Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 11 updates - #20

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/minor-and-patch-6d3809b7eb
Closed

chore(deps): bump the minor-and-patch group across 1 directory with 11 updates#20
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/minor-and-patch-6d3809b7eb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the minor-and-patch group with 11 updates in the / directory:

Package From To
streamlit 1.59.1 1.60.0
groq 1.5.0 1.6.0
fastapi 0.139.0 0.140.1
annotated-types 0.7.0 0.8.0
anyio 4.14.1 4.14.2
cachetools 7.1.4 7.1.6
certifi 2026.6.17 2026.7.22
gitpython 3.1.50 3.1.57
narwhals 2.23.0 2.24.0
tzdata 2026.2 2026.3
websockets 16.0 16.1.1

Updates streamlit from 1.59.1 to 1.60.0

Release notes

Sourced from streamlit's releases.

1.60.0

What's Changed

Breaking Changes 🛠

New Features 🎉

Bug Fixes 🐛

Other Changes

... (truncated)

Commits
  • 70c32f1 Up version to 1.60.0
  • 5b2bbbe [bugfix] Fix widgets inside popover-in-dialog being unclickable (#16067)
  • c5e4012 [bugfix] Fix inconsistent checkbox margin in horizontal container within colu...
  • 96cf9d6 [docs] Pause external pull request contributions (#16037)
  • d71628c [bugfix] Include decorators in st.echo output (#16068)
  • cc1676a Bump the eslint group across 1 directory with 2 updates (#16083)
  • 4ccad5d [chore] Add typing test for st.pydeck_chart (#15801)
  • fc2cb5d Bump the codeql-action group with 2 updates (#16058)
  • 6022987 Bump vite-bundle-analyzer from 1.3.8 to 1.3.9 in /frontend in the vite group ...
  • db297c6 Bump the protobufjs group in /frontend with 2 updates (#16073)
  • Additional commits viewable in compare view

Updates groq from 1.5.0 to 1.6.0

Release notes

Sourced from groq's releases.

v1.6.0

1.6.0 (2026-07-18)

Full Changelog: v1.5.0...v1.6.0

Features

  • stlc: configurable CI runner and private-production-repo support in workflow templates (b39b7db)

Chores

Changelog

Sourced from groq's changelog.

1.6.0 (2026-07-18)

Full Changelog: v1.5.0...v1.6.0

Features

  • stlc: configurable CI runner and private-production-repo support in workflow templates (b39b7db)

Chores

Commits

Updates fastapi from 0.139.0 to 0.140.1

Release notes

Sourced from fastapi's releases.

0.140.1

Refactors

  • ♻️ Update the lru_cache limit for dependencies to account for large apps. PR #16062 by @​tiangolo.

0.140.0

Refactors

Docs

Internal

0.139.2

Fixes

  • 🐛 Refactor router route building to make it thread-safe, mainly relevant for tests running in parallel threads (uncommon). PR #16013 by @​tiangolo.

0.139.1

Fixes

  • 🐛 Fix frontend fallback support for doted paths like /users/john.doe. PR #16011 by @​tiangolo.

Docs

  • 📝 Fix topic repository list not being displayed and skip_users not being applied. PR #15995 by @​YuriiMotov.

Translations

... (truncated)

Commits

Updates annotated-types from 0.7.0 to 0.8.0

Release notes

Sourced from annotated-types's releases.

v0.8.0

What's Changed

New Contributors

Full Changelog: annotated-types/annotated-types@v0.7.0...v0.8.0

Commits

Updates anyio from 4.14.1 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
Commits
  • c384f99 Bumped up the version
  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
  • be24b04 Relaxed timeouts to fix test flakiness
  • 8113506 Fix test flakiness caused by slow callback duration logging
  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
  • Additional commits viewable in compare view

Updates cachetools from 7.1.4 to 7.1.6

Changelog

Sourced from cachetools's changelog.

v7.1.6 (2026-07-24)

  • Minor style improvements to keep ruff happy.

v7.1.5 (2026-07-23)

  • Fix TLRUCache silently keeping stale values on expired overwrites.

  • Reject negative cache item getsizeof values.

  • Update build environment.

Commits
  • 13bb86a Minor style improvements to keep ruff happy.
  • e2250be Fix RTD version handling.
  • 0d2a6ea Release v7.1.5.
  • d64cf80 Prepare v7.1.5.
  • fcbb0de Fix #406: Merge branch 'gaoflow-fix-tlru-overwrite-expired-stale-value' into ...
  • c0fdf6a Fix TLRUCache silently keeping stale value on expired overwrite
  • 978d34d Bump actions/setup-python from 6.2.0 to 6.3.0
  • d5c7eea Reject negative cache item sizes
  • 578e976 Update build environment.
  • e164b70 Bump codecov/codecov-action from 6.0.0 to 7.0.0
  • Additional commits viewable in compare view

Updates certifi from 2026.6.17 to 2026.7.22

Commits

Updates gitpython from 3.1.50 to 3.1.57

Release notes

Sourced from gitpython's releases.

3.1.57 - Security and Fixes

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

3.1.56 - SECURITY

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.55...3.1.56

3.1.55 - Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.54...3.1.55

3.1.54 - Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.53...3.1.54

3.1.53 - Security

What's Changed

New Contributors

... (truncated)

Commits
  • ccbd573 prepare for new release
  • d1a631d Merge pull request #2193 from gitpython-developers/more-unsafe-options
  • ab33e33 Merge pull request #2194 from gitpython-developers/fix-basedpyright
  • 52199b3 address review comments
  • 60dec71 Adopt basedpyright with a legacy baseline
  • 7a4f5dc Block unsafe archive additions and bundle URI
  • 3af0c25 Block unsafe checkout-index and tag file options
  • fb5d584 Merge pull request #2187 from pick7/codex/remote-progress-return-type
  • 951cc44 Merge pull request #2188 from pick7/codex/redact-http-extraheader
  • 2e5b13f Merge pull request #2189 from pick7/codex/output-stream-timeout
  • Additional commits viewable in compare view

Updates narwhals from 2.23.0 to 2.24.0

Release notes

Sourced from narwhals's releases.

Narwhals v2.24.0

Changes

✨ Enhancements

  • feat: Widen IntoSchema to accept IntoDType values and (name, dtype) pair sequences (#3756)
  • feat: add nw.list (#3694)
  • feat: Support plugin native objects in is_into_* (#3754)
  • feat: stabilize dtype conversion across pandas, pyarrow, and modin test constructors (#3749)

🐞 Bug fixes

  • fix: avoid potential sql injection in sink_parquet (#3783)
  • fix(pyarrow): Adapt for pyarrow v25.0.0 (#3771)
  • fix(ci): sync all dependencies in altair downstream test (#3767)
  • fix: Fix fill_null for Dask with expressions (#3758)
  • fix: avoid potential sql injection for join_asof (#3782)
  • fix assert_equal_data for objects where __eq__ returns non-bool (#3760)

📖 Documentation

  • docs: Add 'AI-assisted contributions' section in CONTRIBUTING.md and PR field (#3701)

🛠️ Other improvements

  • ci: fix lightgbm nightly test (#3786)
  • fix: tighten assert_equal_data (#3772)
  • remove pull requests: write from release-drafter (#3764)
  • use pyrefly coverage check instead of pyright-cov (#3747)
  • chore: prek autoupdate (#3755)
  • ci: Bump release-drafter action (#3748)
  • ci: speed up pyspark connect (#3740)
  • ci: Run pytest actions on uv.lock changes (#3738)

Thank you to all our contributors for making this release possible! @​CangyuanLi, @​EdAbati, @​FBruzzesi, @​MarcoGorelli, @​PraveenKumarSridhar, @​camriddell, @​dangotbanned, @​dependabot[bot], @​github-actions[bot], @​renovate[bot], dependabot[bot], github-actions[bot] and renovate[bot]

Commits
  • 007bbeb release: Bump version to 2.24.0
  • 71de97b ci: fix lightgbm nightly test (#3786)
  • 5b3bb00 fix: tighten assert_equal_data (#3772)
  • 7e72e00 chore(deps): lock file maintenance (#3785)
  • 23af8f6 fix: avoid potential sql injection in sink_parquet (#3783)
  • f44556b fix: avoid potential sql injection for join_asof (#3782)
  • deffd1d chore(deps): lock file maintenance (#3781)
  • 93652c3 chore(deps): lock file maintenance (#3776)
  • 2721975 ci: Remove core, typing dependency group conflict (#3773)
  • dcbbf22 feat: Widen IntoSchema to accept IntoDType values and (name, dtype) pai...
  • Additional commits viewable in compare view

Updates tzdata from 2026.2 to 2026.3

Release notes

Sourced from tzdata's releases.

2026.3: Release of upstream tzdata 2026c

Version 2026.3

Upstream version 2026c released 2026-07-08T17:23:58+00:00

Briefly:

Alberta moved to permanent -06 on 2026-06-18. Morocco moves to permanent +00 on 2026-09-20. More integer overflow bugs have been fixed in zic.

Changes to future timestamps

Alberta’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -06 thereafter. (Thanks to Roozbeh Pournader and others.) Model this with its traditional abbreviation CST. Although the change to permanent -06 legally took place on 2026-06-18, temporarily model the change to occur on 2026-11-01 at 02:00 instead, for the same reason we introduced a similarly temporary hack for British Columbia in 2026b.

Although another TZDB release will likely be needed soon because Northwest Territories will likely follow Alberta, the legal formalities have not yet taken place.

Morocco plans to move back to permanent UTC, without daylight saving time transitions, on 2026-09-20 at 02:00. This also affects Western Sahara.

Changes to commentary

Northwest Territories is expected to move to permanent -06 prior to 2026-11-01 02:00, when clocks would otherwise fall back. (Thanks to Tim Parenti and James Bellaire.) Model this with its traditional abbreviation CST. Unfortunately the change is not yet official, so it is currently present only as comments that can be uncommented as needed.

Changelog

Sourced from tzdata's changelog.

Version 2026.3

Upstream version 2026c released 2026-07-08T17:23:58+00:00

Briefly:

Alberta moved to permanent -06 on 2026-06-18. Morocco moves to permanent +00 on 2026-09-20. More integer overflow bugs have been fixed in zic.

Changes to future timestamps

Alberta’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -06 thereafter. (Thanks to Roozbeh Pournader and others.) Model this with its traditional abbreviation CST. Although the change to permanent -06 legally took place on 2026-06-18, temporarily model the change to occur on 2026-11-01 at 02:00 instead, for the same reason we introduced a similarly temporary hack for British Columbia in 2026b.

Although another TZDB release will likely be needed soon because Northwest Territories will likely follow Alberta, the legal formalities have not yet taken place.

Morocco plans to move back to permanent UTC, without daylight saving time transitions, on 2026-09-20 at 02:00. This also affects Western Sahara.

Changes to commentary

Northwest Territories is expected to move to permanent -06 prior to 2026-11-01 02:00, when clocks would otherwise fall back. (Thanks to Tim Parenti and James Bellaire.) Model this with its traditional abbreviation CST. Unfortunately the change is not yet official, so it is currently present only as comments that can be uncommented as needed.

Commits
  • a442794 Update tzdata to version 2026c (#145)
  • 8f35937 Use the release environment for TestPyPI publishes (#146)
  • ba0b891 Few fixes to the maintaining doc
  • 9a7e6a0 Add Stan Ulbrych to license
  • 1cab5e2 Bump actions/checkout from 6.0.2 to 7.0.0 (#144)
  • e71cff9 Bump hynek/build-and-inspect-python-package action (#143)
  • 14b2953 Make open PR check stricter (#141)
  • 68d4d51 Isolate package build and publish (#137)

@dependabot
chore(deps): bump the minor-and-patch group across 1 directory with 1…
c52e669 
…1 updates

Bumps the minor-and-patch group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [streamlit](https://github.com/streamlit/streamlit) | `1.59.1` | `1.60.0` |
| [groq](https://github.com/groq/groq-python) | `1.5.0` | `1.6.0` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.140.1` |
| [annotated-types](https://github.com/annotated-types/annotated-types) | `0.7.0` | `0.8.0` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.1` | `4.14.2` |
| [cachetools](https://github.com/tkem/cachetools) | `7.1.4` | `7.1.6` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.6.17` | `2026.7.22` |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.50` | `3.1.57` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.23.0` | `2.24.0` |
| [tzdata](https://github.com/python/tzdata) | `2026.2` | `2026.3` |
| [websockets](https://github.com/python-websockets/websockets) | `16.0` | `16.1.1` |



Updates `streamlit` from 1.59.1 to 1.60.0
- [Release notes](https://github.com/streamlit/streamlit/releases)
- [Commits](streamlit/streamlit@1.59.1...1.60.0)

Updates `groq` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/groq/groq-python/releases)
- [Changelog](https://github.com/groq/groq-python/blob/main/CHANGELOG.md)
- [Commits](groq/groq-python@v1.5.0...v1.6.0)

Updates `fastapi` from 0.139.0 to 0.140.1
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.0...0.140.1)

Updates `annotated-types` from 0.7.0 to 0.8.0
- [Release notes](https://github.com/annotated-types/annotated-types/releases)
- [Commits](annotated-types/annotated-types@v0.7.0...v0.8.0)

Updates `anyio` from 4.14.1 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.1...4.14.2)

Updates `cachetools` from 7.1.4 to 7.1.6
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](tkem/cachetools@v7.1.4...v7.1.6)

Updates `certifi` from 2026.6.17 to 2026.7.22
- [Commits](certifi/python-certifi@2026.06.17...2026.07.22)

Updates `gitpython` from 3.1.50 to 3.1.57
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.50...3.1.57)

Updates `narwhals` from 2.23.0 to 2.24.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](narwhals-dev/narwhals@v2.23.0...v2.24.0)

Updates `tzdata` from 2026.2 to 2026.3
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.2...2026.3)

Updates `websockets` from 16.0 to 16.1.1
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@16.0...16.1.1)

---
updated-dependencies:
- dependency-name: streamlit
  dependency-version: 1.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: groq
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: fastapi
  dependency-version: 0.140.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: annotated-types
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: anyio
  dependency-version: 4.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: cachetools
  dependency-version: 7.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: gitpython
  dependency-version: 3.1.57
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: narwhals
  dependency-version: 2.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tzdata
  dependency-version: '2026.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: websockets
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from Alexi5000 as a code owner July 27, 2026 13:17
@codecov-commenter

codecov-commenter commented Jul 27, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 3, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/minor-and-patch-6d3809b7eb branch August 3, 2026 13:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Alexi5000 Alexi5000 Awaiting requested review from Alexi5000 Alexi5000 is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@codecov-commenter