Skip to content

Bump the python-production group across 1 directory with 7 updates - #2429

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/main/python-production-fe08bdd3ec
Open

Bump the python-production group across 1 directory with 7 updates#2429
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/main/python-production-fe08bdd3ec

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-production group with 6 updates in the / directory:

Package From To
fastapi 0.138.0 0.140.13
aiida-core 2.8.0 2.8.1
httpx2 2.4.0 2.9.1
click 8.2.1 8.4.2
ase 3.28.0 3.29.0
mkdocs-material 9.7.6 9.7.7

Updates fastapi from 0.138.0 to 0.140.13

Release notes

Sourced from fastapi's releases.

0.140.13

Fixes

Docs

0.140.12

Fixes

0.140.11

Fixes

  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

Internal

0.140.9

Fixes

  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

Internal

0.140.8

Fixes

0.140.6

Refactors

... (truncated)

Commits
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • e92a0dc 🐛 Fix status_code being ignored for SSE and JSONL streaming endpoints (#15937)
  • 6215d8a 📝 Update release notes
  • 12242c4 📝 Fix format_sse_event docstring rendering of \n\n terminator (#15613)
  • 70a8f3d 📝 Update release notes
  • 4f0152c 📝 Add API reference page for fastapi.sse (#15930)
  • 5f25505 🔖 Release version 0.140.12 (#16095)
  • 76e2c83 📝 Update release notes
  • 0f3e7bd 🐛 Fix line splitting in format_sse_event to comply with SSE spec (#15515)
  • Additional commits viewable in compare view

Updates aiida-core from 2.8.0 to 2.8.1

Release notes

Sourced from aiida-core's releases.

AiiDA v2.8.1

See CHANGELOG.md

Changelog

Sourced from aiida-core's changelog.

v2.8.1 - 2026-07-25

This patch fixes a SQLite QueryBuilder regression where plugin code using filters such as {'ctime': {'in': [...]}} or {'ctime': {'!in': [...]}} with Python datetime values could fail. Plugins that compare or exclude nodes by creation/modification time should now work again with SQLite profiles. It also adds a downgrade migration so that a v10 configuration schema — introduced in aiida-core v2.9 — can be brought back to the v9 schema used in aiida-core v2.8.

Full list of changes

Features

  • Add a config v10 migration for deprecated logging and broker options (#7417) [fded1e6e0]

Fixes

Improvements

Refactoring

Tests & CI

Commits

Updates httpx2 from 2.4.0 to 2.9.1

Release notes

Sourced from httpx2's releases.

v2.9.1

What's Changed

Full Changelog: pydantic/httpx2@v2.9.0...v2.9.1

v2.9.0

What's Changed

Full Changelog: pydantic/httpx2@v2.8.0...v2.9.0

v2.8.0

What's Changed

Full Changelog: pydantic/httpx2@v2.7.0...v2.8.0

v2.7.0

This release syncs the vendored WebSocket support with the latest httpx-ws, which was previously pinned to an outdated snapshot.

What's Changed

Full Changelog: pydantic/httpx2@v2.6.0...v2.7.0

v2.6.0

The main feature in this release is support for WebSockets! 🎉

from httpx2 import AsyncClient
async with httpx2.AsyncClient() as client:
async with client.websocket("ws://localhost:8000/ws") as ws:
await ws.send_text("Hello!")
message = await ws.receive_text()

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.9.1 (July 24th, 2026)

Fixed

  • Alias httpcore imports to httpcore2 in alias_httpx(). (#1082)

2.9.0 (July 23rd, 2026)

Added

  • Add alias_httpx(), letting applications make import httpx resolve to httpx2 process-wide. (#1077)

2.8.0 (July 23rd, 2026)

No changes since 2.7.0. Version bumped to stay in lockstep with httpcore2.

2.7.0 (July 14th, 2026)

Changed

  • Update the vendored httpx-ws to upstream v0.9.0. (#1067)

2.6.0 (July 14th, 2026)

Added

  • Add native WebSocket support by vendoring httpx-ws, installable with httpx2[ws]. (#1042)
  • Add support for the QUERY HTTP method via httpx2.query() and client.query(). (#1055)

Changed

  • Allow click 8.4+ in the cli extra, dropping the upper bound. (#1040)

2.5.0 (June 25th, 2026)

Added

  • Add native server-sent events support via client.sse(). (#1046)
  • Support | and |= operators for Headers. (#1047)

Fixed

  • Allow IPv6 CIDR notation in no_proxy. (#967)
Commits

Updates click from 8.2.1 to 8.4.2

Release notes

Sourced from click's releases.

8.4.2

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.2/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-2 Milestone: https://github.com/pallets/click/milestone/34

  • Fix Fish shell completion broken in 8.4.0 by #3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. #3502 #3043 #3504 #3508
  • Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. #3509
  • A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. #3059 #3507
  • echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. #3242 #2542 #3534
  • echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from #3482. #3449 #3533
  • Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. #3578
  • {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. #2331 #1884 #3125 #3582

8.4.1

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-1 Milestone: https://github.com/pallets/click/milestone/32

  • get_parameter_source() is available during eager callbacks and type conversion again. #3458 #3484
  • Zsh completion scripts parse correctly on Windows. #3277 # 3466
  • Shell completion of Choice Enum values produces a valid completion result. #3015
  • Fix empty byte-string handling in echo. #3487
  • Fix closed file error with echo_via_pager. #3449

8.4.0

This is the Click 8.4.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our [Version Support Policy][version] on our website.

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.4.2

Released 2026-06-24

  • Fix Fish shell completion broken in 8.4.0 by {pr}3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. {issue}3502 {issue}3043 {pr}3504 {pr}3508
  • Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. {pr}3509
  • A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. {issue}3059 {pr}3507
  • echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. {issue}3242 {issue}2542 {pr}3534
  • echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from {pr}3482. {issue}3449 {pr}3533
  • Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. {pr}3578
  • {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. {issue}2331 {issue}1884 {issue}3125 {pr}3582

Version 8.4.1

Released 2026-05-21

  • get_parameter_source() is available during eager callbacks and type conversion again. {issue}3458 {pr}3484
  • Zsh completion scripts parse correctly on Windows. {issue}3277 {pr}3466
  • Shell completion of Enum values used as Choice options produces a valid completion result. {issue}3015 {pr}3471
  • Fix empty byte-string handling in echo. {issue}3487 {pr}3493
  • Fix closed file error with echo_via_pager. {issue}3449 {pr}3482
  • Fix open_url on Windows when the file path contains spaces. {issue}2994 {pr}3478

Version 8.4.0

Released 2026-05-17

  • {class}ParamType typing improvements. {pr}3371

    • {class}ParamType is now a generic abstract base class,

... (truncated)

Commits
  • b2e30a1 Release version 8.4.2
  • 7a16b20 Fix package_name resolution when module differs from distribution name (#3582)
  • bec5928 Fix package_name resolution when top-level module differs from distribution...
  • 916883a Fix tests to not rely on -Wdefault option (#3591)
  • 09195f6 Fix double-bracketing of choices in synopsis (#3578)
  • 1557e26 Check for warning exception with idiomatic context manager
  • d9ff133 Static typing improvements in click.shell_completion (#3460)
  • 762c97e Fix double-bracketing of choices in synopsis
  • 8929d39 Convert changes to markdown. (#3559)
  • 237be50 Move changes headings down a level.
  • Additional commits viewable in compare view

Updates ase from 3.28.0 to 3.29.0

Commits
  • f27c000 ASE version 3.29.0
  • 814f6ad replay trajectory: fix resource warning by using ExitStack
  • 62edf66 Merge branch 'fix-pipeline' into 'master'
  • d75c014 Pass sparse matrices for block_diag
  • f5e452c Merge branch 'fix-mr-4143' into 'master'
  • 8e57da8 Add test_vasp_out_with_empty_contcar
  • ee4fac3 Rename variable
  • 2b5d80c Merge branch 'master' into 'master'
  • 765cb11 Merge branch 'fix-1935' into 'master'
  • bbd0c19 Merge branch 'fix-strange-ci-issue' into 'master'
  • Additional commits viewable in compare view

Updates numpy from 2.2.6 to 1.26.4

Commits
  • 9815c16 Merge pull request #25770 from charris/prepare-1.26.4
  • 114ed25 REL: Prepare for the NumPy 1.26.4 release
  • 2fae4d3 Merge pull request #25323 from stefanor/import-asstr
  • ce89a0a Merge pull request #25756 from charris/backport-24711
  • f62dfc6 Merge pull request #25755 from charris/backport-25709
  • fee88ab BUG: Fix np.quantile([Fraction(2,1)], 0.5) (#24711)
  • 659be68 MAINT: Include header defining backtrace
  • 837cd38 Merge pull request #25748 from rgommers/unvendor-mesonpython
  • f984240 CI: upgrade cibuildwheel from 2.16.4 to 2.16.5 [wheel build]
  • 3548f9d BLD: unvendor meson-python [wheel build]
  • Additional commits viewable in compare view

Updates mkdocs-material from 9.7.6 to 9.7.7

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.7.7

[!WARNING]

Material for MkDocs is approaching end of life

Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. After this date, the project will remain available on PyPI and GitHub, but no further maintenance is planned except in exceptional circumstances.

For users looking for a long-term, actively developed successor, we're building Zensical – a next-generation static site generator designed for technical documentation. If you're planning a new documentation project or evaluating your long-term options, we invite you to take a look.

Organizations requiring support beyond this date are welcome to get in touch to discuss available options.

Read the full announcement on our blog

Changes

  • Fixed a DOM-based XSS vulnerability in search suggestions

Thanks to @​p- for responsibly reporting this issue.

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.7.7 (2026-07-17)

  • Fixed DOM-based XSS vulnerability in search suggestions

mkdocs-material-9.7.6 (2026-03-19)

  • Automatically disable MkDocs 2.0 warning for forks of MkDocs

mkdocs-material-9.7.5 (2026-03-10)

  • Limited version range of mkdocs to <2
  • Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)

mkdocs-material-9.7.4 (2026-03-03)

  • Hardened social cards plugin by switching to sandboxed environment
  • Updated MkDocs 2.0 incompatibility warning

mkdocs-material-9.7.3 (2026-02-24)

  • Fixed #8567: Print MkDocs 2.0 incompatibility warning to stderr

mkdocs-material-9.7.2 (2026-02-18)

  • Opened up version ranges of optional dependencies for forward-compatibility
  • Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility

mkdocs-material-9.7.1 (2025-12-18)

  • Updated requests to 2.30+ to mitigate CVE in urllib
  • Fixed privacy plugin not picking up protocol-relative URLs
  • Fixed #8542: false positives and negatives captured in privacy plugin

mkdocs-material-9.7.0 (2025-11-11)

⚠️ Material for MkDocs is now in maintenance mode

This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.

Read the full announcement on our blog: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/

This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.

Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python-production group across 1 directory with 7 updates
03a5d45 
Bumps the python-production group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [fastapi](https://github.com/fastapi/fastapi) | `0.138.0` | `0.140.13` |
| [aiida-core](https://github.com/aiidateam/aiida-core) | `2.8.0` | `2.8.1` |
| [httpx2](https://github.com/pydantic/httpx2) | `2.4.0` | `2.9.1` |
| [click](https://github.com/pallets/click) | `8.2.1` | `8.4.2` |
| [ase](https://gitlab.com/ase/ase) | `3.28.0` | `3.29.0` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.6` | `9.7.7` |



Updates `fastapi` from 0.138.0 to 0.140.13
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.138.0...0.140.13)

Updates `aiida-core` from 2.8.0 to 2.8.1
- [Release notes](https://github.com/aiidateam/aiida-core/releases)
- [Changelog](https://github.com/aiidateam/aiida-core/blob/v2.8.1/CHANGELOG.md)
- [Commits](aiidateam/aiida-core@v2.8.0...v2.8.1)

Updates `httpx2` from 2.4.0 to 2.9.1
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.4.0...v2.9.1)

Updates `click` from 8.2.1 to 8.4.2
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.2.1...8.4.2)

Updates `ase` from 3.28.0 to 3.29.0
- [Changelog](https://gitlab.com/ase/ase/blob/master/CHANGELOG.rst)
- [Commits](https://gitlab.com/ase/ase/compare/3.28.0...3.29.0)

Updates `numpy` from 2.2.6 to 1.26.4
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.2.6...v1.26.4)

Updates `mkdocs-material` from 9.7.6 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.6...9.7.7)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.140.13
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-production
- dependency-name: aiida-core
  dependency-version: 2.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-production
- dependency-name: httpx2
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-production
- dependency-name: click
  dependency-version: 8.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-production
- dependency-name: ase
  dependency-version: 3.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-production
- dependency-name: numpy
  dependency-version: 1.26.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-production
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependency_updates Issues pertaining to updates to our dependencies that are breaking the eager build label Aug 1, 2026
@dependabot
dependabot Bot requested review from CasperWA and ml-evs as code owners August 1, 2026 05:51
@dependabot dependabot Bot added the dependency_updates Issues pertaining to updates to our dependencies that are breaking the eager build label Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@CasperWA CasperWA Awaiting requested review from CasperWA CasperWA is a code owner
@ml-evs ml-evs Awaiting requested review from ml-evs ml-evs is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependency_updates Issues pertaining to updates to our dependencies that are breaking the eager build

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants