chore(deps): bump the elt-common-dependencies group across 1 directory with 10 updates by dependabot[bot] · Pull Request #478 · ISISNeutronMuon/analytics-data-platform

dependabot · 2026-09-17T13:58:24Z

Bumps the elt-common-dependencies group with 10 updates in the /elt-common directory:

Package	From	To
click	`8.4.2`	`8.5.0`
pydantic-settings	`2.14.2`	`2.15.0`
pydantic	`2.13.4`	`2.13.5`
dbt-core	`1.12.3`	`1.12.4`
python-dotenv	`1.2.2`	`1.2.3`
sqlalchemy	`2.0.51`	`2.0.52`
trino	`0.338.0`	`0.339.0`
authlib	`1.7.2`	`1.8.0`
prek	`0.4.12`	`0.5.2`
ruff	`0.16.1`	`0.16.6`

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637

Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505

{class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473

confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653

{class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642

Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581

style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677

The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678

unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681

Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637

Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505

{class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473

confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653

Fix test failures when using pytest >= 9.1. {pr}3656

{class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642

Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). {pr}3581

style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677

The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678

unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681

Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641

{func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695

The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits

8b19813 Release version 8.5.0
2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
131c86a Add FAQ entry about UnicodeEncodeError on Windows
e1fd594 Add support of pathlib.Path to edit (#3781)
a1d8785 Add support of pathlib.Path to edit
2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
a6256bf Forwards all user's parameters set in PAGER
61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
9835b0f Resolve the pager command once, in _pager_contextmanager
f36d58b Refactor pager stream handling (#3767)
Additional commits viewable in compare view

Updates pydantic-settings from 2.14.2 to 2.15.0

Release notes

Sourced from pydantic-settings's releases.

v2.15.0

Highlights

Behavior changes

case_sensitive now applies to init kwargs and config-file sources (#900). InitSettingsSource and the JSON/TOML/YAML config sources previously ignored case_sensitive. Since it defaults to False, case-insensitive matching is now the default for these sources — e.g. Settings(TeSt=...) now populates a test field where it previously did not. Nested keys are still matched case-sensitively.

Fields with unresolved forward references now emit a warning (#901). Settings sources can silently fail to resolve such fields; they now raise IncompleteFieldDefinitionWarning telling you to call model_rebuild(). If you have filterwarnings = error configured, this may surface as a new failure.

Non-JSON env values for strict fields now raise ValidationError (#926) instead of a less specific error.

New features

Show environment variable names in CLI help via cli_show_env_vars=True (#860), so generated --help output doubles as configuration documentation.

PYDANTIC_SETTINGS_DEBUG for debugging settings resolution (#906, #913). Set it to a truthy value with DEBUG logging enabled to see each source's contribution in priority order, which source won for each value, and which env_file/secret files were probed, loaded, or skipped — the long-standing "why isn't my .env being picked up?" question.

toml_table_header for regular TOML files (#882, #886, #887), letting you root settings at a nested table in any TOML file, not just pyproject.toml.

Traversable support for JSON/TOML/YAML file sources (#902), so you can load config packaged inside a distribution — including files inside a zip or wheel — via importlib.resources.files(...) without casting to Path.

GCP: project_id can come from an earlier settings source (#878), rather than only from the constructor or GOOGLE_CLOUD_PROJECT.

Bug fixes

Fix env vars not loading on Windows with case_sensitive=True (#894). Windows upper-cases os.environ keys, so fields raised Field required instead of picking up their values.

Read secret files as UTF-8 instead of the platform locale encoding (#917). On Windows code pages such as cp1252 this silently corrupted non-ASCII secrets.

Fix AliasPath on nested model fields not JSON-decoding env values (#898).

Fix case-insensitive matching for optional nested models (#905).

Fix dotenv extras being wrongly claimed by a complex field sharing a name prefix (#912) — e.g. dbx_token being swallowed by a db: dict field.

Fix nested_model_default_partial_update=True corrupting discriminated unions (#876).

Fix Secret subclasses crashing when loaded from the environment (#920).

Fix enum names not parsing through nested annotations such as Optional[Annotated[MyEnum, ...]] with env_parse_enums=True (#910).

An empty yaml_config_section now falls back to defaults instead of raising AttributeError: 'NoneType' object has no attribute 'keys' (#914).

NestedSecretsSettingsSource no longer follows symlinks pointing outside secrets_dir (#889).

GCP: skip the list_secrets call when case_sensitive=True (#862), lowering the required IAM permissions to just roles/secretmanager.secretAccessor.

AWS: types-boto3[secretsmanager] is no longer required at runtime (#880).

Documentation

Document JSON parsing of complex env values, plus a comma-separated-values recipe (#919).

Recommend an async settings loading pattern (#908).

Clarify behavior when an unprefixed value is present in a dotenv file (#895).

Clarify environment variable helper descriptions (#867) and fix assorted typos (#904).

What's Changed

Update documentation link for Pydantic settings by @hramezani in pydantic/pydantic-settings#863

Bump the python-packages group with 4 updates by @dependabot[bot] in pydantic/pydantic-settings#865

docs: clarify environment variable helper descriptions by @vip892766gma in pydantic/pydantic-settings#867

Bump the python-packages group with 4 updates by @dependabot[bot] in pydantic/pydantic-settings#870

Bump the python-packages group with 4 updates by @dependabot[bot] in pydantic/pydantic-settings#875

Skip list_secrets call when case_sensitive=True by @ecerulm in pydantic/pydantic-settings#862

GoogleSecretManagerSettingsSource: read project_id from previous sources by @ecerulm in pydantic/pydantic-settings#878

... (truncated)

Commits

f725ca1 Prepare release 2.15.0 (#930)
28f35c2 Bump the python-packages group with 4 updates (#929)
9056db0 test: move function-local imports to the top of test modules (#927)
f077e3a fix: raise ValidationError for non-JSON env values on strict fields (#926)
ae25d70 fix: treat Secret subclasses as non-complex fields (#716) (#920)
798dcea Bump the python-packages group with 4 updates (#924)
a190041 Bump the github-actions group with 4 updates (#925)
5d93332 Bump the python-packages group with 4 updates (#921)
d2fdeda fix: read secret files as UTF-8 instead of the locale encoding (#917)
2256a4e Bump the python-packages group with 3 updates (#915)
Additional commits viewable in compare view

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

Allow reuse of validators when plugins are set by @Viicos in #13535

Fix missing GC traversal on some pydantic-core struct fields by @Viicos in #13624

Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @Viicos in #13629

Count validated model fields once in smart unions by @tamird in #13731

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

Allow reuse of validators when plugins are set by @Viicos in #13535

Fix missing GC traversal on some pydantic-core struct fields by @Viicos in #13624

Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @Viicos in #13629

Count validated model fields once in smart unions by @tamird in #13731

Commits

001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
558379f Bump twine to v7.0.0
2cfd5d3 Do not check for docs build
a735bee Fix more Clippy lints
7eed4a1 Fix Clippy 0.1.95 warnings
b353bbb Prepare release v2.13.5
63d2ccc Count validated model fields once in smart unions
a53ec2e Speed up PyPy CI tests
d65e0f9 Workaround circular import error in Mypy
47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
Additional commits viewable in compare view

Updates dbt-core from 1.12.3 to 1.12.4

Release notes

Sourced from dbt-core's releases.

dbt-core v1.12.4

dbt-core 1.12.4 - September 08, 2026

Features

Add otel_trace_id() and otel_span_id() Jinja functions to correlate query comments and model SQL with OpenTelemetry trace/span ids (#)

Fixes

Re-parse the built-in generic tests (test_not_null, test_unique, test_accepted_values, test_relationships) after loading a Fusion-generated manifest, so they are not permanently evicted and left undefined at test-compile time (#15914)

Write target/manifest.json from the corrected in-memory manifest after loading a Fusion-generated manifest, so the on-disk artifact reflects the rediscovered adapter macros actually used for compilation instead of Fusion's raw bundled macros (#)

Capture and re-emit fusion parser subprocess output through dbt-core's event system instead of letting it pass through to raw stdout/stderr, re-leveling each line by its json-compat severity when available (#15672)

Validate that a resolved package installation path stays within the configured packages-install-path (#N/A)

Under the Hood

sync JSON schemas from dbt-fusion (#N/A)

Contributors

@aiguofer (#15914, #, #15672)

@ash2shukla (#N/A)

@b-per (#)

@fa-assistant (#N/A)

Changelog

Sourced from dbt-core's changelog.

dbt-core 1.12.4 - September 08, 2026

Features

Add otel_trace_id() and otel_span_id() Jinja functions to correlate query comments and model SQL with OpenTelemetry trace/span ids (#)

Fixes

Re-parse the built-in generic tests (test_not_null, test_unique, test_accepted_values, test_relationships) after loading a Fusion-generated manifest, so they are not permanently evicted and left undefined at test-compile time (#15914)

Write target/manifest.json from the corrected in-memory manifest after loading a Fusion-generated manifest, so the on-disk artifact reflects the rediscovered adapter macros actually used for compilation instead of Fusion's raw bundled macros (#)

Capture and re-emit fusion parser subprocess output through dbt-core's event system instead of letting it pass through to raw stdout/stderr, re-leveling each line by its json-compat severity when available (#15672)

Validate that a resolved package installation path stays within the configured packages-install-path (#N/A)

Under the Hood

sync JSON schemas from dbt-fusion (#N/A)

Contributors

@aiguofer (#15914, #, #15672)

@ash2shukla (#N/A)

@b-per (#)

@fa-assistant (#N/A)

Commits

43f7532 Bumping version to 1.12.4 and generate changelog
ef84f08 Revert "feat: announce dbt v2 availability on dbt --version (#16132) (#1614...
5cee9a5 fix: set Issue to N/A in changelog entry missing required custom field (#1623...
c958dfa fix: validate resolved package installation path stays within packages-instal...
96873d9 fix: capture and re-emit fusion parser subprocess output through dbt-core's e...
7bd7e8d feat: announce dbt v2 availability on dbt --version (#16132) (#16147)
d380dfc feat: add otel_trace_id() and otel_span_id() Jinja functions (#15992) (#16086)
eef816d chore: sync JSON schemas from dbt-fusion (#15498) (#16024)
9f6ac8f fix: rediscover built-in generic test macros and reflect them in target/manif...
f0c57e9 [Automated] Merged prep-release/1.12.3_32419339943 into target 1.12.latest du...
See full diff in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@h1whelan] in #640

set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@dchaudhari7177] in #680

dotenv run now prints a friendly error instead of a traceback when no command is given by [@bbc2] in #606

Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@h1whelan] in #640

set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@dchaudhari7177] in #680

dotenv run now prints a friendly error instead of a traceback when no command is given by [@bbc2] in #606

Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@ReinerBRO] in #638

Commits

49515af Bump version: 1.2.2 → 1.2.3
8ac846f chore: add release runbook (RELEASING.md) and make release target
bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
f7b18d9 fix: round-trip backslashes through set_key (#680)
751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.52

Release notes

Sourced from sqlalchemy's releases.

2.0.52

Released: August 11, 2026

platform

[platform] [bug] Python 3.15 support has been added and tested, including minimal changes for full compatibility.

References: #13477

orm

[orm] [bug] Fixed a result-column misalignment bug in ORM-enabled UPDATE statements where synchronize_session="fetch" is in use, either explicitly or because the statement uses constructs such as CTEs that implicitly select for it. Columns in rows returned by .returning() could be returned under incorrect keys (e.g. row[SomeClass.a] returning the value of a different column), a problem most likely to manifest under concurrent workloads. ORM DELETE statements were not affected.

References: #13439

[orm] [bug] Fixed bug where a failed _orm.Session.bulk_insert_mappings(), _orm.Session.bulk_update_mappings() or _orm.Session.bulk_save_objects() call could leave the _orm.Session permanently in a "flushing" state, such as when the transaction could not be begun because a previous flush had left it needing a rollback. Unlike _orm.Session.flush(), the bulk methods set the internal flushing flag and began the transaction outside of the try/finally block that resets it, so that neither _orm.Session.rollback() nor _orm.Session.close() would clear it, and every subsequent flush would raise InvalidRequestError: Session is already flushing. Pull request courtesy Hamody We.

References: #13485

[orm] [bug] Fixed issue where unpickling an ORM object that were loaded using loader options making use of wildcard tokens, such as _orm.load_only() or _orm.raiseload() with "*", would fail with KeyError or IndexError if the process doing the unpickling had not yet constructed a loader path making use of that same token. This would typically be observed when the object were unpickled in a separate process, such as with the spawn or forkserver multiprocessing start methods, the latter of which became the default on POSIX platforms as of Python 3.14. The internal collection of these tokens is now established up front, so that it is identical in every process.

... (truncated)

Commits

See full diff in compare view

Updates trino from 0.338.0 to 0.339.0

Release notes

Sourced from trino's releases.

0.339.0

What's Changed

Make result iteration recoverable from errors by @hashhar in trinodb/trino-python-client#615

Add automated Python version update workflow by @hashhar in trinodb/trino-python-client#594

Raise error when sending credentials over HTTP by @hashhar in trinodb/trino-python-client#593

Forward custom HTTP headers on coordinator spooling requests by @hashhar in trinodb/trino-python-client#620

Send Content-Type charset on statement POST requests by @hashhar in trinodb/trino-python-client#619

Return column comments in SQLAlchemy get_columns by @hashhar in trinodb/trino-python-client#618

Remove incorrect assertion on "processedRows" cursor stat in a test by @azawlocki-sbdt in trinodb/trino-python-client#625

Retry on HTTP 200 with empty response body by @emanuelsdsj in trinodb/trino-python-client#603

Do not cancel completed DML statements on cursor close by @hashhar in trinodb/trino-python-client#617

Validate host in SQLAlchemy URL helper by @hashhar in trinodb/trino-python-client#621

Cache server_version_info and guard against re-entrant reads by @hashhar in trinodb/trino-python-client#622

Do not double-decode username, password and query values in SQLAlchemy URL by @arpitjain099 in trinodb/trino-python-client#616

Expose query stats through a cursor callback by @hashhar in trinodb/trino-python-client#623

Add 0.339.0 release notes by @hashhar in trinodb/trino-python-client#629

New Contributors

@emanuelsdsj made their first contribution in trinodb/trino-python-client#603

@arpitjain099 made their first contribution in trinodb/trino-python-client#616

Full Changelog: trinodb/trino-python-client@0.338.0...0.339.0

Changelog

Sourced from trino's changelog.

Release 0.339.0

Add support for returning column comments from SQLAlchemy get_columns. (#581)

Fix infinite recursion when reading server_version_info on the SQLAlchemy dialect while a query issued through the same connection is already in flight, for example when used with aws-xray-sdk. (#559)

Fix trino.sqlalchemy.URL() to validate the host argument and raise a clear error instead of producing a malformed connection URL. (#579)

Fix INSERT/UPDATE/DELETE queries incorrectly being left as cancelled on the server when the cursor is closed immediately after reading the row count. (#601)

Fix crash and retry instead when the server returns an HTTP 200 response with an empty body. (#596)

Fix result iteration to raise transient errors, such as network errors while downloading spooled segments, to the caller instead of silently truncating the results. (#598)

Fix custom HTTP headers passed to connect() not being forwarded on requests used to fetch and acknowledge spooled result segments from the coordinator. (#620)

Send a charset in the Content-Type header of statement requests so that proxies such as Trino Gateway can parse the submitted SQL. (#600)

Fix SQLAlchemy connections corrupting a + character in the username, password, or query parameter values. (#611)

Add a stats_callback argument to Connection.cursor() that is invoked with the current query stats after every response from the coordinator, starting right after the query is submitted so the query ID is available while the query is still running. (#578)

Breaking Changes

Raise an error when authentication credentials would be sent over an insecure HTTP connection instead of silently sending them. Use https:// in the host URL, or pass http_scheme='https', to keep using authentication. (#593)

Commits

c8eb52e Bump version to 0.339.0
8bc22b9 Add 0.339.0 release notes
03b5cc2 Expose query stats through a cursor callback
405f1d8 Do not double-decode username, password and query values in SQLAlchemy URL
d4d3715 Cache server_version_info and guard against re-entrant reads
5dbb996 Validate host in SQLAlchemy URL helper
e8ba17b Cast TRINO_RUNNING_PORT to int in integration conftest
9c1f385 Do not cancel completed DML statements on cursor close
fda8cef Add unit test for empty 200 response error in process()
f8b1203 Retry on HTTP 200 with empty response body
Additional commits viewable in compare view

Updates authlib from 1.7.2 to 1.8.0

Release notes

Sourced from authlib's releases.

v1.8.0

What's Changed

Prefer id_token_signed_response_alg client metadata to guess algs by @azmeuk in authlib/authlib#888

fix: Catch InvalidKeyIdError in RFC 9068 JWTBearerTokenValidator by @liudonggalaxy in authlib/authlib#891

fix: make leeway configurable in JWTBearerTokenValidator by @mondi04 in authlib/authlib#903

feat: add default jti claim to sign_jwt_bearer_assertion by @liudonggalaxy in authlib/authlib#897

fix(oauth): cast sub claim to string in JWTBearerTokenGenerator by @levinKaus in authlib/authlib#911

Declare lower bounds for dependencies by @azmeuk in authlib/authlib#912

feat(client): use httpx2 instead of httpx by @levinKaus in authlib/authlib#909

Fix RFC7523 malformed claims handling by @azmeuk in authlib/authlib#916

Fix httpx oauth1 binary form data by @shc261392 in authlib/authlib#779

fix(starlette_client): remove default= keyword from config.get calls by @aliaksei-protchanka in authlib/authlib#770

Added client_id parameter to AssertionClient by @vilmar-hillow in authlib/authlib#476

fix(oauth): save device credential with authenticated client id by @arpitjain099 in authlib/authlib#908

fix(oauth1): correct protocol name in InsecureTransportError description by @RavSinghChandan in authlib/authlib#919

fix(client): client can be flexible with jwt's header by @lepture in authlib/authlib#922

fix(oidc): omit claims when the value is None by @lepture in authlib/authlib#923

New Contributors

@mondi04 made their first contribution in authlib/authlib#903

@levinKaus made their first contribution in authlib/authlib#911

@aliaksei-protchanka made their first contribution in authlib/authlib#770

@vilmar-hillow made their first contribution in authlib/authlib#476

@arpitjain099 made their first contribution in authlib/authlib#908

@RavSinghChandan made their first contribution in authlib/authlib#919

Full Changelog: authlib/authlib@v1.7.2...v1.8.0

Commits

1a86748 chore: release 1.8.0
e4fb941 Merge pull request #923 from authlib/fix-921
9f2cd2e Merge pull request #922 from authlib/fix-902
5d53239 fix(oidc): omit claims when the value is None
772bc72 Merge pull request #919 from RavSinghChandan/fix-oauth1-insecure-transport-de...
11794b0 Merge pull request #908 from arpitjain099/chore/device-cred-authenticated-cli...
13f2eb0 fix(client): Added client_id parameter to AssertionClient (#476)
dde5b7a fix(client): rollback
e4aec8c fix(client): remove default= keyword from starlette client config.get calls (...
62f41cc fix(client): httpx oauth1 binary form data (#779)
Additional commits viewable in compare view

Updates prek from 0.4.12 to 0.5.2

Release notes

Sourced from prek's releases.

0.5.2

Release Notes

Released on 2026-09-03.

Enhancements

Allow unknown tags by default in check-yaml (#2678)

Contributors

@j178

Install prek 0.5.2

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek
Download prek 0.5.2

File Platform Checksum

prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum

prek-x86_64-apple-darwin.tar.gz Intel macOS checksum

prek-aarch64-pc-windows-msvc.zip ARM64 Windows

…y with 10 updates Bumps the elt-common-dependencies group with 10 updates in the /elt-common directory: | Package | From | To | | --- | --- | --- | | [click](https://github.com/pallets/click) | `8.4.2` | `8.5.0` | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.2` | `2.15.0` | | [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` | | [dbt-core](https://github.com/dbt-labs/dbt-core) | `1.12.3` | `1.12.4` | | [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.3` | | [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.51` | `2.0.52` | | [trino](https://github.com/trinodb/trino-python-client) | `0.338.0` | `0.339.0` | | [authlib](https://github.com/authlib/authlib) | `1.7.2` | `1.8.0` | | [prek](https://github.com/j178/prek) | `0.4.12` | `0.5.2` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.1` | `0.16.6` | Updates `click` from 8.4.2 to 8.5.0 - [Release notes](https://github.com/pallets/click/releases) - [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md) - [Commits](pallets/click@8.4.2...8.5.0) Updates `pydantic-settings` from 2.14.2 to 2.15.0 - [Release notes](https://github.com/pydantic/pydantic-settings/releases) - [Commits](pydantic/pydantic-settings@v2.14.2...v2.15.0) Updates `pydantic` from 2.13.4 to 2.13.5 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md) - [Commits](pydantic/pydantic@v2.13.4...v2.13.5) Updates `dbt-core` from 1.12.3 to 1.12.4 - [Release notes](https://github.com/dbt-labs/dbt-core/releases) - [Changelog](https://github.com/dbt-labs/dbt/blob/v1.12.4/CHANGELOG.md) - [Commits](dbt-labs/dbt@v1.12.3...v1.12.4) Updates `python-dotenv` from 1.2.2 to 1.2.3 - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3) Updates `sqlalchemy` from 2.0.51 to 2.0.52 - [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases) - [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst) - [Commits](https://github.com/sqlalchemy/sqlalchemy/commits) Updates `trino` from 0.338.0 to 0.339.0 - [Release notes](https://github.com/trinodb/trino-python-client/releases) - [Changelog](https://github.com/trinodb/trino-python-client/blob/master/CHANGES.md) - [Commits](trinodb/trino-python-client@0.338.0...0.339.0) Updates `authlib` from 1.7.2 to 1.8.0 - [Release notes](https://github.com/authlib/authlib/releases) - [Commits](authlib/authlib@v1.7.2...v1.8.0) Updates `prek` from 0.4.12 to 0.5.2 - [Release notes](https://github.com/j178/prek/releases) - [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md) - [Commits](j178/prek@v0.4.12...v0.5.2) Updates `ruff` from 0.16.1 to 0.16.6 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.1...0.16.6) --- updated-dependencies: - dependency-name: click dependency-version: 8.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: elt-common-dependencies - dependency-name: pydantic-settings dependency-version: 2.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: elt-common-dependencies - dependency-name: pydantic dependency-version: 2.13.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: elt-common-dependencies - dependency-name: dbt-core dependency-version: 1.12.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: elt-common-dependencies - dependency-name: python-dotenv dependency-version: 1.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: elt-common-dependencies - dependency-name: sqlalchemy dependency-version: 2.0.52 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: elt-common-dependencies - dependency-name: trino dependency-version: 0.339.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: elt-common-dependencies - dependency-name: authlib dependency-version: 1.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: elt-common-dependencies - dependency-name: prek dependency-version: 0.5.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: elt-common-dependencies - dependency-name: ruff dependency-version: 0.16.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: elt-common-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-09-17T13:58:48Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 53c2ca53-d412-453a-8819-dc10503d98e8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 17, 2026

dependabot Bot requested a review from a team as a code owner September 17, 2026 13:58

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 17, 2026

Navigation Menu

chore(deps): bump the elt-common-dependencies group across 1 directory with 10 updates - #478

chore(deps): bump the elt-common-dependencies group across 1 directory with 10 updates#478
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/elt-common/elt-common-dependencies-aaff93b989

dependabot Bot commented on behalf of github Sep 17, 2026

Uh oh!

coderabbitai Bot commented Sep 17, 2026

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

File	Platform	Checksum
prek-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
prek-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
prek-aarch64-pc-windows-msvc.zip	ARM64 Windows

Conversation

dependabot Bot commented on behalf of github Sep 17, 2026

8.5.0

Version 8.5.0

v2.15.0

Highlights

Behavior changes

New features

Bug fixes

Documentation

What's Changed

v2.13.5 (2026-08-28)

What's Changed

Fixes

v2.13.5 (2026-08-28)

What's Changed

Fixes

dbt-core v1.12.4

dbt-core 1.12.4 - September 08, 2026

Features

Fixes

Under the Hood

Contributors

dbt-core 1.12.4 - September 08, 2026

Features

Fixes

Under the Hood

Contributors

v1.2.3

Fixed

[1.2.3] - 2026-08-16

Fixed

2.0.52

platform

orm

0.339.0

What's Changed

New Contributors

Release 0.339.0

Breaking Changes

v1.8.0

What's Changed

New Contributors

0.5.2

Release Notes

Enhancements

Contributors

Install prek 0.5.2

Install prebuilt binaries via shell script

Install prebuilt binaries via powershell script

Install prebuilt binaries via Homebrew

Download prek 0.5.2

Uh oh!

coderabbitai Bot commented Sep 17, 2026

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants