Sync uv.lock#578
Merged
Merged
Conversation
kdeldycke
force-pushed
the
sync-uv-lock
branch
8 times, most recently
from
0e8cc30 to
bf98769
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Runs
uv lock --upgradeto update transitive dependencies to their latest allowed versions. See thesync-uv-lockjob documentation for details.Updated packages
Resolved with
exclude-newercutoff:2026-05-18.2026.2.25→2026.4.228.3.2→8.3.37.13.0→7.16.17.13.5→7.14.01.21.6→1.22.126.1→26.21.0.4→1.1.10.4.1→0.5.22.13.3→2.13.42.46.3→2.46.42.14.0→2.14.12026.1.post1→2026.26.14.0→6.18.42.0.1→2.0.20.14.0→0.15.02026.1.1.20260408→2026.2.0.202605180.6.0→0.7.0Release notes
click8.3.3This is the Click 8.3.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/click/8.3.3/
Changes: https://click.palletsprojects.com/page/changes/#version-8-3-3
Milestone: https://redirect.github.com/pallets/click/milestone/30
shlex.splitto split pager and editor commands intoargvlists for :class:
subprocess.Popen, removingshell=True.#1026 #1477 #2775
TypeErrorwhen rendering help for an option whose default value isan object that doesn't support equality comparison with strings, such as
semver.Version. #3298 #3299tmp_pathfixture instead of a shared temporary file path. #3238Sentinel.UNSETvalues in adefault_mapas absent, so they fallthrough to the next default source instead of being used as the value.
#3224 #3240
pdb.PdbinCliRunnerisolation sopdb.set_trace(),breakpoint(), and debuggers subclassingpdb.Pdb(ipdb, pdbpp) caninteract with the real terminal instead of the captured I/O streams.
#654 #824 #843 #951 #3235
pytest-randomlyandpytest-xdistto detect test pollution and race conditions. #3151parallel tests, and Flask smoke tests. #3151 #3177
show_defaultstring in prompts, matching the existinghelp text behavior. #2836 #2837 #3165 #3262 #3280
#3328
default=Truewith booleanflag_valuealways returning theflag_valueinstead ofTrue. Thedefault=Truetoflag_valuesubstitution now only applies to non-boolean flags, where
Trueacts as a... Full release notes
click-extrav7.14.0wrapsubcommand:click-extra wrap SCRIPT [ARGS]...applies help colorization to any installed Click CLI without modifying its source. Supports--themeoption and[tool.click-extra.wrap.<script>]config sections for persistent CLI defaults. Resolves SCRIPT via console_scripts entry points,module:functionnotation,.pyfile paths, or bare module names. Unknown subcommand names fall through towrapautomatically, soclick-extra flask --helpworks without typingwrap.runis kept as an alias.show-paramssubcommand:click-extra show-params SCRIPT [SUBCOMMAND]...introspects any external Click CLI's parameters and displays them as a table. Supports all--table-formatrenderings. Drills into nested subcommands. Auto-discovers the Click command when the entry point is a wrapper function.Spec.column withoptiontheme (cyan) andPython typewithmetavartheme (cyan dim) in both--show-paramsandshow-params, matching help-screen conventions.get_param_spec()andformat_param_row()as public API inclick_extra.parameters.get_param_spec()extracts option-spec strings and handles hidden-param unhiding.format_param_row()is the shared cell renderer for both--show-paramsandshow-paramstables.ParamStructure.get_param_type()a@staticmethod. Returnsstrfor unrecognised custom types instead of raisingValueError.render-matrixsubcommand with individualcolors,styles,palette,8color, andgradientsubcommands grouped under a "Demo" section. Remove theclick-extra-demoentry point.tests/sphinx/. Downstream packagers can skip them with--ignore=tests/sphinxwithout pulling in Sphinx dependencies.... Full release notes
v7.14.18.1. ReplaceParameterSourceordered comparisons inConfigOptionwith explicit set membership so the code works on both the regularEnum(Click8.1/8.2) and theIntEnum(Click8.3+).0.9. Backport thecolon_gridformat by aliasing it togridat module load when tabulate< 0.10is installed.Full changelog:
v7.14.0...v7.14.1🛡️ VirusTotal scans
click-extra-7.14.1-linux-arm64.binclick-extra-7.14.1-linux-x64.binclick-extra-7.14.1-macos-arm64.binclick-extra-7.14.1-macos-x64.bin... Full release notes
v7.15.0true_color=TruetoAnsiColorLexer,AnsiFilter, or any session lexer (likeget_lexer_by_name("ansi-shell-session", true_color=True)) to preserveSGR 38;2;r;g;band48;2;r;g;bsequences asToken.Ansi.FG_{rrggbb}/Token.Ansi.BG_{rrggbb}tokens instead of quantizing them to the 256-color palette.AnsiHtmlFormatterrenders those tokens as inlinestyle="color: #rrggbb"/style="background-color: #rrggbb"spans. The default behavior (256-color quantization) is unchanged.click_extra.thememodule centralizes all theme machinery:HelpExtraTheme,default_theme,nocolor_theme,OK,KO,ThemeOption,theme_optiondecorator,theme_registry, andregister_theme(). Every click-extra command now accepts--theme [dark|light]; downstream consumers can extend the choice list viaregister_theme(). The active theme for a CLI run is stored inctx.meta[context.THEME]byThemeOptionand retrieved viaget_current_theme(), so back-to-back invocations in the same process (Sphinx builds, test runners, REPLs) no longer leak--themechoices into each other. Thewrapsubcommand reads the theme from the parent group's context rather than carrying its own--theme. Adds a correspondingdocs/theme.mduser guide. Breaking: downstream code importing theme symbols directly fromclick_extra.colorizemust update toclick_extra.theme; the canonicalfrom click_extra import HelpExtraThemepath is unaffected.... Full release notes
v7.16.0solarized_dark(Ethan Schoonover),dracula(Zeno Rocha),nord(Arctic Ice Studio), andmonokai(Wimer Hazenberg), hand-curated for the semantic roles click-extra exposes (option, metavar, choice, deprecated, envvar, …). The full catalog now ships asclick_extra/themes.toml(a TOML data file) instead of Python subclasses, loaded at import time viaimportlib.resourcesfor proper wheel/zipapp support.BUILTIN_THEMESis the single public dict of{name: HelpExtraTheme}; access individual palettes viaBUILTIN_THEMES["dark"],BUILTIN_THEMES["solarized_dark"], etc. Adding a built-in theme is a one-file data edit: declare a[<name>]table with one inline-table per styled slot, no Python needed. Breaking: theclick_extra.themesmodule is removed (import fromclick_extraorclick_extra.theme); the six per-theme UPPER_CASE constants (DARK,DRACULA,LIGHT,MONOKAI,NORD,SOLARIZED_DARK) are removed (useBUILTIN_THEMES["<name>"]instead).default_thememodule attribute replaced by theget_default_theme()/set_default_theme(theme)accessors. The previous module-attribute pattern silently froze whatever was bound at import time when consumers (e.g.ExtraVersionOption's style defaults) captureddefault_theme.invoked_commandas a default function parameter, so later overrides viawrap.patch_click()didn't propagate. The function pair always observes the current value.click_extra.wrap.patch_click()now callsset_default_theme().... Full release notes
v7.16.1ConfigOptionmutating its cachedparams_templatewhen merging user configuration._recursive_updateupdates its first argument in place, so back-to-back invocations of the same CLI (Sphinx builds, test runners, REPLs) leaked keys set by an earlier--configinto the current invocation'sdefault_map. Both the--configload path and--validate-confignow pass a deep copy of the template.Full changelog:
v7.16.0...v7.16.1🛡️ VirusTotal scans
click-extra-7.16.1-linux-arm64.binclick-extra-7.16.1-linux-x64.binclick-extra-7.16.1-macos-arm64.binclick-extra-7.16.1-macos-x64.bin... Full release notes
coverage7.14.0Version 7.14.0 — 2026-05-10
combinewas too verbose, listing each file considered. Now it shows a single line with the counts of files combined, files skipped, and files with errors. The-qflag suppresses this line. The old detailed lines are available with the new--debug=combineoption.Collector.flush_datacould fail with “RuntimeError: Set changed size during iteration” when a tracer in another thread added a line to the per-file set thatadd_lines(oradd_arcs) was iterating. The values passed toCoverageDataare now snapshotted viadict.copy()andset.copy(), which are atomic under the GIL. Thanks, Alex Vandiver.lazyis now bolded in HTML reports.➡️ PyPI page: coverage 7.14.0.
➡️ To install:
python3 -m pip install coverage==7.14.0packaging26.2What's Changed
Fixes:
Version,Specifier,SpecifierSet,Tag,Marker, andRequirementpickle-safeand backward-compatible with pickles created in 25.0-26.1 (including references to the removed
packaging._structuresmodule) by @eachimei and @henryiii in https://redirect.github.com/pypa/packaging/pull/1163, https://redirect.github.com/pypa/packaging/pull/1168, https://redirect.github.com/pypa/packaging/pull/1170, and https://redirect.github.com/pypa/packaging/pull/1171Documentation:
Internal:
New Contributors
Full Changelog: https://redirect.github.com/pypa/packaging/compare/26.1...26.2
pathspecv1.1.0Release v1.1.0. See CHANGES.rst.
v1.1.1Release v1.1.1. See CHANGES.rst.
propcachev0.5.20.5.0 and 0.5.1 were tagged earlier today but never reached PyPI: 0.5.0's deploy failed at cibuildwheel's post-build pytest on free-threaded armv7l musllinux (SIGBUS under QEMU emulation while importing the C extension), and 0.5.1's deploy hit a transient sigstore Rekor 502 during the attestation step. 0.5.2 is the first of the three to actually publish.
Features
Added support for newer type hints and remove
OptionalandUnionfrom all annotations-- by :user:
VizonexRelated issues and pull requests on GitHub:
#193.
Removals and backward incompatible breaking changes
Dropped support for Python 3.9 as it has reached end of life.
Related issues and pull requests on GitHub:
#216.
Packaging updates and notes for downstreams
Changed the Cython build dependency from
~= 3.1.0to>= 3.2.0,removing the upper version bound to avoid conflicts for downstream packagers
-- by :user:
jameshilliardand :user:gundalow.The upstream Cython version is pinned to 3.2.4 in the CI/CD environment.
Related issues and pull requests on GitHub:
#184, #188, #214.
Start building and shipping riscv64 wheels
-- by :user:
justeph.Related issues and pull requests on GitHub:
#194.
The :pep:
517build backend now supports a newbuild-inplaceconfig setting (and
PROPCACHE_BUILD_INPLACEenvironment variable)for controlling whether to build the project in-tree or in a
temporary directory. It only affects wheels and is set up to build
in a temporary directory by default. It does not affect editable
wheel builds; they will keep being built in-tree regardless.
Here's an example of using this setting:
.. code-block:: console
$ python -m build --config-setting=build-inplace=true
Additionally, when building wheels in an automatically created
... Full release notes
pydanticv2.13.4v2.13.4 (2026-05-06)
What's Changed
Packaging
pydantic-corelinker flags on macOS by @washingtoneg and @Viicos in #13147Fixes
RootModelcore metadata by @Viicos in #13129Full Changelog: https://redirect.github.com/pydantic/pydantic/compare/v2.13.3...v2.13.4
pydantic-settingsv2.14.1What's Changed
clsconflicting with classmethod parameter by @hramezani in https://redirect.github.com/pydantic/pydantic-settings/pull/858Full Changelog: https://redirect.github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1
repomaticv6.15.0validate = falsein the bundledmdformat.tomlsomdformat-recover-urlsdecodes percent-encoded non-ASCII characters in link destinations back to their original form. Without this, anchor links with Chinese, accented, or other non-ASCII characters got rewritten to%XXsequences on everyformat-markdownrun.awesome-lint-compatible-syntax.fix-vulnerable-depsjob now unionsuv auditand the repository's Dependabot alerts feed, deduplicates by(package, advisory_id), credits each entry's source(s) in the PR body, and shows theexclude-newercooldown cutoff above the updated packages table so reviewers can confirm which upgrades required a cooldown bypass. Configurable via[tool.repomatic] vulnerable-deps.sources.... Full release notes
v6.16.0sphinx-docsagent to theagentscomponent (deployed byrepomatic init agentsalongsidegrunt-qaandqa-engineer, or via[tool.repomatic] include = ["agents"]). The agent carries a canonical Sphinx extension set with notes onsphinx_clickvsclick_extra.sphinx, a standard octicon registry, governance rules forsuppress_warnings/nitpick_ignore/linkcheck_ignoreentries, the<!-- {feature}-{kind}-start -->auto-region marker convention, and a Sphinx cross-reference render test recipe. Dropssphinx_issuesfrom the set: its:issue:/:pr:/:user:/:commit:roles render only inside Sphinx, appearing as raw role text in GitHub's repo browser, IDE previews, and PyPI descriptions; a Python migration script (covering MyST roles, reST roles, and cross-repo prefixed forms) and a matchingsphinx-docs-syncaudit category are included.docs/myst-docstrings.mddocuments the load-order failure mode (backtick-doubled:py:obj:roles) whenrepomatic.myst_docstringsloads aftersphinx_autodoc_typehints.[tool.repomatic.workflow]configuration knobs for customizingpaths:filters in generated thin callers and synced headers:extra-pathsappends repo-specific entries (likeinstall.sh,dotfiles/**) to every workflow's filter,ignore-pathsstrips canonical entries that don't exist downstream (liketests/**,uv.lock) by exact match, andpathskeyed by workflow filename replaces a workflow's filter wholesale (skipping the other knobs and--source-pathsfor that filename).... Full release notes
v6.17.0OSError: Lock for file .git/config did already existtest failures.tests/test_git_ops.pyandtests/test_metadata.pysharepytestmark = pytest.mark.xdist_group("git")so pydriller'sGit(".")initialization (which acquires.git/config.lockon every call) is serialized to a single pytest-xdist worker. Addmypy_path = "docs"to[tool.mypy]so mypy resolvesimport docs_updateintests/test_readme.pyagainstdocs/docs_update.py.docs/configuration.mdper-option**Type:**lines (likelist\[dict[str, str]\]). The escape, needed only for raw GFM table cells in therepomatic show-configCLI output (wheremdformatwould otherwise interpret[…]as a markdown link), was leaking into inline-code spans where backslashes are literal in CommonMark._format_typenow returns clean Python type strings; the newescape_type_for_gfm_tablehelper is applied only at the CLI rendering layer.--template-file <path>and--template-arg KEY=VALUEflags torepomatic pr-bodyso downstream repos can render project-specific PR templates without forking repomatic.--templateand--template-fileare mutually exclusive.load_template,render_template,render_title,render_commit_message, andtemplate_argsnow accept a {class}~pathlib.Pathto read a template from disk in addition to a packaged-resource name.render_titlereturns an empty string instead of raisingKeyErrorwhen the frontmatter defines notitle.... Full release notes
v6.18.1publish-pypicomposite action attempting to verify build attestations on every file in the workflow workspace (includingchangelog.md,pyproject.toml, etc.) instead of just the downloaded distribution artifacts. Theactions/download-artifactstep now downloads todist/so the verification loop anduv publishonly target the actual artifact files.Full changelog:
v6.18.0...v6.18.1🛡️ VirusTotal scans
repomatic-6.18.1-linux-arm64.binrepomatic-6.18.1-linux-x64.binrepomatic-6.18.1-macos-arm64.binrepomatic-6.18.1-macos-x64.bin... Full release notes
v6.18.2release.yamluploading distributions to PyPI without PEP 740 attestations. The build job now signs each dist file withpypi-attestations sign(using the job's OIDC token via Sigstore), writing<dist>.publish.attestationsidecars directly into./dist/so the dist artifact carries its own attestations. Thepublish-pypicomposite action shrinks to setup-uv → download artifact →uv publish dist/*. Replaces the previousactions/attest+ GitHub-attestation-API flow for Python distributions: the Nuitka binary attestation flow is unchanged, and PyPI's PEP 740 provenance is now populated so thesetup-guidecheck_pypi_trusted_publisherprobe can confirm the trusted publisher is wired up. Removes theattestation-signer-repoinput from the composite action and the separateattestation-<artifact-name>artifact: dist files and their.publish.attestationsidecars travel together in a single artifact and end up alongside each other on the GitHub release page.Full changelog:
v6.18.1...v6.18.2🛡️ VirusTotal scans
repomatic-6.18.2-linux-arm64.binrepomatic-6.18.2-linux-x64.bin... Full release notes
v6.18.3autofix.yamlsetup-guidejob being skipped onworkflow_dispatchre-runs. Theif:condition now allows bothpushandworkflow_dispatchevents instead ofpushonly, so manual re-runs from the Actions UI re-evaluate the setup guide and update the issue accordingly.release.yamlpublish-pypijob running against downstream callers and failing PyPI trusted publishing with ajob_workflow_refmismatch. The gate now usesgithub.repository == 'kdeldycke/repomatic'(which reflects the caller's repo underworkflow_call) instead ofgithub.event_name == 'push'(which stayspushin both self-release and downstream contexts), so the upstream-only job is properly skipped when invoked from a downstream caller. Downstream repos publish through their own thin-callerpublish-pypijob, which inherits the correct OIDC context.compile-binariesjob from--onefileto--mode=onefile, the documented spelling since Nuitka 4.0 (--onefileis now hidden but still accepted).Full changelog:
v6.18.2...v6.18.3🛡️ VirusTotal scans
repomatic-6.18.3-linux-arm64.binrepomatic-6.18.3-linux-x64.bin... Full release notes
v6.18.4RepoScope.NON_AWESOMEvariant withPYTHON_ONLY, gating affected components on the presence of a PEP 621[project].nameinpyproject.toml(detected via the newrepomatic.pyproject.is_python_projecthelper). Repos that carrypyproject.tomlonly for[tool.*]configuration (like dotfiles) are now classified as non-Python and skip Python-flavored components by default.RepoScope.matches()now takes bothis_awesomeandis_pythontraits. Existing entries are reclassified:codecov,publish-pypi-action,changelog.yaml,debug.yaml,release.yaml, and the generatedchangelog.mdmove toPYTHON_ONLY;renovatemoves toALL(Renovate is language-agnostic). Explicit CLI naming and[tool.repomatic] includecontinue to bypass scope, so a dotfiles repo can still opt intopublish-pypi-actionif needed.release_prep.freeze_workflow_urlsandunfreeze_workflow_urlsto walk non-symlink YAML files underrepomatic/data/in addition to.github/workflows/. The bundledrelease-publish-pypi-job.yamlfragment now participates in the@main↔@vX.Y.Zrewrite, so wheels built from a freeze commit ship with the pinned action ref baked in. Symlinks in the data dir are skipped to avoid double-processing.repomatic.github.workflow_sync._PUBLISH_PYPI_DEFAULT_ACTION_REFis now derived fromDEFAULT_VERSIONso the search string always matches the ref in the (possibly frozen) bundled fragment.2.4.13to2.4.14and Lychee from0.24.1to0.24.2in the tool registry.... Full release notes
sphinxcontrib-mermaidChangelog
tomlkit0.15.0What's Changed
New Contributors
... Full release notes
types-pytzChangelog
wcwidth0.7.0width()andclip().clip()parametercontrol_codes='parse','ignore', and'strict'.clip()is now able to clip OSC 8 hyperlinks and OSC 66 text sizing sequences.
clip()andwidth()to support horizontal cursor sequences (cub,cuf,hpa). Cursor-left (cub) or backspace (\b) now overwrites text. column_address(
hpa) and carriage return (\r) are now parsed, and more values conditionally raiseValueErrorwhencontrol_codes='strict'.PR's
Full Changelog: https://redirect.github.com/jquast/wcwidth/compare/0.6.0...0.7.0
Configuration
Relevant
[tool.repomatic]options:uv-lock.syncImportant
If you suspect the PR content is outdated, click
Run workflowto refresh it manually before merging.Workflow metadatapushmain0f936a05sync-uv-lockautofix.yaml🏭 Generated with repomatic
6.20.0