=True or from a base class, now raises ValueError. On CPython 3.12 and later the weakref slot is stored in a pre-header in front of the instance, so releasing an instance of a gc=False type with that slot corrupted memory, in most builds crashing the interpreter outright. The combination worked on 3.10 and 3.11, and the restriction applies there as well, so that the same class definition behaves the same way on every supported version (#1207).
• Add frozendict support on Python 3.15+ (#1052, #1105).
• Support passing a callable as decimal_format to msgspec.json.Encoder and msgspec.msgpack.Encoder for custom Decimal encoding (#978).
• Support Literal[True] and Literal[False] types (#1004).
• Publish CPython 3.15 wheels, including freethreaded builds (#1152).
• Publish Linux riscv64 wheels (#987).
• Support the PyEmscripten (Pyodide) platform (#1083).
• Fix handling of PEP 695 type parameter syntax (class Foo[T]) and of types.GenericAlias instances in type annotations (#962).
• Fix NameError when creating a Struct with an unquoted forward reference on Python 3.14 (#1165).
• Fix a crash on incorrect typing.ClassVar annotations (#1097).
• Fix an AttributeError when converting to a Struct type defined in a namespace without a __name__ (#1072).
• Fix overriding an inherited field alias back to the field's own name (#1133).
• Raise ValidationError instead of SystemError when convert receives an out-of-range int for a float target (#1162).
• Report raw rather than the misleading any as the expected type when a non-Raw value is given for a Raw field in convert, and therefore in yaml.decode and toml.decode (#1169).
• Fix an empty expected-type name in validation errors for a required Raw field in a TypedDict, or a Raw field with a default_factory on a dataclass or an attrs class (#1176).
• Correct the error messages for out-of-range Meta length bounds (#1172).
• Fix a reference leak when decoding msgpack Ext payloads (#1109).
• Fix backing type declaration of Ext.code (#1135).
• Fix a reference leak in msgspec.to_builtins, and therefore in yaml.encode, for array_like=True structs (#1177).
• Fix reference leaks in typenode_collect_literal, Meta.__rich_repr__, ms_decode_bigint, and Encoder.__init__ (#1021, #1022, #1023, #1040).
• Fix msgspec.inspect.type_info and msgspec.json.schema crashing on mixed-type Literals such as Literal[1, None] (#1080).
• Place null last in the anyOf generated for optional unions in JSON schemas (#1028).
• Fix minItems in the JSON schema for array_like=True structs whose fields are all optional (#1124).
• Use [] or "" rather than a Python set or bytearray object as the JSON schema default for Struct fields with a set or bytearray

... (truncated)

Changelog

Sourced from msgspec's changelog.

Version 0.22.0 (2026-09-29)

• BREAKING: Setting gc=False on a struct type that has a weakref slot, whether from weakref=True or from a base class, now raises ValueError. On CPython 3.12 and later the weakref slot is stored in a pre-header in front of the instance, so releasing an instance of a gc=False type with that slot corrupted memory, in most builds crashing the interpreter outright. The combination worked on 3.10 and 3.11, and the restriction applies there as well, so that the same class definition behaves the same way on every supported version ({pr}1207).
• BREAKING: Encode an object as a dataclass only when its type defines __dataclass_fields__, as dataclasses.is_dataclass does. Objects that expose it only through instance attribute access, such as proxies wrapping a dataclass instance, are now passed to enc_hook, and encoding them raises TypeError when no enc_hook is given. An enc_hook can return the wrapped instance, which is then encoded as a dataclass. Objects with a Python-level __getattr__, such as pydantic models, now reach enc_hook without that __getattr__ being called ({pr}1196).
• Add frozendict support on Python 3.15+ ({pr}1052, {pr}1105).
• Support passing a callable as decimal_format to msgspec.json.Encoder and msgspec.msgpack.Encoder for custom Decimal encoding ({pr}978).
• Support Literal[True] and Literal[False] types ({pr}1004).
• Publish CPython 3.15 wheels, including freethreaded builds ({pr}1152).
• Publish Linux riscv64 wheels ({pr}987).
• Support the PyEmscripten (Pyodide) platform ({pr}1083).
• Fix handling of PEP 695 type parameter syntax (class Foo[T]) and of types.GenericAlias instances in type annotations ({pr}962).
• Fix NameError when creating a Struct with an unquoted forward reference on Python 3.14 ({issue}1165).
• Fix a crash on incorrect typing.ClassVar annotations ({pr}1097).
• Raise TypeError instead of crashing when a base class of a Struct type is a C extension type that has not been initialized with PyType_Ready yet ({pr}1199).
• Fix an AttributeError when converting to a Struct type defined in a namespace without a __name__ ({pr}1072).
• Fix overriding an inherited field alias back to the field's own name ({pr}1133).
• Raise ValidationError instead of SystemError when convert receives an out-of-range int for a float target ({pr}1162).
• Report raw rather than the misleading any as the expected type when a non-Raw value is given for a Raw field in convert, and therefore in yaml.decode and toml.decode ({pr}1169).
• Fix an empty expected-type name in validation errors for a required Raw field in a TypedDict, or a Raw field with a default_factory on a dataclass or an attrs class ({pr}1176).
• Correct the error messages for out-of-range Meta length bounds ({pr}1172).
• Fix a reference leak when decoding msgpack Ext payloads ({pr}1109).
• Fix backing type declaration of Ext.code ({pr}1135).
• Raise DecodeError instead of TypeError when a decoded msgpack map key is

... (truncated)

Commits

• 6d3443f Fix a reference leak of a non-Struct base's type dict (#1199)
• 2f0b50d Correct the reported signatures of several public callables (#1197)
• 8a25471 Skip instance __dataclass_fields__ lookup for non-dataclass types (#1196)
• 7930780 Fix reference leak when defining a Struct type (#1194)
• 55f5cdd fix(msgpack): raise DecodeError for unhashable map keys (#1209)
• b2d1b7a Reject gc=False on struct types with a weakref slot (#1207)
• f2bbec5 Move the unreleased changes into the 0.22.0 changelog (#1211)
• c23e150 Fix json schema defaults for set / bytearray default_factory fields (#1183)
• fed9fc3 Skip recursive type alias test on Windows ARM64 with Python 3.12 (#1210)
• e7552f0 Bump msgpack from 1.2.1 to 1.2.2 (#1202)
• Additional commits viewable in compare view

Updates coverage from 7.16.1 to 7.16.2

Release notes

Sourced from coverage's releases.

7.16.2

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168.
• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289.
• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923.

➡️  PyPI page: coverage 7.16.2. :arrow_right:  To install: python3 -m pip install coverage==7.16.2

Changelog

Sourced from coverage's changelog.

Version 7.16.2 — 2026-09-27

• Fix: on Python 3.14 and later, a for loop completing immediately before a function return could mistakenly report an uncovered branch. This is now fixed, closing issue 2168_.

• Fix: on Python 3.14 and later, the else clause of a try whose body is a with statement could incorrectly be reported as covered when the with raised. This is now fixed, closing issue 2289_.

• Fix: with dynamic_context = test_function, test methods written as @staticmethod or @classmethod were not given a context of their own. Now they are, on Python 3.11 and later. Closes issue 1923_.

.. _issue 1923: coveragepy/coveragepy#1923 .. _issue 2168: coveragepy/coveragepy#2168 .. _issue 2289: coveragepy/coveragepy#2289

.. _changes_7-16-1:

Commits

• 5643ae7 docs: prep for 7.16.2
• a3e969f fix: dynamic_context for @​staticmethod and @​classmethod tests (issue 1923) (#...
• 8ad7236 fix: stop counting the try/else line when a with statement raises (#2301)
• c6dab1f fix(debug): debug output doesn't mis-handle odd line separators #2296
• 08fbc32 style: Protocols should use ... for method bodies
• bc7b0e3 refactor: positional-only args are better than pragmas
• 52afd6b Document parallel tox coverage data files (#2284)
• f653aae fix: loop completion arcs on Python 3.14 (#2281)
• cc1ced4 test: PyPy still compiles comprehensions as functions
• 85a9088 chore: make upgrade
• Additional commits viewable in compare view

Updates hypothesis from 6.168.1 to 6.168.3

Commits

• 44b82b2 Bump hypothesis version to 6.168.3 and update changelog
• aeaafb5 Merge pull request #4888 from gpacix/fix-quadratic-statistics
• f3f4a29 wording, remove hardcoded test
• 7fabb94 Add RELEASE.rst and AUTHORS.rst changes
• 0ab4e38 Summarize statistics events in linear time
• 32ebeb2 Bump hypothesis version to 6.168.2 and update changelog
• ff7e800 Merge pull request #4886 from pschanely/atomic-constants-cache
• e57fd12 Isolate the constants cache test from existing cache files
• c8981a0 Write the local constants cache atomically
• 9c55f97 Merge pull request #4877 from HypothesisWorks/create-pull-request/patch
• Additional commits viewable in compare view

Updates uv from 0.12.18 to 0.12.21

Release notes

Sourced from uv's releases.

0.12.21

Release Notes

Released on 2026-09-29.

Python

• Update CPython to use OpenSSL 3.5.9 (#22076)

Enhancements

• Omit empty [manifest] tables from lockfiles that contain only manifest subtables (#22070)

Preview features

• Omit redundant runtime constraints from uv.lock, including those involving pre-releases, with the resolution-inputs preview feature (#22004, #22068)

Bug fixes

• Prevent uv python pin --rm from removing a global .python-versions file without --global (#21992)
• Fix installed-package checks incorrectly reporting post-releases as incompatible with exclusive lower bounds on pre-releases (#22049)

Install uv 0.12.21

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.21/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.21/uv-installer.ps1 | iex"

Download uv 0.12.21

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.12.21

Released on 2026-09-29.

Python

• Update CPython to use OpenSSL 3.5.9 (#22076)

Enhancements

• Omit empty [manifest] tables from lockfiles that contain only manifest subtables (#22070)

Preview features

• Omit redundant runtime constraints from uv.lock, including those involving pre-releases, with the resolution-inputs preview feature (#22004, #22068)

Bug fixes

• Prevent uv python pin --rm from removing a global .python-versions file without --global (#21992)
• Fix installed-package checks incorrectly reporting post-releases as incompatible with exclusive lower bounds on pre-releases (#22049)

0.12.20

Released on 2026-09-28.

Enhancements

• Reuse lockfiles when dependency declarations are semantically equivalent (#21951)
• Preserve second-line encoding declarations when installing wheel scripts with CRLF shebangs (#21990)

Preview features

• Write normalized requirement declarations with the lockfile-normalization preview feature (#21951)
• Honor synthetic default groups when installing or syncing from pylock.toml (#22003)
• Resolve local paths in exported pylock.toml files relative to the output file (#22042)
• Install each package only once when repeated tool-install-locks requirements resolve to the same package (#22000)
• Reuse lock-without-metadata lockfiles for conflicting groups with distinct base and extra requirement specifiers (#22055)
• Use consistent root-package paths in uv workspace metadata and uv tree --format json output (#22050)

Configuration

• Continue searching XDG_CONFIG_DIRS after empty entries (#21987)

Performance

• Restore the previous HTTP cache-write scheduling while investigating severe cache-revalidation stalls on ext4 filesystems (#22051)

Bug fixes

• Apply hash constraints to every repeated requirement under --require-hashes and --verify-hashes (#21996)

... (truncated)

Commits

• 7af8268 Bump version to 0.12.21 (#22081)
• 73337b7 Fix post-release matching for exclusive version bounds (#22049)
• cd050e4 Sync latest Python releases (#22076)
• d8d2b30 Omit empty manifest headers from lockfiles (#22070)
• 77ab05f Omit compatible prerelease version constraints (#22068)
• 9a04b8f Omit redundant runtime constraints from lockfiles (#22004)
• 89d689b Add a HashReader benchmark (#21782)
• 73b640e Replace serde_yaml with yaml_serde (#22069)
• f93fee6 protect global .python-versions from removal without --global flag (#21992)
• 7467a0d Unify override and exclude code (#20689)
• Additional commits viewable in compare view

Updates botocore from 1.43.101 to 1.43.106

Commits

• ca596c7 Merge branch 'release-1.43.106'
• 1808528 Bumping version to 1.43.106
• 3d316f0 Update endpoints model
• 053554b Update to latest models
• e9bb16c Merge branch 'release-1.43.105'
• 21f2f87 Merge branch 'release-1.43.105' into develop
• 8be13b2 Bumping version to 1.43.105
• 9931e97 Update to latest models
• 66a4744 Merge branch 'release-1.43.104'
• 358f8ee Merge branch 'release-1.43.104' into develop
• Additional commits viewable in compare view

Updates ruff from 0.16.8 to 0.16.9

Release notes

Sourced from ruff's releases.

0.16.9

Release Notes

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)
• [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

• Fix horizontal overflow on the rules documentation page (#28699)
• Update rules table with category information (#28651)
• [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
• [flake8-bugbear] Document type-checker interaction (B010) (#28509)
• [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
• [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

• @​qinpei-dev
• @​sanjayrohith
• @​ntBre
• @​webdevsamran
• @​zaniebot
• @​ewdurbin
• @​MichaReiser
• @​spaceone
• @​IbrahimKhan12
• @​devtechedge
• @​GruffElixir

Install ruff 0.16.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.9

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)
• [flake8-pyi] Mention stubs in the diagnostic message (PYI002) (#28542)

Documentation

• Fix horizontal overflow on the rules documentation page (#28699)
• Update rules table with category information (#28651)
• [flake8-annotations] Clarify that ANN401 checks return types in addition to arguments (#28334)
• [flake8-bugbear] Document type-checker interaction (B010) (#28509)
• [flake8-comprehensions] Document map/generator exception behavior (C417) (#27794)
• [ruff] Mention related isort settings (RUF022) (#28719)

Contributors

• @​qinpei-dev
• @​sanjayrohith
• @​ntBre
• @​webdevsamran
• @​zaniebot
• @​ewdurbin
• @​MichaReiser
• @​spaceone
• @​IbrahimKhan12
• @​devtechedge
• @​GruffElixir

Commits

• 0be08a2 Bump version to 0.16.9 (#28882)
• b4920b7 Rename ruff_cli to ruff_command_line (#28881)
• 47c751b Update dependency astral-sh/uv to v0.12.18 (#28880)
• 8c244e5 [flake8-comprehensions] Document map/generator exception behavior (C417...
• 5edf5a1 Use target form in rooster.version_files (#28876)
• 915bb2b [ty] Prefer existing @ paths over response files in Ruff and ty (#28877)
• 4710e1a ci(github): update version number in placeholder of issue template (#28871)
• eedfc62 [ty] Propagate outer type context through cast calls (#28855)
• ceaa6a0 [ty] Contain rendered code within Markdown fences (#28869)
• dba0f30 authorize ruff-pre-commit dispatch via OIDC (#28867)
• Additional commits viewable in compare view

Updates astroid from 4.3.1 to 4.3.3

Release notes

Sourced from astroid's releases.

v4.3.3

What's new in astroid 4.3.3?

Release date: 2026-09-30

Bug Fixes

• Preserve the length of inferred list and tuple concatenations when an element has multiple possible values. An ambiguous or uninferable element is now represented as unknown instead of being expanded into multiple sequence items.

  Refs #3221 Closes pylint-dev/pylint#2621

• Fix TypeError in ClassDef.getitem when __class_getitem__ is uninferable.

  Closes #3312

• Fix AssertionError in NodeNG.root() when inferring Class.__bases__, which previously returned a parentless Tuple.

  Closes pylint-dev/pylint#11491

v4.3.2

What's new in astroid 4.3.2?

Release date: 2026-09-25

Bug Fixes

• Fix a crash when a namedtuple or Enum type name or field name contains str.format markup, as in namedtuple("{0}", "abc"). The name is interpolated into an error message that astroid then reformats, so building the message raised IndexError. Inference now falls back to its default.

  Closes #3199

• Infer a functional TypeVar or NewType whose name is not an identifier without splicing that name into the synthesized class source. A crafted value such as TypeVar("T(Base): #") no longer breaks out of the identifier position to inject bases or a body; the name is assigned to the class verbatim.

  Refs #3217

• Raise InferenceError instead of crashing with IndexError when a class uses six.with_metaclass() with no positional metaclass argument, both while

... (truncated)

Commits

• fc14188 Bump astroid to 4.3.3, update changelog
• 9d97d07 [Backport maintenance/4.3.x] Fix crash when inferring Class.bases without...
• 0698518 [Backport maintenance/4.3.x] Fix crash inferring class subscription with unin...
• 9034c98 [Backport maintenance/4.3.x] Preserve sequence length with ambiguous elements...
• e6e7908 Bump astroid to 4.3.2, update changelog
• 69e47dd Point towncrier at the 4.3 what's new page on the maintenance branch
• 164f1ef Add a CI check for missing news fragments
• ee28385 Move the what's new documentation to a towncrier tree
• b9d1b59 Add towncrier configuration and scripts
• 8d33a23 [Backport maintenance/4.3.x] Catch OverflowError when inferring "c" format sp...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions