security(deps-dev): bump the python-dependencies group with 3 updates#564
Merged
Conversation
Bumps the python-dependencies group with 3 updates: [hypothesis](https://github.com/HypothesisWorks/hypothesis), [ruff](https://github.com/astral-sh/ruff) and [matplotlib](https://github.com/matplotlib/matplotlib). Updates `hypothesis` from 6.152.1 to 6.152.3 - [Release notes](https://github.com/HypothesisWorks/hypothesis/releases) - [Commits](HypothesisWorks/hypothesis@hypothesis-python-6.152.1...hypothesis-python-6.152.3) Updates `ruff` from 0.15.11 to 0.15.12 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.11...0.15.12) Updates `matplotlib` from 3.10.8 to 3.10.9 - [Release notes](https://github.com/matplotlib/matplotlib/releases) - [Commits](matplotlib/matplotlib@v3.10.8...v3.10.9) --- updated-dependencies: - dependency-name: hypothesis dependency-version: 6.152.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: ruff dependency-version: 0.15.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: matplotlib dependency-version: 3.10.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
Dependency ReviewThe following issues were found:
Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. License Issuesuv.lock
OpenSSF Scorecard
Scanned Files
|
github-actions
Bot
changed the title
Contributor
|
✅ AW Dependabot PR Review completed successfully! |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #564 +/- ##
==========================================
+ Coverage 63.91% 66.56% +2.65%
==========================================
Files 250 262 +12
Lines 15409 16639 +1230
Branches 2163 2260 +97
==========================================
+ Hits 9848 11076 +1228
Misses 5274 5274
- Partials 287 289 +2
*This pull request uses carry forward flags. Click here to find out more. 🚀 New features to boost your workflow:
|
bindsi
approved these changes
Apr 27, 2026
Contributor
|
✅ AW Dependabot PR Review completed successfully! |
bindsi
added a commit
that referenced
this pull request
Apr 27, 2026
…#564) Bumps the python-dependencies group with 3 updates: [hypothesis](https://github.com/HypothesisWorks/hypothesis), [ruff](https://github.com/astral-sh/ruff) and [matplotlib](https://github.com/matplotlib/matplotlib). Updates `hypothesis` from 6.152.1 to 6.152.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/HypothesisWorks/hypothesis/releases">hypothesis's releases</a>.</em></p> <blockquote> <h2>Hypothesis for Python - version 6.152.3</h2> <p>The "hypothesis-urandom" backend now reads from "/dev/urandom" with buffering disabled, which improves the control of those hooking "/dev/urandom" to change or read Hypothesis's random decisions.</p> <p><em><a href="https://hypothesis.readthedocs.io/en/latest/changelog.html#v6-152-3">The canonical version of these notes (with links) is on readthedocs.</a></em></p> <h2>Hypothesis for Python - version 6.152.2</h2> <p>This release further improves printing of generated values, building on the changes in version 6.151.11.</p> <p>Principle changes:</p> <ul> <li> <p>In many cases where we would have printed a complex expression producing a value, we now print the repr (or a pretty-printed version of it).</p> </li> <li> <p>Additionally, in some cases where we would print a complex expression that involved a lambda, we are now able to simplify that expression into a more readable one.</p> </li> </ul> <p><em><a href="https://hypothesis.readthedocs.io/en/latest/changelog.html#v6-152-2">The canonical version of these notes (with links) is on readthedocs.</a></em></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/609de04108945b1ee711a514c3bfa520f75b71e9"><code>609de04</code></a> Bump hypothesis-python version to 6.152.3 and update changelog</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/902f1baddcbc0059eee61b3518a07489935e28ef"><code>902f1ba</code></a> Merge pull request <a href="https://github.com/HypothesisWorks/hypothesis/issues/4720">#4720</a> from Liam-DeVoe/urandom-disable-buffering</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/da81118e4cf06651c63ade29892fe45562a4afbc"><code>da81118</code></a> claude: open /dev/urandom with buffering=0 in URandomProvider</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/80fada332e4a5cd19e22ac6be9f7dcfea71d9b68"><code>80fada3</code></a> Merge pull request <a href="https://github.com/HypothesisWorks/hypothesis/issues/4714">#4714</a> from HypothesisWorks/DRMacIver/uv</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/634e2be14895c79c88abcf04b7f0ac3aef685023"><code>634e2be</code></a> Let tox auto-provision tox-uv instead of pinning it in tools.txt</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/526556470a396edb8c43033d466ccf7416c58efe"><code>5265564</code></a> Seed pip into tox-uv envs</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/d6caeb86759f52d5d68c4ad9535f5b471b288240"><code>d6caeb8</code></a> Use uv instead of pyenv for build-time Python installs and tox</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/c727ead5923bd738c51116bba50d4c9f06a1ff51"><code>c727ead</code></a> Bump hypothesis-python version to 6.152.2 and update changelog</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/36d74b796957d7ca99927a3456c6179c22b8dd83"><code>36d74b7</code></a> Merge pull request <a href="https://github.com/HypothesisWorks/hypothesis/issues/4711">#4711</a> from HypothesisWorks/DRMacIver/is-code-owner</li> <li><a href="https://github.com/HypothesisWorks/hypothesis/commit/bbc8963637ec87b8f450f09b1db2e375f0be7247"><code>bbc8963</code></a> Merge pull request <a href="https://github.com/HypothesisWorks/hypothesis/issues/4712">#4712</a> from HypothesisWorks/DRMacIver/fix-build</li> <li>Additional commits viewable in <a href="https://github.com/HypothesisWorks/hypothesis/compare/hypothesis-python-6.152.1...hypothesis-python-6.152.3">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.15.11 to 0.15.12 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.15.12</h2> <h2>Release Notes</h2> <p>Released on 2026-04-24.</p> <h3>Preview features</h3> <ul> <li>Implement <code>#ruff:file-ignore</code> file-level suppressions (<a href="https://github.com/astral-sh/ruff/pull/23599">#23599</a>)</li> <li>Implement <code>#ruff:ignore</code> logical-line suppressions (<a href="https://github.com/astral-sh/ruff/pull/23404">#23404</a>)</li> <li>Revert preview changes to displayed diagnostic severity in LSP (<a href="https://github.com/astral-sh/ruff/pull/24789">#24789</a>)</li> <li>[<code>airflow</code>] Implement <code>task-branch-as-short-circuit</code> (<code>AIR004</code>) (<a href="https://github.com/astral-sh/ruff/pull/23579">#23579</a>)</li> <li>[<code>flake8-bugbear</code>] Fix <code>break</code>/<code>continue</code> handling in <code>loop-iterator-mutation</code> (<code>B909</code>) (<a href="https://github.com/astral-sh/ruff/pull/24440">#24440</a>)</li> <li>[<code>pylint</code>] Fix <code>PLC2701</code> for type parameter scopes (<a href="https://github.com/astral-sh/ruff/pull/24576">#24576</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>pandas-vet</code>] Suggest <code>.array</code> as well in <code>PD011</code> (<a href="https://github.com/astral-sh/ruff/pull/24805">#24805</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Respect default Unix permissions for cache files (<a href="https://github.com/astral-sh/ruff/pull/24794">#24794</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>[<code>pylint</code>] Fix <code>PLR0124</code> description not to claim self-comparison always returns the same value (<a href="https://github.com/astral-sh/ruff/pull/24749">#24749</a>)</li> <li>[<code>pyupgrade</code>] Expand docs on reusable <code>TypeVar</code>s and scoping (<code>UP046</code>) (<a href="https://github.com/astral-sh/ruff/pull/24153">#24153</a>)</li> <li>Improve rules table accessibility (<a href="https://github.com/astral-sh/ruff/pull/24711">#24711</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/dylwil3"><code>@dylwil3</code></a></li> <li><a href="https://github.com/AlexWaygood"><code>@AlexWaygood</code></a></li> <li><a href="https://github.com/woodruffw"><code>@woodruffw</code></a></li> <li><a href="https://github.com/avasis-ai"><code>@avasis-ai</code></a></li> <li><a href="https://github.com/Dev-iL"><code>@Dev-iL</code></a></li> <li><a href="https://github.com/denyszhak"><code>@denyszhak</code></a></li> <li><a href="https://github.com/ShipItAndPray"><code>@ShipItAndPray</code></a></li> <li><a href="https://github.com/anishgirianish"><code>@anishgirianish</code></a></li> <li><a href="https://github.com/augustelalande"><code>@augustelalande</code></a></li> <li><a href="https://github.com/amyreese"><code>@amyreese</code></a></li> <li><a href="https://github.com/majiayu000"><code>@majiayu000</code></a></li> </ul> <h2>Install ruff 0.15.12</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.15.12/ruff-installer.sh | sh </code></pre> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.15.12</h2> <p>Released on 2026-04-24.</p> <h3>Preview features</h3> <ul> <li>Implement <code>#ruff:file-ignore</code> file-level suppressions (<a href="https://github.com/astral-sh/ruff/pull/23599">#23599</a>)</li> <li>Implement <code>#ruff:ignore</code> logical-line suppressions (<a href="https://github.com/astral-sh/ruff/pull/23404">#23404</a>)</li> <li>Revert preview changes to displayed diagnostic severity in LSP (<a href="https://github.com/astral-sh/ruff/pull/24789">#24789</a>)</li> <li>[<code>airflow</code>] Implement <code>task-branch-as-short-circuit</code> (<code>AIR004</code>) (<a href="https://github.com/astral-sh/ruff/pull/23579">#23579</a>)</li> <li>[<code>flake8-bugbear</code>] Fix <code>break</code>/<code>continue</code> handling in <code>loop-iterator-mutation</code> (<code>B909</code>) (<a href="https://github.com/astral-sh/ruff/pull/24440">#24440</a>)</li> <li>[<code>pylint</code>] Fix <code>PLC2701</code> for type parameter scopes (<a href="https://github.com/astral-sh/ruff/pull/24576">#24576</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>pandas-vet</code>] Suggest <code>.array</code> as well in <code>PD011</code> (<a href="https://github.com/astral-sh/ruff/pull/24805">#24805</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Respect default Unix permissions for cache files (<a href="https://github.com/astral-sh/ruff/pull/24794">#24794</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>[<code>pylint</code>] Fix <code>PLR0124</code> description not to claim self-comparison always returns the same value (<a href="https://github.com/astral-sh/ruff/pull/24749">#24749</a>)</li> <li>[<code>pyupgrade</code>] Expand docs on reusable <code>TypeVar</code>s and scoping (<code>UP046</code>) (<a href="https://github.com/astral-sh/ruff/pull/24153">#24153</a>)</li> <li>Improve rules table accessibility (<a href="https://github.com/astral-sh/ruff/pull/24711">#24711</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/dylwil3"><code>@dylwil3</code></a></li> <li><a href="https://github.com/AlexWaygood"><code>@AlexWaygood</code></a></li> <li><a href="https://github.com/woodruffw"><code>@woodruffw</code></a></li> <li><a href="https://github.com/avasis-ai"><code>@avasis-ai</code></a></li> <li><a href="https://github.com/Dev-iL"><code>@Dev-iL</code></a></li> <li><a href="https://github.com/denyszhak"><code>@denyszhak</code></a></li> <li><a href="https://github.com/ShipItAndPray"><code>@ShipItAndPray</code></a></li> <li><a href="https://github.com/anishgirianish"><code>@anishgirianish</code></a></li> <li><a href="https://github.com/augustelalande"><code>@augustelalande</code></a></li> <li><a href="https://github.com/amyreese"><code>@amyreese</code></a></li> <li><a href="https://github.com/majiayu000"><code>@majiayu000</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/66f93cf7ed4d36325f35a452e4afa28268fbcd28"><code>66f93cf</code></a> Bump 0.15.12 (<a href="https://github.com/astral-sh/ruff/issues/24815">#24815</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/476a4d02e8e3b6c157ac39979d8b698a1b6baa91"><code>476a4d0</code></a> [ty] Complete support for more detailed diagnostics on possibly unbound error...</li> <li><a href="https://github.com/astral-sh/ruff/commit/ed669eab30095d6c51fe6cdef6050fb01276bcb3"><code>ed669ea</code></a> Implement <code>#ruff:file-ignore</code> file-level suppressions (<a href="https://github.com/astral-sh/ruff/issues/23599">#23599</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/e73d952e43feb51356ee740c5a973fce81396ff6"><code>e73d952</code></a> [ty] Include inferred type in <code>invalid-key</code> concise diagnostic for union/inte...</li> <li><a href="https://github.com/astral-sh/ruff/commit/80feb29b31cd98c093316df2e0407b0c70c01b55"><code>80feb29</code></a> [ty] report only dead annotation-only locals as unused (<a href="https://github.com/astral-sh/ruff/issues/24811">#24811</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/0fbf2bc27336a3d17d39af52cf89b78dcda8c7c8"><code>0fbf2bc</code></a> Drop deprecated license classifier (<a href="https://github.com/astral-sh/ruff/issues/24808">#24808</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/43b174cc7f2fcb0080bb1d4843cd4bf6b72bbe27"><code>43b174c</code></a> [ty] Infer lambda parameter types with <code>Callable</code> type context (<a href="https://github.com/astral-sh/ruff/issues/24317">#24317</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/4f449ae4a2377569330a5ab94799d389357b5a3f"><code>4f449ae</code></a> [ty] Add error context for intersection types (<a href="https://github.com/astral-sh/ruff/issues/24772">#24772</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/5b4e753acb46e96ad408e4904c15308e33efe307"><code>5b4e753</code></a> [ty] Add support for goto in literal enum member inlay hint (<a href="https://github.com/astral-sh/ruff/issues/24792">#24792</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/e7cc76275a758ce1c636ea1c2d091fd576aac794"><code>e7cc762</code></a> [ty] Add error context for TypedDict assignments (<a href="https://github.com/astral-sh/ruff/issues/24790">#24790</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.15.11...0.15.12">compare view</a></li> </ul> </details> <br /> Updates `matplotlib` from 3.10.8 to 3.10.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/matplotlib/matplotlib/releases">matplotlib's releases</a>.</em></p> <blockquote> <h2>v3.10.9</h2> <p>This is a micro release of the v3.10.x series. Highlights of this release include:</p> <ul> <li>Various minor bug and doc fixes</li> <li>Security hardening validation of cyclers - Removing eval usage</li> <li>Security hardening in Latex and PS calls - Removing shell escapes</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/matplotlib/matplotlib/commit/dd8d78b8dce60b6c8db86132892577a0b9dbe469"><code>dd8d78b</code></a> REL: v3.10.9</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/2fb18915bcfe69a188832c776fe18d88337de9bc"><code>2fb1891</code></a> REL: Release prep v3.10.9</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/d0e923abfa016c04901fe4e315b9d215949f6fc5"><code>d0e923a</code></a> Merge branch 'v3.10.8-doc' into v3.10.x</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/163793248a5fc9f23a560e45551c44351a8bd716"><code>1637932</code></a> Merge pull request <a href="https://github.com/matplotlib/matplotlib/issues/31558">#31558</a> from meeseeksmachine/auto-backport-of-pr-31556-on-v...</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/a83faacb0dbe7edd1bae38e1e715b77b6aaebb84"><code>a83faac</code></a> Backport PR <a href="https://github.com/matplotlib/matplotlib/issues/31556">#31556</a>: FIX: Inverted PyErr_Occurred check in enum type caster (_...</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/a4f57ab0623f9d26be29e0a3b0de904667c7eeb7"><code>a4f57ab</code></a> Merge pull request <a href="https://github.com/matplotlib/matplotlib/issues/31545">#31545</a> from ksunden/backport-of-pr-31282-on-v3.10.x</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/063288d0cc912aa2af5cc1b7e7ca3d228d9f8976"><code>063288d</code></a> Merge pull request <a href="https://github.com/matplotlib/matplotlib/issues/31544">#31544</a> from ksunden/backport-of-pr-31248-on-v3.10.x</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/b2ed1969191a03ec8927f96573664474662ab4c1"><code>b2ed196</code></a> Backport PR <a href="https://github.com/matplotlib/matplotlib/issues/31248">#31248</a>: SEC: Remove eval() from validate_cycler</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/acc60241a70b920eaf04fce41a8cf0a77010fb7d"><code>acc6024</code></a> Merge pull request <a href="https://github.com/matplotlib/matplotlib/issues/31282">#31282</a> from scottshambaugh/tex_no_shell</li> <li><a href="https://github.com/matplotlib/matplotlib/commit/e3fb54163b1ce9dbc1a9e8e0973289dc14e366c2"><code>e3fb541</code></a> Merge pull request <a href="https://github.com/matplotlib/matplotlib/issues/31078">#31078</a> from meeseeksmachine/auto-backport-of-pr-31075-on-v...</li> <li>Additional commits viewable in <a href="https://github.com/matplotlib/matplotlib/compare/v3.10.8...v3.10.9">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Marcel Bindseil <marcelbindseil@gmail.com>
WilliamBerryiii
pushed a commit
that referenced
this pull request
May 8, 2026
🤖 I have created a release *beep* *boop* --- ## [0.8.0](v0.7.4...v0.8.0) (2026-05-08) ### ⚠ BREAKING CHANGES * **dataviewer:** bump frontend stack to React 19, Vite 8, Tailwind v4, MSAL 5, ESLint 10 ([#524](#524)) ### ✨ Features * **agents:** add automated validation for high-risk Dependabot bumps ([#574](#574)) ([8c3686a](8c3686a)), closes [#573](#573) * **data:** add camera selector to annotation workspace and fix AV1 frame extraction ([#591](#591)) ([c809d2f](c809d2f)) * **data:** seed dataviewer frontend test foundation and per-section codecov flags ([#594](#594)) ([c06c4e3](c06c4e3)) * **dataviewer:** add OWASP security middleware stack ([#439](#439)) ([239edb9](239edb9)) * **infrastructure:** add conversion pipeline Terraform module ([#542](#542)) ([244531e](244531e)) * **infrastructure:** upgrade OSMO to chart 1.2.1 / image 6.2 with secure auth and skrl 2.0.0 compatibility ([#492](#492)) ([edfd7a5](edfd7a5)) * **pipeline:** add ACSA setup for ROS2 bag sync to Blob ([#451](#451)) ([c271a54](c271a54)) * **workflows:** add advisory Dependabot PR reviewer agentic workflow ([#498](#498)) ([d4bb140](d4bb140)) * **workflows:** trigger AW Dependabot PR reviewer after PR Validation ([#580](#580)) ([7ab3d16](7ab3d16)) ### 🐛 Bug Fixes * **ci:** correct stale version comment for actions/create-github-app-token ([#506](#506)) ([b2e9a54](b2e9a54)) * **ci:** restore data-pipeline and training broken tests by domain folder restructure ([#547](#547)) ([06d8472](06d8472)) * **docs:** update remaining stale 'Coming soon' labels in docs/README.md ([#507](#507)) ([02439d6](02439d6)) * **docs:** update stale coming soon label for Training section ([#472](#472)) ([46db49b](46db49b)) * **evaluation:** scope SIL AzureML validation code path and script reference ([#387](#387)) ([9f138a9](9f138a9)) * **infrastructure:** OSMO workflow execution, PostgreSQL public access, and quickstart corrections ([#477](#477)) ([9ed2da6](9ed2da6)) * **scripts:** exclude CHANGELOG.md from changed-files msdate check ([#644](#644)) ([8133bdc](8133bdc)) * **workflows:** allow dependabot[bot] to activate AW Dependabot PR Review ([#586](#586)) ([39dc022](39dc022)) * **workflows:** correct branches filter on AW Dependabot PR Review workflow_run trigger ([#584](#584)) ([fe06b52](fe06b52)) * **workflows:** normalize validate.yaml placeholder env/compute values ([#510](#510)) ([340ff44](340ff44)) * **workflows:** recompile aw-dependabot-pr-review lock file ([#576](#576)) ([d77c167](d77c167)) * **workflows:** switch AW Dependabot PR Review to pull_request_target ([#589](#589)) ([3f1edd1](3f1edd1)) ### 📚 Documentation * **docs:** Fix deployment guide links ([#614](#614)) ([0070b04](0070b04)) * document dependency-pinning-artifacts directory purpose ([#508](#508)) ([50e0010](50e0010)) ### 📦 Build System * **training:** standardize on Python 3.12 across manifests, containers, and runtime scripts ([#541](#541)) ([7ad014a](7ad014a)) ### 🔧 Operations * **build:** add Copilot cloud agent setup-steps workflow ([#593](#593)) ([c912668](c912668)) ### 🔧 Miscellaneous * **build:** exclude auto-generated CHANGELOG.md from cspell and seed dictionary ([#582](#582)) ([de1dd57](de1dd57)) * **build:** redesign codecov flags and split pytest CI per component ([#520](#520)) ([357e745](357e745)) * **dataviewer:** bump frontend stack to React 19, Vite 8, Tailwind v4, MSAL 5, ESLint 10 ([#524](#524)) ([50f8ad4](50f8ad4)) * **dataviewer:** repoint stale src/dataviewer references to data-management/viewer ([#504](#504)) ([88fa1b4](88fa1b4)), closes [#503](#503) * **deps-dev:** bump basic-ftp from 5.3.0 to 5.3.1 ([#618](#618)) ([ca10f2a](ca10f2a)) * **deps-dev:** bump globals from 15.15.0 to 17.5.0 in /data-management/viewer/frontend ([#527](#527)) ([0e0b2ae](0e0b2ae)) * **deps-dev:** bump ip-address from 10.1.0 to 10.2.0 ([#616](#616)) ([816c9cf](816c9cf)) * **deps-dev:** bump lint-staged from 16.4.0 to 17.0.2 in the root-npm-dependencies group across 1 directory ([#626](#626)) ([0e2f293](0e2f293)) * **deps-dev:** bump pydantic from 2.13.3 to 2.13.4 in the python-dependencies group across 1 directory ([#629](#629)) ([c24f1c1](c24f1c1)) * **deps-dev:** bump the python-dependencies group across 1 directory with 2 updates ([#514](#514)) ([8410f4b](8410f4b)) * **deps:** bump azure-core from 1.39.0 to 1.40.0 in /evaluation in the inference-dependencies group across 1 directory ([#597](#597)) ([6141db4](6141db4)) * **deps:** bump cryptography from 46.0.6 to 46.0.7 in /data-management/viewer ([#424](#424)) ([5fb6d58](5fb6d58)) * **deps:** bump cryptography from 46.0.6 to 46.0.7 in /data-management/viewer/backend ([#423](#423)) ([b516ad5](b516ad5)) * **deps:** bump lucide-react from 0.469.0 to 1.8.0 in /data-management/viewer/frontend ([#528](#528)) ([1bdfc1e](1bdfc1e)) * **deps:** bump nginx from `8aa63af` to `5616878` in /data-management/viewer/frontend ([#511](#511)) ([9e7e20e](9e7e20e)) * **deps:** bump nginx from 1.27-alpine to 1.29-alpine in /data-management/viewer/frontend ([#484](#484)) ([0e5c3dd](0e5c3dd)) * **deps:** bump node from `435f353` to `e49fd70` in /data-management/viewer/frontend ([#560](#560)) ([2884649](2884649)) * **deps:** bump react-is from 18.3.1 to 19.2.5 in /data-management/viewer/frontend ([#530](#530)) ([d51318c](d51318c)) * **deps:** bump tensordict from 0.11.0 to 0.12.1 in /evaluation in the inference-dependencies group across 1 directory ([#456](#456)) ([b24e733](b24e733)) * **deps:** bump the dataviewer-backend-dependencies group across 1 directory with 2 updates ([#531](#531)) ([171a1da](171a1da)) * **deps:** bump the dataviewer-backend-dependencies group across 1 directory with 5 updates ([#516](#516)) ([4f9a577](4f9a577)) * **deps:** bump the dataviewer-backend-dependencies group across 1 directory with 5 updates ([#602](#602)) ([6c27ab5](6c27ab5)) * **deps:** bump the dataviewer-dependencies group across 1 directory with 2 updates ([#529](#529)) ([8646971](8646971)) * **deps:** bump the dataviewer-dependencies group across 1 directory with 3 updates ([#601](#601)) ([d28fb50](d28fb50)) * **deps:** bump the dataviewer-dependencies group across 1 directory with 3 updates ([#632](#632)) ([4ca5f3e](4ca5f3e)) * **deps:** bump the dataviewer-dependencies group across 1 directory with 5 updates ([#515](#515)) ([109ee81](109ee81)) * **deps:** bump the dataviewer-frontend-patch-minor group across 1 directory with 6 updates ([#630](#630)) ([04d5dfd](04d5dfd)) * **deps:** bump the dataviewer-frontend-patch-minor group across 1 directory with 9 updates ([#563](#563)) ([c08f450](c08f450)) * **deps:** bump the docusaurus-dependencies group across 1 directory with 4 updates ([#627](#627)) ([f5825fc](f5825fc)) * **deps:** bump the docusaurus-dependencies group across 1 directory with 6 updates ([#599](#599)) ([b859344](b859344)) * **deps:** bump the github-actions group across 1 directory with 4 updates ([#459](#459)) ([2609c52](2609c52)) * **deps:** bump the github-actions group across 1 directory with 4 updates ([#517](#517)) ([f54bf5d](f54bf5d)) * **deps:** bump the inference-dependencies group across 1 directory with 11 updates ([#562](#562)) ([087f53a](087f53a)) * **deps:** bump the inference-dependencies group across 1 directory with 2 updates ([#628](#628)) ([4a3be47](4a3be47)) * **deps:** bump the pip group across 2 directories with 1 update ([#494](#494)) ([a14b6b0](a14b6b0)) * **docs:** update stale Python 3.11 references to 3.12 ([#575](#575)) ([6f85c95](6f85c95)) * **scripts:** remove redundant SC1091 disables in OSMO deploy scripts ([#509](#509)) ([ae1cb82](ae1cb82)) ### 🔒 Security * **build:** pin dependencies and hash-verify downloads ([#465](#465)) ([0289f49](0289f49)) * **build:** remediate dependency security advisories ([#479](#479)) ([7196d6d](7196d6d)) * **deps-dev:** bump basic-ftp from 5.2.1 to 5.2.2 ([#454](#454)) ([cb158f1](cb158f1)) * **deps-dev:** bump basic-ftp from 5.2.2 to 5.3.0 ([#495](#495)) ([e983b8b](e983b8b)) * **deps-dev:** bump hypothesis from 6.152.3 to 6.152.4 in the python-dependencies group ([#598](#598)) ([83384d2](83384d2)) * **deps-dev:** bump markdownlint-cli2 from 0.22.0 to 0.22.1 in the root-npm-dependencies group ([#559](#559)) ([32bde35](32bde35)) * **deps-dev:** bump picomatch from 2.3.1 to 2.3.2 in /docs/docusaurus ([#455](#455)) ([66f86ca](66f86ca)) * **deps-dev:** bump postcss from 8.5.10 to 8.5.12 in /data-management/viewer/frontend ([#569](#569)) ([a652dba](a652dba)) * **deps-dev:** bump the python-dependencies group with 2 updates ([#457](#457)) ([749d231](749d231)) * **deps-dev:** bump the python-dependencies group with 2 updates ([#485](#485)) ([71b44fd](71b44fd)) * **deps-dev:** bump the python-dependencies group with 3 updates ([#564](#564)) ([9fc52fd](9fc52fd)) * **deps-dev:** bump typescript from 6.0.2 to 6.0.3 in /docs/docusaurus in the docusaurus-dependencies group ([#513](#513)) ([5694dbc](5694dbc)) * **deps:** bump azureml/openmpi4.1.0-ubuntu22.04 from 20260303.v5 to 20260409.v4 in /evaluation/sil/docker ([#480](#480)) ([25d4df8](25d4df8)) * **deps:** bump cryptography from 46.0.6 to 46.0.7 in /evaluation in the uv group across 1 directory ([#538](#538)) ([92c5b2e](92c5b2e)) * **deps:** bump diffusers from 0.35.2 to 0.38.0 in /training/il/lerobot ([#638](#638)) ([6261d19](6261d19)) * **deps:** bump follow-redirects from 1.15.11 to 1.16.0 in /docs/docusaurus ([#469](#469)) ([0458908](0458908)) * **deps:** bump gitpython and mako for lerobot IL training ([#623](#623)) ([9f8022b](9f8022b)) * **deps:** bump node from 24.14.1-slim to 25.9.0-slim in /data-management/viewer/frontend ([#482](#482)) ([1532d09](1532d09)) * **deps:** bump packaging from 26.0 to 26.1 in /evaluation in the inference-dependencies group ([#483](#483)) ([f4afb6c](f4afb6c)) * **deps:** bump pillow from 12.1.1 to 12.2.0 ([#467](#467)) ([39fb663](39fb663)) * **deps:** bump python from 3.11-slim to 3.14-slim in /data-management/viewer/backend ([#481](#481)) ([7af9dfc](7af9dfc)) * **deps:** bump the dataviewer-backend-dependencies group across 1 directory with 15 updates ([#428](#428)) ([e4446a2](e4446a2)) * **deps:** bump the dataviewer-backend-dependencies group in /data-management/viewer/backend with 4 updates ([#487](#487)) ([0f57c5b](0f57c5b)) * **deps:** bump the dataviewer-backend-dependencies group in /data-management/viewer/backend with 8 updates ([#566](#566)) ([d6e7869](d6e7869)) * **deps:** bump the dataviewer-dependencies group across 1 directory with 5 updates ([#464](#464)) ([24c208d](24c208d)) * **deps:** bump the dataviewer-dependencies group in /data-management/viewer with 2 updates ([#486](#486)) ([90149f3](90149f3)) * **deps:** bump the dataviewer-dependencies group in /data-management/viewer with 6 updates ([#565](#565)) ([f0bb36b](f0bb36b)) * **deps:** bump the dataviewer-frontend-patch-minor group across 1 directory with 10 updates ([#613](#613)) ([e481f83](e481f83)) * **deps:** bump the github-actions group across 1 directory with 4 updates ([#534](#534)) ([5478ab6](5478ab6)) * **deps:** bump the github-actions group with 2 updates ([#488](#488)) ([4e6ce98](4e6ce98)) * **deps:** bump the github-actions group with 3 updates ([#567](#567)) ([48c38dc](48c38dc)) * **deps:** bump the github-actions group with 3 updates ([#634](#634)) ([00cfb49](00cfb49)) * **deps:** bump the github-actions group with 6 updates ([#603](#603)) ([73eb79a](73eb79a)) * **deps:** bump the training-dependencies group across 1 directory with 23 updates ([#463](#463)) ([d5a8656](d5a8656)) * **deps:** bump yaml from 2.8.2 to 2.8.3 in /data-management/viewer/frontend ([#453](#453)) ([10449df](10449df)) * pytest harness, dependabot advisories, and OSSF Scorecard remediations ([#501](#501)) ([e8756e8](e8756e8)) * **scripts:** pin and hash-verify all shell script downloads ([#468](#468)) ([0c2bb9c](0c2bb9c)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: physical-ai-toolchain-release[bot] <267194360+physical-ai-toolchain-release[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the python-dependencies group with 3 updates: hypothesis, ruff and matplotlib.
Updates
hypothesisfrom 6.152.1 to 6.152.3Release notes
Sourced from hypothesis's releases.
Commits
609de04Bump hypothesis-python version to 6.152.3 and update changelog902f1baMerge pull request #4720 from Liam-DeVoe/urandom-disable-bufferingda81118claude: open /dev/urandom with buffering=0 in URandomProvider80fada3Merge pull request #4714 from HypothesisWorks/DRMacIver/uv634e2beLet tox auto-provision tox-uv instead of pinning it in tools.txt5265564Seed pip into tox-uv envsd6caeb8Use uv instead of pyenv for build-time Python installs and toxc727eadBump hypothesis-python version to 6.152.2 and update changelog36d74b7Merge pull request #4711 from HypothesisWorks/DRMacIver/is-code-ownerbbc8963Merge pull request #4712 from HypothesisWorks/DRMacIver/fix-buildUpdates
rufffrom 0.15.11 to 0.15.12Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
Commits
66f93cfBump 0.15.12 (#24815)476a4d0[ty] Complete support for more detailed diagnostics on possibly unbound error...ed669eaImplement#ruff:file-ignorefile-level suppressions (#23599)e73d952[ty] Include inferred type ininvalid-keyconcise diagnostic for union/inte...80feb29[ty] report only dead annotation-only locals as unused (#24811)0fbf2bcDrop deprecated license classifier (#24808)43b174c[ty] Infer lambda parameter types withCallabletype context (#24317)4f449ae[ty] Add error context for intersection types (#24772)5b4e753[ty] Add support for goto in literal enum member inlay hint (#24792)e7cc762[ty] Add error context for TypedDict assignments (#24790)Updates
matplotlibfrom 3.10.8 to 3.10.9Release notes
Sourced from matplotlib's releases.
Commits
dd8d78bREL: v3.10.92fb1891REL: Release prep v3.10.9d0e923aMerge branch 'v3.10.8-doc' into v3.10.x1637932Merge pull request #31558 from meeseeksmachine/auto-backport-of-pr-31556-on-v...a83faacBackport PR #31556: FIX: Inverted PyErr_Occurred check in enum type caster (_...a4f57abMerge pull request #31545 from ksunden/backport-of-pr-31282-on-v3.10.x063288dMerge pull request #31544 from ksunden/backport-of-pr-31248-on-v3.10.xb2ed196Backport PR #31248: SEC: Remove eval() from validate_cycleracc6024Merge pull request #31282 from scottshambaugh/tex_no_shelle3fb541Merge pull request #31078 from meeseeksmachine/auto-backport-of-pr-31075-on-v...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions