Bump the python-packages group with 9 updates

[dependabot]

Bumps the python-packages group with 9 updates:

Package	From	To
anyio	4.14.2	4.15.1
alembic	1.19.1	1.19.2
pytest-randomly	4.1.0	5.0.0
pytest-rerunfailures	16.6	16.6.1
prek	0.5.1	0.5.2
ruff	0.16.5	0.16.6
types-pyyaml	6.0.12.20260815	6.0.12.20260906
types-authlib	1.7.2.20260901	1.8.0.20260907
types-requests	2.33.0.20260712	2.33.0.20260906

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

• Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311 <agronholm/anyio#1311)

4.15.0

• Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

  • follow_symlinks on exists() (Python 3.12+)
  • follow_symlinks on is_dir() (Python 3.13+)
  • follow_symlinks on is_file() (Python 3.13+)
  • follow_symlinks on owner() (Python 3.13+)
  • follow_symlinks on group() (Python 3.13+)
  • newline on read_text() (Python 3.13+)

  (#1286, #1293; PR by @​jaideeppyne)

• Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

• Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

• Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

• Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

• Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

• Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

• Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

• Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

• Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

• Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

• Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

• Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

• Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

• Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

• Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

• Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

• Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

• Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

... (truncated)

Commits

• ffcd154 Bumped up the version
• 0ecf5ed Added a workaround for third party code accessing unimported submodules (#1309)
• 9283662 Bumped up the version
• d137692 Improved the instructions for AI agents
• 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
• 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
• b825c3b Fixed pyproject.toml changes not triggering the test suite
• 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
• b05fe6d Fixed wrong type in move_on_after (#1297)
• 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
• Additional commits viewable in compare view

Updates alembic from 1.19.1 to 1.19.2

Release notes

Sourced from alembic's releases.

1.19.2

Released: September 4, 2026

changed

• [changed] [autogenerate] The autogenerate plugin for CHECK constraint detection by name, added in 1.19.0. for #508, is no longer enabled by default. It has been renamed from alembic.autogenerate.checkconstraint_byname to alembic.ext.checkconstraint_byname and no longer matches on the "alembic.autogenerate.*" wildcard, which remains the default plugin specification. The previous name will still function as well if placed in the plugins list explicitly, both to enable the plugin and within a "~" exclusion, so that an env.py written against 1.19.0 or 1.19.1 requires no change.

  The plugin is now recommended only for schemas that ensure the naming of all constraints using a client side naming convention, otherwise there's a persistent risk of false positives. See autogenerate_check_constraints for background on things to be aware of when using this plugin.

  As part of this change "type bound" CHECK constraints, which include constraints generated for the Boolean and Enum datatypes when the create_constraint parameter is set to True, are no longer ignored in the metadata side, so that normal name-based matching can occur for these constraints.

  References: #1859

usecase

• [usecase] [autogenerate] [batch] The target of a ~sqlalchemy.schema.ForeignKey is now located using the ForeignKey.target_tokens and ForeignKey.target_table_key accessors added in SQLAlchemy 2.1, rather than by splitting the dotted string form of that target on ".". As a dot inside a schema, table or column name cannot be told apart from the separator between those names, a foreign key whose target name contained a dot was previously mis-parsed by autogenerate rendering as well as by batch migrations. The dotted string continues to be split when running against SQLAlchemy 2.0, where these accessors are not present. Thanks to Gyanu Mayank for the initial pull request.

  References: #1860

Commits

• See full diff in compare view

Updates pytest-randomly from 4.1.0 to 5.0.0

Changelog

Sourced from pytest-randomly's changelog.

5.0.0 (2026-09-01)

• Support Python 3.15.

• Shuffle tests in a wrapper around the pytest_collection_modifyitems hook, guaranteeing that the shuffle runs before all other plugins’ implementations of the hook.

  Previously, pytest-randomly shuffled in a plain tryfirst hook implementation. When another plugin also implemented the hook with tryfirst, as pytest-django does, whichever plugin pytest happened to register later ran first. Registration order comes from package metadata on disk, which can differ between seemingly identical environments — even two containers built from the same Dockerfile, or the same virtual environment after reinstalling a package. As a result, the same seed could yield different test orders in different environments. Worse, in environments where pytest-randomly ended up shuffling last, it silently destroyed the other plugin’s ordering — for pytest-django, the grouping of database tests that mirrors Django’s test runner (non-transactional database tests, then transactional ones, then the rest).

  Now the shuffle always runs first, and plugins that group tests with a stable sort apply their grouping on top of the shuffled order, so the final order is reproducible from the seed alone. In environments that previously hit the reversed hook order, upgrading changes the test order for a given seed — restoring both reproducibility and other plugins’ grouping.

  PR [#746](https://github.com/pytest-dev/pytest-randomly/issues/746) <https://github.com/pytest-dev/pytest-randomly/pull/746>. Thanks to milssky for the report in Issue [#701](https://github.com/pytest-dev/pytest-randomly/issues/701) <https://github.com/pytest-dev/pytest-randomly/issues/701>.

• Require pytest 8+, the first version to require a version of pluggy that supports hook wrappers, as used by the above fix.

  PR [#746](https://github.com/pytest-dev/pytest-randomly/issues/746) <https://github.com/pytest-dev/pytest-randomly/pull/746>__.

• Reset Polyfactory <https://polyfactory.litestar.dev/>__\’s default random state at the start of every test, if it is installed.

  Thanks to Rahul Kumar in PR [#735](https://github.com/pytest-dev/pytest-randomly/issues/735) <https://github.com/pytest-dev/pytest-randomly/issues/735>__.

• Switch package build backend from setuptools to uv_build <https://docs.astral.sh/uv/concepts/build-backend/>__. This makes builds with uv about nine times faster, since uv runs the backend natively, without creating a build environment or spawning a Python process. Additionally, source distributions no longer include test files, which setuptools previously included incompletely, missing the files needed to actually run them.

Commits

• 89ddfb1 Version 5.0.0
• 0d00951 Shuffle before other plugins' collection hooks (#746)
• 817091d Upgrade dependencies (#745)
• 42a2066 Fix podcast link in README (#740)
• c2a001d Reset Polyfactory's default random state on each test (#735)
• cc4762b Upgrade dependencies (#744)
• 94aba4a Upgrade dependencies (#743)
• c9140ef Support Python 3.15 (#741)
• 15f531e Switch build backend to uv_build (#739)
• 79eee6c [pre-commit.ci] pre-commit autoupdate (#738)
• Additional commits viewable in compare view

Updates pytest-rerunfailures from 16.6 to 16.6.1

Changelog

Sourced from pytest-rerunfailures's changelog.

16.6.1 (2026-09-03)

Bug Fixes +++++++++

• Ensure teardown reports are passed to pytest_runtest_logreport for rerun attempts. ([#237](https://github.com/pytest-dev/pytest-rerunfailures/issues/237) <https://github.com/pytest-dev/pytest-rerunfailures/issues/237>_)
• Prevent superseded built-in subtest failures from remaining in the final test result when rerunning tests with pytest-xdist. ([#350](https://github.com/pytest-dev/pytest-rerunfailures/issues/350) <https://github.com/pytest-dev/pytest-rerunfailures/issues/350>_)
• Restore module, class, and session scoped fixture teardown when a flaky marker condition is falsy. ([#351](https://github.com/pytest-dev/pytest-rerunfailures/issues/351) <https://github.com/pytest-dev/pytest-rerunfailures/issues/351>_)
• Restore module, class, and session scoped fixture teardown when an error raised during teardown rules out a re-run. ([#356](https://github.com/pytest-dev/pytest-rerunfailures/issues/356) <https://github.com/pytest-dev/pytest-rerunfailures/issues/356>_)
• Keep module, class, and session scoped fixtures alive across re-runs of a test whose call phase failed through subtests only. ([#357](https://github.com/pytest-dev/pytest-rerunfailures/issues/357) <https://github.com/pytest-dev/pytest-rerunfailures/issues/357>_)
• Authenticate xdist StatusDB connections with a per-session token. ([#358](https://github.com/pytest-dev/pytest-rerunfailures/issues/358) <https://github.com/pytest-dev/pytest-rerunfailures/issues/358>_)
• Ensure negative rerun counts do not skip the initial test execution. ([#359](https://github.com/pytest-dev/pytest-rerunfailures/issues/359) <https://github.com/pytest-dev/pytest-rerunfailures/issues/359>_)

Misc ++++

• Replace deprecated Config.getvalue() calls with Config.getoption(). ([#345](https://github.com/pytest-dev/pytest-rerunfailures/issues/345) <https://github.com/pytest-dev/pytest-rerunfailures/issues/345>_)

Commits

• dad07a7 Preparing release 16.6.1
• 968fb6c Prevent negative reruns from skipping initial execution (#360)
• 367df90 Keep higher-scoped fixtures alive across re-runs of failed subtests (#357)
• 69ac0a7 Authenticate xdist StatusDB connections (#358)
• 20decd3 Restore higher-scoped teardown when a teardown error rules out a re-run (#356)
• 84af73d Fix subtest rerun reporting with xdist (#352)
• d784cdd Test with pytest-xdist on CI (#354)
• 9f85e06 Restore higher-scoped teardown when a flaky condition is falsy (#351)
• eab650f Test rerun-except for setup errors (#349)
• 0b0843a Fix only_rerun marker precedence test (#348)
• Additional commits viewable in compare view

Updates prek from 0.5.1 to 0.5.2

Release notes

Sourced from prek's releases.

0.5.2

Release Notes

Released on 2026-09-03.

Enhancements

• Allow unknown tags by default in check-yaml (#2678)

Contributors

• @​j178

Install prek 0.5.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.2

File	Platform	Checksum
prek-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
prek-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
prek-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
prek-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
prek-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
prek-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
prek-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
prek-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

</tr></table> 

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.2

Released on 2026-09-03.

Enhancements

• Allow unknown tags by default in check-yaml (#2678)

Contributors

• @​j178

Commits

• bfaa03c Bump version to 0.5.2 (#2679)
• f0ce4c2 Allow unknown tags by default in check-yaml (#2678)
• 78bb3fe Show verbose builtin details by default (#2676)
• 57ea73d Add --allow-unknown-tags to check-yaml to disable tag checks (#2675)
• 695f3d0 Show hook selectors first in prek run help (#2673)
• edf43d5 Reapply "Reject unsupported YAML tags in check-yaml (#2656)" (#2672)
• ed225b1 Bump version to 0.5.2 (#2671)
• de6e614 Revert unsupported YAML tag rejection in check-yaml (#2670)
• See full diff in compare view

Updates ruff from 0.16.5 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

• Move pytest-fixture-autouse to the restriction category (#28219)
• [flake8-pytest-style] Add an autofix for PT020 (#27993)
• [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
• [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

• Validate unary expressions when parsing (#28233)
• [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
• [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
• [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
• [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
• [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

• [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

• Add another example and glob reference for lint.per-file-ignores (#28106)
• Add duplicate work guidance (#28229)
• [flake8-async] Document thread offloading (ASYNC240) (#28008)
• [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

• Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

• @​flying-sheep
• @​pikammmmm
• @​fly1d
• @​waterWang
• @​Pierre-Sassoulas
• @​ntBre
• @​jelle-openai
• @​ericbuehl
• @​tjkuson
• @​AbhinavMir
• @​Whning0513
• @​chirizxc

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

• Move pytest-fixture-autouse to the restriction category (#28219)
• [flake8-pytest-style] Add an autofix for PT020 (#27993)
• [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
• [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

• Validate unary expressions when parsing (#28233)
• [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
• [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
• [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
• [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
• [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

• [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

• Add another example and glob reference for lint.per-file-ignores (#28106)
• Add duplicate work guidance (#28229)
• [flake8-async] Document thread offloading (ASYNC240) (#28008)
• [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

• Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

• @​flying-sheep
• @​pikammmmm
• @​fly1d
• @​waterWang
• @​Pierre-Sassoulas
• @​ntBre
• @​jelle-openai
• @​ericbuehl
• @​tjkuson
• @​AbhinavMir
• @​Whning0513
• @​chirizxc

Commits

• 22f65a2 Bump 0.16.6 (#28280)
• 7cc9f1e [ty] Document CallableTypeKind variants (#28277)
• 056ce07 Add UV_LOCKED to all workflows (#28261)
• 6d6e35d [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
• 80b4891 [ty] Temporarily disable tuple types in property tests (#28275)
• 3f7a54d [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
• 35656cf [ty] Preserve deprecations on decorated callables (#28256)
• d2626c8 [ty] Reject missing attributes on type[] aliases (#28267)
• ee6a6d1 [ty] Support ParamSpecs in ConstraintSet (#28028)
• 7f6a170 [ty] Move bound APIs to constraint owners (#28094)
• Additional commits viewable in compare view

Updates types-pyyaml from 6.0.12.20260815 to 6.0.12.20260906

Commits

• See full diff in compare view

Updates types-authlib from 1.7.2.20260901 to 1.8.0.20260907

Commits

• See full diff in compare view

Updates types-requests from 2.33.0.20260712 to 2.33.0.20260906

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage Report •

File	Stmts	Miss	Branch	BrPart	Cover	Missing
TOTAL	2391	149	256	61	92%

report-only-changed-files is enabled. No changed files were found in the coverage report :)