Skip to content

chore(deps-dev): bump the python-deps group with 10 updates#97

Merged
nfb2021 merged 1 commit into
mainfrom
dependabot/pip/python-deps-df0baa3342
May 6, 2026
Merged

chore(deps-dev): bump the python-deps group with 10 updates#97
nfb2021 merged 1 commit into
mainfrom
dependabot/pip/python-deps-df0baa3342

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 6, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on anywidget, commitizen, marimo, mystmd, pytest, pytest-cov, ruff, traitlets, ty and zensical to permit the latest version.
Updates anywidget to 0.11.0

Release notes

Sourced from anywidget's releases.

anywidget@0.11.0

This release implements the widget composition RFC shared earlier this year. All changes are additive: existing widgets keep working without modification.

Background

For the past year, anywidget has predominantly been in maintenance mode. The library works, and the community has been expanding on both ends (more host platforms and more widgets shipped on top of it).

A stretch of stability also tends to surface what's still missing. One pattern that kept coming up (#28, #193, #855) was a different kind of widget than the AFM had been designed around.

Prior to v0.11, anywidget was a good fit for widgets that own a self-contained piece of the screen (a chart, a map, a control). Two limitations got in the way of anything else:

  • Composition was left to the host. A widget that wanted to lay out other widgets had to be expressed using whatever container the host provides (ipywidgets.HBox / ipywidgets.VBox in Jupyter, mo.hstack / mo.vstack in marimo). Container widgets that ship as a single anywidget primitive were not expressible.
  • Shared interfaces were limited to model state. The only thing one widget could know about another was what was exposed on the synced model. Calling panTo(lat, lng) or highlight(rowId) on another widget on the page had to round-trip through a synced trait.

v0.11 closes both gaps with three additions to the front-end contract.

For the full narrative, see the blog post: anywidgets All the Way Down.

For the formal spec, see the updated AFM specification.

What's new

signal (AbortSignal) on initialize and render (#974)

Both initialize and render now receive an AbortSignal via the signal prop. The host aborts it when the widget is destroyed (or during HMR). This is the preferred way to manage cleanup going forward, since it composes with web platform APIs that already accept an AbortSignal (addEventListener, fetch, child widgets):

// before
export default {
  render({ model, el }) {
    let handler = () => { /* ... */ };
    el.addEventListener("click", handler);
    return () => el.removeEventListener("click", handler);
  },
};
// after
export default {
render({ model, el, signal }) {
el.addEventListener("click", () => { /* ... */ }, { signal });
},
};

Returning a cleanup callback from render (or initialize) still works, so existing widgets need no changes. New code is encouraged to prefer signal.

initialize MAY return an exports object (#974)

initialize runs once per widget instance. In v0.11, it MAY return a plain object: the widget's exports. The host stores it and exposes it to other widgets that resolve this one as a reference (next section).

... (truncated)

Commits
  • 5789879 Version Packages (#986)
  • 4d15a1f Draft v0.11 release blog post (#991)
  • bd746a4 chore(deps): bump esbuild from 0.21.5 to 0.28.0 in the prod-dependencies grou...
  • c575c88 chore(deps-dev): bump @​typescript/native-preview from 7.0.0-dev.20260410.1 to...
  • aec303e chore(deps): bump @​types/node from 12.20.55 to 25.6.0 (#981)
  • 77c5b81 chore(deps): bump react-dom and @​types/react-dom (#982)
  • cb1f469 chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 up...
  • b76b9c6 Fix orphaned ready promise on widget rebind (#988)
  • 0399b9a Fix HMR race when _esm changes during widget load (#987)
  • bad65ae Rename snake_case identifiers to camelCase (#977)
  • Additional commits viewable in compare view

Updates commitizen to 4.15.1

Release notes

Sourced from commitizen's releases.

v4.15.1 (2026-05-06)

Fix

  • security: prevent command injection via shell=True (CWE-78) (#1941)
Changelog

Sourced from commitizen's changelog.

v4.13.9 (2026-02-25)

Fix

  • avoid raising an exception when a change_type is not defined (#1879)

v4.13.8 (2026-02-18)

Fix

  • config: fix contains_commitizen_section failing for completely empty files

v4.13.7 (2026-02-09)

Fix

  • provider: use encoding settings in config (#1857)

v4.13.6 (2026-02-07)

Fix

  • bump: preserve existing changelog header when changelog_merge_prerelease is used with cz bump --changelog (#1850)

v4.13.5 (2026-02-05)

Fix

  • changelog: add incremental parameter to changelog generation (#1808)

v4.13.4 (2026-02-04)

Fix

  • pre-commit-hooks: correct rev-range syntax in commitizen-branch (#1841)

v4.13.3 (2026-02-04)

Refactor

  • version_schemes: shorten generate_prerelease (#1838)

v4.13.2 (2026-02-03)

Refactor

  • simplify code with pathlib Path object (#1840)
  • tags: extract version resolution method (#1839)

v4.13.1 (2026-02-03)

... (truncated)

Commits
  • efb1a7d bump: version 4.15.0 → 4.15.1
  • 0cc88a5 fix(security): prevent command injection via shell=True (CWE-78) (#1941)
  • 509ef91 docs(cli/screenshots): update CLI screenshots
  • 9b53b63 ci: rebase before push in screenshots workflow (#1942)
  • bdcf27b docs(cli/screenshots): update CLI screenshots
  • b4f4209 bump: version 4.14.0 → 4.15.0
  • b5e0840 feat(version): add MANUAL_VERSION, --next and --patch to version command (#1724)
  • d157e09 docs(cli/screenshots): update CLI screenshots
  • 06850b2 docs: update AGENTS.md with CI/linting guidance and known pitfalls (#1940)
  • 35ffe03 docs(cli/screenshots): update CLI screenshots
  • Additional commits viewable in compare view

Updates marimo to 0.23.5

Release notes

Sourced from marimo's releases.

0.23.5

What's Changed

This release adds editable code in slide view, OpenTelemetry distributed tracing support, and patches polars network I/O in WASM notebooks.

⭐ Highlights

Editable code in slide view

Press C (or click the code icon) in slide view to toggle an inline code editor under each slide, including in fullscreen mode. Run mode shows a read-only editor when include-code is enabled.

✨ Enhancements

  • Add OTLP export and W3C trace context propagation to tracing (#9414)
  • Add editable code in slide view (#9389)
  • Patch polars I/O in wasm (#9413)
  • Add a CLI tip for marimo pair (#9422)
  • Prompt user to build fe at first run (#9381)

🐛 Bug fixes

  • Provide upper bound on jedi pin (#9449)
  • Force Content-Disposition on table export downloads (#9426)

📚 Documentation

  • Update marimo-pair docs to mention molab (#9436)

📝 Other changes

  • Add load_notebook helper, simplify AppFileRouter (#9438)
  • Add data-testids to file-explorer dropdown menu items (#9427)
  • Deflake subprocess kill test (#9423)
  • CI: doppler secrets (#9236)

Contributors

Thanks to all our community and contributors who made this release possible: @​akshayka, @​dmadisetti, @​koaning, @​Light2Dark, @​mscolnick, @​ouatu-ro, @​tigretigre

Full Changelog: marimo-team/marimo@0.23.4...0.23.5

Commits

Updates mystmd to 1.9.0

Release notes

Sourced from mystmd's releases.

mystmd@1.9.0

This brings some quality of life improvements for users and fixes several under-the-hood bugs. You can now skip link-checking in --strict mode, which will improve performance significantly for documentation sites with many links!

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​agoose77 (activity) | @​bsipocz (activity) | @​choldgraf (activity) | @​engyrus (activity) | @​FreekPols (activity) | @​mforbes (activity) | @​pancakereport (activity) | @​Polirecyliente (activity) | @​rowanc1 (activity) | @​ryanlovett (activity) | @​stefanv (activity) | @​stevejpurves (activity) | @​TimMonko (activity)

Commits

Updates pytest to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

    -- by aleguy02

Commits

Updates pytest-cov to 7.1.0

Changelog

Sourced from pytest-cov's changelog.

7.1.0 (2026-03-21)

  • Fixed total coverage computation to always be consistent, regardless of reporting settings. Previously some reports could produce different total counts, and consequently can make --cov-fail-under behave different depending on reporting options. See [#641](https://github.com/pytest-dev/pytest-cov/issues/641) <https://github.com/pytest-dev/pytest-cov/issues/641>_.

  • Improve handling of ResourceWarning from sqlite3.

    The plugin adds warning filter for sqlite3 ResourceWarning unclosed database (since 6.2.0). It checks if there is already existing plugin for this message by comparing filter regular expression. When filter is specified on command line the message is escaped and does not match an expected message. A check for an escaped regular expression is added to handle this case.

    With this fix one can suppress ResourceWarning from sqlite3 from command line::

    pytest -W "ignore:unclosed database in <sqlite3.Connection object at:ResourceWarning" ...

  • Various improvements to documentation. Contributed by Art Pelling in [#718](https://github.com/pytest-dev/pytest-cov/issues/718) <https://github.com/pytest-dev/pytest-cov/pull/718>_ and "vivodi" in [#738](https://github.com/pytest-dev/pytest-cov/issues/738) <https://github.com/pytest-dev/pytest-cov/pull/738>. Also closed [#736](https://github.com/pytest-dev/pytest-cov/issues/736) <https://github.com/pytest-dev/pytest-cov/issues/736>.

  • Fixed some assertions in tests. Contributed by in Markéta Machová in [#722](https://github.com/pytest-dev/pytest-cov/issues/722) <https://github.com/pytest-dev/pytest-cov/pull/722>_.

  • Removed unnecessary coverage configuration copying (meant as a backup because reporting commands had configuration side-effects before coverage 5.0).

7.0.0 (2025-09-09)

  • Dropped support for subprocesses measurement.

    It was a feature added long time ago when coverage lacked a nice way to measure subprocesses created in tests. It relied on a .pth file, there was no way to opt-out and it created bad interations with coverage's new patch system <https://coverage.readthedocs.io/en/latest/config.html#run-patch>_ added in 7.10 <https://coverage.readthedocs.io/en/7.10.6/changes.html#version-7-10-0-2025-07-24>_.

    To migrate to this release you might need to enable the suprocess patch, example for .coveragerc:

    .. code-block:: ini

    [run] patch = subprocess

    This release also requires at least coverage 7.10.6.

  • Switched packaging to have metadata completely in pyproject.toml and use hatchling <https://pypi.org/project/hatchling/>_ for building. Contributed by Ofek Lev in [#551](https://github.com/pytest-dev/pytest-cov/issues/551) <https://github.com/pytest-dev/pytest-cov/pull/551>_ with some extras in [#716](https://github.com/pytest-dev/pytest-cov/issues/716) <https://github.com/pytest-dev/pytest-cov/pull/716>_.

  • Removed some not really necessary testing deps like six.

... (truncated)

Commits
  • 66c8a52 Bump version: 7.0.0 → 7.1.0
  • f707662 Make the examples use pypy 3.11.
  • 6049a78 Make context test use the old ctracer (seems the new sysmon tracer behaves di...
  • 8ebf20b Update changelog.
  • 861d30e Remove the backup context manager - shouldn't be needed since coverage 5.0, ...
  • fd4c956 Pass the precision on the nulled total (seems that there's some caching goion...
  • 78c9c4e Only run the 3.9 on older deps.
  • 4849a92 Punctuation.
  • 197c35e Update changelog and hopefully I don't forget to publish release again :))
  • 14dc1c9 Update examples to use 3.11 and make the adhoc layout example look a bit more...
  • Additional commits viewable in compare view

Updates ruff to 0.15.12

Release notes

Sourced from ruff's releases.

0.15.12

Release Notes

Released on 2026-04-24.

Preview features

  • Implement #ruff:file-ignore file-level suppressions (#23599)
  • Implement #ruff:ignore logical-line suppressions (#23404)
  • Revert preview changes to displayed diagnostic severity in LSP (#24789)
  • [airflow] Implement task-branch-as-short-circuit (AIR004) (#23579)
  • [flake8-bugbear] Fix break/continue handling in loop-iterator-mutation (B909) (#24440)
  • [pylint] Fix PLC2701 for type parameter scopes (#24576)

Rule changes

  • [pandas-vet] Suggest .array as well in PD011 (#24805)

CLI

  • Respect default Unix permissions for cache files (#24794)

Documentation

  • [pylint] Fix PLR0124 description not to claim self-comparison always returns the same value (#24749)
  • [pyupgrade] Expand docs on reusable TypeVars and scoping (UP046) (#24153)
  • Improve rules table accessibility (#24711)

Contributors

Install ruff 0.15.12

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.12/ruff-installer.sh | sh

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.12

Released on 2026-04-24.

Preview features

  • Implement #ruff:file-ignore file-level suppressions (#23599)
  • Implement #ruff:ignore logical-line suppressions (#23404)
  • Revert preview changes to displayed diagnostic severity in LSP (#24789)
  • [airflow] Implement task-branch-as-short-circuit (AIR004) (#23579)
  • [flake8-bugbear] Fix break/continue handling in loop-iterator-mutation (B909) (#24440)
  • [pylint] Fix PLC2701 for type parameter scopes (#24576)

Rule changes

  • [pandas-vet] Suggest .array as well in PD011 (#24805)

CLI

  • Respect default Unix permissions for cache files (#24794)

Documentation

  • [pylint] Fix PLR0124 description not to claim self-comparison always returns the same value (#24749)
  • [pyupgrade] Expand docs on reusable TypeVars and scoping (UP046) (#24153)
  • Improve rules table accessibility (#24711)

Contributors

0.15.11

Released on 2026-04-16.

Preview features

  • [ruff] Ignore RUF029 when function is decorated with asynccontextmanager (#24642)
  • [airflow] Implement airflow-xcom-pull-in-template-string (AIR201) (#23583)
  • [flake8-bandit] Fix S103 false positives and negatives in mask analysis (#24424)

... (truncated)

Commits
  • 66f93cf Bump 0.15.12 (#24815)
  • 476a4d0 [ty] Complete support for more detailed diagnostics on possibly unbound error...
  • ed669ea Implement #ruff:file-ignore file-level suppressions (#23599)
  • e73d952 [ty] Include inferred type in invalid-key concise diagnostic for union/inte...
  • 80feb29 [ty] report only dead annotation-only locals as unused (#24811)
  • 0fbf2bc Drop deprecated license classifier (#24808)
  • 43b174c [ty] Infer lambda parameter types with Callable type context (#24317)
  • 4f449ae [ty] Add error context for intersection types (#24772)
  • 5b4e753 [ty] Add support for goto in literal enum member inlay hint (#24792)
  • e7cc762 [ty] Add error context for TypedDict assignments (#24790)
  • Additional commits viewable in compare view

Updates traitlets to 5.15.0

Release notes

Sourced from traitlets's releases.

v5.15.0

5.15.0

(Full Changelog)

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

  • Use extension:filetype mapping in sphinx configuration #928 (@​Carreau)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​EwoutH (activity) | @​fleming79 (activity) | @​ivanov (activity) | @​JohanMabille (activity) | @​kylebarron (activity) | @​minrk (activity) | @​ryumasai (activity) | @​sethtroisi (activity) | @​SylvainCorlay (activity)

Changelog

Sourced from traitlets's changelog.

5.15.0

(Full Changelog)

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

  • Use extension:filetype mapping in sphinx configuration #928 (@​Carreau)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​EwoutH (activity) | @​fleming79 (activity) | @​ivanov (activity) | @​JohanMabille (activity) | @​kylebarron (activity) | @​minrk (

@dependabot
chore(deps-dev): bump the python-deps group with 10 updates
cee733e 
Updates the requirements on [anywidget](https://github.com/manzt/anywidget), [commitizen](https://github.com/commitizen-tools/commitizen), [marimo](https://github.com/marimo-team/marimo), [mystmd](https://github.com/jupyter-book/mystmd), [pytest](https://github.com/pytest-dev/pytest), [pytest-cov](https://github.com/pytest-dev/pytest-cov), [ruff](https://github.com/astral-sh/ruff), [traitlets](https://github.com/ipython/traitlets), [ty](https://github.com/astral-sh/ty) and [zensical](https://github.com/zensical/zensical) to permit the latest version.

Updates `anywidget` to 0.11.0
- [Release notes](https://github.com/manzt/anywidget/releases)
- [Commits](https://github.com/manzt/anywidget/compare/anywidget@0.10.0...anywidget@0.11.0)

Updates `commitizen` to 4.15.1
- [Release notes](https://github.com/commitizen-tools/commitizen/releases)
- [Changelog](https://github.com/commitizen-tools/commitizen/blob/master/CHANGELOG.md)
- [Commits](commitizen-tools/commitizen@v4.13.10...v4.15.1)

Updates `marimo` to 0.23.5
- [Release notes](https://github.com/marimo-team/marimo/releases)
- [Commits](marimo-team/marimo@0.23.4...0.23.5)

Updates `mystmd` to 1.9.0
- [Release notes](https://github.com/jupyter-book/mystmd/releases)
- [Commits](https://github.com/jupyter-book/mystmd/compare/mystmd@1.8.3...mystmd@1.9.0)

Updates `pytest` to 9.0.3
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.1...9.0.3)

Updates `pytest-cov` to 7.1.0
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](pytest-dev/pytest-cov@v7.0.0...v7.1.0)

Updates `ruff` to 0.15.12
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.10...0.15.12)

Updates `traitlets` to 5.15.0
- [Release notes](https://github.com/ipython/traitlets/releases)
- [Changelog](https://github.com/ipython/traitlets/blob/main/CHANGELOG.md)
- [Commits](ipython/traitlets@v5.14.3...v5.15.0)

Updates `ty` to 0.0.34
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.33...0.0.34)

Updates `zensical` to 0.0.40
- [Release notes](https://github.com/zensical/zensical/releases)
- [Commits](zensical/zensical@v0.0.33...v0.0.40)

---
updated-dependencies:
- dependency-name: anywidget
  dependency-version: 0.11.0
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: commitizen
  dependency-version: 4.15.1
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: marimo
  dependency-version: 0.23.5
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: mystmd
  dependency-version: 1.9.0
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: pytest
  dependency-version: 9.0.3
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: pytest-cov
  dependency-version: 7.1.0
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: ruff
  dependency-version: 0.15.12
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: traitlets
  dependency-version: 5.15.0
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: ty
  dependency-version: 0.0.34
  dependency-type: direct:development
  dependency-group: python-deps
- dependency-name: zensical
  dependency-version: 0.0.40
  dependency-type: direct:development
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency version updates python Python package dependency updates labels May 6, 2026
@dependabot dependabot Bot requested a review from nfb2021 as a code owner May 6, 2026 14:28
@dependabot dependabot Bot added dependencies Dependency version updates python Python package dependency updates labels May 6, 2026
@github-actions

github-actions Bot commented May 6, 2026

Copy link
Copy Markdown
Contributor

Coverage report

This PR does not seem to contain any modification to coverable code.

@nfb2021 nfb2021 merged commit ad9b8c8 into main May 6, 2026
20 checks passed
@dependabot dependabot Bot deleted the dependabot/pip/python-deps-df0baa3342 branch May 6, 2026 14:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nfb2021 nfb2021 Awaiting requested review from nfb2021 nfb2021 is a code owner

Assignees

No one assigned

Labels

dependencies Dependency version updates python Python package dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nfb2021