Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 9 updates - #170

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/minor-and-patch-75e3446b1b
Closed

chore(deps): bump the minor-and-patch group across 1 directory with 9 updates#170
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/minor-and-patch-75e3446b1b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 9 updates in the / directory:

Package From To
cpg-utils 5.6.0 5.6.1
grpcio 1.78.0 1.80.0
grpcio-status 1.78.0 1.80.0
build 1.4.2 1.5.0
pre-commit 4.5.1 4.6.0
pytest 9.0.2 9.0.3
ruff 0.15.7 0.15.12
mike 2.1.4 2.2.0
pyright 1.1.408 1.1.409

Updates cpg-utils from 5.6.0 to 5.6.1

Commits

Updates grpcio from 1.78.0 to 1.80.0

Release notes

Sourced from grpcio's releases.

Release v1.80.0

This is release 1.80.0 (glimmering) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • [ssl] Implement TLS private key signer in Python. (#41701)
  • [TLS Credentials]: Private Key Offload Implementation. (#41606)
  • Fix max sockaddr struct size on OpenBSD. (#40454)
  • [core] Enable EventEngine for Python by default, and EventEngine fork support in Python and Ruby. (#41432)
  • [TLS Credentials]: Create InMemoryCertificateProvider to update certificates independently. (#41484)
  • [Ruby] Build/test ruby 4.0 and build native gems with Ruby 4.0 support. (#41324)
  • [EventEngine] Remove an incorrect std::move in DNSServiceResolver constructor. (#41502)
  • [RR and WRR] enable change to connect from a random index. (#41472)
  • [xds] Implement gRFC A101. (#41051)

C++

  • [C++] Add SNI override option to C++ channel credentials options API. (#41460)

C#

  • [C# tools] Option to append Async to server side method names #39010. (#39797)

Objective-C

  • [Fix][Compiler] Plugins fall back to the edition 2023 for older protobuf. (#41357)

PHP

  • [PHP] Disable php infinite recursion check for callback from Core to PHP. (#41835)
  • [PHP] Fix runtime error with PHp8.5 alpha because zend_exception_get_defaul…. (#40337)

Python

  • [Python] Fix GRPC_TRACE not working when absl log initialized in cython. (#41814)
  • Revert "[Python] Align GRPC_ENABLE_FORK_SUPPORT env defaults in core and python (#41455)". (#41769)
  • [Python] Fix AsyncIO Server maximum_concurrent_rpcs enforcement preventing negative active_rpcs count. (#41532)
  • [Python] Docs: correct grpc.Compression references. (#41705)
  • [Python] [Typeguard] Part 4 - Add Typeguard to AIO stack in tests . (#40226)

... (truncated)

Commits
  • f5e2d6e [Release] Bump version to 1.80.0 (on v1.80.x branch) (#41857)
  • 938cfec [subchannel connection scaling] fix when we reset backoff (#41935)
  • 91778be [Backport][v1.80.x][Python] New _create method for aio.Metadata (#41888)
  • f10b9f2 [bzlmod] upgrade rules_swift to avoid BCR CI breakage on Windows with bazel 7...
  • be4c1c5 [subchannel] fix crash in connection scaling code (#41853)
  • a71df73 [Release] Bump version to 1.80.0-pre1 (on v1.80.x branch) (#41844)
  • 3ca09e4 [Python] Fix GRPC_TRACE and add test to check the GRPC_TRACE logs print (#41814)
  • 260c6fd [PHP] Disable php infinite recursion check for callback from Core to PHP (#41...
  • 50957c5 [Flakiness] Delete flaky iomgr fd_conservation_posix_test and create an Event...
  • e1e1d0a [Bzlmod] Turn off bzlmod for PSM python tests. (#41810)
  • Additional commits viewable in compare view

Updates grpcio-status from 1.78.0 to 1.80.0

Updates build from 1.4.2 to 1.5.0

Release notes

Sourced from build's releases.

1.5.0

What's Changed

Full Changelog: pypa/build@1.4.4...1.5.0

1.4.4

What's Changed

Full Changelog: pypa/build@1.4.3...1.4.4

1.4.3

What's Changed

... (truncated)

Changelog

Sourced from build's changelog.

#################### 1.5.0 (2026-04-30) ####################

Features

  • Drop Python 3.9 support - by :user:henryiii (:issue:1036)

Bugfixes

  • Make --ignore-installed opt-in from the API via fresh=True - by :user:henryiii (:issue:1056)

Miscellaneous

  • :issue:1033

#################### 1.4.4 (2026-04-22) ####################

Bugfixes

  • Fix release pipeline generating CHANGELOG.rst entries with inconsistent heading levels, which broke sphinx -W and pinned Read the Docs stable at 1.4.0 - by :user:gaborbernat. (:issue:1031)
  • Revert :pr:1039 from build 1.4.3, no longer check direct_url (for now) - by :user:henryiii (:issue:1039)
  • Add --ignore-installed to pip install command to prevent issues with packages already present in the isolated build environment - by :user:henryiii (:issue:1037) (:issue:1040)
  • Partial revert of :pr:973, keeping log messages in one entry, multiple lines. (:issue:1044)

Miscellaneous

  • :issue:1048, :issue:1049

#################### 1.4.3 (2026-04-10) ####################

Features

... (truncated)

Commits

Updates pre-commit from 4.5.1 to 4.6.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.0

Features

  • pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.0 - 2026-04-21

Features

  • pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.

Fixes

Commits
  • f35134b v4.6.0
  • 2a51ffc Merge pull request #3662 from pre-commit/hook-impl-optional-hook-dir
  • d7dee32 make --hook-dir optional for hook-impl
  • 965aeb1 Merge pull request #3661 from pre-commit/hook-impl-required
  • 2eacc06 --hook-type is required for hook-impl
  • f5678bf Merge pull request #3657 from pre-commit/pre-commit-ci-update-config
  • 054cc5b [pre-commit.ci] pre-commit autoupdate
  • 5c0f302 Merge pull request #3652 from pre-commit/pre-commit-ci-update-config
  • a5d9114 [pre-commit.ci] pre-commit autoupdate
  • 129a1f5 Merge pull request #3641 from pre-commit/mxr-patch-1
  • Additional commits viewable in compare view

Updates pytest from 9.0.2 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

    -- by aleguy02

Commits

Updates ruff from 0.15.7 to 0.15.12

Release notes

Sourced from ruff's releases.

0.15.12

Release Notes

Released on 2026-04-24.

Preview features

  • Implement #ruff:file-ignore file-level suppressions (#23599)
  • Implement #ruff:ignore logical-line suppressions (#23404)
  • Revert preview changes to displayed diagnostic severity in LSP (#24789)
  • [airflow] Implement task-branch-as-short-circuit (AIR004) (#23579)
  • [flake8-bugbear] Fix break/continue handling in loop-iterator-mutation (B909) (#24440)
  • [pylint] Fix PLC2701 for type parameter scopes (#24576)

Rule changes

  • [pandas-vet] Suggest .array as well in PD011 (#24805)

CLI

  • Respect default Unix permissions for cache files (#24794)

Documentation

  • [pylint] Fix PLR0124 description not to claim self-comparison always returns the same value (#24749)
  • [pyupgrade] Expand docs on reusable TypeVars and scoping (UP046) (#24153)
  • Improve rules table accessibility (#24711)

Contributors

Install ruff 0.15.12

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.12/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.12

Released on 2026-04-24.

Preview features

  • Implement #ruff:file-ignore file-level suppressions (#23599)
  • Implement #ruff:ignore logical-line suppressions (#23404)
  • Revert preview changes to displayed diagnostic severity in LSP (#24789)
  • [airflow] Implement task-branch-as-short-circuit (AIR004) (#23579)
  • [flake8-bugbear] Fix break/continue handling in loop-iterator-mutation (B909) (#24440)
  • [pylint] Fix PLC2701 for type parameter scopes (#24576)

Rule changes

  • [pandas-vet] Suggest .array as well in PD011 (#24805)

CLI

  • Respect default Unix permissions for cache files (#24794)

Documentation

  • [pylint] Fix PLR0124 description not to claim self-comparison always returns the same value (#24749)
  • [pyupgrade] Expand docs on reusable TypeVars and scoping (UP046) (#24153)
  • Improve rules table accessibility (#24711)

Contributors

0.15.11

Released on 2026-04-16.

Preview features

  • [ruff] Ignore RUF029 when function is decorated with asynccontextmanager (#24642)
  • [airflow] Implement airflow-xcom-pull-in-template-string (AIR201) (#23583)
  • [flake8-bandit] Fix S103 false positives and negatives in mask analysis (#24424)

... (truncated)

Commits
  • 66f93cf Bump 0.15.12 (#24815)
  • 476a4d0 [ty] Complete support for more detailed diagnostics on possibly unbound error...
  • ed669ea Implement #ruff:file-ignore file-level suppressions (#23599)
  • e73d952 [ty] Include inferred type in invalid-key concise diagnostic for union/inte...
  • 80feb29 [ty] report only dead annotation-only locals as unused (#24811)
  • 0fbf2bc Drop deprecated license classifier (#24808)
  • 43b174c [ty] Infer lambda parameter types with Callable type context (#24317)
  • 4f449ae [ty] Add error context for intersection types (#24772)
  • 5b4e753 [ty] Add support for goto in literal enum member inlay hint (#24792)
  • e7cc762 [ty] Add error context for TypedDict assignments (#24790)
  • Additional commits viewable in compare view

Updates mike from 2.1.4 to 2.2.0

Release notes

Sourced from mike's releases.

v2.2.0

New features

Bug fixes

  • Use DST timestamps for new commits when DST is in effect
  • Support ISO8601 and RFC 2822 values for GIT_COMMITTER_DATE
Changelog

Sourced from mike's changelog.

v2.2.0 (2026-04-13)

New features

Bug fixes

  • Use DST timestamps for new commits when DST is in effect
  • Support ISO8601 and RFC 2822 values for GIT_COMMITTER_DATE
Commits

Updates pyright from 1.1.408 to 1.1.409

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 1, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner May 1, 2026 03:50
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 1, 2026
@github-actions

github-actions Bot commented May 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🐳 Docker Image Built

A new Docker image has been built for this PR:

Image: australia-southeast1-docker.pkg.dev/cpg-common/images-dev/cpg_flow:01319b4a4713c639361bc405ea70bbd7837adc48

Pull command:

docker pull australia-southeast1-docker.pkg.dev/cpg-common/images-dev/cpg_flow:01319b4a4713c639361bc405ea70bbd7837adc48

🔗 View in Google Cloud Console

This comment was automatically generated by the Docker workflow.

@dependabot
dependabot Bot force-pushed the dependabot/uv/minor-and-patch-75e3446b1b branch from f90bd09 to 27da1de Compare May 4, 2026 00:25
@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 9…
01319b4 
… updates

Bumps the minor-and-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cpg-utils](https://github.com/populationgenomics/cpg-utils) | `5.6.0` | `5.6.1` |
| [grpcio](https://github.com/grpc/grpc) | `1.78.0` | `1.80.0` |
| [grpcio-status](https://grpc.io) | `1.78.0` | `1.80.0` |
| [build](https://github.com/pypa/build) | `1.4.2` | `1.5.0` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.5.1` | `4.6.0` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.2` | `9.0.3` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.7` | `0.15.12` |
| [mike](https://github.com/jimporter/mike) | `2.1.4` | `2.2.0` |
| [pyright](https://github.com/RobertCraigie/pyright-python) | `1.1.408` | `1.1.409` |



Updates `cpg-utils` from 5.6.0 to 5.6.1
- [Commits](https://github.com/populationgenomics/cpg-utils/commits)

Updates `grpcio` from 1.78.0 to 1.80.0
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.78.0...v1.80.0)

Updates `grpcio-status` from 1.78.0 to 1.80.0

Updates `build` from 1.4.2 to 1.5.0
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.4.2...1.5.0)

Updates `pre-commit` from 4.5.1 to 4.6.0
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.5.1...v4.6.0)

Updates `pytest` from 9.0.2 to 9.0.3
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.2...9.0.3)

Updates `ruff` from 0.15.7 to 0.15.12
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.7...0.15.12)

Updates `mike` from 2.1.4 to 2.2.0
- [Release notes](https://github.com/jimporter/mike/releases)
- [Changelog](https://github.com/jimporter/mike/blob/master/CHANGES.md)
- [Commits](jimporter/mike@v2.1.4...v2.2.0)

Updates `pyright` from 1.1.408 to 1.1.409
- [Release notes](https://github.com/RobertCraigie/pyright-python/releases)
- [Commits](RobertCraigie/pyright-python@v1.1.408...v1.1.409)

---
updated-dependencies:
- dependency-name: build
  dependency-version: 1.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: cpg-utils
  dependency-version: 5.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: grpcio
  dependency-version: 1.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: grpcio-status
  dependency-version: 1.80.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mike
  dependency-version: 2.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pre-commit
  dependency-version: 4.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pyright
  dependency-version: 1.1.409
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pytest
  dependency-version: 9.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: ruff
  dependency-version: 0.15.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/minor-and-patch-75e3446b1b branch from 27da1de to 01319b4 Compare May 5, 2026 01:38
@github-actions

github-actions Bot commented May 5, 2026

Copy link
Copy Markdown
Contributor

Vulnerability Audit

Found 27 vulnerabilities across 14 packages.
21 actionable now, 2 blocked, 4 in dev-only paths.

Actionable now — bump via uv.lock

Package Current → Fix CVEs Path
aiohttp 3.13.3 → 3.13.4 CVE-2026-34514, CVE-2026-34517, CVE-2026-34520, CVE-2026-34518, CVE-2026-34525, CVE-2026-34513, CVE-2026-34516, CVE-2026-34519, CVE-2026-34515, CVE-2026-22815 hail → aiohttp
azure-core 1.37.0 → 1.38.0 CVE-2026-21226 hail → azure-identity → azure-core
cryptography 46.0.3 → 46.0.7 CVE-2026-34073, CVE-2026-39892, CVE-2026-26007 hail → azure-identity → cryptography
orjson 3.11.5 → 3.11.6 CVE-2025-67221 hail → orjson
pillow 12.1.0 → 12.2.0 CVE-2026-25990, CVE-2026-40192 hail → bokeh → pillow
pyasn1 0.6.1 → 0.6.3 CVE-2026-23490, CVE-2026-30922 cpg-utils → google-auth → pyasn1-modules → pyasn1
pyjwt 2.10.1 → 2.12.0 CVE-2026-32597 hail → azure-identity → msal → pyjwt
requests 2.32.5 → 2.33.0 CVE-2026-25645 cpg-utils → requests
One-shot fix command 
uv lock \
  --upgrade-package aiohttp \
  --upgrade-package azure-core \
  --upgrade-package cryptography \
  --upgrade-package orjson \
  --upgrade-package pillow \
  --upgrade-package pyasn1 \
  --upgrade-package pyjwt \
  --upgrade-package requests

Blocked upstream — needs a fix in a parent package

Package Current → Fix CVEs Blocked by
bokeh 3.4.3 → 3.8.2 CVE-2026-21883 hail==0.2.137 pins <3.5,>=3
urllib3 2.6.2 → 2.6.3 CVE-2026-21441 botocore==1.42.23 pins <1.27,>=1.25.4

Dev-only — not in production image

Package Current → Fix CVEs Path
filelock 3.20.2 → 3.20.3 CVE-2026-22701 pre-commit → virtualenv → filelock
jaraco-context 6.0.2 → 6.1.0 CVE-2026-23949 twine → keyring → jaraco-context
pygments 2.19.2 → 2.20.0 CVE-2026-4539 mkdocs-material → pygments
virtualenv 20.35.4 → 20.36.1 CVE-2026-22702 pre-commit → virtualenv

@dependabot @github

dependabot Bot commented on behalf of github May 5, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 5, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/minor-and-patch-75e3446b1b branch May 5, 2026 03:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants