[dependabot]

Bumps the weekly-batch group with 34 updates:

Package	From	To
boto3	1.43.124	1.43.126
apispec	6.10.0	6.10.1
botocore	1.43.124	1.43.126
cattrs	26.2.0	26.2.1
certifi	2026.10.18	2026.10.23
charset-normalizer	3.5.1	3.5.2
click	8.5.0	8.5.1
dnspython	2.9.0	2.9.2
enum-tools	0.12.0	0.13.0
importlib-metadata	9.0.1	10.1.0
markupsafe	3.0.3	3.0.4
marshmallow	4.3.1	4.4.0
platformdirs	4.11.10	4.14.5
pydantic	2.13.5	2.14.3
pydantic-core	2.46.5	2.50.4
pyparsing	3.3.2	3.3.3
pyshacl	0.40.1	0.40.2
python-dateutil	2.9.0.post0	4.0.0
rich	13.9.4	15.0.0
s3transfer	0.19.2	0.19.3
typing-inspection	0.4.4	0.4.5
tzlocal	5.4.4	5.4.5
url-normalize	3.0.0	3.1.0
wcwidth	0.8.4	0.9.4
zipp	4.1.0	4.1.2
cryptography	50.0.1	50.0.2
iniconfig	2.3.0	2.3.1
moto	5.2.3	5.2.5
pip-tools	7.6.1	7.6.2
pluggy	1.6.0	1.7.0
pycparser	3.0	3.12
pytest	9.1.1	9.2.0
pytest-mock	3.15.1	3.17.0
ruff	0.16.8	0.17.4

Updates boto3 from 1.43.124 to 1.43.126

Commits

• ef06721 Merge branch 'release-1.43.126'
• de8922c Bumping version to 1.43.126
• 03472f1 Add changelog entries from botocore
• 0b10f04 Merge branch 'release-1.43.125'
• 6b6c175 Merge branch 'release-1.43.125' into develop
• 140a240 Bumping version to 1.43.125
• e239fae Add changelog entries from botocore
• 6b03fe3 Merge branch 'release-1.43.124' into develop
• See full diff in compare view

Updates apispec from 6.10.0 to 6.10.1

Changelog

Sourced from apispec's changelog.

6.10.1 (2026-11-03)

---

Bug fixes:

• Recognize trace operations defined in view docstrings, instead of silently dropping them (:pr:1059). Thanks :user:binggao1230 for the PR.
• Fix intersect OneOf and Equal choices in field2choices (:issue:198). Thanks :user:alexchen-sys for the PR.

Other changes:

• Drop support for marshmallow 3, which is EOL.
• Drop support for Python 3.10.
• Test against Python 3.15.

Commits

• 0560380 Bump version and update changelog
• bfebdae Support Python 3.11-3.15 (#1094)
• 8a22dae Update all dependencies (#1091)
• 99b63a5 Lock file maintenance (#1092)
• 0b66a26 [pre-commit.ci] pre-commit autoupdate (#1079)
• 9b70048 Update AUTHORS.rst
• 771fc7d Merge pull request #1059 from binggao1230/add-trace-to-path-keys
• 1cd742f Merge branch 'dev' into add-trace-to-path-keys
• 96e93e8 Update CHANGELOG
• 92e9dea Update AUTHORS.rst
• Additional commits viewable in compare view

Updates botocore from 1.43.124 to 1.43.126

Commits

• 76ccee1 Merge branch 'release-1.43.126'
• 51e0576 Bumping version to 1.43.126
• a6d782a Update partitions file
• bbb7c71 Update endpoints model
• 1cd0552 Update to latest models
• 7e892ec Merge branch 'release-1.43.125'
• 4f864a4 Merge branch 'release-1.43.125' into develop
• 651dc15 Bumping version to 1.43.125
• 554b2fe Update to latest models
• 7d43609 Merge branch 'release-1.43.124' into develop
• See full diff in compare view

Updates cattrs from 26.2.0 to 26.2.1

Release notes

Sourced from cattrs's releases.

v26.2.1

What's Changed

• Fix heterogeneous tuples and NamedTuples with a member type containing a quote in its repr, like tuple[Literal["a"], int], crashing structuring code generation with SyntaxError; the index note is now embedded with repr. (#777)
• Fix transform_error listing the extra keys of a ForbiddenExtraKeysError in set iteration order, which made the message differ between runs; the keys are now sorted, like the error's own __str__ already sorts them. (#776)

New Contributors

• @​MaxFreedomPollard made their first contribution in python-attrs/cattrs#776

Full Changelog: python-attrs/cattrs@v26.2.0...v26.2.1

Changelog

Sourced from cattrs's changelog.

26.2.1 (2026-09-26)

• Honor field renaming overrides when selecting literal discriminators for unions, so renamed union members can be structured from their serialized keys. (#778)
• Fix heterogeneous tuples and NamedTuples with a member type containing a quote in its repr, like tuple[Literal["a"], int], crashing structuring code generation with SyntaxError; the index note is now embedded with repr. (#777)
• Fix {func}transform_error <cattrs.transform_error> listing the extra keys of a ForbiddenExtraKeysError in set iteration order, which made the message differ between runs; the keys are now sorted, like the error's own __str__ already sorts them. (#776)

Commits

• 995d66a v26.2.1
• 5bf7c97 Escape the index note when structuring heterogeneous tuples
• bc34a46 Sort extra keys when formatting ForbiddenExtraKeysError (#776)
• See full diff in compare view

Updates certifi from 2026.10.18 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• 662df63 Restore unaffected emSign roots (#439) (#440)
• See full diff in compare view

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates click from 8.5.0 to 8.5.1

Release notes

Sourced from click's releases.

8.5.1

This is the Click 8.5.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.5.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-1 Milestone: https://github.com/pallets/click/milestone/66

• Fix copy.deepcopy() and pickle on a Parameter, Option or Command. #3805
• A KeyboardInterrupt arriving while Command.main() reports an abort or an error, or while it exits, no longer escapes as an unhandled traceback. The command still exits with the intended code; only the message may be lost. #3802
• Add Option.get_help_spec(), which returns the option's left help column even when the option is hidden. Option.get_help_record() still returns None for hidden options, so help screens are unchanged. #3821
• The Positional arguments help section lists every argument of the command, not only the documented ones. An argument with no help gets an empty description, the same way an option with no help does. #3860
• Argument.get_help_record() always returns a tuple. It used to return None for an argument with no help. #3860
• Document which types are inferred from default, and what an unrecognized type callable does to a command-line value. #3036 #3808
• path_type narrows the converted value's type for convert and prompt. #3822 #3858
• Parameter accepts a new help argument, and Option and Argument inherit it. Parameter.to_info_dict() now reports help for every kind of parameter. #3861
• A command's short help no longer stops at an abbreviation such as vs. or e.g. inside the first sentence. A period ends the sentence only when it closes the text or the next word does not start in lowercase. #3865
• With show_envvar=True, an option's error message now prints all variables of an envvar sequence instead of the repr of the sequence. #3884
• An empty envvar, such as [] or "", shows the same help and error message as no envvar when show_envvar=True. The help screen used to show [env var: ]. #3884
• Align command's deprecated help text to options and arguments: do not translate the command's own help text, only the (DEPRECATED) label. #3901

Changelog

Sourced from click's changelog.

Version 8.5.1

Released 2026-11-09

• Fix copy.deepcopy() and pickle on a Parameter, Option or Command. {pr}3805
• A KeyboardInterrupt arriving while Command.main() reports an abort or an error, or while it exits, no longer escapes as an unhandled traceback. The command still exits with the intended code; only the message may be lost. {issue}3802
• Add {meth}Option.get_help_spec, which returns the option's left help column even when the option is hidden. {meth}Option.get_help_record still returns None for hidden options, so help screens are unchanged. {pr}3821
• The Positional arguments help section lists every argument of the command, not only the documented ones. An argument with no help gets an empty description, the same way an option with no help does. {pr}3860
• {meth}Argument.get_help_record always returns a tuple. It used to return None for an argument with no help. {pr}3860
• Document which types are inferred from default, and what an unrecognized type callable does to a command-line value. {issue}3036 {pr}3808
• path_type narrows the converted value's type for convert and prompt. {issue}3822 {pr}3858
• {class}Parameter accepts a new help argument and {class}Option and {class}Argument inherits it. {meth}Parameter.to_info_dict now reports help for every kind of parameter. {pr}3861
• A command's short help no longer stops at an abbreviation such as vs. or e.g. inside the first sentence. A period ends the sentence only when it closes the text or the next word does not start in lowercase. {pr}3865
• With show_envvar=True, an option's error message now prints all variables of an envvar sequence instead of the repr of the sequence. {pr}3884
• An empty envvar, such as [] or "", shows the same help and error message as no envvar when show_envvar=True. The help screen used to show [env var: ]. {pr}3884
• Align command's deprecated help text to options and arguments: do not translate the command's own help text, only the (DEPRECATED) label. {pr}3901

Commits

• cf19179 Release version 8.5.1
• 1ff766d Remove documentation changelog entry.
• 16da191 Add a standalone application guide for Nuitka (#3897)
• 473f652 Remove issue and PR references outside the changelog (#3905)
• df7fe0b Remove issue and PR references outside the changelog
• 4fd4206 Bump pypa/gh-action-pypi-publish to v1.14.3 (#3906)
• 9048ab0 Bump pypa/gh-action-pypi-publish to v1.14.3
• ff0c369 Add a standalone application guide for Nuitka
• 5125851 Stop passing a deprecated command's help text through gettext (#3901)
• 6d34602 Additional round-trip tests for unstyle() (#3899)
• Additional commits viewable in compare view

Updates dnspython from 2.9.0 to 2.9.2

Release notes

Sourced from dnspython's releases.

dnspython 2.9.2

A malicious WKS record in text format can consume excessive memory and CPU when parsed, possibly causing the process to exit due to memory exhaustion. Thanks to Jace (GitHub @​manus-use) for discovering and reporting this issue.

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

dnspython 2.9.1

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

Changelog

Sourced from dnspython's changelog.

2.9.2

• A maliciously crafted zone file could use a WKS record to consume excessive memory and CPU, possibly causing the process to exit due to memory exhaustion. Thanks to Jace (GitHub @​manus-use) for discovering and reporting this issue.

2.9.1

• LOC text parsing now converts the altitude, size, horizontal precision, and vertical precision fields to centimeters exactly, and requires them to be decimal numbers of meters with at most two fractional digits, as RFC 1876 section 3 specifies. They were converted with float(), so 9.29m became 928 cm rather than 929 cm and the text and wire forms of the record disagreed, forms such as 1e3m, 1_000m, +10m, nanm, and infm were accepted, extra fractional digits were silently dropped, and an altitude outside the representable range was accepted and then failed in to_wire() with a non-DNS exception. dns.exception.SyntaxError is now raised for all of these.

• The resolver now assigns a new random query id to every query.

• For transports that require a 0 query id, set it in a way that does not break TSIG.

• dns.message.QueryMessage.resolve_chaining() now caps the minimum TTL of a negative response with no SOA record at 300 seconds (dns.message.NEGATIVE_TTL_WITHOUT_SOA). Previously the TTL was left at its initial value of 2^32 - 1, so a single NXDOMAIN or NODATA response with no SOA, e.g. a spoofed one, stayed in the resolver cache for the life of the process.

• DNSSEC validation now rejects an RRSIG whose type covered or class does not match the RRset, as RFC 4035 section 5.3.1 requires. This was not checked, so a revoked DNSKEY, which may only validate the DNSKEY RRset, still validated any RRset signed with its private key if the RRSIG claimed to cover DNSKEY.

• dns.tokenizer.Tokenizer now ends a line at a carriage return, or at a carriage return followed by a line feed, unless the carriage return is in a quoted string. The carriage return of CRLF line ends used to stay in the last token of each line and in the text of a comment, so e.g. dns.zone.from_text() rejected a zone with CRLF line ends.

• DNSSEC validation no longer uses a DNSKEY with the REVOKE flag set to validate anything other than the DNSKEY RRset. RFC 5011 section 2.1 says a revoked key must not be used for any other purpose, but it was a candidate key like any other, so as long as the revoked key was still published, data signed with its private key, e.g. by whoever compromised it, validated.

... (truncated)

Commits

• 854bedd bump README.md version
• 388db14 Constrain WKS bitmap size.
• 7e1832f version bump
• dddd69c black lint
• 185cc38 release prep
• cf22838 Randomize the id of every message the resolver sends. (#1395)
• e0fce7f use a short negative TTL for a negative answer with no SOA in resolve_chainin...
• ad0803c check the RRSIG type covered and class against the RRset (#1388)
• 8c38a04 Strictly apply RFC 3597 compression rules when decompressing. (#1383)
• ab5ade8 end a line at a carriage return in the tokenizer (#1387)
• Additional commits viewable in compare view

Updates enum-tools from 0.12.0 to 0.13.0

Release notes

Sourced from enum-tools's releases.

Version 0.13.0

Automatically copied from PyPI.

---

Powered by OctoCheese
📝 docs | repo | 🐇 issues | 🥚 marketplace

Commits

• baf43df Bump version v0.12.0 -> v0.13.0
• 9e71eda Use older macOS for Python 3.7
• 390ab41 Bump macOS version.
• b5c781e Run Flake8 on Ubuntu 22.04 (#106)
• 4321397 Don't test Python 3.12 with older Sphinx versions (require distutils)
• 38bcbcf Fix for Sphinx 8.2
• b982dc7 Actually run tests on newer Sphinx versions.
• 2706b17 Bump Ubuntu to 22.04 (#103)
• a6eb3eb Drop Python 3.6 from test matrix.
• 9098922 [repo-helper] Configuration Update (#101)
• Additional commits viewable in compare view

Updates importlib-metadata from 9.0.1 to 10.1.0

Changelog

Sourced from importlib-metadata's changelog.

v10.1.0

Features

• Detecting whether a distribution supplies metadata no longer reads or parses that metadata where the metadata directory can be inspected instead, so retrieving a distribution by name, which prefers the valid candidates, is substantially faster.
• Reverted the preference for the greater metadata directory added in v9.1.0. The ordering was lexicographic on the directory name and not on the parsed version, so it only approximated a preference for the newer version. Where a path supplies more than one metadata directory for a distribution, discovery once again reports them in the order the path supplies python/cpython#100666

Bugfixes

• entry_points() now prefers distributions whose metadata is readable, so an empty metadata directory left behind by an unclean upgrade no longer shadows the valid one of the same name and suppresses its entry points. Invalid distributions are deferred to the end of the enumeration rather than dropped. (#534)
• The preference for valid distributions no longer propagates the MetadataNotFound of a distribution that a provider derived from importlib.metadata, whose exception is a different class from this package's and so escaped the preference rather than marking the distribution invalid.

v10.0.0

Features

• Added IDistribution and IPackagePath protocols so consumers can target a stable, shared interface across importlib.metadata and importlib_metadata. A provider supplying its own Distribution subclass is warned about only when the class omits members that interface requires, not merely because it derives from importlib.metadata. origin is exempt from that expectation until support for Python 3.12 is dropped, as there is none to inherit before Python 3.13. (#486)

Deprecations and Removals

• When providers supply objects from importlib.metadata, they are now adapted to the classes from importlib_metadata. (#486)

v9.1.0

... (truncated)

Commits

• d196fdb Finalize
• 5d253ae Merge pull request #553 from python/bugfix/534-entry-points-prefer-valid
• 0aa24f3 Prefer valid distributions when collecting entry points.
• e52be78 Detect the presence of metadata without reading it.
• 60bbaca Merge pull request #552 from python/debt/revert-prefer-greater-version
• 7e162d8 Revert "Prefer the greater metadata directory when a path supplies several."
• 3be1416 Finalize
• e3dad22 Merge pull request #505 from python/bugfix/486-local-objects
• 301b791 Finalize
• 4b7c45f Avoid a dot in the news fragment id.
• Additional commits viewable in compare view

Updates markupsafe from 3.0.3 to 3.0.4

Release notes

Sourced from markupsafe's releases.

3.0.4

This is the MarkupSafe 3.0.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.4/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-4 Milestone: https://github.com/pallets/markupsafe/milestone/17?closed=1

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. #521

Changelog

Sourced from markupsafe's changelog.

Version 3.0.4

Released 2026-10-02

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. :issue:521

Commits

• ece2607 release version 3.0.4
• 620bc80 split archs
• 73c3be1 fix wheel builds (#536)
• d8ae19e fix wheel builds
• ff1eaff Build Android and iOS wheels (#516)
• 87e64f9 build Android and iOS wheels
• bc33c55 Build ppc64le wheels (#518)
• 0ddd6ea build ppc64le wheels
• 3e07758 Build armv7l wheels (#514)
• 39b9aae build armv7l wheels
• Additional commits viewable in compare view

Updates marshmallow from 4.3.1 to 4.4.0

Changelog

Sourced from marshmallow's changelog.

4.4.0 (2026-11-03)

Features:

• Simplify get_value to match actual usage (:pr:3024).

Bug fixes:

• Raise ValidationError <marshmallow.exceptions.ValidationError> (not ValueError) for NaN in TimeDelta <marshmallow.fields.TimeDelta> (:pr:3004). Thanks :user:vidigoat for the PR.
• Fix Pluck handling of empty data_key (:pr:3082).

Other changes:

• Drop support for Python 3.10.
• Test against Python 3.15.

Commits

• a38b7f6 Bump version and update changelog
• 88efe3e Support Python 3.11-3.15 (#3102)
• f988218 pre-commit autoupdate
• 70868ff Update all dependencies (#3097)
• d90ab58 Lock file maintenance (#3098)
• b762ea2 Update CHANGELOG
• 5761bea Fix Pluck handling of empty data_key
• d08471b [pre-commit.ci] pre-commit autoupdate
• 1c63bda Update astral-sh/setup-uv action to v10.2.0 (#3061)
• 1ed2773 Lock file maintenance (#3062)
• Additional commits viewable in compare view

Updates platformdirs from 4.11.10 to 4.14.5

Release notes

Sourced from platformdirs's releases.

4.14.5

Bug fixes

• Resolve the temporary user_runtime_dir fallback to /runtime-<uid> instead of //runtime-<uid> when the temporary directory is / (#687) by @​darrenhuai and @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

4.14.4

🐍 PyPI release

📜 Full Changelog

4.14.3

Bug fixes

• Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (#679) by @​mikegit123git and @​gaborbernat.

New Contributors

• @​mikegit123git made their first contribution in tox-dev/platformdirs#679

PyPI release

Full Changelog

4.14.2

Bug fixes

• Deduplicate equivalent XDG directory spellings across string and path iterators and file searches (#677) by @​AlvaroBalbin and @​gaborbernat.

New Contributors

• @​AlvaroBalbin made their first contribution in tox-dev/platformdirs#677

PyPI release

Full Changelog

4.14.0

Features

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-14-5:

---

4.14.5 (2026-11-04)

---

.. _release-4-14-5-fixed:

Fixed

• Resolve the temporary :func:~platformdirs.user_runtime_dir fallback to /runtime-<uid> instead of //runtime-<uid> when the temporary directory is / (:pr:687) by :user:darrenhuai and :user:gaborbernat.

.. _release-4-14-4:

---

4.14.4 (2026-11-04)

---

.. _release-4-14-3:

---

4.14.3 (2026-11-01)

---

.. _release-4-14-3-fixed:

Fixed

• Preserve trailing whitespace in absolute XDG directory values instead of resolving a different directory (:pr:679) by :user:mikegit123git and :user:gaborbernat.

.. _release-4-14-2:

---

4.14.2 (2026-10-31)

---

.. _release-4-14-2-fixed:

... (truncated)

Commits

• 6a7d284 release 4.14.5
• c9ad21d 🐛 fix(unix): avoid // in the runtime fallback when the temp dir is / (#687)
• cf51ebd release 4.14.4
• 573a192 👷 ci: adopt shared workflows and dependency hygiene (#685)
• 9008466 build(deps): refresh project lock (#684)
• 246e9ad Bump the "dependencies" group with 2 updates across multiple ecosystems (#683)
• d4064eb 👷 ci(scorecard): publish OpenSSF results (#682)
• f9323b0 🔧 build(deps): use release-creator 4.4 (#681)
• eb0cce8 👷 ci(news): stop cancelling the news check (#680)
• 099c969 release 4.14.3
• Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.3

Release notes

Sourced from pydantic's releases.

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

• Build wheels for GraalPy 3.13 by @​msimacek in #14136.

  The previous v2.14.2 release published GraalPy 3.11 wheels, which were not working due to a PyO3 version bump. A CI workflow issue made it so that the wheel wasn't tested before publishing. This is now fixed: starting in v2.14.3, we no longer publish GraalPy 3.11 wheels, and GraalPy 3.13 wheels are now published together with the existing 3.12 one.

Performance

• Improve schema generation for fixed type handlers by @​alexmojaki in #14130
• Skip general schema dispatch for builtin scalars by @​alexmojaki in #14141
• Skip annotation handler setup when annotations are empty by @​alexmojaki in #14149
• Fix quadratic serialization time with per-index include/exclude on sequences by @​Viicos in #14160
• Avoid type lookups when checking for None during serialization by @​Viicos in #14167
• Improve performance of model serialization by @​Viicos in #14171
• Improve performance of dict serialization by @​Viicos in #14172
• Improve performance of type inference during serialization by @​Viicos in #14173
• Avoid cloning the field name when using the default value during validation by @​Viicos in #14175
• Do not evaluate model_config annotations by @​Viicos in #14195
• Avoid slow runtime Protocol check when expanding GroupedMetadata annotations by @​Viicos in #14196
• Use a lightweight @contextmanager implementation internally by @​Viicos in #14199

Fixes

• Fix various issues about GC tracking in pydantic-core by @​Viicos in #13819
• Include null in serialization JSON Schema for unless-none field serializers by @​Kropiunig in #13848
• Fix RecursionError when copying or unpickling models with defer_build by @​Viicos in #14115
• Remove dead default_factory check in unsupported Field() attribute by @​owtaylor in #14129
• Disallow non string extra keys during validation by @​Viicos in #14135
• Fix deeply nested data being reported as a cyclic reference by @​Viicos in #14164

New Contributors

• @​owtaylor made their first contribution in #14129

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.

Packaging

• Bump PyO3 to 0.30.1, jiter to 0.18.0, use PyFrozenDict by @​Viicos in #14003
• Bump speedate to v0.18.0 by @​Viicos in #14007
• Publish pydantic-core wheels for PyPy 8.0 (pp80 ABI) by @​Viicos in #14083

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in