chore(deps): bump the python-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the python-dependencies group with 3 updates in the / directory: pyjwt, ruff and httpx2.

Updates pyjwt from 2.14.0 to 2.15.0

Release notes

Sourced from pyjwt's releases.

2.15.0

See the 2.15.0 changelog for complete release details.

Changelog

Sourced from pyjwt's changelog.

v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>__

Security

- Wrap recursion errors from deeply nested JWT payloads in ``DecodeError``
  instead of exposing a raw ``RecursionError``.
Added

- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__
Changed



JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS
payload, so a cache hit no longer re-parses every key. JWKSetCache.put()
accepts either form and raises PyJWKSetError for anything else. As a
result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance
for as long as it stays cached, rather than a freshly built one per call in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
PyJWKClient.fetch_data() now raises
PyJWKClientError("The JWKS endpoint did not return a JSON object") when
the endpoint response is not a JSON object, instead of returning it for
get_jwk_set() to reject. Callers reaching the JWKS through
get_jwk_set() see the same error as before in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
</tr></table> 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68&quot;&gt;&lt;code&gt;1d41a64&lt;/code&gt;&lt;/a> chore: prepare 2.15.0 release</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3&quot;&gt;&lt;code&gt;9bc0665&lt;/code&gt;&lt;/a> fix: make recursive payload tests deterministic</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b&quot;&gt;&lt;code&gt;5fde08a&lt;/code&gt;&lt;/a> fix: normalize recursive JWT payload errors</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19&quot;&gt;&lt;code&gt;171062d&lt;/code&gt;&lt;/a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173&quot;&gt;#1173&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6&quot;&gt;&lt;code&gt;c9d4d53&lt;/code&gt;&lt;/a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174&quot;&gt;#1174&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53&quot;&gt;&lt;code&gt;2763752&lt;/code&gt;&lt;/a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202&quot;&gt;#1202&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5&quot;&gt;&lt;code&gt;4adcd02&lt;/code&gt;&lt;/a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201&quot;&gt;#1201&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097&quot;&gt;&lt;code&gt;9e501d9&lt;/code&gt;&lt;/a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179&quot;&gt;#1179&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2&quot;&gt;&lt;code&gt;4047c44&lt;/code&gt;&lt;/a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212&quot;&gt;#1212&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9&quot;&gt;&lt;code&gt;f4e2b59&lt;/code&gt;&lt;/a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210&quot;&gt;#1210&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />

Updates ruff from 0.16.7 to 0.16.8

Release notes
Sourced from ruff's releases.

0.16.8
Release Notes
Released on 2026-09-16.
Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)
[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
[flake8-simplify] Preserve operand order in SIM109 fix (#27824)
[pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
[pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

Add support for __lazy_modules__ (#28459)
Recognize PEP-728 TypedDict class keywords (#28533)
Recognize quoted types in typing.TypeForm (#28507)
Support conditional assignment to __lazy_modules__ (#28491)
[flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
[pyupgrade] Make the fix for UP040 always unsafe (#28526)
[pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
[ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
[ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

[flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

@​VedantMadane
@​alzeph
@​charliermarsh
@​fredrikblau
@​ntBre
@​zsol
@​Aniket-a14
@​r-b-1

Install ruff 0.16.8
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 


... (truncated)


Changelog
Sourced from ruff's changelog.

0.16.8
Released on 2026-09-16.
Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)
[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
[flake8-simplify] Preserve operand order in SIM109 fix (#27824)
[pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
[pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

Add support for __lazy_modules__ (#28459)
Recognize PEP-728 TypedDict class keywords (#28533)
Recognize quoted types in typing.TypeForm (#28507)
Support conditional assignment to __lazy_modules__ (#28491)
[flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
[pyupgrade] Make the fix for UP040 always unsafe (#28526)
[pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
[ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
[ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

[flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

@​VedantMadane
@​alzeph
@​charliermarsh
@​fredrikblau
@​ntBre
@​zsol
@​Aniket-a14
@​r-b-1




Commits

62914c4 Bump version to 0.16.8 (#28648)
c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
94efeaa [ty] Compact reachable binding and declaration histories (#28349)
50020fb [ty] Avoid storing constraint nodes twice (#28375)
446bb68 [ty] Compare bound-method receivers before signatures (#28384)
304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
fe9f065 [flake8-tidy-imports] Add extend-banned-api (#28644)
31131db [ty] Support type[A & B] (#27124)
Additional commits viewable in compare view




Updates httpx2 from 2.13.0 to 2.13.1

Release notes
Sourced from httpx2's releases.

v2.13.1
Highlights
📤 Accurate file upload lengths
Passing a file as content= now calculates Content-Length from its remaining bytes, respecting the current file position (#1214).
🔐 Reliable proxy TLS and HTTP/2 negotiation
TLS hostname overrides now apply inside HTTP proxy tunnels without affecting the proxy's own TLS connection (#1223). HTTP/2 is advertised first when enabled, and HTTP/1.1 is omitted when disabled (#1155).
🧹 Clean WebSocket shutdown
The sync WebSocket keepalive thread now exits cleanly when a ping races with connection shutdown (#1228).
httpx2
Fixed

Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position (#1214).
Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown (#1228).

httpcore2
Fixed

Honor the sni_hostname extension for TLS inside HTTP proxy tunnels without applying it to the proxy's TLS connection (#1223).
Prefer HTTP/2 during TLS protocol negotiation when enabled, and stop advertising HTTP/1.1 when it is disabled (#1155).

Full Changelog: https://github.com/pydantic/httpx2/compare/v2.13.0...v2.13.1



Changelog
Sourced from httpx2's changelog.

2.13.1 (September 23rd, 2026)
Fixed

Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position.
(#1214)
Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown.
(#1228)




Commits

d91c9f4 Correct the upcoming release version to 2.13.1 (#1228)
62a607d Prepare version 2.14.0 (#1227)
df9783d Respect file cursor positions when calculating raw content length (#1214)
04d152b docs: correct stale URL.query example (#1222)
See full diff in compare view




Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options


You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 852ff2e3-f8dc-446b-b7e6-de40e6865dc1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}