pip: bump the pip-updates group with 6 updates

[dependabot]

Updates the requirements on aiohttp, anyio, certifi, yarl, ruff and coverage to permit the latest version.
Updates aiohttp from 3.14.1 to 3.14.3
Updates anyio from 4.14.1 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

• Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
• Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
• Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
• Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
• Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
• Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
• Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
• Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)

Commits

• c384f99 Bumped up the version
• dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
• 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
• 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
• be24b04 Relaxed timeouts to fix test flakiness
• 8113506 Fix test flakiness caused by slow callback duration logging
• 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
• 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
• f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
• 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
• Additional commits viewable in compare view

Updates certifi from 2026.6.17 to 2026.7.22

Commits

• f4bc676 2026.07.22 (#428)
• 4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427)
• 01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426)
• eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425)
• 474e6fc Include tests in the source distribution (#424)
• a31ef39 Bump actions/setup-python from 6.2.0 to 6.3.0 (#420)
• 98eb2c7 Bump actions/checkout from 6.0.3 to 7.0.0 (#419)
• See full diff in compare view

Updates yarl from 1.24.2 to 1.24.5

Release notes

Sourced from yarl's releases.

1.24.5

[!IMPORTANT] The v1.24.3 and v1.24.4 releases never published: their wheel builds failed on the emulated odd architectures, so no packages reached PyPI and no GitHub release was created for either version. No changes were lost; everything intended for v1.24.3 and v1.24.4 shipped in v1.24.5. Their changelog entries are reproduced below.

---

Contributor-facing changes

• Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

  Related issues and pull requests on GitHub: #1806.

---

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

• Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

  Related issues and pull requests on GitHub: #1804.

---

v1.24.3

(2026-07-19)

Bug fixes

... (truncated)

Changelog

Sourced from yarl's changelog.

v1.24.5

(2026-07-19)

Contributor-facing changes

• Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1806.

---

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

• Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:1804.

---

v1.24.3

(2026-07-19)

... (truncated)

Commits

• 0b30cb0 Release 1.24.5 (#1807)
• 56150c8 Run the IDNA sweep test only on native Linux x86_64 (#1806)
• 515adca Release 1.24.4 (#1805)
• ab5dec2 Do not install hypothesis in the wheel-build test env (#1804)
• f9d10fb Release 1.24.3 (#1803)
• 058b7cb Test lone surrogate handling in encoded and parsed URL paths (#991)
• a181cee Update hypothesis requirement from >=6.156.4 to >=6.157.0 in /requirements (#...
• 28c1bcc Encode scheme-shaped path colon in relative-path builders (#1802)
• 51e2802 Reject hosts with Unicode default-ignorable code points (#1801)
• 3921a73 Drop lone surrogates that split a percent escape in the Cython quoter (#1752)
• Additional commits viewable in compare view

Updates ruff to 0.16.1

Release notes

Sourced from ruff's releases.

0.16.1

Release Notes

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.1

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

Documentation

• Cover pycon Markdown formatting (#27153)
• [flake8-bandit] Document TYPE_CHECKING exception (S101) (#27004)
• [flake8-import-conventions] Document that extend-aliases can override default aliases (#27191)
• [pylint] Add missing fix safety gotchas for non-augmented-assignment (PLR6104) (#27250)

Other changes

• Reduce syntax error noise by swallowing dedents like indents (#27170)
• Vendor latest annotate-snippets (#27033)

Contributors

• @​bxff
• @​anishgirianish
• @​Avasam
• @​epage
• @​LHMQ878
• @​MichaReiser

... (truncated)

Commits

• 80790b3 Bump 0.16.1 (#27330)
• 63830f3 [ty] Borrow from constraint set storage less often (#27328)
• f40dca9 [ty] Preserve forwarded expanded-variadic diagnostic sources (#27266)
• 0d80497 Lint TOML files in the LSP (#26862)
• d91586b Update prek dependencies (#27293)
• 7da4b8b [ty] Respect bounds and constraints in generic materializations (#27228)
• b20daf7 [ty] refactor: add helper function to send partial results (#27249)
• 4d4c8fa [ty] Emit diagnostic when specializing a non-generic class (#26883)
• 7c3e2db [ty] Fix enum class container assignability (#27318)
• d5ef97f [flake8-return] Fix false positive when variable is read in finally claus...
• Additional commits viewable in compare view

Updates coverage to 7.15.3

Release notes

Sourced from coverage's releases.

7.15.3

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.
• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️  PyPI page: coverage 7.15.3. :arrow_right:  To install: python3 -m pip install coverage==7.15.3

Changelog

Sourced from coverage's changelog.

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>. Closes issue 2200.

• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios <pull 2239_>_.

• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: coveragepy/coveragepy#2200 .. _pull 2234: coveragepy/coveragepy#2234 .. _pull 2239: coveragepy/coveragepy#2239 .. _pull 2240: coveragepy/coveragepy#2240

.. _changes_7-15-2:

Version 7.15.2 — 2026-07-15

• Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

• Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

• A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213

... (truncated)

Commits

• b7470d9 docs: sample HTML for 7.15.3
• 27e6e80 docs: prep for 7.15.3
• 396dbbb build: include NOTICE in wheels (#2232)
• 54dde05 chore: bump the action-dependencies group with 7 updates (#2248)
• c83a0e0 perf: skip AST parsing without soft keywords (#2240)
• a57f981 refactor: fix some uncovered lines
• 0252c34 refactor: move numbits aggregate to numbits
• 1c4184c docs: maintainer workflow
• e8a1c87 perf: speed up SQLite numbits aggregation (#2239)
• 18c2a59 test: conditional use of Hypothesis
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions