Skip to content

chore(deps)(deps): bump the all-dependencies group across 1 directory with 9 updates - #265

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/all-dependencies-c80f26fb76
Open

chore(deps)(deps): bump the all-dependencies group across 1 directory with 9 updates#265
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/all-dependencies-c80f26fb76

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 9 updates in the / directory:

Package From To
coverage 7.15.4 7.16.0
hypothesis 6.165.10 6.168.0
import-linter 2.13 2.15
ruff 0.16.4 0.16.6
types-pyyaml 6.0.12.20260815 6.0.12.20260906
anyio 4.14.2 4.15.1
mcp 1.29.1 1.30.0
huggingface-hub 1.29.0 1.30.0
pebble 5.2.1 5.2.2

Updates coverage from 7.15.4 to 7.16.0

Release notes

Sourced from coverage's releases.

7.16.0

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
  • The Coverage.switch_context() method now returns the previous context.
  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
  • Fixes to validation of options and configuration settings:
    • Negative precision settings now always cause useful error messages (pull 2261).
    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

Changelog

Sourced from coverage's changelog.

Version 7.16.0 — 2026-08-28

  • When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

  • The :meth:.Coverage.switch_context method now returns the previous context.

  • Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

  • Fixes to validation of options and configuration settings:

    • Negative precision settings now always cause useful error messages (pull 2261_).

    • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

    • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

    • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with "Can't combine statement coverage data with branch data". Each named concurrency library is now properly considered (pull 2270_).

  • Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265_).

.. _pull 2261: coveragepy/coveragepy#2261 .. _pull 2262: coveragepy/coveragepy#2262 .. _pull 2263: coveragepy/coveragepy#2263 .. _pull 2265: coveragepy/coveragepy#2265 .. _issue 2266: coveragepy/coveragepy#2266 .. _pull 2268: coveragepy/coveragepy#2268

... (truncated)

Commits
  • 3e9fc16 docs: prep for 7.16.0
  • 38be8d1 build: control check-manifest explicitly
  • 8eb1266 docs(build): no longer commit sample_html
  • 1a8b3fa docs: remove sample_html
  • aeaa79b docs: linklint is now sphinx-linklint
  • d5eaf3f test: a branchless way to re-add extensions
  • 57e52fd docs: adjust CHANGES for #2270
  • b9d304d fix: check for multiprocessing in a --concurrency list (#2270)
  • a6ef928 chore: make upgrade
  • 070461f chore: bump the action-dependencies group with 4 updates (#2271)
  • Additional commits viewable in compare view

Updates hypothesis from 6.165.10 to 6.168.0

Commits
  • cd434f2 Bump hypothesis version to 6.168.0 and update changelog
  • 3187fb9 Merge pull request #4868 from Zac-HD/claude/hypothesis-datetime-strategy-ajzai0
  • a60dc77 Reduce rate of tricky datetimes
  • 67e5c04 Merge pull request #4875 from HypothesisWorks/create-pull-request/patch
  • ecaed93 Merge remote-tracking branch 'upstream/master' into plait/review-hypothesis-4868
  • 116ef84 Probe backwards for bound windows before the scan range
  • ef17651 Bound the cache of probed timezone transitions
  • 6b35510 Skip transition probing for fixed-offset timezones
  • 26df9dd Simplify clamping of tricky-draw windows
  • 6e9b745 Extract a _draw_ordinary_datetime helper
  • Additional commits viewable in compare view

Updates import-linter from 2.13 to 2.15

Changelog

Sourced from import-linter's changelog.

2.15 (2026-09-04)

  • Add support for lazy imports to the explore UI and drawgraph command.

2.14 (2026-08-28)

  • Add broken_contract_guidance option to contracts, for explaining how to fix them when they're broken.
  • Add TextField for multi-line text configuration values.
  • Show the count of ignored imports next to a contract's result.
  • Add --no-logo option to hide the logo in terminal output.
Commits

Updates ruff from 0.16.4 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Commits

Updates types-pyyaml from 6.0.12.20260815 to 6.0.12.20260906

Commits

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

  • Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

  • Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

    • follow_symlinks on exists() (Python 3.12+)
    • follow_symlinks on is_dir() (Python 3.13+)
    • follow_symlinks on is_file() (Python 3.13+)
    • follow_symlinks on owner() (Python 3.13+)
    • follow_symlinks on group() (Python 3.13+)
    • newline on read_text() (Python 3.13+)

    (#1286, #1293; PR by @​jaideeppyne)

  • Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

  • Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

  • Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

  • Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

  • Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

  • Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

  • Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

  • Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

  • Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

  • Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

  • Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

  • Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

  • Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

  • Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

  • Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

  • Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

  • Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

  • Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits
  • ffcd154 Bumped up the version
  • 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
  • 9283662 Bumped up the version
  • d137692 Improved the instructions for AI agents
  • 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
  • 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
  • b825c3b Fixed pyproject.toml changes not triggering the test suite
  • 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
  • b05fe6d Fixed wrong type in move_on_after (#1297)
  • 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
  • Additional commits viewable in compare view

Updates mcp from 1.29.1 to 1.30.0

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

  • streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
  • A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
  • The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
  • OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

  • A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
  • Clients that keep the GET stream open (the SDK's client does) are not affected.
  • A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
  • To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

  • Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
  • Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
  • If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

  • ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
  • AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
  • Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

  • AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
  • issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
  • session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

Commits
  • 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
  • 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
  • 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
  • 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
  • 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
  • See full diff in compare view

Updates huggingface-hub from 1.29.0 to 1.30.0

Release notes

Sourced from huggingface-hub's releases.

[v1.30.0] Scheduled job filters, repo-aware revision pinning and more

🖥️ hf jobs scheduled ls can now filter by status, label and name

You can now filter scheduled jobs with --status (active/suspended), repeatable -l/--label key=value and --name (a shortcut for --label name=NAME), matching the flags hf jobs ls already had. On the Python side, HfApi.list_scheduled_jobs gains a labels argument.

[!WARNING] -f/--filter on hf jobs scheduled ls is deprecated and no longer applied: it is accepted but ignored, with a warning pointing to the new flags. Migrate as shown below. The option itself will be removed in a future release.

hf jobs scheduled ls --all
hf jobs scheduled ls --status suspended
hf jobs scheduled ls --name hourly-task --label env=prod
before after
-f name=daily-report --name daily-report
-f env=prod --label env=prod
-f suspend!=true (default, or --status active)
-f suspend=true --status suspended

📚 Documentation: Jobs guide

  • Align hf jobs scheduled ls filtering with hf jobs ls (--status/--label/--name) by @​moon-bot-app[bot] in #4773

🔖 ResolvedRevision now pins the repo it was resolved for

ResolvedRevision didn't record which repo a commit hash was resolved against, so resolving "main" on two different repos returned the same commit oid. It now remembers its repo_id and repo_type: passed back for the same repo it is returned as is, for a different repo the requested revision is resolved again.

>>> from huggingface_hub import resolve_revision
>>> revision = resolve_revision("openai-community/gpt2")
Same repo => returned as is
>>> resolve_revision("openai-community/gpt2", revision=revision) is revision
True
Another repo => "main" is resolved again for that repo
>>> resolve_revision("openai-community/gpt2-medium", revision=revision).resolved
'6dcaa7a952f72f9298047fd5137cd6e4f05f41da'

📚 Documentation: Manage cache — Pin a revision

  • [Download] A ResolvedRevision only pins the repo it was resolved for by @​Wauplin in #4767

🤖 Inference

  • Do not require the conversational tag for chat-completion on hf-inference: any model with pipeline tag text-generation or image-text-to-text can now be served, mirroring the updated provider-side rules by @​hanouticelina in #4784

... (truncated)

Commits
  • 48ef278 Release: v1.30.0
  • a073ecb Release: v1.30.0.rc0
  • b84090b [Release] Consolidate the HF CLI skill sync into the release workflow (#4765)
  • 176d4f3 [CI] Disable auto close (#4800)
  • f0a5c6d [Inference Providers] Do not require the conversational tag for chat-completi...
  • 6a2eb09 [Sandbox] Document experimental status (#4783)
  • 94cb25d [CI] Fix torch_1.11 case-arm label to match renamed matrix entry (#4776)
  • 4cc16bc [Download] A ResolvedRevision only pins the repo it was resolved for (#4767)
  • 1de4817 [Download] Follow redirects between Hub hosts when resolving files (#4739)
  • 97655e8 Align hf jobs scheduled ls filtering with hf jobs ls (--status/`--label...
  • Additional commits viewable in compare view

Updates pebble from 5.2.1 to 5.2.2

Commits
  • e9b3a79 build: release 5.2.2
  • 5833275 chore: add CONTRIBUTING.md file
  • 82bd19e fix(build): fix version string parsing
  • 85553cd fix(pool): fix map signature with proper type hints
  • 4392d7b fix(pool): fix type hints within Pool's with statement
  • fecf809 build(hooks): add .pre-commit-config.yaml config file
  • a917add style(ruff): format using ruff's Black formatter
  • e2d17d6 fix(README): fix build badge in README
  • 718a598 fix(actions): store build artifacts in build workflow
  • afa8aff fix(tests): exclude non-GIL on win and mac
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): bump the all-dependencies group across 1 directory…
28b6ea7 
… with 9 updates

Bumps the all-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.4` | `7.16.0` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.165.10` | `6.168.0` |
| [import-linter](https://github.com/seddonym/import-linter) | `2.13` | `2.15` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.4` | `0.16.6` |
| [types-pyyaml](https://github.com/python/typeshed) | `6.0.12.20260815` | `6.0.12.20260906` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.29.1` | `1.30.0` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.29.0` | `1.30.0` |
| [pebble](https://github.com/noxdafox/pebble) | `5.2.1` | `5.2.2` |



Updates `coverage` from 7.15.4 to 7.16.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.4...7.16.0)

Updates `hypothesis` from 6.165.10 to 6.168.0
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.165.10...v6.168.0)

Updates `import-linter` from 2.13 to 2.15
- [Changelog](https://github.com/seddonym/import-linter/blob/main/docs/release_notes.md)
- [Commits](seddonym/import-linter@v2.13...v2.15)

Updates `ruff` from 0.16.4 to 0.16.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.4...0.16.6)

Updates `types-pyyaml` from 6.0.12.20260815 to 6.0.12.20260906
- [Commits](https://github.com/python/typeshed/commits)

Updates `anyio` from 4.14.2 to 4.15.1
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.2...4.15.1)

Updates `mcp` from 1.29.1 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.29.1...v1.30.0)

Updates `huggingface-hub` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.29.0...v1.30.0)

Updates `pebble` from 5.2.1 to 5.2.2
- [Release notes](https://github.com/noxdafox/pebble/releases)
- [Commits](noxdafox/pebble@5.2.1...5.2.2)

---
updated-dependencies:
- dependency-name: coverage
  dependency-version: 7.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: hypothesis
  dependency-version: 6.168.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: import-linter
  dependency-version: '2.15'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: ruff
  dependency-version: 0.16.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20260906
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: anyio
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: mcp
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: huggingface-hub
  dependency-version: 1.30.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: pebble
  dependency-version: 5.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 12, 2026
@github-actions

github-actions Bot commented Sep 12, 2026

Copy link
Copy Markdown
Contributor

diffctx review context

Range f79fb9abece0e3485a6569ebfff364983db0d3fe..28b6ea7a9afb8e584d22dec81f1fb07ae332de81 — 18 tokens (o200k_base), 0 fragments across 0 changed files. Empty: false.

Review this instead of the raw diff: download the context (artifact diffctx-review-context, 14 days).

Changed files as diffctx lists them (omitted = no fragment fit)

@sonarqubecloud

sonarqubecloud Bot commented Sep 12, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] approved these changes

Assignees

@nikolay-e nikolay-e

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nikolay-e