Skip to content

fix: bump the uv group across 1 directory with 6 updates - #2611

Merged
groupthinking merged 1 commit into
mainfrom
dependabot/uv/uv-5d9ef4a7c0
Nov 6, 2026
Merged

fix: bump the uv group across 1 directory with 6 updates#2611
groupthinking merged 1 commit into
mainfrom
dependabot/uv/uv-5d9ef4a7c0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 6 updates in the / directory:

Package From To
aiohttp 3.14.3 3.14.4
gitpython 3.1.62 3.2.1
filelock 3.32.2 4.2.1
oauthlib 3.3.1 4.0.1
pyasn1 0.6.4 0.6.5
tornado 6.5.8 6.6

Updates aiohttp from 3.14.3 to 3.14.4
Updates gitpython from 3.1.62 to 3.2.1

Release notes

Sourced from gitpython's releases.

3.2.1

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.2.0...3.2.1

3.2.0 - Security

What's Changed

... (truncated)

Changelog

Sourced from gitpython's changelog.

3.2.1

Security fixes for

If you can, also try and provide feedback on the upcoming v4 branch gitpython-developers/GitPython#2274 - patches welcome.

See the following for all changes. https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1

3.2.0

Drops support for Python 3.7 (5 years after its EOL).

Security fixes for

If you can, also try and provide feedback on the upcoming v4 branch gitpython-developers/GitPython#2274 - patches welcome.

See the following for all changes. https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0

Commits
  • c179357 prepare changelog prior to release
  • 97eadb8 fix(submodule): validate destinations before mutation
  • 6a7180a prepare for next release, v3.2
  • 0b64501 refactor(db): deprecate the pure-Python GitDB backend
  • 9349ff5 fix(repo): preserve literal separate Git directory paths
  • 8290c98 fix: bound actor and date parsing
  • 9ad28cc fix: complete safety checks in Git command wrappers
  • ce2093b bump minor version to indicate drop of python 3.7 support
  • dafafff Merge pull request #2247 from gitpython-developers/pos-arg-sanitization
  • 790bb31 fix(remote): reject option-shaped pull operands
  • Additional commits viewable in compare view

Updates filelock from 3.32.2 to 4.2.1

Release notes

Sourced from filelock's releases.

4.2.1

Security

This release fixes the following vulnerabilities:

  • CVE-2026-112940 (high): ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files.
  • CVE-2026-112906 (medium): SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse.
  • CVE-2026-112908 (medium): StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold.
  • CVE-2026-112909 (medium): UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path.
  • CVE-2026-112910 (medium): WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL.
  • CVE-2026-112911 (medium): StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion.
  • CVE-2026-112914 (medium): SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory.
  • CVE-2026-112915 (medium): ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout.
  • CVE-2026-112934 (medium): SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record.
  • CVE-2026-112935 (medium): SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders.
  • CVE-2026-112937 (medium): ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name.
  • CVE-2026-112938 (medium): StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses.
  • CVE-2026-112939 (medium): SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker.
  • CVE-2026-112907 (low): On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break.
  • CVE-2026-112912 (low): Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker.
  • CVE-2026-112913 (low): ReadWriteLock on Windows acts on SQLite side files another local user places beside its database.
  • CVE-2026-112941 (low): SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock.

Bug fixes

  • On a singleton wrapper, AsyncReadWriteLock.close() and AsyncSoftReadWriteLock.close() end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. #832 by @​gaborbernat.
  • ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an AsyncFileLock call joins its queue no longer blocks every later call on that lock. #833 by @​gaborbernat.
  • Fix ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database in a directory other accounts cannot write, such as one under %LOCALAPPDATA%. The lock removes link directories through a checked descriptor rather than by name, reads a link directory's name only when the locking account owns it, and leaves alone a directory with other content renamed onto a link directory's name. A database whose schema takes more than a few kilobytes to load raises ValueError instead of running past the acquire timeout. #834 by @​gaborbernat.
  • Fix five bugs in opening the lock file. UnixFileLock no longer truncates a file it did not create, such as one renamed to the lock path, and no longer applies mode to it. An on_acquired hook that writes holder metadata now truncates the file itself. A lease (Linux) or an oplock (Windows) on the lock file or a soft lock's marker no longer holds acquire() past its timeout or blocking=False, and an oplock no longer holds release(); ReadWriteLock on Windows waits for its timeout and raises Timeout. On Windows, a mode without group and other bits, such as 0o600, now creates the lock file with an owner-only permission list; the ReadWriteLock database gets the same. The soft locks' writability check no longer follows a symlink swapped in at the lock path. On a filesystem without flock, a contender from another account now waits on a marker it cannot write instead of raising PermissionError. #835 by @​gaborbernat.
  • Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing a live holder's marker in three cases: the holder and the contender run in Linux time namespaces with different boottime offsets; only one of them can read the boot id; a process other than the owner rewrote the marker. Soft markers no longer carry group or other write bits. A process name containing a carriage return or another line separator no longer makes the stale check raise ValueError. When /proc/self/ns/time exists but cannot be read, the stale check no longer compares start times and keeps the marker. #836 by @​gaborbernat.
  • The async read-write locks record their hold under a task owner, so synchronous code on the executor thread that took the hold can no longer re-enter or release it. AsyncSoftReadWriteLock gives back one level on release, so synchronous readers of a shared singleton keep theirs. SoftReadWriteLock tracks read levels per thread: release() from a thread that holds none raises RuntimeError. After its heartbeat recorded a lost hold, it refuses new acquires until that hold is released. #838 by @​gaborbernat.
  • StrictSoftFileLock creates <path>.filelock and its claims directory with the lock's mode and sets the sticky bit (a directory flag that lets only a file's owner remove it) on both. On the next acquisition it narrows a directory it owns that an earlier release created wider; it leaves a directory of another account as it is, so remove such leftovers by hand. It reaches claims through a descriptor opened without following symlinks; on Windows it holds both directories open and refuses a junction (a directory that points at another directory). Under a sticky parent such as /tmp it refuses a coordination directory of another account, as SoftReadWriteLock does for <path>.rw. One read grace now covers a whole claim scan, a failed claim cleanup no longer leaves the sentinel descriptor open, and a non-regular node at a sentinel private-record name raises SoftFileLockProtocolError. On Windows, contenders read claims without blocking their owner's unlink. #839 by @​gaborbernat.
  • Fix a lock reporting a hold the OS had dropped after a signal handler raised during acquire or release. A release that a signal handler cuts short after it has started now completes before the error propagates. A handler that acquires the lock its own thread is releasing now gets RuntimeError instead of a hold that stays held. The singleton cache no longer hands out an is_singleton=True lock or a ReadWriteLock whose finalizer is running, which released the new holder's lock. A signal during os.fork() no longer leaves the other threads blocked in their next lock call, and a fork from another thread no longer waits for a ReadWriteLock acquire on a busy database. #840 by @​gaborbernat.
  • Fix a lock on a relative path locking a file in the directory the process changed to while the lock waited, and leaving its marker behind on release after such a change. The path resolved when an acquisition starts stays in use until the hold ends. An is_singleton=True lookup no longer returns a cached lock whose relative path now resolves to another file; a held lock still matches the file it holds. A rename of the lock's directory during a hold no longer leaves the marker behind or reports a false lease compromise, and a waiter no longer creates a second lock file in a directory that was renamed away. #841 by @​gaborbernat.
  • SoftReadWriteLock reaches its records through descriptors of <path>.rw and gen or holders opened without following symlinks. On Windows it holds those directories open and refuses a junction (a directory that points at another directory). A tree swapped in after an earlier acquire therefore cannot redirect them. Its heartbeat rewrites a holder record only when the name still leads to the file it created, and does not block on a FIFO (a named pipe). A heartbeat that finds <path>.rw replaced by a symlink or junction reports the hold lost instead of ending the heartbeat thread. A live lock object repeats the ownership check whenever the tree it opens is not the one it prepared. #842 by @​gaborbernat.
  • Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing or displacing a live holder's marker in five cases. ext4 gave a freed inode number to the next marker. A stalled FileLock removed its ENOSYS placeholder after a peer replaced it. A failed acquire cleaned up after a successor took the path. A stale break left the lock path empty while it checked the marker it had moved. A lifetime break judged a marker by a reused inode number. On Linux and macOS a stale marker now changes hands in one atomic exchange. On other platforms without one, except Windows, including NFS and SMB, the marker stays in place and waits for timeout or break_lock(). Restoring a marker no longer follows a symlink found under the break name. A holder that releases while a peer's exchange has its marker aside leaves a record no lock parses, so the put-back lands a marker that ages out. A lease heartbeat that finds another file at the lock path once, while a peer's break has its marker aside, waits for the next refresh before it reports a compromise. A contender that finds a dead breaker's marker puts back the marker that breaker left under its break name. A marker is the breaker's own only when it names the breaker's process on this host; the same process number on another host is a holder. A contender takes a stranded marker under a name of its own before it puts the marker back, so two contenders no longer reverse each other's exchange and remove the live holder's marker. A claim left behind by a failed put-back is retried on the next poll. #843 by @​gaborbernat.
  • Canceling an AsyncReadWriteLock or AsyncSoftReadWriteLock acquire that waits for another process now stops the wait and raises the cancellation. It used to wait until that process released, or raise Timeout. A thread_local=True AsyncFileLock that threads with their own event loops share no longer deadlocks when one thread waits for the lock while another holds it. #844 by @​gaborbernat.
  • SoftReadWriteLock refuses a commit that lands a whole retention window behind the log, so two committers stalled at adjacent generations can no longer admit a second writer. Its stale check samples the clock before it reads a holder record, so a pause between the two no longer counts as time the record stayed unchanged. #845 by @​gaborbernat.
  • Fix a SoftFileLock contender evicting an empty marker after two seconds while its owner held the lock. The owner is a SoftFileLock before 3.22, which writes nothing into its marker, or a current one still writing its record. An empty marker now reads as held, and timeout, lifetime or break_lock() clears it. A contender that finds an empty marker a dead breaker left aside puts it back instead of removing it. #846 by @​gaborbernat.
  • Fix ReadWriteLock on Windows acting on -journal and -wal files another account places beside its database: an acquire could fail with OperationalError, or SQLite could replay the journal and delete the file it names. The lock now reads the database directory's access control list. Where an account other than the locking account, SYSTEM and Administrators can add or remove names, SQLite opens a hard link inside a directory only those accounts can write. A filesystem without hard links raises OSError. #854 by @​gaborbernat.
  • Fix SoftReadWriteLock subclasses sharing singleton instances with the base class or sibling subclasses. Each concrete class now keeps its own cache and construction guard, including after fork, while preserving cooperative class-definition keywords. #855 by @​AryanRG.

New Contributors

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-9:

4.2.9 (2026-11-04)

.. _release-4-2-9-fixed:

Fixed

  • :class:~filelock.ReadWriteLock, :class:~filelock.SoftReadWriteLock and their async wrappers now raise :class:TypeError for a blocking that is not a :class:bool, in the constructor and on acquire, as :class:~filelock.FileLock already does. Before, blocking=0 waited out the full timeout on a contended :class:~filelock.ReadWriteLock while blocking=False failed at once, and a truthy value such as "false" turned a single attempt into a blocking wait (:pr:908) by :user:abhishekcpp007 and :user:gaborbernat.

.. _release-4-2-8:

4.2.8 (2026-11-04)

.. _release-4-2-8-documentation:

Documentation

  • Clarify the platform-specific locking primitive and range used by descriptor locks, and correct the guidance on interoperating with byte-range lock protocols such as conda's repodata lock (:pr:905) by :user:boyfeiyu.

.. _release-4-2-7:

4.2.7 (2026-11-02)

.. _release-4-2-7-fixed:

Fixed

... (truncated)

Commits
  • 60331bb Release 4.2.1
  • 834bf13 🧪 test(soft): skip Unix pin test on Windows
  • 9d15e38 fix(soft-rw): isolate subclass singleton registries (#855)
  • e1e825b 🐛 fix(open): keep lock files intact, honor deadlines and mode (#835)
  • 5e3f2ec 🐛 fix(read-write): keep SQLite off shared names, bound schema (#834)
  • bfa066d 🐛 fix(strict): keep claim directories private to the lock (#839)
  • 977d2c3 🐛 fix(soft): wait on an empty marker instead of evicting (#846)
  • 740ff66 🐛 fix(soft): break stale markers without emptying the lock path (#843)
  • 86c6d5f 🐛 fix(async): honor cancellation and per-thread gates (#844)
  • eeceaa8 🐛 fix(soft): keep live holders when owner identity differs (#836)
  • Additional commits viewable in compare view

Updates oauthlib from 3.3.1 to 4.0.1

Release notes

Sourced from oauthlib's releases.

4.0.1

Security

  • CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token endpoint did not validate the device_code parameter. A request with a known client_id and a bogus device_code could obtain a bearer token. DeviceCodeGrant.validate_token_request now calls DeviceCodeGrant.validate_device_code(), which rejects missing or unknown device codes (invalid_request / invalid_grant) and delegates the code's authorization status to the new RequestValidator.validate_device_code() hook, per RFC 8628 Section 3.5. (cherry-picked from #954)

Upgrade note for device flow integrators

Custom RequestValidator implementations using the device flow must now implement validate_device_code(client_id, code, request). Return one of the DeviceCodeGrant.DEVICE_CODE_* statuses for known codes, or None for an unknown code. When returning AUTHORIZED, the validator must also populate request.user and request.scopes from the stored authorization.

4.0.0

Introduction

The release 4.0.0 defines the foundation that enables AI contributions and will improve the maintenance of oauthlib by using AI agents, skills, code for both contributors and maintainers. It includes devcontainer, skills and cleanup of instructions.

What's Changed

Important: this release contains 2 breaking changes. See CHANGELOG.rst for details:

  • Removed JSONP support from token revocation endpoint (#951)
  • Client authentication validation reorganized across grants (#919, #920): the grant_type parameter is now validated before client authentication.

New Contributors

Full Changelog: oauthlib/oauthlib@v3.3.1...v4.0.0

Changelog

Sourced from oauthlib's changelog.

4.0.1 (2026-11-04):

OAuth2.0 Provider (Security):

  • Security: CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token endpoint did not validate the device_code parameter. A request with a known client_id and a bogus device_code could obtain a bearer token. DeviceCodeGrant.validate_token_request now calls a new DeviceCodeGrant.validate_device_code() which rejects missing or unknown device codes (400 invalid_request / 400 invalid_grant) and delegates the code's authorization status to a new required RequestValidator.validate_device_code() hook, per RFC 8628 Section 3.5. (cherry-picked from #954, merged as 1c91d64)

    Upgrade note for device flow integrators: custom RequestValidator implementations using the device flow must now implement validate_device_code(client_id, code, request). Return one of the DeviceCodeGrant.DEVICE_CODE_* statuses (AUTHORIZED, PENDING, SLOW_DOWN or EXPIRED) for known codes, or None for an unknown code. When returning AUTHORIZED, the validator must also populate request.user and request.scopes from the stored authorization.

4.0.0 (2026-09-28):

OAuth2.0 Provider:

  • Breaking: #951: Removed JSONP support from token revocation endpoint. JSONP has been superseded by CORS for cross-origin requests. The enable_jsonp parameter has been removed from RevocationEndpoint and the callback parameter has been removed from prepare_token_revocation_request.
  • Breaking: #919, #920: Fixed DeviceCodeGrant.validate_token_request trying to authenticate public clients. Client authentication validation has been reorganized and is now shared across AuthorizationCodeGrant, DeviceCodeGrant, RefreshTokenGrant and ResourceOwnerPasswordCredentialsGrant: the grant_type parameter is validated before client authentication, so requests missing grant_type now return 400 invalid_request instead of 401 invalid_client.
  • #963: Improved PKCE code comparison

Misc:

  • #904: Stop installing examples into site-packages.
  • #930: Add devcontainer, Add Python3.14, Python3.14t.
  • #931: Fix ruff checks about unused variables.
  • #932: Dropped EOL Python 3.8 from CI.
  • #934: Pre-commit hooks autoupdate.
  • #938: Fix typos discovered by typos.
  • Add OAuthLib Maintainer agent for automated issue/PR triage and release management.
Commits
  • 6e3aa05 Release 4.0.1: fix CVE-2026-49272 (device_code validation in device flow)
  • 77a5f1c Merge pull request #954 from hekhuisk/improve-device-workflow
  • 145a9a4 Release 4.0.0: clarify changelog breaking changes and reformat entries
  • c8344d6 Update CHANGELOG.rst
  • e172830 Release 4.0.0: bump version to 4.0.0 and update changelog
  • 40b0ab5 Merge pull request #963 from oauthlib/ft/pkcecode
  • 1b68cea Merge pull request #920 from hekhuisk/validate-client-authentication
  • c951a1d Organized validate_client functions for all grant to avoid mistake in grnat i...
  • 74664d3 Improve PKCE code comparison
  • 9859b05 Merge pull request #950 from oauthlib/feature/3.4.0-maintainer-agent
  • Additional commits viewable in compare view

Updates pyasn1 from 0.6.4 to 0.6.5

Release notes

Sourced from pyasn1's releases.

Release 0.6.5

Revision 0.6.5, released 26-10-2026

  • GHSA-mm57-4v3p-rchx: Decoded binary REAL mantissas in linear time instead of repeatedly shifting a growing integer and slicing the remaining bytes (thanks for reporting, manus-use, manus-pi, ucsurf, adriank31)
  • GHSA-2qm8-x737-gmw5: Reassembled constructed BIT STRING fragments in linear time while preserving their decoded bit values, including intermediate fragment padding (thanks for reporting, manus-use)
  • GHSA-9m75-vc3g-4x39: Reassembled constructed OCTET STRING and character-string fragments and indefinite-length ANY content in linear time. Nested constructed OCTET STRING fragments now contribute their decoded octets (thanks for reporting, alimony, manus-pi, adriank31)
  • GHSA-fm9c-5rcf-2q5p: Bounded schemaless container type tracking after two distinct tag sets to prevent quadratic CPU use from colliding long tag IDs (thanks for reporting, droideck)
Changelog

Sourced from pyasn1's changelog.

Revision 0.6.5, released 26-10-2026

  • GHSA-mm57-4v3p-rchx: Decoded binary REAL mantissas in linear time instead of repeatedly shifting a growing integer and slicing the remaining bytes (thanks for reporting, manus-use, manus-pi, ucsurf, adriank31)
  • GHSA-2qm8-x737-gmw5: Reassembled constructed BIT STRING fragments in linear time while preserving their decoded bit values, including intermediate fragment padding (thanks for reporting, manus-use)
  • GHSA-9m75-vc3g-4x39: Reassembled constructed OCTET STRING and character-string fragments and indefinite-length ANY content in linear time. Nested constructed OCTET STRING fragments now contribute their decoded octets (thanks for reporting, alimony, manus-pi, adriank31)
  • GHSA-fm9c-5rcf-2q5p: Bounded schemaless container type tracking after two distinct tag sets to prevent quadratic CPU use from colliding long tag IDs (thanks for reporting, droideck)
Commits
  • 5d16736 Prepare release 0.6.5
  • a36e3a3 Fix quadratic CPU use in schemaless container decoding
  • 4ce0079 Remove quadratic constructed OCTET STRING and ANY reassembly
  • 73ba7b0 Remove quadratic constructed BIT STRING reassembly
  • ce3ec33 Remove quadratic binary REAL mantissa decoding
  • See full diff in compare view

Updates tornado from 6.5.8 to 6.6

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.6.0 releases/v6.5.10 releases/v6.5.9 releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2

... (truncated)

Commits
  • e2b0f45 Merge pull request #3831 from bdarnell/final-6.6
  • 90c4e3f Version bump for 6.6 final release
  • ec17353 Merge pull request #3828 from bdarnell/downstream-ci-66
  • 15f66b0 ci: Add explicit read permission to CI jobs
  • 4446441 ci: Run the downstream testbed on a wheel built in the same run
  • c2e24d2 Merge pull request #3823 from bdarnell/claude/project-thread-uzh2s8
  • c2d8884 test: Add pre-6.3 security fixes to the corpus
  • de32687 test: Add a regression corpus of past security fixes
  • 7848790 maint: Add pre-tag checks and release instructions
  • f14321e ci: Compare benchmarks with the base branch on every PR
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
fix: bump the uv group across 1 directory with 6 updates
8e0a99a 
Bumps the uv group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.14.3` | `3.14.4` |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.62` | `3.2.1` |
| [filelock](https://github.com/tox-dev/filelock) | `3.32.2` | `4.2.1` |
| [oauthlib](https://github.com/oauthlib/oauthlib) | `3.3.1` | `4.0.1` |
| [pyasn1](https://github.com/pyasn1/pyasn1) | `0.6.4` | `0.6.5` |
| [tornado](https://github.com/tornadoweb/tornado) | `6.5.8` | `6.6` |



Updates `aiohttp` from 3.14.3 to 3.14.4

Updates `gitpython` from 3.1.62 to 3.2.1
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/doc/source/changes.rst)
- [Commits](gitpython-developers/GitPython@3.1.62...3.2.1)

Updates `filelock` from 3.32.2 to 4.2.1
- [Release notes](https://github.com/tox-dev/filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.2...4.2.1)

Updates `oauthlib` from 3.3.1 to 4.0.1
- [Release notes](https://github.com/oauthlib/oauthlib/releases)
- [Changelog](https://github.com/oauthlib/oauthlib/blob/v4.0.1/CHANGELOG.rst)
- [Commits](oauthlib/oauthlib@v3.3.1...v4.0.1)

Updates `pyasn1` from 0.6.4 to 0.6.5
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.4...v0.6.5)

Updates `tornado` from 6.5.8 to 6.6
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.8...v6.6.0)

---
updated-dependencies:
- dependency-name: aiohttp
  dependency-version: 3.14.4
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: gitpython
  dependency-version: 3.2.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: filelock
  dependency-version: 4.2.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: oauthlib
  dependency-version: 4.0.1
  dependency-type: indirect
  dependency-group: uv
- dependency-name: pyasn1
  dependency-version: 0.6.5
  dependency-type: indirect
  dependency-group: uv
- dependency-name: tornado
  dependency-version: '6.6'
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from groupthinking as a code owner November 5, 2026 23:05
@vercel

vercel Bot commented Nov 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
v0-uvai Ready Ready Preview, v0 Nov 5, 2026 11:06pm UTC

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 5, 2026
@coderabbitai

coderabbitai Bot commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@github-actions

github-actions Bot commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
pip/aiohttp 3.14.4 UnknownUnknown
pip/filelock 4.2.1 UnknownUnknown
pip/gitpython 3.2.1 UnknownUnknown
pip/oauthlib 4.0.1 🟢 7.8
Details
CheckScoreReason
Code-Review🟢 4Found 6/14 approved changesets -- score normalized to 4
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
SAST⚠️ -1internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: Although you appear to have the correct authorization credentials, the `mistralai` organization has an IP allow list enabled, and your IP address is not permitted to access this resource.
Packaging🟢 10packaging workflow detected
pip/packaging 26.3 UnknownUnknown
pip/pyasn1 0.6.5 UnknownUnknown
pip/python-discovery 1.9.4 UnknownUnknown
pip/tornado 6.6 UnknownUnknown
pip/virtualenv 21.15.5 UnknownUnknown
pip/yarl 1.25.1 🟢 6.4
Details
CheckScoreReason
Code-Review⚠️ 1Found 2/11 approved changesets -- score normalized to 1
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Signed-Releases🟢 43 out of the last 5 releases have a total of 3 signed artifacts.
pip/yt-dlp 2026.10.26 UnknownUnknown

Scanned Files

  • uv.lock

@groupthinking
groupthinking merged commit ce5820d into main Nov 6, 2026
40 of 42 checks passed
@groupthinking
groupthinking deleted the dependabot/uv/uv-5d9ef4a7c0 branch November 6, 2026 03:11

This branch was successfully deployed

1 active deployment
Preview — 8e0a99a6 Deployed Nov 5, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@groupthinking groupthinking Awaiting requested review from groupthinking groupthinking is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@groupthinking