[dependabot]

Bumps the python-dependencies group with 13 updates in the / directory:

Package	From	To
obstore	0.12.0	0.12.1
coverage	7.16.2	7.17.2
pytest	9.1.1	9.2.0
pytest-asyncio	1.4.0	1.4.1.post1
hypothesis	6.170.5	6.170.14
pytest-benchmark	5.3.0	5.3.1
pytest-codspeed	5.0.3	5.0.4
uv	0.13.5	0.13.7
moto[s3,server]	5.2.4	5.2.5
mkdocs-material[imaging]	9.7.7	9.8.0
markdown-exec[ansi]	1.12.5	1.12.6
ruff	0.17.1	0.17.3
mypy	2.4.0	2.4.1

Updates obstore from 0.12.0 to 0.12.1

Commits

• See full diff in compare view

Updates coverage from 7.16.2 to 7.17.2

Release notes

Sourced from coverage's releases.

7.17.2

Version 7.17.2 — 2026-11-04

• Fix: two different scenarios failed with “attempt to write a readonly database”. These were regressions in 7.17.1. They are fixed, closing issue 2356:
  • When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.
  • coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can’t read is now reported like any other unusable data file, and is left in place.

➡️  PyPI page: coverage 7.17.2. :arrow_right:  To install: python3 -m pip install coverage==7.17.2

7.17.1

Version 7.17.1 — 2026-11-03

• Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167 and issue 2337.
• Fix: the HTML report only rewrites a file’s page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.
• Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message “total of 0.4 is less than fail-under=0.5”. Previously, the comparison rounded the total to zero and the message could claim “1 is less than 0”. Closes issue 2295.
• Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &. Now they are properly escaped only once.
• Fix: --source=/ measured no files. A file system root can’t be a source directory, so now it is an error. Closes issue 2291.
• In an abundance of caution, prevent forged SQLite journal files from deleting files they shouldn’t.

➡️  PyPI page: coverage 7.17.1. :arrow_right:  To install: python3 -m pip install coverage==7.17.1

7.17.0

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.
• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.
• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.
• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.
• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.
• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.
• Fix: The “Can’t combine statement coverage data with branch data” error now names the two data files it couldn’t combine. The error description in the docs now lists common causes and how to find the process that wrote the file.
• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293 and issue 2294.
• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338.
• Fixes for obscure but legal file names:
  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and coverage debug data replace non-printable characters in names. Printable names are unchanged.
  • A file pattern (from include, omit, or a [paths] alias) containing a newline sent the glob-to-regex translation into an infinite loop, hanging the process. Newlines in patterns are now handled like any other character.
• Fixes in the implementation of the C tracer:
  • If a plugin’s dynamic_source_filename method raised an exception, lines in that function could be recorded as belonging to a different file. Also fixed some minor memory leaks in the C tracer.
  • The refcount of None was mismanaged during function calls, including comprehensions. This was unlikely to cause an actual problem, but is now fixed. Thanks, Andrew Dalke.
  • The C tracer held borrowed references to dictionary values, which was unsafe on free-threaded Python. Now it takes its own references.
  • An internal error while recording a new file could be reported as a confusing SystemError instead of the actual exception.
• Performance: the text summary report (coverage report) held on to every file’s parsed source until it finished, so its memory use grew with the size of the project: ten times or more what 7.14 used on large projects. Now it keeps only what it needs to print. Fixes issue 2277.
• Performance: HTML reports should be about 5% faster to produce.
• Kept the political banner in the README. Closes issue 2344.

➡️  PyPI page: coverage 7.17.0. :arrow_right:  To install: python3 -m pip install coverage==7.17.0

Changelog

Sourced from coverage's changelog.

Version 7.17.2 — 2026-11-04

• Fix: two different scenarios failed with "attempt to write a readonly database". These were regressions in 7.17.1. They are fixed, closing issue 2356_:

  • When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.

  • coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can't read is now reported like any other unusable data file, and is left in place.

.. _issue 2356: coveragepy/coveragepy#2356

.. _changes_7-17-1:

Version 7.17.1 — 2026-11-03

• Fix: a one-line class or function body immediately followed by another statement (such as class Foo: ... on its own line) was incorrectly reported as a missing branch when using the sys.monitoring core. This is now fixed, closing issue 2167_ and issue 2337_.

• Fix: the HTML report only rewrites a file's page when the file or its data has changed, but each page also links to the previous and next files. When the set of reported files changed, unchanged pages kept their old links. For example, with skip_covered, a file that became 100% covered had its page deleted, but the pages next to it still linked to it. Now a page is also rewritten when its neighbors change.

• Fix: --fail-under now uses at least the decimal precision of the threshold for both the comparison and failure message. With precision=0, a total of 0.4 now passes --fail-under=0.3 and fails --fail-under=0.5 with the message "total of 0.4 is less than fail-under=0.5". Previously, the comparison rounded the total to zero and the message could claim "1 is less than 0". Closes issue 2295_.

• Fix: the HTML report escaped file names twice, so a name with &, <, or quotes in it was shown with entities like &. Now they are properly escaped only once.

• Fix: --source=/ measured no files. A file system root can't be a source directory, so now it is an error. Closes issue 2291_.

... (truncated)

Commits

• d0d3e1d docs: combine the two 'combine' failure descriptions
• 33cb85f fix: don't initialize a data file we can only read (#2360)
• 6e71bac docs: prep for 7.17.2
• 8273f72 test: fix two tests that failed on the Rocky 8 old_sqlite job
• ce216fd build: a test environment for old version of SQLite
• 36e4a18 fix: combine failed on SQLite<3.34.0 #2356
• d80ed19 build: bump version to 7.17.2
• 1941ee1 docs: prep for 7.17.1
• 474bba1 chore: make upgrade
• 1ab58b3 chore: bump the action-dependencies group with 6 updates (#2355)
• Additional commits viewable in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

• #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

• #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

  Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

• #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

  • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
  • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

  pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

• #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

• #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

• #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

  They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

• #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

• #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

• #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
• #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
• #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

• #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits

• ae1d0ff Prepare release version 9.2.0
• 143ce31 pre-commit: exclude codespell on generated release announcements
• 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
• a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
• 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
• 41d12cd docs: clarify typing for yield fixtures
• b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
• 16f87a7 docs: improve getting-started.rst test execution description
• 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
• ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
• Additional commits viewable in compare view

Updates pytest-asyncio from 1.4.0 to 1.4.1.post1

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio v1.4.1.post1

1.4.1.post1 - 2026-11-01

Changed

• Removed the upper version bound on the pytest dependency. (#1605)

pytest-asyncio v1.4.1

1.4.1 - 2026-10-25

Added

• Declared support for Python 3.15 (#1588)

Fixed

• Allow AsyncIterable as a return type for asynchronous generator fixtures decorated with pytest_asyncio.fixture (#1090)

Notes for Downstream Packagers

• Source-tree development dependencies now use PEP 735 dependency groups and uv.lock. (#1518)

Commits

• e420349 Bump mypy pre-commit hook to v2.4.0 (#1601)
• 16a1ba4 chore: Prepare release of v1.4.1.post1.
• 7087e7f build: drop pytest upper bound (#1605) (#1606)
• 6af7f5c chore: Prepare release of v1.4.1.
• 32ccf64 Support 3.15 (#1588)
• 9830071 Build(deps): Bump certifi from 2026.6.17 to 2026.10.19 (#1590)
• 0238023 Build(deps): Bump virtualenv from 21.7.13 to 21.14.13 (#1589)
• 93893ec Build(deps): Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#1583)
• f287e5e Build(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (#1581)
• b71da4f Build(deps-dev): Bump hypothesis from 6.168.3 to 6.168.5 (#1582)
• Additional commits viewable in compare view

Updates hypothesis from 6.170.5 to 6.170.14

Commits

• 255a880 Bump hypothesis version to 6.170.14 and update changelog
• fd6038c Merge pull request #4949 from moreati/issue4926-denylist
• 8dd4664 Rephrase RELEASE note following review
• 5e93693 Bump hypothesis version to 6.170.13 and update changelog
• a5512a3 Merge pull request #4952 from jorenham/codemods/characters-kwargs
• 8375d12 Fix characters() codemod crash with **kwargs
• ac21c15 Add RELEASE note
• 04e55b4 dateutil: Exclude coverage measurement of old releases
• 891e478 Update pinned dependencies (to block eMudhra certificates)
• 8fca8fd Bump hypothesis version to 6.170.12 and update changelog
• Additional commits viewable in compare view

Updates pytest-benchmark from 5.3.0 to 5.3.1

Changelog

Sourced from pytest-benchmark's changelog.

v5.3.1 (2026-11-01)

• Fixed an AttributeError with pytest's public nodeid attribute by avoiding the removed private node._nodeid attribute (fixes [#321](https://github.com/ionelmc/pytest-benchmark/issues/321) <https://github.com/ionelmc/pytest-benchmark/issues/321>). This adds support for Pytest 9.2. Contributed by Hfycium in [#323](https://github.com/ionelmc/pytest-benchmark/issues/323) <https://github.com/ionelmc/pytest-benchmark/pull/323>.
• Fixed Stats.hd15iqr returning the first datum above the Tukey upper fence instead of the highest datum within it, so the statistic reported the outlier it exists to exclude. ld15iqr was already correct. Contributed by WatchTree-19 in [#320](https://github.com/ionelmc/pytest-benchmark/issues/320) <https://github.com/ionelmc/pytest-benchmark/pull/320>_.
• Added workaround for pygal's broken PluginImportFixer (it's removed from sys.meta_path).

Commits

• 97c52d8 Bump version: 5.3.0 → 5.3.1
• 1031904 Ignore this too.
• b9d2222 Add workaround till Kozea/pygal#532 is released.
• defaee2 Ignore windows deprecation warning (from some notebook thing) and bump pygal ...
• 90204d9 Dump histogram for test_hd15iqr_excludes_high_outliers to a file. Also fix so...
• 154cc0c Update changelog.
• 5b535e1 Fix hd15iqr returning the outlier it is meant to exclude
• f9b57d1 Add python 3.15 and pytest 9.2 in test suite.
• 9f669a3 Fix benchmark fixture for pytest nodeid changes
• See full diff in compare view

Updates pytest-codspeed from 5.0.3 to 5.0.4

Release notes

Sourced from pytest-codspeed's releases.

v5.0.4

Fixes

• Support pytest 9.2: pytest --codspeed no longer crashes at session start when pytest-benchmark is installed (#141)

What's Changed

• build: pin -std=c11 for instrument-hooks core.c by @​not-matthias in CodSpeedHQ/pytest-codspeed#128
• docs(readme): bump action version to v5 by @​adriencaccia in CodSpeedHQ/pytest-codspeed#130
• feat: warn when running on an unsupported Python version by @​not-matthias in CodSpeedHQ/pytest-codspeed#133
• ci: migrate to github default arm runners by @​lvaroqui in CodSpeedHQ/pytest-codspeed#136
• ci: use 26.04 image instead of latest by @​lvaroqui in CodSpeedHQ/pytest-codspeed#138
• ci: test against stable python 3.15 and 3.15t by @​not-matthias in CodSpeedHQ/pytest-codspeed#137
• docs: add Python 3.15 to README version badge by @​not-matthias in CodSpeedHQ/pytest-codspeed#139
• fix: support pytest 9.2 fixture manager changes by @​claude[bot] in CodSpeedHQ/pytest-codspeed#141

New Contributors

• @​lvaroqui made their first contribution in CodSpeedHQ/pytest-codspeed#136
• @​claude[bot] made their first contribution in CodSpeedHQ/pytest-codspeed#141

Full Changelog: CodSpeedHQ/pytest-codspeed@v5.0.3...v5.0.4

Changelog

Sourced from pytest-codspeed's changelog.

[5.0.4] - 2026-10-31

🚀 Features

• Warn when running on an unsupported python version by @​not-matthias in #133

🐛 Bug Fixes

• Support pytest 9.2 fixture manager changes by @​GuillaumeLagrange

💼 Other

• Pin -std=c11 for instrument-hooks core.c by @​not-matthias in #128

🏗️ Refactor

• Consolidate fixture overrides in sessionstart (#148)

📚 Documentation

• Add Python 3.15 to README version badge (#139) by @​not-matthias in #139
• Bump action version to v5 (#130) by @​adriencaccia in #130

🧪 Testing

• Write the example benchmark inside the pytester sandbox (#149)

⚙️ Internals

• Skip the example tests when testing built wheels (#147)
• Remove the runner main branch usage for macos test by @​GuillaumeLagrange in #141
• Use ubuntu-24 for python 3.9 test by @​GuillaumeLagrange
• Test against stable python 3.15 and 3.15t (#137) by @​not-matthias in #137
• Use 26.04 image instead of latest (#138) by @​lvaroqui in #138
• Migrate to github default arm runners (#136) by @​lvaroqui in #136

Commits

• 7d20221 Release v5.0.4 🚀
• 02bb848 refactor: consolidate fixture overrides in sessionstart (#148)
• 4087d63 test: write the example benchmark inside the pytester sandbox (#149)
• 39d95db ci: skip the example tests when testing built wheels (#147)
• 088872f ci: remove the runner main branch usage for macos test
• 3a4c4d4 ci: use ubuntu-24 for python 3.9 test
• 82c972b fix: support pytest 9.2 fixture manager changes
• 5af4238 docs: add Python 3.15 to README version badge (#139)
• 40ad6e6 ci: test against stable python 3.15 and 3.15t (#137)
• 0d4041b ci: use 26.04 image instead of latest (#138)
• Additional commits viewable in compare view

Updates uv from 0.13.5 to 0.13.7

Release notes

Sourced from uv's releases.

0.13.7

Release Notes

Released on 2026-11-03.

Preview features

• Add --output-version to uv workspace metadata for requesting a specific schema version (#22958)
• Report aliased OSV records as a single vulnerability in uv audit (#22990)

Bug fixes

• Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#23008)
• Prevent uv's Windows trampolines from closing handles they did not inherit (#22977)
• Allow uvx to run tools with CPython builds whose versions contain local identifiers (#23013)
• Generate valid module names when uv init creates packaged projects whose names start with a digit (#23022)
• Preserve comments around existing inline dependency groups when uv add updates a group (#23017)
• Allow uv remove with an empty inline tool.uv.sources table (#23012)

Documentation

• Correct the cache-keys inline table example (#22984)

Install uv 0.13.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.ps1 | iex"

Download uv 0.13.7

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum

... (truncated)

Changelog

Sourced from uv's changelog.

0.13.7

Released on 2026-11-03.

Preview features

• Add --output-version to uv workspace metadata for requesting a specific schema version (#22958)
• Report aliased OSV records as a single vulnerability in uv audit (#22990)

Bug fixes

• Treat workspace member paths added by uv init or uv add as literals instead of glob patterns (#23008)
• Prevent uv's Windows trampolines from closing handles they did not inherit (#22977)
• Allow uvx to run tools with CPython builds whose versions contain local identifiers (#23013)
• Generate valid module names when uv init creates packaged projects whose names start with a digit (#23022)
• Preserve comments around existing inline dependency groups when uv add updates a group (#23017)
• Allow uv remove with an empty inline tool.uv.sources table (#23012)

Documentation

• Correct the cache-keys inline table example (#22984)

0.13.6

Released on 2026-10-26.

Enhancements

• Accept an empty UV_RUN_RECURSION_DEPTH as zero and report invalid values consistently (#22814)
• Explain how to add project metadata when uv init finds a pyproject.toml without a [project] table (#22916)

Python

• Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 (#22938)

Preview features

• Detect NVIDIA GPU capabilities when selecting compatible wheel variants with wheel-variants (#22690)
• Nest each module's owners in an object in uv workspace metadata output (#22638)
• Report the unsupported properties required by an incompatible wheel variant (#22719)

Performance

• Reduce peak memory use when resolving large workspaces (#22860, #22863, #22864, #22866, #22870)
• Reduce peak memory use when locking or upgrading large projects (#22833, #22834)
• Speed up redirected output from uv export and uv pip compile (#22840)
• Reuse cached or active environments when running PEP 723 scripts without dependencies (#21458)
• Reduce parsing overhead for build dependency and build backend settings (#22848, #22871, #22879, #22884)
• Reduce parsing overhead for project sources and workspace references (#22880, #22883)
• Reduce parsing overhead for cache, exclusion, cutoff, and preview settings (#22876, #22877, #22878, #22887)

... (truncated)

Commits

• 316c827 Bump version to 0.13.7 (#23068)
• 917b4c3 Update Rust crate tokio-rustls to v0.26.6 (#23048)
• baec6ce Update conda-incubator/setup-miniconda action to v4.1.0 (#23032)
• da8bbd3 Update fedora Docker tag to v46 (#23033)
• 3db723c Update Rust crate cargo-util to v0.2.32 (#23045)
• 28c0c65 Update Rust crate uuid to v1.27.0 (#23052)
• 7716878 Update Rust crate insta to v1.49.0 (#23051)
• 3be10e3 Update dependency @​openai/codex to v0.160.0 (#23050)
• 8eb756a Update CodSpeedHQ/action action to v5.4.0 (#23049)
• 632df30 Update Rust crate spdx to v0.13.6 (#23047)
• Additional commits viewable in compare view

Updates moto[s3,server] from 5.2.4 to 5.2.5

Changelog

Sourced from moto[s3,server]'s changelog.

5.2.5

Docker Digest for 5.2.5: sha256:59a1965d845249b04def37a0e2565f9cc6c44543cb89b68e90f28f344b3b0d1a

New Methods:
    * S3Vectors:
        * list_tags_for_resource()
        * tag_resource()
        * untag_resource()
Miscellaneous:
* AutoScaling: delete_autoscaling_group() now correctly succeeds when an attached ELBv2 target group has been deleted
* CloudFormation: get_template_summary() no longer crashes when the optional AWSTemplateFormatVersion-key is not supplied
* CloudFormation: list_stack_resources() now returns the correct LastUpdatedTimestamp-attribute
* CognitoIDP now serves the OpenID Connect discovery document
* Connect: Resources can now be discovered by the ResourceGroupsTagging API
* ECS: list_container_instances() now supports the status-parameter
* Logs: describe_queries() now returns a correctly formatted createTime, enabling support for the Go SDK
* S3: now supports underscores in object metadata keys
* S3: get_object_attributes() now returns the LastModified-attribute in the correct format
* S3: upload_part() now no longer hangs when using ThreadedMotoServer in conjunction with @mock_aws (regression from 5.2.4)
* S3Vectors: create_index() and create_vector_bucket() now support the tag-parameter
* StepFunctions: create_state_machine() now supports the type-parameter
* SQS: send_message_batch() now returns a correctly-formatted 'Failed'-attribute (if appropriate)
* SWF: describe_workflow_execution() and get_workflow_execution_history() now have basic parameter validation

Commits

• 57b3772 Pre-Release: Up Version Number
• ae5c31d Prep release 5.2.5 (#10430)
• db82cbc Make strict adherence to AWS SQS purge queue behaviour optional (#10409)
• d42f047 CloudFormation: allow GetTemplateSummary without AWSTemplateFormatVersion (#1...
• f0a2584 CloudFormation: return LastUpdatedTimestamp in ListStackResources (#10424)
• 96a7b09 StepFunctions: store and return the state machine type (#10405)
• 95cecea aws - connect - add resource groups tagging api support via TaggableResources...
• a42ca27 Wait for the Windows proxy before running its test suite (#10423)
• b26ffd3 Cognito IDP: serve the OpenID Connect discovery document (#10377)
• ec8074c Core: add a dedicated service-model router (#10421)
• Additional commits viewable in compare view

Updates mkdocs-material[imaging] from 9.7.7 to 9.8.0

Release notes

Sourced from mkdocs-material[imaging]'s releases.

mkdocs-material-9.8.0

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

• Updated Node build-time dependencies to fix vulnerabilities
• Updated Python dependency minimums and required Python 3.11
• Removed RSS from recommended dependencies
• Updated project status and maintenance links
• Updated CLI notice with end-of-life and migration guidance
• Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide. It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Dependency	Affected versions	New minimum	Advisory
Jinja2	<=3.1.5	3.1.6	CVE-2025-27516
Markdown	<3.8.1	3.8.1	CVE-2025-69534
Pygments	<2.20.0	2.20.0	CVE-2026-4539
PyMdown Extensions	<=11.0.0	11.0.1	CVE-2026-67422
Requests	<2.33.0	2.33.0	CVE-2026-25645
Pillow	<13.0.0	13.0.0	CVE-2026-96636
CairoSVG	<=2.9.0	2.9.1	CVE-2026-107378
GitPython	<=3.2.0	3.2.1	CVE-2026-114145

Pillow and CairoSVG apply to the imaging extra; GitPython applies to the git extra.

Changelog

Sourced from mkdocs-material[imaging]'s changelog.

mkdocs-material-9.8.1 (2026-11-07)

• Updated Docker base image to Alpine 3.24
• Updated Docker image dependencies to fix vulnerabilities
• Updated Node build-time dependencies to fix vulnerabilities

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulne...

Description has been truncated