Skip to content

Bump the python-port group with 10 updates - #1

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-port-62491ed903
Open

Bump the python-port group with 10 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-port-62491ed903

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown

Bumps the python-port group with 10 updates:

Package From To
numpy 2.5.3 2.5.4
netcdf4 1.7.4 1.7.5.1.post1
numba 0.67.0 0.68.1
zarr 3.4.0 3.4.2
pytest 9.1.1 9.2.0
mypy 2.3.1 2.4.1
reportlab 5.0.1 5.1.0
pypdf 6.19.0 6.21.4
coverage 7.16.1 7.17.0
pre-commit 4.6.2 4.7.0

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

  • Many typing fixes and improvements,
  • A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

  • numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

  • Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

  • numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits
  • a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
  • 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
  • 91acd87 REL: Prepare for the NumPy 2.5.4 release.
  • 9cc555b Merge pull request #32956 from charris/backport-typing-1
  • e04b972 TYP: dtype[void].names: allow setting with list (#32943)
  • d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
  • 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
  • 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
  • 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
  • c7bcd2c TYP: place: widen mask (#32926)
  • Additional commits viewable in compare view

Updates netcdf4 from 1.7.4 to 1.7.5.1.post1

Changelog

Sourced from netcdf4's changelog.

version 1.7.6 (not yet released)

  • Speed up index setup in _StartCountStride (used when indexing variables) by skipping numpy conversion for plain ints and slices and classifying each index once (PR #1524).

version 1.7.5.1.post1 (tag v1.7.5.1.post1rel)

  • fix installation of plugins into linux wheels.

version 1.7.5.1 (tag v1.7.5.1rel)

  • make sure zstd compression filter test always runs unless specifically disabled, fix cli test so it runs on 32-bit x86. New wheels for linux that include plugins (they were left out of the 1.7.5 release).
  • fix version comparison logic that was broken when using netcdf-c >= 4.10.0 - this was the cause of issue #1515 (diskless persisted datasets are no longer persisted).

version 1.7.5 (tag v1.7.5rel)

  • remove python 3.10 support (it reaches EOL October 31, 2026).
  • Reject fractional scalar indices instead of silently truncating reads or writes (issue #1350).
  • Preserve surviving dimensions and decoded types for empty orthogonal selections, including empty integer indices and all-false masks (PR #1499).
  • Convert non-native-endian numeric attributes to native byte order before writing (issue #1502).
  • Fix command-line usage error exit codes and --help handling, honour nc4tonc3 --chunk, and fix ncinfo group dimension selection (issue #1500).
  • Change default encoding for stringtochar/chartostring functions from 'utf-8' to 'utf-8'/'ascii' for dtype.kind='U'/'S' (issue #1464).
  • Fix DeprecationWarning for assigning to numpy.ndarray.shape for numpy >= 2.5.0 (issue #1468).
  • Disable parallel support even if libs support it via DISABLE_PARALLEL_SUPPORT env var (issue #1389).

version 1.7.4 (tag v1.7.4rel)

  • Make sure automatic conversion of character arrays <--> string arrays works for Unicode strings (issue #1440). (previously only worked correctly for encoding="ascii").
  • Add netcdf plugins (blosc, zstd, bzip2) in wheels. Blosc plugin doesn't work in Windows wheels. Macos wheels now use conda provided libs. (PR #1450)
  • Add windows/arm (PR #1453) and free-threaded python wheels (issue #1454). Windows wheels now use netcdf-c 4.9.3. WARNING: netcdf-c is not thread-safe and netcdf4-python does have internal locking so expect segfaults if you use netcdf4-python on multiple threads with free-threaded python. Users must exercise care to only call netcdf from a single thread.

version 1.7.3 (tag v1.7.3rel)

  • Python 3.14 wheels (issue #1432)
  • support os.PathLike arguments for Dataset.fromcdl and raise a FileNotFoundError if the cdl is missing and a FileExistsError if the nc file already exists (PR #1387)
  • raise more informative error when trying to iterate or perform a membership operation on a Dataset (issue #1383)
  • fix type hint for createEnumType (issue #1378)
  • add python 3.13 to windows wheel builds (PR #1377)

... (truncated)

Commits

Updates numba from 0.67.0 to 0.68.1

Updates zarr from 3.4.0 to 3.4.2

Release notes

Sourced from zarr's releases.

v3.4.2

What's Changed

Dependency updates

What's Changed

New Contributors

Full Changelog: zarr-developers/zarr-python@v3.4.1...v3.4.2

v3.4.1

... (truncated)

Changelog

Sourced from zarr's changelog.

3.4.2 (2026-10-27)

Features

  • Reading data encoded with the pickle codec now requires an explicit opt-in, because unpickling data from an untrusted store can execute arbitrary code (GHSA-jqc8-qjfv-5m6r). Enable it with zarr.config.set({"array.allow_unsafe_pickle_decode": True}) or the environment variable ZARR_ARRAY__ALLOW_UNSAFE_PICKLE_DECODE=True. Without the opt-in, reading such data raises zarr.errors.PickleCodecDisabledError. numcodecs has its own opt-in (numcodecs.pickles.ALLOW_UNSAFE_PICKLE_DECODE), which must also be enabled. Writing with the pickle codec is unchanged. (#4465)

Bugfixes

  • Resizing an array with delete_outside_chunks=True now generates only the out-of-bounds chunk coordinates and deletes them with a bounded pool of workers, instead of materializing the entire old and new grids and all deletion tasks. This bounds auxiliary memory during shrinking and mixed growing/shrinking resizes while preserving retained chunks. Growing, or shrinking within the last chunk of each axis, no longer schedules any deletion work. When a deletion fails, the remaining deletions are now canceled before the error is raised; previously they ran to completion. (#4344)
  • zarr.open_array and zarr.open (sync and async) now apply the config argument when opening an existing array. Previously config was only used when a new array was created, so zarr.open_array(store, config={"read_missing_chunks": False}) silently ran an existing array with the global defaults. config is now a named parameter of both functions and of Array.open/AsyncArray.open. zarr.open raises a TypeError naming the problem when config is given for a group. (#4408)
  • Fixed several ways ZipStore could lose data or fail. A store created with mode="w" or mode="x" now keeps its entries when it is used again after close(), move(), or unpickling, instead of truncating the archive. Every method now opens the archive on first use, under a lock, so get, get_partial_values, set_if_not_exists, and clear no longer raise AttributeError on a store that was never opened, and threads sharing a store no longer open the archive twice. An unpickled store now opens its archive on first use rather than when it is unpickled, so writing a dask array to a ZipStore no longer produces an unreadable file. Where reopening an archive would silently drop its entries, the store now raises instead: RuntimeError after a failed close(), zipfile.BadZipFile if the file is not a complete zip archive, and io.UnsupportedOperation for a file object that is not readable and seekable. The type of the mode parameter now includes "x". Builds on #3593 by @​oelhammouchi. (#4450)
  • Reads through FusedCodecPipeline no longer hang in a process forked after an earlier read had started the codec thread pool. The pool is now reset in the child process after a fork. Previously the child inherited an executor whose threads did not exist, so small reads were queued on a pool nothing would run. (#4483)
  • Structured data types now default string (S, U) and raw-bytes (V) fields to zero bytes. Before, an array with a raw-bytes field failed to create without an explicit fill value, and string fields defaulted to "0". (#4495)
  • The minimum supported numcodecs version is now 0.16.6, and 0.17.0 is excluded. Those versions leave Pickle.decode enabled by default, which allows arbitrary code execution when reading an untrusted Zarr v2 array (GHSA-jqc8-qjfv-5m6r). (#4465)
  • The zarr.storage module can now be serialized with pickle and cloudpickle. Previously, code that referenced the module (for example a Dask task that used zarr.storage.ObjectStore) failed with TypeError: cannot pickle 'VerboseModule' object. (#4557)

Improved Documentation

  • Document the removal of LRUStoreCache in the v3 migration guide, and point to the experimental zarr.experimental.cache_store.CacheStore as its replacement. (#3850)
  • Added a deprecation policy to the contributing guide. It defines when a deprecation cycle is required for public API changes, a shared framework for deciding whether a removal is worthwhile, the mechanics a deprecation must follow (warning class, message contents, documentation, and changelog entry), and a minimum deprecation period of at least 6 months and at least one minor release before removal. (#4051)
  • Clarify how Zarr format 3 codec pipeline roles map to filters, serializer, and compressors when creating arrays. (#4166)
  • Correct the docstrings of zarr.save, zarr.save_array and zarr.save_group to say the functions write to any store. Previously the docstrings stated the functions wrote to only the local file system, which was inaccurate. (#4520)

Misc

3.4.1 (2026-10-08)

Bugfixes

  • Chunk sizes must now be at least 1, while an array extent may still be 0. On a zero-length axis, chunks=-1, chunks=False, chunks="auto", shards=-1 and shards=False all give chunk size 1, and a shard spanning an axis is rounded up to a multiple of the inner chunk size, so shards=-1 works when the axis length is not a multiple of it. A rectilinear chunk grid can be declared on a zero-length dimension; its chunk sizes are kept for later growth.

    FixedDimension(size=0, ...) raises ValueError. ArrayV2Metadata(chunks=(0,)) is still accepted and written as given, and is read back the way a stored 0 is read (below). create_hierarchy now builds every node before it deletes or stores anything, so a node that cannot be built leaves the store untouched. Regular chunk grid metadata reads a bool chunk size as the integer it equals and rejects a string or mapping as a chunk shape. RectilinearChunkGridMetadata (experimental) does the same for bool edges and rejects NumPy integers and floats such as 4.0 with TypeError; it used to store them as given, which produced JSON floats the specification does not allow.

    Stored metadata with a regular chunk size of 0 or JSON false (Zarr format 2 chunks, Zarr format 3 regular chunk_shape) is now read as chunk size 1, or the inner chunk size for sharded arrays, which previously could not be opened. The result does not depend on how far the axis has grown since. zarr-python wrote such sizes for arrays created with a zero-length axis until 3.4, and from 2.18.7 to 3.2.1 for an explicit chunks=(0,) or False on any axis; those arrays hold no data. On a zero-length axis the array opens silently, and appending stores chunks of size 1. On a longer axis it opens with a ZarrUserWarning that says the array holds only its fill value, how to recreate it with the wanted chunk shape (zarr.from_array(array.store, name=array.path, data=array, chunks=..., overwrite=True, write_data=False) keeps the data type, fill value, attributes and codecs), and how to keep it by storing valid metadata instead (array.update_attributes({}), then zarr.consolidate_metadata if the metadata is consolidated). JSON true, which zarr-python 3.0 and 3.2 wrote for chunks=True, is read as 1 without a warning, in regular and rectilinear chunk grids and in the inner chunk shape of any sharding codec. Rectilinear edges stored as integral JSON floats ([[4.0, 2]]), as 3.2 wrote them, are read as integers without a warning. A float anywhere else is rejected.

    Writing data to an array whose stored chunk size is 0 or false first re-reads the stored metadata and stores its repair, unless another writer has stored valid metadata since, so that other readers find the chunks written; in a ZipStore this adds a second entry for the metadata document, as every metadata update does. If the stored metadata now lays out chunks differently, the write raises ValueError asking to reopen the array and stores nothing. update_attributes and resize store the repair as before. No other operation does: a group's consolidated metadata keeps the array's metadata as it was stored until the array itself writes the repair. (#4334)

  • Nested structured data types now round-trip through Zarr format 2 metadata. Converting a NumPy dtype with field titles or subarray fields raises ValueError naming the unsupported field, instead of producing duplicate or raw-byte fields; this is a limitation of the current zarr-python dtype implementation, not of the format. Padded layouts are still converted to packed layouts, now with a ZarrUserWarning that field values are preserved but offsets and itemsize may change. These checks apply to nested fields too. New zdtypes and structured_dtypes hypothesis strategies back property tests for dtype serialization and layout conversion. (#4340)

  • DateTime64 and TimeDelta64 now normalize μs to us and keep generic-unit scale factors when converting NumPy dtypes and writing V2 and V3 metadata. V2 metadata spells a scaled generic unit explicitly, such as [2generic], because NumPy's dtype.str drops the scale. Generic temporal arrays keep their dtype parameters when CPU buffers are allocated and convert byte order correctly, and generic datetime fill values can be read back, including in structured fields. The default NaT fill value carries the scale factor, so missing chunks of an array such as m8[2us] read back as NaT on NumPy < 2.2 instead of an arbitrary count. (#4342)

  • LocalStore no longer blocks the event loop on filesystem calls. open, clear, delete, delete_dir, list, list_prefix, list_dir, move and getsize now run their disk I/O in a worker thread, as get and set already did. The LocalStore tests fail if any async store method touches the filesystem from the event loop thread. (#4353)

  • Coordinate selections, including vindex masks, and orthogonal integer-array selections no longer allocate memory proportional to the total number of chunks, so selecting a few points from an array with billions of chunks no longer raises MemoryError. The indexers keep only the occupied chunk IDs and run-end offsets (chunk_run_ends); unsorted selections may still need a sort. The dense chunk_nitems and chunk_nitems_cumsum attributes of CoordinateIndexer and IntArrayDimIndexer are still available: each is computed on first access and cached, so its identity and in-place mutations persist, and dataclasses.asdict() still materializes them. repr omits them. Accessing one still allocates memory proportional to the full chunk grid. The new zarr.core.common.ceildiv_int computes chunk counts and slice bounds in exact integer arithmetic; ceildiv keeps its floating-point behaviour. (#4356)

  • Runtime code no longer uses assert, and ruff's S101 rule keeps it out. Asserts are stripped under python -O, and two were load-bearing: GroupMetadata.from_dict asserted on node_type, which the array-to-group fallback in zarr.open relied on, and make_store asserted on mode. Both now raise proper errors, NodeTypeValidationError and ValueError. (#4363)

  • Arrays whose stored regular chunk grid mixes integers with lists of edge lengths, such as "chunk_shape": [2, [5, 10, 5]] (written by zarr 3.2.0 and 3.2.1 for chunks=(2, (5, 10, 5)), with float edges for float input), can be read again without enabling array.rectilinear_chunks. The grid is read as the rectilinear grid it describes, with a ZarrUserWarning. Re-saving the array's metadata, or writing chunks to it, stores that rectilinear grid and so requires the flag. A group's consolidated metadata keeps the array's metadata as stored.

    The array.rectilinear_chunks flag now gates reading and storing array metadata that declares a rectilinear chunk grid, including in consolidated metadata, rather than the construction of RectilinearChunkGridMetadata. An operation that would store such metadata with the flag off (creating an array, Array.resize, deleting a member of a group with consolidated metadata, create_hierarchy) raises before it deletes or writes anything, and the error names the array. (#4375)

  • Chunk specifications are now judged by the chunk normalizer alone; the separate duck-typed check for rectilinear input is gone.

... (truncated)

Commits
  • a2f2415 docs: 3.4.2 release notes (#4565)
  • d588831 chore(deps): bump setuptools from 83.0.0 to 84.1.0 (#4566)
  • 1ee442b chore(deps): bump graphql-core from 3.2.8 to 3.2.12 (#4567)
  • e28e7dc ci(big-endian): install tzdata so pip check passes on the s390x image (#4570)
  • 04dd0fb docs: create the explicit serializer example array with overwrite=True (#4569)
  • 9b7b93b feat: require opt-in to read data encoded with the pickle codec (#4465)
  • e376ace fix(api): apply config when open_array opens an existing array (#4408)
  • 332caef docs: clarify Zarr v3 codec pipeline roles (#4166)
  • a429d16 fix(storage): open ZipStore archive on first use from every method and reopen...
  • 44e89e7 chore(zarr-metadata): build 0.6.0 changelog (#4563)
  • Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

  • #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

  • #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

    Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

  • #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

    • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
    • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

    pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

  • #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

  • #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

  • #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

    They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

  • #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

  • #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

  • #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
  • #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
  • #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

  • #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits
  • ae1d0ff Prepare release version 9.2.0
  • 143ce31 pre-commit: exclude codespell on generated release announcements
  • 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
  • a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
  • 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
  • 41d12cd docs: clarify typing for yield fixtures
  • b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
  • 16f87a7 docs: improve getting-started.rst test execution description
  • 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
  • ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
  • Additional commits viewable in compare view

Updates mypy from 2.3.1 to 2.4.1

Changelog

Sourced from mypy's changelog.

Mypy 2.4.1

  • Process overloads as a whole in two-phase type checking (Ivan Levkivskyi, PR 22231)
  • Skip recursive setup for frame-private nested functions in mypyc (Piotr Sawicki, PR 22187)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • A5rocks
  • Adam Dangoor
  • Alex Waygood
  • Ali Hamdan
  • Brian Helba
  • Chad Dombrova
  • David Foster
  • dnwpark
  • Edgar Ramírez Mondragón
  • Giorgos Michas
  • Ivan Levkivskyi
  • Jelle Zijlstra
  • Jukka Lehtosalo
  • Marc Mueller
  • Michael R. Crusoe
  • NIYONSHUTI Emmanuel
  • Piotr Sawicki
  • Shantanu
  • themylogin
  • Vaggelis Danias
  • Willy Bruns

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

... (truncated)

Commits

Updates reportlab from 5.0.1 to 5.1.0

Updates pypdf from 6.19.0 to 6.21.4

Release notes

Sourced from pypdf's releases.

Version 6.21.4, 2026-10-28

What's new

Security (SEC)

Documentation (DOC)

Full Changelog

Version 6.21.3, 2026-10-27

What's new

Security (SEC)

Performance Improvements (PI)

Bug Fixes (BUG)

Documentation (DOC)

Developer Experience (DEV)

Maintenance (MAINT)

  • Revert: Reject unsupported key lengths in the /Encrypt dictionary by @​stefan6419846

Full Changelog

Version 6.21.2, 2026-10-21

What's new

Security (SEC)

Bug Fixes (BUG)

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.21.4, 2026-10-28

Security (SEC)

  • Limit the number of copied page attributes during flattening (#4290)
  • Detect EOF when reading standard xref table trailer (#4289)
  • Fix loop detection when cloning DictionaryObject (#4288)

Documentation (DOC)

  • Exclude performance issues from security reports (#4280)

Full Changelog

Version 6.21.3, 2026-10-27

Security (SEC)

  • Use the validated page count after decrypting a document (#4270)
  • Limit total number of cross-reference stream entries (#4269)
  • Avoid excessive error messages (#4265)

Performance Improvements (PI)

  • Read flat page label number trees once for all pages (#4251)
  • Collect the named destinations once when resolving links (#4249)
  • Avoid scanning all objects in get_outline_root (#4245)

Bug Fixes (BUG)

  • Resolve indirect widths in CID font /W arrays (#4267)

Documentation (DOC)

  • Block incremental writes of encrypted documents (#4246)

Developer Experience (DEV)

  • Update to PyPy 3.12 and pinned requirements (#4244)

Maintenance (MAINT)

  • Revert: Reject unsupported key lengths in the /Encrypt dictionary

Full Changelog

Version 6.21.2, 2026-10-21

Security (SEC)

  • Avoid repeated full file loads (#4240)
  • Limit size of standard xref table (#4239)

Bug Fixes (BUG)

  • Decode UniGB-UTF16 CMaps as UTF-16BE (#4231)
  • Keep 8-bit DeviceRGB image mode (#4230)
  • Preserve all annotation quadrilaterals when merging pages (#4223)

Robustness (ROB)

... (truncated)

Commits
  • b2c3fa2 REL: 6.21.4
  • ea4ac66 SEC: Limit the number of copied page attributes during flattening (#4290)
  • 06593f9 SEC: Detect EOF when reading standard xref table trailer (#4289)
  • f176db1 SEC: Fix loop detection when cloning DictionaryObject (#4288)
  • c7d391c PI: Speed up transformation matrix handling for layout mode text extraction (...
  • b330dcd DEV: Bump actions/setup-python from 7.0.0 to 7.1.0 (#4278)
  • 8901534 DOC: Exclude performance issues from security reports (#4280)
  • 70eab9b PI: Speed up parse_bfchar (#4273)
  • 4ef744f ROB: Skip an embedded file specification that is not a dictionary (#4256)
  • 945216f ROB: Keep the text state when a text state operator has no operand in layout ...
  • Additional commits viewable in compare view

Updates coverage from 7.16.1 to 7.17.0

Release notes

Sourced from coverage's releases.

7.17.0

Version 7.17.0 — 2026-10-22

  • Dropped support for Python 3.10.
  • Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.
  • Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.
  • Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.
  • Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.
  • Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. The...

    Description has been truncated

@dependabot
Bump the python-port group with 10 updates
79c0121 
Bumps the python-port group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [numpy](https://github.com/numpy/numpy) | `2.5.3` | `2.5.4` |
| [netcdf4](https://github.com/Unidata/netcdf4-python) | `1.7.4` | `1.7.5.1.post1` |
| [numba](https://numba.pydata.org) | `0.67.0` | `0.68.1` |
| [zarr](https://github.com/zarr-developers/zarr-python) | `3.4.0` | `3.4.2` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` |
| [mypy](https://github.com/python/mypy) | `2.3.1` | `2.4.1` |
| [reportlab](https://www.reportlab.com/) | `5.0.1` | `5.1.0` |
| [pypdf](https://github.com/py-pdf/pypdf) | `6.19.0` | `6.21.4` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.16.1` | `7.17.0` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.2` | `4.7.0` |


Updates `numpy` from 2.5.3 to 2.5.4
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.5.3...v2.5.4)

Updates `netcdf4` from 1.7.4 to 1.7.5.1.post1
- [Release notes](https://github.com/Unidata/netcdf4-python/releases)
- [Changelog](https://github.com/Unidata/netcdf4-python/blob/master/Changelog)
- [Commits](https://github.com/Unidata/netcdf4-python/commits)

Updates `numba` from 0.67.0 to 0.68.1

Updates `zarr` from 3.4.0 to 3.4.2
- [Release notes](https://github.com/zarr-developers/zarr-python/releases)
- [Changelog](https://github.com/zarr-developers/zarr-python/blob/main/docs/release-notes.md)
- [Commits](zarr-developers/zarr-python@v3.4.0...v3.4.2)

Updates `pytest` from 9.1.1 to 9.2.0
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.1.1...9.2.0)

Updates `mypy` from 2.3.1 to 2.4.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.3.1...v2.4.1)

Updates `reportlab` from 5.0.1 to 5.1.0

Updates `pypdf` from 6.19.0 to 6.21.4
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.19.0...6.21.4)

Updates `coverage` from 7.16.1 to 7.17.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.16.1...7.17.0)

Updates `pre-commit` from 4.6.2 to 4.7.0
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.2...v4.7.0)

---
updated-dependencies:
- dependency-name: numpy
  dependency-version: 2.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-port
- dependency-name: netcdf4
  dependency-version: 1.7.5.1.post1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-port
- dependency-name: numba
  dependency-version: 0.68.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-port
- dependency-name: zarr
  dependency-version: 3.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-port
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-port
- dependency-name: mypy
  dependency-version: 2.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-port
- dependency-name: reportlab
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-port
- dependency-name: pypdf
  dependency-version: 6.21.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-port
- dependency-name: coverage
  dependency-version: 7.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-port
- dependency-name: pre-commit
  dependency-version: 4.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-port
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from sgupta92 as a code owner November 2, 2026 17:58
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 2, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sgupta92 sgupta92 Awaiting requested review from sgupta92 sgupta92 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants