[dependabot]

Bumps the python-minor-patch group with 5 updates:

Package	From	To
pyarrow	26.0.0	26.0.1
pydantic	2.14.2	2.14.3
cyclopts	5.3.2	5.4.0
mkdocs-material	9.8.0	9.8.1
ruff	0.17.3	0.17.4

Updates pyarrow from 26.0.0 to 26.0.1

Release notes

Sourced from pyarrow's releases.

Apache Arrow 26.0.1

Release Notes URL: https://arrow.apache.org/release/26.0.1.html

Apache Arrow 26.0.1 RC1

Release Notes: Release Candidate: 26.0.1 RC1

Commits

• 9e5d697 MINOR: [Release] Update versions for 26.0.1
• 905f17c MINOR: [Release] Update .deb/.rpm changelogs for 26.0.1
• 2c3234c MINOR: [Release] Update CHANGELOG.md for 26.0.1
• 8d3388b GH-55316: [CI][FlightRPC][ODBC] Apply ports.patch in Windows build (#55317)
• 3ec2cf1 GH-54936: [C++] Ensure reading an invalid map array from IPC doesn't crash (#...
• f942ba3 GH-51684: [C++][Parquet][FOLLOWUP] Speed up content-defined chunking with a l...
• 700a983 GH-52161: [C++][Parquet] Add support for string/binary view to content define...
• ba754c4 GH-51669: [C++][Parquet] Preserve cipher in plaintext footer metadata (#54884)
• 16f1823 GH-50544: [C++][Gandiva] Fix out-of-bounds read in round with most negative p...
• ae357c6 GH-53518: [Parquet] Reject unsupported compression codecs (#53522)
• Additional commits viewable in compare view

Updates pydantic from 2.14.2 to 2.14.3

Release notes

Sourced from pydantic's releases.

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

• Build wheels for GraalPy 3.13 by @​msimacek in #14136.

  The previous v2.14.2 release published GraalPy 3.11 wheels, which were not working due to a PyO3 version bump. A CI workflow issue made it so that the wheel wasn't tested before publishing. This is now fixed: starting in v2.14.3, we no longer publish GraalPy 3.11 wheels, and GraalPy 3.13 wheels are now published together with the existing 3.12 one.

Performance

• Improve schema generation for fixed type handlers by @​alexmojaki in #14130
• Skip general schema dispatch for builtin scalars by @​alexmojaki in #14141
• Skip annotation handler setup when annotations are empty by @​alexmojaki in #14149
• Fix quadratic serialization time with per-index include/exclude on sequences by @​Viicos in #14160
• Avoid type lookups when checking for None during serialization by @​Viicos in #14167
• Improve performance of model serialization by @​Viicos in #14171
• Improve performance of dict serialization by @​Viicos in #14172
• Improve performance of type inference during serialization by @​Viicos in #14173
• Avoid cloning the field name when using the default value during validation by @​Viicos in #14175
• Do not evaluate model_config annotations by @​Viicos in #14195
• Avoid slow runtime Protocol check when expanding GroupedMetadata annotations by @​Viicos in #14196
• Use a lightweight @contextmanager implementation internally by @​Viicos in #14199

Fixes

• Fix various issues about GC tracking in pydantic-core by @​Viicos in #13819
• Include null in serialization JSON Schema for unless-none field serializers by @​Kropiunig in #13848
• Fix RecursionError when copying or unpickling models with defer_build by @​Viicos in #14115
• Remove dead default_factory check in unsupported Field() attribute by @​owtaylor in #14129
• Disallow non string extra keys during validation by @​Viicos in #14135
• Fix deeply nested data being reported as a cyclic reference by @​Viicos in #14164

New Contributors

• @​owtaylor made their first contribution in #14129

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• ea492e0 Bump pydantic-core to v2.50.4
• 4f4a33f Prepare release v2.14.3
• dca067b Benchmark TypedDict schema generation across builds
• a2d1f6c Skip annotation handler setup when annotations are empty
• 3ae0a40 Construct builtin scalar union schemas directly
• 358d36f Skip general schema dispatch for builtin scalars
• 3cc701a Improve schema generation for fixed type handlers
• 762db7e Remove redundant None check in union schema generation
• c214986 Bump pytest-codspeed to v5.0.4
• 038ee97 Bump typing-inspection to v0.4.5
• Additional commits viewable in compare view

Updates cyclopts from 5.3.2 to 5.4.0

Release notes

Sourced from cyclopts's releases.

v5.4.0

Features

• App.argfile_prefix reads CLI arguments from files, like argparse's fromfile_prefix_chars. With App(argfile_prefix="@"), a token like @run.args is replaced by the file's lines (one argument per line), and files may reference other files. @​yash-bitla #1043

Bug Fixes

Meta Apps & Combined Short Flags

• An unknown combined short flag is reported whole instead of blaming a meta-app option. #1040
• A meta option inside a combined short token takes all of its values. #1042
• Combined short flags with an = value (e.g. -vn=bob) no longer misbind in meta apps. #1041

Other

• An app run with python -m mypkg is named after the module in help and usage-strings, matching argparse. @​Rahul-cs50 #1053
• Pydantic URL types (HttpUrl, AnyUrl, ...) and other custom-schema types are parsed as a single value instead of recursing forever. #1048
• A CoercionError raised by convert() (e.g. inside a custom converter) can be printed instead of raising AssertionError. @​gal-a #1047
• Shell-completion generation skips Parameter(parse=False) arguments, so an injected dependency whose type is only imported under TYPE_CHECKING no longer raises NameError. @​damvolkov #1045

Maintenance

• The release workflow uses pypi-publish v1.14.3 (addresses a compromised Sigstore CA), and Dependabot now keeps GitHub Actions up to date. #1054
• Dependency and GitHub Actions bumps. #1049, #1050, #1051, #1055, #1056, #1057, #1058

New Contributors

• @​gal-a made their first contribution in #1047
• @​damvolkov made their first contribution in #1045

Full Changelog: BrianPugh/cyclopts@v5.3.3...v5.4.0

v5.3.3

Bug Fixes

• convert NewType nested inside containers and unions to its underlying type by @​Enesuygurs in BrianPugh/cyclopts#1036
• show choices for an enum NewType nested in a container or union by @​BrianPugh in BrianPugh/cyclopts#1038
• complete default-command positionals alongside subcommands in bash/zsh/fish by @​BrianPugh in BrianPugh/cyclopts#1037

New Contributors

• @​Enesuygurs made their first contribution in BrianPugh/cyclopts#1036

Full Changelog: BrianPugh/cyclopts@v5.3.2...v5.3.3

Commits

• 1cfe669 Merge pull request #1057 from BrianPugh/dependabot/github_actions/codecov/cod...
• 0a695f1 Merge pull request #1056 from BrianPugh/dependabot/github_actions/actions/cac...
• 3715e24 Merge pull request #1055 from BrianPugh/dependabot/github_actions/actions/che...
• fb3d162 Merge pull request #1058 from BrianPugh/dependabot/github_actions/astral-sh/s...
• e9ad6d0 Merge pull request #1041 from BrianPugh/fix/meta-combined-short-equals
• c9b0452 chore(deps): bump astral-sh/setup-uv from 5 to 7
• 0f237cd chore(deps): bump codecov/codecov-action from 4 to 7
• 05c585d chore(deps): bump actions/cache from 4 to 6
• 77cfd18 chore(deps): bump actions/checkout from 4 to 7
• 76908fb Merge pull request #1054 from BrianPugh/ci/security-bumps
• Additional commits viewable in compare view

Updates mkdocs-material from 9.8.0 to 9.8.1

Release notes

Sourced from mkdocs-material's releases.

mkdocs-material-9.8.1

[!WARNING]

Material for MkDocs reaches end of life on May 5, 2027. Critical fixes and security updates continue until that date.

We're continuing our work with Zensical, a maintained successor built by the team behind Material for MkDocs. It carries forward what we've learned from building documentation tools with this community, with Markdown authoring, a familiar design, and full control over your content. Zensical is Open Source and MIT-licensed.

You can evaluate Zensical alongside MkDocs using your existing mkdocs.yml. Check plugin compatibility and compare your pages, navigation, search, and customizations before switching. The classic theme variant preserves the appearance of Material for MkDocs. See the migration guide for the steps and current compatibility details.

Upcoming changes on November 5

• Updated Docker base image to Alpine 3.24
• Updated Docker image dependencies to fix vulnerabilities
• Updated Node build-time dependencies to fix vulnerabilities

Changelog

Sourced from mkdocs-material's changelog.

mkdocs-material-9.8.1 (2026-11-07)

• Updated Docker base image to Alpine 3.24
• Updated Docker image dependencies to fix vulnerabilities
• Updated Node build-time dependencies to fix vulnerabilities

mkdocs-material-9.8.0 (2026-10-24)

This is primarily a security release. It raises dependency minimums to address known vulnerabilities. We recommend upgrading to this release and updating your dependency lockfiles.

Python 3.11 or newer is now required. Python 3.8–3.10 are no longer supported.

• Updated Node build-time dependencies to fix vulnerabilities
• Updated Python dependency minimums and required Python 3.11
• Removed RSS from recommended dependencies
• Updated project status and maintenance links
• Updated CLI notice with end-of-life and migration guidance
• Removed redirects from recommended dependencies

Previous dependency ranges allowed versions with known vulnerabilities. The new minimums cover core Python dependencies and the optional git and imaging extras, including GitPython 3.2.1 or newer for the git extra.

Recent releases of mkdocs-rss-plugin and mkdocs-redirects depend on ProperDocs, a separate static site generator that Material for MkDocs does not require. Removing these plugins from the recommended extra keeps its dependency footprint smaller and leaves the choice of additional tools to each project. If your project uses RSS feeds or redirects, declare the relevant plugin explicitly in your own dependencies.

The CLI notice now gives the May 5, 2027 end-of-life date and links to the Zensical migration guide: https://zensical.org/docs/compatibility/mkdocs/migration/

It also clarifies that third-party ProperDocs migration notices do not represent a recommendation from the Material for MkDocs team. Package metadata now marks the project as inactive and includes maintenance and migration links.

Selected Python security advisories addressed by the new minimums:

Jinja2: affected <=3.1.5; new minimum 3.1.6 (CVE-2025-27516) GHSA-cpwx-vrp4-4pq7

Markdown: affected <3.8.1; new minimum 3.8.1 (CVE-2025-69534) GHSA-5wmx-573v-2qwq

Pygments: affected <2.20.0; new minimum 2.20.0 (CVE-2026-4539) GHSA-5239-wwwm-4pmq

... (truncated)

Commits

• 16c95ad Prepare 9.8.1 release
• b3fe832 Fixed documentation workflow
• 004d29e Updated dependencies to fix vulnerabilities
• 7590e14 Documentation
• 0f044db Updated documentation build to use public Material
• dc38d1e Documentation
• ebbfb46 Updated Docker base image to Alpine 3.24
• 624aff1 Updated build and documentation workflows
• See full diff in compare view

Updates ruff from 0.17.3 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits

• 05cdc36 Bump version to 0.17.4 (#30073)
• c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
• 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
• 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
• 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
• 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
• c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
• c9150f0 Add project walltime benchmarks for Ruff (#30061)
• 64989ec [ty] Report invalid module globs once per override pattern (#30031)
• 367a563 [ty] Fix conditional type and tuple annotations (#29987)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1237ff81-dcb2-4298-832b-dcccf6fd2d3b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn