Skip to content

Bump the python-requirements group across 1 directory with 7 updates - #258

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-requirements-89b6d24c94
Open

Bump the python-requirements group across 1 directory with 7 updates#258
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-requirements-89b6d24c94

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on fonttools, pillow, python-fsutil, coverage, mypy, pre-commit and tox to permit the latest version.
Updates fonttools from 4.62.1 to 4.63.0

Release notes

Sourced from fonttools's releases.

4.63.0

  • [ttLib] Add support for Apple Color Emoji bgcl table (#4065).
  • [ttLib] Add support for IFT and IFTX tables (Incremental Font Transfer, PatchMapFormat2) (#4070, #4072).
  • [otData] Introduce FieldSpec dataclass for OpenType table schema definitions, replacing raw tuples in otData.py (#4076).
  • [Feat] Show name table strings as comments next to label IDs in TTX output, matching the convention used by fvar, STAT, trak (#4089).
  • [cu2qu] Fix Cython complex-division rounding difference in split_cubic_into_three that could cause ±1 off-curve coordinate shifts (#3928, #4083).
  • [designspaceLib] Fix map_backwardgooglefonts/ufo2ft#978#4085).
  • [OS/2] Fix setUnicodeRanges to accept reserved bits 123-127, restoring round-trip with getUnicodeRanges and fixing recalcUnicodeRanges crash in the subsetter (#4087, #4088).
  • [cython] Declare Cython extensions as free-threading compatible on Python 3.13+, so that importing them on free-threaded Python no longer re-enables the GIL (#4073, #4090).
Changelog

Sourced from fonttools's changelog.

4.63.0 (released 2026-05-14)

  • [ttLib] Add support for Apple Color Emoji bgcl table (#4065).
  • [ttLib] Add support for IFT and IFTX tables (Incremental Font Transfer, PatchMapFormat2) (#4070, #4072).
  • [otData] Introduce FieldSpec dataclass for OpenType table schema definitions, replacing raw tuples in otData.py (#4076).
  • [Feat] Show name table strings as comments next to label IDs in TTX output, matching the convention used by fvar, STAT, trak (#4089).
  • [cu2qu] Fix Cython complex-division rounding difference in split_cubic_into_three that could cause ±1 off-curve coordinate shifts (#3928, #4083).
  • [designspaceLib] Fix map_backward for many-to-one (flat-segment) axis maps that silently dropped entries via dict comprehension googlefonts/ufo2ft#978#4085).
  • [OS/2] Fix setUnicodeRanges to accept reserved bits 123-127, restoring round-trip with getUnicodeRanges and fixing recalcUnicodeRanges crash in the subsetter (#4087, #4088).
  • [cython] Declare Cython extensions as free-threading compatible on Python 3.13+, so that importing them on free-threaded Python no longer re-enables the GIL (#4073, #4090).
Commits
  • 978d9ed Release 4.63.0
  • 6b40ecb Add changelog entries for 4.63.0
  • 382a35f Merge pull request #4090 from fonttools/fix-freethreading-compat
  • 0e999b5 Declare Cython extensions as free-threading compatible
  • 9e55ea5 Merge pull request #4089 from fonttools/graphite-feat-labels
  • e84db3a Merge pull request #4088 from fonttools/fix-setUnicodeRanges-bits-123-127
  • d6eabd1 Feat: show name table strings as comments next to label IDs in ttx
  • 7d0902b OS/2: fix setUnicodeRanges round-trip for reserved bits 123-127
  • 06e266c Merge pull request #4085 from fonttools/fix-map-backward-non-injective
  • 6d64598 Add more tests for map_backward with many-to-one axis maps
  • Additional commits viewable in compare view

Updates pillow from 12.2.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Documentation

Dependencies

Testing

... (truncated)

Commits
  • bb1d8e8 12.3.0 version bump
  • e63fc48 Add release notes for SBOM and performance improvements (#9747)
  • 13b701b Add release notes for #9679
  • 5564ca7 List methods
  • a0920fd Speed up ImageChops operations (#9738)
  • 07e9a6c Speed up Image.filter() (#9736)
  • a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
  • 53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
  • af03747 Speed up Image.resample() (#9739)
  • 5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
  • Additional commits viewable in compare view

Updates python-fsutil from 0.16.1 to 0.17.0

Release notes

Sourced from python-fsutil's releases.

0.17.0

  • Add support for file-like objects in get_file_hash.
  • Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. #186 (thanks to @​SAY-5)
  • Harden Content-Disposition filename sanitization in download_file to prevent path traversal. #181
  • Bump requirements and pre-commit hooks.
Changelog

Sourced from python-fsutil's changelog.

0.17.0 - 2026-07-07

  • Add support for file-like objects in get_file_hash.
  • Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. #186 (thanks to @​SAY-5)
  • Harden Content-Disposition filename sanitization in download_file to prevent path traversal. #181
  • Bump requirements and pre-commit hooks.
Commits
  • deb6684 Update CHANGELOG and version.
  • fc91d14 Add support for file-like objects in get_file_hash.
  • e1d342b Bump pre-commit hooks.
  • 88a2ed4 Harden Content-Disposition filename sanitization in download_file to preven...
  • 0fe73fd Bump the python-requirements group across 1 directory with 7 updates (#188)
  • 1429dce Bump the github-actions group across 1 directory with 4 updates (#187)
  • 4abb5aa Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. (#186)
  • c98dbf6 Bump pre-commit hooks.
  • 8854ed2 Fix HIGH-level OpenSSF Scorecard code scanning alerts (VulnerabilitiesID) (#175)
  • 8693f3e Update SECURITY.md.
  • Additional commits viewable in compare view

Updates coverage to 7.15.2

Release notes

Sourced from coverage's releases.

7.15.2

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

Changelog

Sourced from coverage's changelog.

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213 .. _pull 2214: coveragepy/coveragepy#2214 .. _pull 2215: coveragepy/coveragepy#2215 .. _pull 2216: coveragepy/coveragepy#2216 .. _pull 2218: coveragepy/coveragepy#2218 .. _pull 2220: coveragepy/coveragepy#2220 .. _pull 2221: coveragepy/coveragepy#2221 .. _pull 2224: coveragepy/coveragepy#2224

.. _changes_7-15-0:

Version 7.15.0 — 2026-07-02

  • Since 7.14.0, reporting commands implicitly combine parallel data files. Now those commands have a new option --keep-combined to retain the data files after combining them instead of the default, which is to delete them. Finishes issue 2198_.

  • Fix: the LCOV report would incorrectly count excluded functions as uncovered, as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen <pull 2206_>.

  • When running your program, coverage now correctly sets

... (truncated)

Commits
  • 50d8659 docs: sample HTML for 7.15.2
  • b5eed20 docs: prep for 7.15.2
  • 78cab6e fix: reduce memory use during reporting. #2229 (#2231)
  • b4c1fda build: bump version to 7.15.2
  • da63bed docs: sample HTML for 7.15.1
  • bc35e64 docs: prep for 7.15.1
  • 182b010 perf: resolve sysmon branch events lazily, one pair at a time (#2221)
  • ee271ee perf: compute multiline maps cheaply in the sysmon core (#2220)
  • 1441b96 chore: bump the action-dependencies group with 6 updates (#2225)
  • dd80635 fix: escape context labels in html report inline script block (#2224)
  • Additional commits viewable in compare view

Updates mypy to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

  • Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
  • Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
  • Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
  • Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
  • Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
  • 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
  • 24c237d [mypyc] Improve documentation of Final (#21713)
  • b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
  • cbcb51a Narrow for frozendict membership check (#21709)
  • af2bc0f Sync typeshed (#21707)
  • Additional commits viewable in compare view

Updates pre-commit to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

4.6.0 - 2026-04-21

Features

  • pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.

Fixes

4.5.1 - 2025-12-16

Fixes

  • Fix language: python with repo: local without additional_dependencies.

4.5.0 - 2025-11-22

Features

4.4.0 - 2025-11-08

... (truncated)

Commits
  • 242ce8a v4.6.1
  • 766e550 Merge pull request #3727 from pre-commit/dedupe
  • 1558d06 Merge pull request #3726 from pre-commit/exists-faster
  • 8a1c47a avoid duplicate files in --all-files during conflict
  • 2e01c99 faster check of rev existing locally as a commit
  • 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
  • 1d811d9 Return an error for invalid --repo
  • 374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
  • 1e7994f set JULIA_DEPOT_PATH
  • b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
  • Additional commits viewable in compare view

Updates tox to 4.58.0

Release notes

Sourced from tox's releases.

v4.58.0

What's Changed

Full Changelog: tox-dev/tox@4.57.2...4.58.0

Changelog

Sourced from tox's changelog.

Miscellaneous internal changes - 4.58.0

  • Test against Python 3.15 (beta) in CI and declare its classifier - by :user:gaborbernat. (:issue:4001)

v4.57.2 (2026-07-21)

Bug fixes - 4.57.2

  • Fix package environment creation failures being misreported:

    • discard the partially registered configuration on failure, so the real error surfaces instead of a spurious duplicate configuration definition;
    • report the first creation failure in definition order, not a hash-random one;
    • build the PEP 517 frontend lazily, so tox c and tox l work when pyproject.toml cannot be read. (:issue:3987)

  • Fix state corruption in the environment creation machinery:

    • a failed run environment build no longer removes shared package environments other run environments still use;
    • a run environment registers with its package environment once, not twice with triple-counted usage;
    • circular depends reports the cycle as an error instead of a raw traceback;
    • Skip raised by a plugin for a package environment marks the run environment package-skipped instead of crashing with UnboundLocalError. (:issue:3991)

  • Fix two packaging regressions:

    • package = editable on a build backend without PEP-660 support now falls back to editable-legacy with a warning instead of crashing, also when the project metadata is static;
    • editable and wheel environments running after an sdist-wheel environment build from the project sources again, instead of a stale temporary copy that made source edits invisible. (:issue:3992)

  • An environment serving as both a run environment and a package environment now behaves predictably:

    • one defined through a [testenv:...]-style section and referenced by package_env inherits from pkgenv/env_pkg_base as documented, instead of silently keeping run environment defaults;
    • one listed in env_list while referenced as a package environment is reported as a configuration conflict up front, instead of failing late with cannot run packaging environment or silently disappearing from tox l. (:issue:3993)

  • pylock.toml installs now match the lock file:

    • a package locked once per Python range installs only the version matching the environment's interpreter;
    • packages locked to a local directory, VCS repository, or archive install from that source instead of resolving the name against the package index;
    • locked hashes are verified when every entry carries one;
    • changing a pip environment variable such as PIP_INDEX_URL reinstalls, as it already did for deps.

... (truncated)

Commits
  • 69e1bdc release 4.58.0
  • ea8734e 👷 ci: run the test matrix against Python 3.15 (#4001)
  • 2d8d5ae release 4.57.2
  • b74d78b 🐛 fix(ux): four run-edge polish fixes (#4000)
  • 09dad3d 🐛 fix(cli): honor tox c -o, clean devenv ALL error, correct provision pin (#3...
  • fa6ec2b 🐛 fix(run): honor the fail-fast contract, resilient teardown (#3999)
  • b1b0159 🐛 fix(pep723): honor metadata behind a BOM, fail cleanly on bad blocks (#3997)
  • a111ec6 🐛 fix(pip): stable rendering of set options in install cache (#3995)
  • e969723 🐛 fix(config): rebuild loader chains per config set (#3993)
  • 6a9b6a5 🐛 fix(cache): self-heal wrong-shape tox-info content (#3996)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python-requirements group across 1 directory with 7 updates
ee89a1d 
Updates the requirements on [fonttools](https://github.com/fonttools/fonttools), [pillow](https://github.com/python-pillow/Pillow), [python-fsutil](https://github.com/fabiocaccamo/python-fsutil), [coverage](https://github.com/coveragepy/coveragepy), [mypy](https://github.com/python/mypy), [pre-commit](https://github.com/pre-commit/pre-commit) and [tox](https://github.com/tox-dev/tox) to permit the latest version.

Updates `fonttools` from 4.62.1 to 4.63.0
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.62.1...4.63.0)

Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.2.0...12.3.0)

Updates `python-fsutil` from 0.16.1 to 0.17.0
- [Release notes](https://github.com/fabiocaccamo/python-fsutil/releases)
- [Changelog](https://github.com/fabiocaccamo/python-fsutil/blob/main/CHANGELOG.md)
- [Commits](fabiocaccamo/python-fsutil@0.16.1...0.17.0)

Updates `coverage` to 7.15.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.13.0...7.15.2)

Updates `mypy` to 2.3.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.20.0...v2.3.0)

Updates `pre-commit` to 4.6.1
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.5.0...v4.6.1)

Updates `tox` to 4.58.0
- [Release notes](https://github.com/tox-dev/tox/releases)
- [Changelog](https://github.com/tox-dev/tox/blob/main/docs/changelog.rst)
- [Commits](tox-dev/tox@4.52.0...4.58.0)

---
updated-dependencies:
- dependency-name: fonttools
  dependency-version: 4.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: python-fsutil
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-requirements
- dependency-name: coverage
  dependency-version: 7.15.2
  dependency-type: direct:production
  dependency-group: python-requirements
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:production
  dependency-group: python-requirements
- dependency-name: pre-commit
  dependency-version: 4.6.1
  dependency-type: direct:production
  dependency-group: python-requirements
- dependency-name: tox
  dependency-version: 4.58.0
  dependency-type: direct:production
  dependency-group: python-requirements
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants