Skip to content

Bump the dependencies group with 8 updates#50

Merged
amrabed merged 1 commit into
mainfrom
dependabot/uv/dependencies-8c224e68dc
May 15, 2026
Merged

Bump the dependencies group with 8 updates#50
amrabed merged 1 commit into
mainfrom
dependabot/uv/dependencies-8c224e68dc

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 15, 2026

Bumps the dependencies group with 8 updates:

Package From To
pydantic-settings 2.14.0 2.14.1
boto3 1.43.6 1.43.8
requests 2.33.1 2.34.2
aws-cdk-lib 2.253.0 2.254.0
ruff 0.15.12 0.15.13
coverage 7.13.5 7.14.0
moto 5.2.0 5.2.1
hypothesis 6.152.4 6.152.7

Updates pydantic-settings from 2.14.0 to 2.14.1

Release notes

Sourced from pydantic-settings's releases.

v2.14.1

What's Changed

Full Changelog: pydantic/pydantic-settings@v2.14.0...v2.14.1

Commits

Updates boto3 from 1.43.6 to 1.43.8

Commits

Updates requests from 2.33.1 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)
Commits

Updates aws-cdk-lib from 2.253.0 to 2.254.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.254.0

⚠ BREAKING CHANGES

  • ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-elasticache: AWS::ElastiCache::CacheCluster: Id attribute removed. aws-sagemaker: AWS::SageMaker::Model: Id attribute removed. aws-vpclattice: AWS::VpcLattice::AuthPolicy: State attribute enum values changed from ACTIVE|INACTIVE to Active|Inactive.

Features

Bug Fixes

  • file fingerprinting is now ~33% faster (#37802) (b871018)
  • core: "exports cannot be updated" for cross-region references (#37790) (af11f00)
  • rds: add lower bound validation for ClusterInstance promotionTier (#37519) (16c0a29), closes #37518
  • s3deploy: empty sources leads to deployment error (#37786) (d28ad30)
  • bundled jsonschema in @​aws-cdk/cloud-assembly-api causes ELSPROBLEMS (#37774) (64651d3), closes #37756

Alpha modules (2.254.0-alpha.0)

Features

  • bedrock-agentcore-alpha: add tags support to Evaluator and OnlineEvaluationConfig (#37804) (adbf88f)
  • bedrock-agentcore-alpha: add identity L2 constructs (#37610) (67c3af2)
  • mediapackagev2-alpha: add OAC integration between CloudFront and MediaPackageV2 (#37701) (654f59c)

Bug Fixes

  • bedrock-agentcore-alpha: fix cedar policy bug (#37782) (e678d5c), closes #37828
  • custom-resource-handlers: deployment fails when parameter already exists (#37852) (025c38c)

v2.253.1

Bug Fixes

  • core: "exports cannot be updated" for cross-region references (#37790) (b0c00e2)
  • s3deploy: empty sources leads to deployment error (#37786) (f61656a)

Alpha modules (2.253.1-alpha.0)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.254.0-alpha.0 (2026-05-13)

Features

  • bedrock-agentcore-alpha: add tags support to Evaluator and OnlineEvaluationConfig (#37804) (adbf88f)
  • bedrock-agentcore-alpha: add identity L2 constructs (#37610) (67c3af2)
  • mediapackagev2-alpha: add OAC integration between CloudFront and MediaPackageV2 (#37701) (654f59c)

Bug Fixes

  • bedrock-agentcore-alpha: fix cedar policy bug (#37782) (e678d5c), closes #37828
  • custom-resource-handlers: deployment fails when parameter already exists (#37852) (025c38c)

2.253.1-alpha.0 (2026-05-08)

2.253.0-alpha.0 (2026-05-06)

Features

  • bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
  • glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

  • bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197

2.252.0-alpha.0 (2026-04-29)

2.251.0-alpha.0 (2026-04-24)

Features

  • bedrock-agentcore-alpha: add L2 constructs for policy and policy engine (#37238) (1e89e7e)
  • bedrock-agentcore-alpha: add observability configuration for Runtime (#36689) (34b43aa), closes #36596
  • bedrock-agentcore-alpha: support No Authorization for AgentCore Gateway (#36610) (f20bd8e)
  • dsql-alpha: initial L2 construct (#34599) (be1a458), closes #34593

2.250.0-alpha.0 (2026-04-14)

2.249.0-alpha.0 (2026-04-10)

... (truncated)

Commits
  • df4cca7 chore(release): 2.254.0 (#37859)
  • 3854570 Update CHANGELOG.v2.alpha.md
  • 4e11659 Update CHANGELOG.v2.md
  • b1864c9 chore: update analytics metadata blueprints
  • c9faa87 chore(release): 2.254.0
  • fb4197e feat: update L1 CloudFormation resource definitions (#37826)
  • 086738b feat(lambda): add SQS provisionedPollerConfig support with validation and fix...
  • 025c38c fix(custom-resource-handlers): deployment fails when parameter already exists...
  • 69d6457 refactor(core): unify validation plugin execution into single loop (#37809)
  • 13a4924 feat(cloudwatch): add PromQL Alarm L2 construct (#37793)
  • Additional commits viewable in compare view

Updates ruff from 0.15.12 to 0.15.13

Release notes

Sourced from ruff's releases.

0.15.13

Release Notes

Released on 2026-05-14.

Preview features

  • Add a rule to flag lazy imports that are eagerly evaluated (#25016)
  • [pylint] Standardize diagnostic message (PLR0914, PLR0917) (#24996)

Bug fixes

  • Fix F811 false positive for class methods (#24933)
  • Fix setting selection for multi-folder workspace (#24819)
  • [eradicate] Fix false positive for lines with leading whitespace (ERA001) (#25122)
  • [flake8-pyi] Fix false positive for f-string debug specifier (PYI016) (#24098)

Rule changes

  • Always include panic payload in panic diagnostic message (#24873)
  • Restrict PYI034 for in-place operations to enclosing class (#24511)
  • Improve error message for parameters that are declared global (#24902)
  • Update known stdlib (#25103)

Performance

  • [isort] Avoid constructing glob::Patterns for literal known modules (#25123)

CLI

  • Add TOML examples to --config help text (#25013)
  • Colorize ruff check 'All checks passed' (#25085)

Configuration

  • Increase max allowed value of line-length setting (#24962)

Documentation

  • Add D203 to rules that conflict with the formatter (#25044)
  • Clarify COM819 and formatter interaction (#25045)
  • Clarify that NotImplemented is a value, not an exception (F901) (#25054)
  • Update number of lint rules supported (#24942)

Other changes

  • Simplify the playground's markdown template (#24924)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.13

Released on 2026-05-14.

Preview features

  • Add a rule to flag lazy imports that are eagerly evaluated (#25016)
  • [pylint] Standardize diagnostic message (PLR0914, PLR0917) (#24996)

Bug fixes

  • Fix F811 false positive for class methods (#24933)
  • Fix setting selection for multi-folder workspace (#24819)
  • [eradicate] Fix false positive for lines with leading whitespace (ERA001) (#25122)
  • [flake8-pyi] Fix false positive for f-string debug specifier (PYI016) (#24098)

Rule changes

  • Always include panic payload in panic diagnostic message (#24873)
  • Restrict PYI034 for in-place operations to enclosing class (#24511)
  • Improve error message for parameters that are declared global (#24902)
  • Update known stdlib (#25103)

Performance

  • [isort] Avoid constructing glob::Patterns for literal known modules (#25123)

CLI

  • Add TOML examples to --config help text (#25013)
  • Colorize ruff check 'All checks passed' (#25085)

Configuration

  • Increase max allowed value of line-length setting (#24962)

Documentation

  • Add D203 to rules that conflict with the formatter (#25044)
  • Clarify COM819 and formatter interaction (#25045)
  • Clarify that NotImplemented is a value, not an exception (F901) (#25054)
  • Update number of lint rules supported (#24942)

Other changes

  • Simplify the playground's markdown template (#24924)

Contributors

... (truncated)

Commits
  • 2afb467 Bump 0.15.13 (#25157)
  • 3008796 [ty] classify TypeVar semantic tokens as type parameters (#24891)
  • 79470e3 [isort] Avoid constructing glob::Patterns for literal known modules (#25123)
  • 2522549 Remove shellcheck from prek (#25154)
  • 7db7170 [ty] Support TypedDict key completions in incomplete, anonymous contexts (#25...
  • bb3dd53 [ty] Run full iteration analysis on narrowed typevars (#25143)
  • 828cdb7 [ty] Isolate file-watching test environment (#25151)
  • 89e1d86 [ty] Preserve TypedDict keys through dict unpacking (#24523)
  • 86f3064 [ty] Avoid accessing args[0] for static_assert (#25149)
  • ed819f9 [ty] Treat custom enum __new__ values as dynamic (#25136)
  • Additional commits viewable in compare view

Updates coverage from 7.13.5 to 7.14.0

Changelog

Sourced from coverage's changelog.

Version 7.14.0 — 2026-05-10

  • Feature: now when running one of the reporting commands, if there are parallel data files that need combining, they will be implicitly combined before creating the report. There is no option to avoid the combination; let us know if you have a use case that requires it. Thanks, Tim Hatch <pull 2162_>. Closes issue 1781.

  • Fix: the output from combine was too verbose, listing each file considered. Now it shows a single line with the counts of files combined, files skipped, and files with errors. The -q flag suppresses this line. The old detailed lines are available with the new --debug=combine option.

  • Fix: running a Python file through a symlink now sets the sys.path correctly, matching regular Python behavior. Fixes issue 2157_.

  • Fix: Collector.flush_data could fail with "RuntimeError: Set changed size during iteration" when a tracer in another thread added a line to the per-file set that add_lines (or add_arcs) was iterating. The values passed to CoverageData are now snapshotted via dict.copy() and set.copy(), which are atomic under the GIL. Thanks, Alex Vandiver <pull 2165_>_.

  • Fix: the soft keyword lazy is now bolded in HTML reports.

  • We are no longer testing eventlet support. Eventlet started issuing stern deprecation warnings that break our tests. Our support code is still there.

.. _issue 1781: coveragepy/coveragepy#1781 .. _issue 2157: coveragepy/coveragepy#2157 .. _pull 2162: coveragepy/coveragepy#2162 .. _pull 2165: coveragepy/coveragepy#2165

.. _changes_7-13-5:

Commits
  • 646351b docs: sample HTML for 7.14.0
  • 39cd015 docs: prep for 7.14.0
  • 649e8aa docs: thanks Alex Vandiver for #2165
  • 8cd392e fix: snapshot data in Collector.flush_data to avoid threading race (#2165)
  • c48e0ed fix: less output for combining
  • c2a3a28 docs: explain the change from #2162
  • 1cd47aa fix: implicit combine-during-report now removes the combined data files
  • 2d99fd7 feat: automatically combine coverage in report, thanks Tim Hatch (#2162)
  • 9fbdcdf fix: lazy soft keywords are bolded
  • 5de7d02 build: oops, misplaced quote
  • Additional commits viewable in compare view

Updates moto from 5.2.0 to 5.2.1

Changelog

Sourced from moto's changelog.

5.2.1

Docker Digest for 5.2.1: sha256:fe6575dcd878842124f05d20e4ffde2d1126e1e38ad03e196353b9e53649bcdf

Miscellaneous:
    * DynamoDB: batch_write_item() now correctly handles PUT requests with Binary (B) attributes (broken in 5.2.0)
    * S3: Uploading files no longer fails with 'Unsupported protocol' (broken in 5.2.0)
    * S3: create_multipart_upload() is now compatible with Java SDK again (broken in 5.2.0)
    * Route53: update_health_check() now correctly updates falsy values (broken in 5.2.0)
Commits

Updates hypothesis from 6.152.4 to 6.152.7

Release notes

Sourced from hypothesis's releases.

Hypothesis for Python - version 6.152.7

This patch improves our type hints for ".filter()" to work with "typing.TypeGuard". For example:

from typing import TypeGuard

from hypothesis import strategies as st

def is_str(x: object) -> TypeGuard[str]: return isinstance(x, str)

s = st.from_type(object).filter(is_str)

previously: SearchStrategy[object]

now: SearchStrategy[str]

reveal_type(s)

The canonical version of these notes (with links) is on readthedocs.

Hypothesis for Python - version 6.152.6

This patch adds a shrinking pass that tries natural text transformations - unicode decomposition (NFD/NFKD) and case mapping - on individual characters in string choices. Failures involving e.g. ""À" != "À".lower()" will now reliably shrink to ""A"" rather than sometimes getting stuck on the high-codepoint accented form (issue #4725).

The canonical version of these notes (with links) is on readthedocs.

Hypothesis for Python - version 6.152.5

This patch improves the "Phase.explain" phase so that simple cases like "assert n1 == n2" no longer get a misleading "# or any other generated value" comment (issue #4715). Before falling back to random sampling, we now also try borrowing values from each other arg slice with matching shape.

The canonical version of these notes (with links) is on readthedocs.

Commits
  • adc8d2d Bump hypothesis-python version to 6.152.7 and update changelog
  • d66ce67 Merge pull request #4672 from CharString/annotate-filter
  • df88957 Merge pull request #4727 from hettlage/patch-1
  • 415443c Merge branch 'master' into patch-1
  • bfd0ebf Revert RELEASE.rst to original version
  • 492f818 attempt to de-flake test
  • 55ab356 fix release notes
  • 7fd8e50 simplify type hints
  • c8b952e Merge remote-tracking branch 'upstream/master' into annotate-filter-4672
  • b2e8d89 add tests and release notes
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dependencies group with 8 updates
8d6aec5 
Bumps the dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.0` | `2.14.1` |
| [boto3](https://github.com/boto/boto3) | `1.43.6` | `1.43.8` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [aws-cdk-lib](https://github.com/aws/aws-cdk) | `2.253.0` | `2.254.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.12` | `0.15.13` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.13.5` | `7.14.0` |
| [moto](https://github.com/getmoto/moto) | `5.2.0` | `5.2.1` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.152.4` | `6.152.7` |


Updates `pydantic-settings` from 2.14.0 to 2.14.1
- [Release notes](https://github.com/pydantic/pydantic-settings/releases)
- [Commits](pydantic/pydantic-settings@v2.14.0...v2.14.1)

Updates `boto3` from 1.43.6 to 1.43.8
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.6...1.43.8)

Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)

Updates `aws-cdk-lib` from 2.253.0 to 2.254.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](aws/aws-cdk@v2.253.0...v2.254.0)

Updates `ruff` from 0.15.12 to 0.15.13
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.12...0.15.13)

Updates `coverage` from 7.13.5 to 7.14.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.13.5...7.14.0)

Updates `moto` from 5.2.0 to 5.2.1
- [Release notes](https://github.com/getmoto/moto/releases)
- [Changelog](https://github.com/getmoto/moto/blob/master/CHANGELOG.md)
- [Commits](getmoto/moto@5.2.0...5.2.1)

Updates `hypothesis` from 6.152.4 to 6.152.7
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@hypothesis-python-6.152.4...hypothesis-python-6.152.7)

---
updated-dependencies:
- dependency-name: pydantic-settings
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: boto3
  dependency-version: 1.43.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aws-cdk-lib
  dependency-version: 2.254.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: ruff
  dependency-version: 0.15.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: coverage
  dependency-version: 7.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: moto
  dependency-version: 5.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: hypothesis
  dependency-version: 6.152.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels May 15, 2026
@dependabot dependabot Bot requested a review from amrabed as a code owner May 15, 2026 02:14
@amrabed amrabed merged commit 6659e76 into main May 15, 2026
1 check passed
@amrabed amrabed deleted the dependabot/uv/dependencies-8c224e68dc branch May 15, 2026 18:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@amrabed amrabed amrabed approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@amrabed