GHA: Bump the pip-dependencies group across 2 directories with 7 updates by dependabot[bot] · Pull Request #4 · testifysec/curl

dependabot · 2026-08-01T06:09:53Z

Bumps the pip-dependencies group with 2 updates in the /.github/scripts directory: codespell and ruff.
Bumps the pip-dependencies group with 5 updates in the /tests directory:

Package	From	To
impacket	`0.13.0`	`0.13.1`
cryptography	`46.0.7`	`49.0.0`
filelock	`3.29.0`	`3.32.0`
pytest	`9.0.3`	`9.1.1`
websockets	`16.0`	`16.1.1`

Updates codespell from 2.4.2 to 2.4.3

Release notes

Sourced from codespell's releases.

v2.4.3

What's Changed

Add 'radback' to dictionary with correction by @Flo3561 in codespell-project/codespell#3883

Add 'repetirion' to dictionary corrections by @Flo3561 in codespell-project/codespell#3885

Need to specify a version of Python version after all by @DimitriPapadopoulos in codespell-project/codespell#3887

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3889

Add cases for "modulle" -> "module" by @utzcoz in codespell-project/codespell#3888

Add case "auido" -> "audio" by @utzcoz in codespell-project/codespell#3890

Add credentilas->credentials and friends by @peternewman in codespell-project/codespell#3895

Add the case "cubid" -> "cubic" by @utzcoz in codespell-project/codespell#3891

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3897

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3900

Bump codecov/codecov-action from 5 to 6 by @dependabot[bot] in codespell-project/codespell#3902

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3904

Add magntiude->magnitude by @nathanjmcdougall in codespell-project/codespell#3899

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3909

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3912

Add the case "instanc" -> "instance" by @utzcoz in codespell-project/codespell#3896

gampad -> gamepad (and plural) by @julianstirling in codespell-project/codespell#3906

Add typos of monotonic and monotonicity by @nathanjmcdougall in codespell-project/codespell#3898

Add spelling correction for multipile(s)/vulnerabities. by @cfi-gb in codespell-project/codespell#3905

Add 'simpilfy -> simplify' by @alexreinking in codespell-project/codespell#3913

fix(packaging): prevent unwanted files and tests from being installed by @mikelolasagasti in codespell-project/codespell#3911

Add skarhoj->SKAARHOJ to dictionary corrections by @peternewman in codespell-project/codespell#3908

Improve the dictionary by @algonell in codespell-project/codespell#3914

Add spelling correction for accorss/accors. by @cfi-gb in codespell-project/codespell#3916

Bump autofix-ci/action from 1.3.3 to 1.3.4 by @dependabot[bot] in codespell-project/codespell#3921

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3923

Add influecer->influencer and influnce* typos to dictionary by @nathanjmcdougall in codespell-project/codespell#3925

Add typos for excavate and variants by @nathanjmcdougall in codespell-project/codespell#3926

Dict: Add corrections for memoy by @mdeweerd in codespell-project/codespell#3924

overheda -> overhead by @George-Ogden in codespell-project/codespell#3919

inclusize->inclusive and variants by @George-Ogden in codespell-project/codespell#3918

Add spelling corrections for authorization by @cfi-gb in codespell-project/codespell#3922

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3927

Don't fix Voight by @DimitriPapadopoulos in codespell-project/codespell#3929

Add spelling corrections for interstect and interstection by @korli in codespell-project/codespell#3928

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3930

Improve output in interactive mode by @darkmattercoder in codespell-project/codespell#3884

feat: support codespell:ignore-next-line directive by @SAY-5 in codespell-project/codespell#3931

Add woork->work and formace->format and friends by @peternewman in codespell-project/codespell#3828

shortctu -> shortcut by @George-Ogden in codespell-project/codespell#3934

A couple typos by @DimitriPapadopoulos in codespell-project/codespell#3935

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3937

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3942

reclaculate->recalculate by @adamgann in codespell-project/codespell#3936

Add spelling correction for improprt. by @cfi-gb in codespell-project/codespell#3939

Dictionary plasic-plastic by @julianstirling in codespell-project/codespell#3938

... (truncated)

Commits

57b2140 Read only [tool.codespell] from TOML config (#3975)
23b8d94 [pre-commit.ci] pre-commit autoupdate
926c4d6 [pre-commit.ci] pre-commit autoupdate
820a301 Merge pull request #3967 from codespell-project/peternewman-patch-1
9fe42c9 Add common misspellings for reseeve->reserve to dictionary
725173c [pre-commit.ci] pre-commit autoupdate
86c13ee [pre-commit.ci] pre-commit autoupdate
7b9f36c Bump actions/checkout from 6 to 7
bcc1b80 Add spelling corrections for simpe and variants.
89584cc [pre-commit.ci] pre-commit autoupdate
Additional commits viewable in compare view

Updates ruff from 0.15.12 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes
Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.
Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:
import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os
Fixes are now shown in check and format --check output:
❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted
This example also shows off the Markdown formatting.
format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:
❯ ruff format --check --output-format github .
::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted
See the CLI help or documentation for the full list of supported formats.
The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes
Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.
Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:
import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os
Fixes are now shown in check and format --check output:
❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted
This example also shows off the Markdown formatting.
format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

a2635fd Bump 0.16.0 (#27136)
3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
17ef711 Stabilize --add-ignore (#27125)
ef912bb Add newly stabilized rules to defaults (#27055)
b30f040 Stabilize new default rules (#27035)
bcd70c5 Exclude Markdown files from format-dev runs (#27052)
87e51e2 Fix format --check spans for syntax errors (#27045)
afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
Additional commits viewable in compare view

Updates impacket from 0.13.0 to 0.13.1

Release notes

Sourced from impacket's releases.

Impacket 0.13.1

Project's main page at https://www.coresecurity.com/core-labs/open-source-tools/impacket Release blogpost at https://www.coresecurity.com/blog/whats-new-impacket-0131

ChangeLog for v0.13.1:

Library improvements

SMB: Improved server and relay behavior with SMB server signing support, optional read-only shares, Kerberos/NTLM authentication controls, graceful SMB relay packet handling, SMBv1 relay fixes, SMB 3.1.1 negotiation fixes, and clearer errors for truncated SMB responses. (Fixes #2099, #2085, #2111, #2114, #2129)

Kerberos: Fixed S4U2Self service ticket parsing, non-ASCII authentication encoding, LSA Kerberos key decryption, GSSAPI BER length parsing, ccache/kirbi conversion edge cases, and PAC preservation/signing helpers used by ticket tooling. (#2087, #2068, #2088, #2130, #2159, #2164)

MSSQL/TDS: Added TDS 8.0 support for Force Strict Encryption targets, EPA channel binding handling, TDS_SSVARIANT parsing, stricter TLS-backed packet handling, workstation/application name support, and more reliable SQL reply error tracking. (#2074, #2075, #2082, #2098, #2122)

DCE/RPC and WMI: Added WMI PutClass/DeleteClass support, Remote Event Log subscription calls, Remote Desktop Services process parsing fixes, SCMR failure action marshaling fixes, and safer TCP transport handling on empty receives. (#1803, #2061, #2046, #2152, #2155)

Directory and data parsing: Added LDAP CRUD helpers, improved LDAP attribute handling, fixed large-page ESE tag parsing for Windows Server 2025 NTDS.dit files, improved NTFS sparse and INDEX_ROOT reads, fixed DPAPI_BLOB parsing with oversized input, and corrected high-codepoint unicode structure sizing. (#1764, #1995, #2097, #2106, #2112, #2158)

Added a reusable ACL helper module and expanded regression coverage for ACLs, NTFS, TDS, Kerberos, ESE, SCMR, WMI, SMB, and packet parsing. (#1240)

Examples improvements

ntlmrelayx.py:

Added MSSQL and RDP relay servers, strict MSSQL relay support, TLS-backed TDS frame reassembly, NTLM sign/seal removal paths for CVE-2025-33073-related relay workflows, and --remove-mic handling. (#2083, #2101, #2122, #2133)

Improved WinRM relay error handling and NTLMv2 detection, fixed WinRM NTLM relay behavior, made SMB relay negotiation more conservative by avoiding unsupported NEGOEX advertisement, and added multibyte AD CS template name support. (#2089, #2111, #2127, #2163)

Added shadow credentials commands to the interactive LDAP shell and updated KeyCreds handling for the January 2026 Windows changes. (#1402, #2109)

secretsdump.py:

Added SAM history parsing, improved offline machine account and Kerberos key recovery, fixed negative timestamps on Windows, added SAM password timestamp output, and filtered offline NTDS rows by local domain SID. (#2059, #2069, #2135, #2142, #2178)

regsecrets.py:

Added SAM history parsing. (#2059)

ticketer.py:

Improved ccache handling and preserved KDC-issued lifetimes for diamond tickets. (#2159, #2181)

ticketConverter.py:

Improved kirbi/ccache conversion, preserved ticket flags, converted all TGS entries, and added base64 output support. (#2104, #2159)

describeTicket.py:

Fixed credential indexing after skipped decrypts and improved Kerberoast debug output. (#2117)

raiseChild.py:

Preserved PAC buffers, added AES support for modern Windows environments, and improved ticket retry behavior. (#2164)

smbclient.py:

Added ACL management support, recursive rget, and richer share listing output with type and comments. (#1240, #2110, #2156)

mssqlclient.py:

Added workstation/application name options, linked-server RPC enable/disable commands, custom CBT support, and better MSSQL shell behavior. (#2074, #2098, #2134)

ntfs-read.py:

Improved INDEX_ROOT file listing, sparse file support, error handling, and read correctness. (#2106)

tstool.py:

Added Remote Desktop Shadowing support. (#2064)

badsuccessor.py:

Fixed ACE filtering and ObjectType GUID parsing that could cause false negatives when searching OUs. (#2170)

GetUserSPNs.py:

Added an option to avoid forcing RC4-HMAC when requesting a TGT. (#2141)

owneredit.py:

Improved distinguished name lookup behavior. (#2162)

exchanger.py:

Added Basic Authentication support. (#2077)

reg.py:

Added support for persistent registry key creation. (#2113)

... (truncated)

Changelog

Sourced from impacket's changelog.

Impacket v0.13.1 (May 2026):

Library improvements

SMB: Improved server and relay behavior with SMB server signing support, optional read-only shares, Kerberos/NTLM authentication controls, graceful SMB relay packet handling, SMBv1 relay fixes, SMB 3.1.1 negotiation fixes, and clearer errors for truncated SMB responses. (Fixes #2099, #2085, #2111, #2114, #2129)

Kerberos: Fixed S4U2Self service ticket parsing, non-ASCII authentication encoding, LSA Kerberos key decryption, GSSAPI BER length parsing, ccache/kirbi conversion edge cases, and PAC preservation/signing helpers used by ticket tooling. (#2087, #2068, #2088, #2130, #2159, #2164)

MSSQL/TDS: Added TDS 8.0 support for Force Strict Encryption targets, EPA channel binding handling, TDS_SSVARIANT parsing, stricter TLS-backed packet handling, workstation/application name support, and more reliable SQL reply error tracking. (#2074, #2075, #2082, #2098, #2122)

DCE/RPC and WMI: Added WMI PutClass/DeleteClass support, Remote Event Log subscription calls, Remote Desktop Services process parsing fixes, SCMR failure action marshaling fixes, and safer TCP transport handling on empty receives. (#1803, #2061, #2046, #2152, #2155)

Directory and data parsing: Added LDAP CRUD helpers, improved LDAP attribute handling, fixed large-page ESE tag parsing for Windows Server 2025 NTDS.dit files, improved NTFS sparse and INDEX_ROOT reads, fixed DPAPI_BLOB parsing with oversized input, and corrected high-codepoint unicode structure sizing. (#1764, #1995, #2097, #2106, #2112, #2158)

Added a reusable ACL helper module and expanded regression coverage for ACLs, NTFS, TDS, Kerberos, ESE, SCMR, WMI, SMB, and packet parsing. (#1240)

Examples improvements

ntlmrelayx.py:

Added MSSQL and RDP relay servers, strict MSSQL relay support, TLS-backed TDS frame reassembly, NTLM sign/seal removal paths for CVE-2025-33073-related relay workflows, and --remove-mic handling. (#2083, #2101, #2122, #2133)

Improved WinRM relay error handling and NTLMv2 detection, fixed WinRM NTLM relay behavior, made SMB relay negotiation more conservative by avoiding unsupported NEGOEX advertisement, and added multibyte AD CS template name support. (#2089, #2111, #2127, #2163)

Added shadow credentials commands to the interactive LDAP shell and updated KeyCreds handling for the January 2026 Windows changes. (#1402, #2109)

secretsdump.py:

Added SAM history parsing, improved offline machine account and Kerberos key recovery, fixed negative timestamps on Windows, added SAM password timestamp output, and filtered offline NTDS rows by local domain SID. (#2059, #2069, #2135, #2142, #2178)

regsecrets.py:

Added SAM history parsing. (#2059)

ticketer.py:

Improved ccache handling and preserved KDC-issued lifetimes for diamond tickets. (#2159, #2181)

ticketConverter.py:

Improved kirbi/ccache conversion, preserved ticket flags, converted all TGS entries, and added base64 output support. (#2104, #2159)

describeTicket.py:

Fixed credential indexing after skipped decrypts and improved Kerberoast debug output. (#2117)

raiseChild.py:

Preserved PAC buffers, added AES support for modern Windows environments, and improved ticket retry behavior. (#2164)

smbclient.py:

Added ACL management support, recursive rget, and richer share listing output with type and comments. (#1240, #2110, #2156)

mssqlclient.py:

Added workstation/application name options, linked-server RPC enable/disable commands, custom CBT support, and better MSSQL shell behavior. (#2074, #2098, #2134)

ntfs-read.py:

Improved INDEX_ROOT file listing, sparse file support, error handling, and read correctness. (#2106)

tstool.py:

Added Remote Desktop Shadowing support. (#2064)

badsuccessor.py:

Fixed ACE filtering and ObjectType GUID parsing that could cause false negatives when searching OUs. (#2170)

GetUserSPNs.py:

Added an option to avoid forcing RC4-HMAC when requesting a TGT. (#2141)

owneredit.py:

Improved distinguished name lookup behavior. (#2162)

exchanger.py:

Added Basic Authentication support. (#2077)

reg.py:

Added support for persistent registry key creation. (#2113)

New examples

... (truncated)

Commits

See full diff in compare view

Updates cryptography from 46.0.7 to 49.0.0

Changelog

Sourced from cryptography's changelog.

49.0.0 - 2026-06-12


* **BACKWARDS INCOMPATIBLE:** Support for ``x86_64`` macOS has been removed.
  We now only publish ``arm64`` wheels for macOS.
* **BACKWARDS INCOMPATIBLE:** Support for 32-bit Windows has been removed.
  Users should move to a 64-bit Python installation.
* **BACKWARDS INCOMPATIBLE:** Removed the deprecated
  ``PUBLIC_KEY_TYPES``, ``PRIVATE_KEY_TYPES``,
  ``CERTIFICATE_PRIVATE_KEY_TYPES``, ``CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES``,
  and ``CERTIFICATE_PUBLIC_KEY_TYPES`` type aliases. Use
  ``PublicKeyTypes``, ``PrivateKeyTypes``, ``CertificateIssuerPrivateKeyTypes``,
  ``CertificateIssuerPublicKeyTypes``, and ``CertificatePublicKeyTypes``
  instead. These were deprecated in version 40.0.
* **BACKWARDS INCOMPATIBLE:** :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20`
  now treats the first 4 bytes of the ``nonce`` as a 32-bit little-endian block
  counter (as defined in :rfc:`7539`) and tracks the number of bytes processed.
  Attempting to encrypt or decrypt more data than the counter allows before it
  would overflow now raises a :class:`ValueError` rather than silently diverging
  from RFC 7539. Setting the counter portion of the ``nonce`` to zero allows
  encrypting up to 256 GiB with a given nonce.
* **BACKWARDS INCOMPATIBLE:** Loading an X.509 certificate whose ECDSA or DSA
  signature ``AlgorithmIdentifier`` contains encoded NULL parameters now raises
  a :class:`ValueError`. Such certificates are invalid, but older versions of
  Java emitted them; previously they loaded with a deprecation warning.
* Fixed cross-compilation of the CFFI bindings when ``PYO3_CROSS_LIB_DIR``
  is set. The build now derives the Python include directory from
  ``PYO3_CROSS_LIB_DIR`` instead of querying the host interpreter, which
  previously caused the build to fail during cross-compilations for embedded
  systems, on hosts which have same-version Python development headers
  installed as the target Python.
* Added support for signing and verifying X.509 certificates, certificate
  signing requests, and certificate revocation lists with
  :doc:`/hazmat/primitives/asymmetric/mldsa` keys, as well as loading
  certificates that contain ML-DSA public keys.
* Added :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length` to
  :class:`~cryptography.hazmat.primitives.hpke.KEM` so callers can split the
  encapsulated key from the ciphertext returned by
  :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
* :meth:`~cryptography.x509.verification.ExtensionPolicy.require_present`,
  :meth:`~cryptography.x509.verification.ExtensionPolicy.may_be_present`, and
  :meth:`~cryptography.x509.verification.ExtensionPolicy.require_not_present`
  now accept any extension type. Previously only a fixed set of extension
  types was supported, which made it impossible to account for otherwise
  unrecognized critical extensions during path validation.
* Added support for using :class:`~cryptography.x509.Certificate`,
  :class:`~cryptography.x509.CertificateSigningRequest`, and
  :class:`~cryptography.x509.CertificateRevocationList` as field types in
  :doc:`/hazmat/asn1/index` structures.
* Added :func:`~cryptography.hazmat.asn1.value_set`, a class decorator that
</tr></table>

... (truncated)

Commits

e300bbe bump version and changelog for 49.0.0 (#15030)
fa74cd8 Add external mu (message representative) support for ML-DSA (#14979)
f594db3 chore(deps): bump openssl from 0.10.80 to 0.10.81 (#15029)
608e011 chore(deps): bump openssl-sys from 0.9.116 to 0.9.117 (#15028)
a322bc4 chore(deps): bump cc from 1.2.63 to 1.2.64 (#15027)
33181a7 Reject critical nameConstraints extensions containing directoryName constrain...
6080dc7 Bump dependencies that dependabot isn't (#15026)
121faa3 chore(deps): bump virtualenv from 21.4.2 to 21.4.3 (#15023)
829520b Add more robust processing for DH parameters. (#15016)
0f05001 Bump downstream dependencies in CI (#15025)
Additional commits viewable in compare view

Updates filelock from 3.29.0 to 3.32.0

Release notes

Sourced from filelock's releases.

3.32.0

What's Changed

👷 ci: add Python 3.15 to the test matrix by @gaborbernat in tox-dev/filelock#683

🐛 fix(packaging): let an unpacked sdist run the test suite by @gaborbernat in tox-dev/filelock#685

Full Changelog: tox-dev/filelock@3.31.2...3.32.0

3.31.2

What's Changed

🐛 fix(strict): tolerate an errno without ENOTSUP by @gaborbernat in tox-dev/filelock#681

Full Changelog: tox-dev/filelock@3.31.1...3.31.2

3.31.1

What's Changed

♻️ refactor(coverage): key exclusions on probed capability by @gaborbernat in tox-dev/filelock#679

scope a lease's claim to the context that acquired it by @dxbjavid in tox-dev/filelock#680

Full Changelog: tox-dev/filelock@3.31.0...3.31.1

3.31.0

What's Changed

✨ feat(platform): support Termux/Android by @gaborbernat in tox-dev/filelock#678

Full Changelog: tox-dev/filelock@3.30.3...3.31.0

3.30.3

What's Changed

Keep both tables of contents on screen at any browser font size by @gaborbernat in tox-dev/filelock#673

📝 docs(mermaid): follow the light and dark theme toggle by @gaborbernat in tox-dev/filelock#674

asyncio: scope the reentrant-deadlock registry to the owning task by @xt-yin in tox-dev/filelock#676

New Contributors

@xt-yin made their first contribution in tox-dev/filelock#676

Full Changelog: tox-dev/filelock@3.30.2...3.30.3

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

3.32.2 (2026-07-29)

A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

3.32.1 (2026-07-26)

Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

3.32.0 (2026-07-21)

SoftReadWriteLock closes the directory handle it opens to scan for readers as soon as a scan stops early, rather than holding it until the generator is collected. :pr:685

Declare support for Python 3.15 and run the test suite against it and its free-threaded build, both currently in beta. :pr:683

The source distribution ships the capability probes the tests import, and reading one no longer needs coverage installed, so the suite runs from an unpacked sdist instead of failing on a missing coverage_pragmas. :pr:685

3.31.2 (2026-07-21)

filelock imports again on runtimes whose errno omits ENOTSUP, such as GraalPy, where importing the package raised ImportError. It probes the code instead, preferring ENOTSUP, falling back to EOPNOTSUPP where that name is absent, and dropping to ENOSYS/EXDEV where neither exists. Platforms defining ENOTSUP keep their behavior. :pr:681

3.31.1 (2026-07-20)

A SoftFileLease acquired on one thread keeps its claim when another thread fails to acquire the same lease object, so its heartbeat carries on refreshing the marker instead of being torn down and letting a peer take the live claim. :pr:680

... (truncated)

Commits

76525e6 Release 3.32.0
9824d15 🐛 fix(packaging): let an unpacked sdist run the test suite (#685)
f6c41e9 👷 ci: add Python 3.15 to the test matrix (#683)
caeb1c9 Release 3.31.2
60eda0f 🐛 fix(strict): tolerate an errno without ENOTSUP (#681)
c1b2e6f Release 3.31.1
9fd7de5 scope a lease's claim to the context that acquired it (#680)
2b3ad2c ♻️ refactor(coverage): key exclusions on probed capability (#679)
3b66fdc Release 3.31.0
166b2b5 ✨ feat(platform): support Termux/Android (#678)
Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

#14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.

#14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".

#14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.

#14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

#14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

If this is undesirable, move the fixture definition to a conftest.py file if possible.

Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

#10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

See 10819 and 14011.

#12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

See dynamic-fixture-request-during-teardown for details.

#13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

See parametrize-iterators for details and suggestions.

#13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

See config-inicfg for more details.

#14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

cf470ec Prepare release version 9.1.1
e0c8ce6 Merge pull request

Bumps the pip-dependencies group with 2 updates in the /.github/scripts directory: [codespell](https://github.com/codespell-project/codespell) and [ruff](https://github.com/astral-sh/ruff). Bumps the pip-dependencies group with 5 updates in the /tests directory: | Package | From | To | | --- | --- | --- | | [impacket](https://github.com/fortra/impacket) | `0.13.0` | `0.13.1` | | [cryptography](https://github.com/pyca/cryptography) | `46.0.7` | `49.0.0` | | [filelock](https://github.com/tox-dev/py-filelock) | `3.29.0` | `3.32.0` | | [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` | | [websockets](https://github.com/python-websockets/websockets) | `16.0` | `16.1.1` | Updates `codespell` from 2.4.2 to 2.4.3 - [Release notes](https://github.com/codespell-project/codespell/releases) - [Commits](codespell-project/codespell@v2.4.2...v2.4.3) Updates `ruff` from 0.15.12 to 0.16.0 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.12...0.16.0) Updates `impacket` from 0.13.0 to 0.13.1 - [Release notes](https://github.com/fortra/impacket/releases) - [Changelog](https://github.com/fortra/impacket/blob/master/ChangeLog.md) - [Commits](https://github.com/fortra/impacket/commits) Updates `cryptography` from 46.0.7 to 49.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.7...49.0.0) Updates `filelock` from 3.29.0 to 3.32.0 - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@3.29.0...3.32.0) Updates `pytest` from 9.0.3 to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.3...9.1.1) Updates `websockets` from 16.0 to 16.1.1 - [Release notes](https://github.com/python-websockets/websockets/releases) - [Commits](python-websockets/websockets@16.0...16.1.1) --- updated-dependencies: - dependency-name: codespell dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-dependencies - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-dependencies - dependency-name: impacket dependency-version: 0.13.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-dependencies - dependency-name: cryptography dependency-version: 49.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: pip-dependencies - dependency-name: filelock dependency-version: 3.32.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-dependencies - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-dependencies - dependency-name: websockets dependency-version: 16.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 1, 2026

github-actions Bot added documentation Improvements or additions to documentation CI tests labels Aug 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

GHA: Bump the pip-dependencies group across 2 directories with 7 updates - #4

GHA: Bump the pip-dependencies group across 2 directories with 7 updates#4
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/dot-github/scripts/pip-dependencies-e68b394e85

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

v2.4.3

What's Changed

0.16.0

Release Notes

Breaking changes

0.16.0

Breaking changes

Impacket 0.13.1

Impacket v0.13.1 (May 2026):

3.32.0

What's Changed

3.31.2

What's Changed

3.31.1

What's Changed

3.31.0

What's Changed

3.30.3

What's Changed

New Contributors

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

Deprecations (removal in next major release)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants