chore(deps-dev): bump the development-dependencies group across 1 directory with 5 updates by dependabot[bot] · Pull Request #105 · Zenable-io/ai-native-python

dependabot · 2026-09-14T08:08:19Z

Bumps the development-dependencies group with 5 updates in the / directory:

Package	From	To
coverage	`7.15.0`	`7.16.1`
gitpython	`3.1.50`	`3.1.62`
pre-commit	`4.6.0`	`4.6.2`
pyright	`1.1.411`	`1.1.414`
python-semantic-release	`10.6.0`	`10.6.2`

Updates coverage from 7.15.0 to 7.16.1

Release notes

Sourced from coverage's releases.

7.16.1

Version 7.16.1 — 2026-09-13

Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.

Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.

➡️ PyPI page: coverage 7.16.1. :arrow_right: To install: python3 -m pip install coverage==7.16.1

7.16.0

Version 7.16.0 — 2026-08-28

When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.

The Coverage.switch_context() method now returns the previous context.

Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.

Fixes to validation of options and configuration settings:

Negative precision settings now always cause useful error messages (pull 2261).

An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).

Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).

coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).

Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️ PyPI page: coverage 7.16.0. :arrow_right: To install: python3 -m pip install coverage==7.16.0

7.15.4

Version 7.15.4 — 2026-08-06

Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.

Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.

Wheels are now provided for Python 3.15.

➡️ PyPI page: coverage 7.15.4. :arrow_right: To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.

A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.

Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️ PyPI page: coverage 7.15.3. :arrow_right: To install: python3 -m pip install coverage==7.15.3

7.15.2

Version 7.15.2 — 2026-07-15

Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

... (truncated)

Changelog

Sourced from coverage's changelog.

Version 7.16.1 — 2026-09-13

Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

.. _issue 1563: coveragepy/coveragepy#1563 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Version 7.16.0 — 2026-08-28

When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

The :meth:.Coverage.switch_context method now returns the previous context.

Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

Fixes to validation of options and configuration settings:

Negative precision settings now always cause useful error messages (pull 2261_).

An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't

... (truncated)

Commits

ccbb992 docs: prep for 7.16.1
0697ccc chore: make upgrade
12f3595 chore: bump docker/setup-qemu-action in the action-dependencies group (#2280)
35b58d3 fix: CoverageData.update() can be called twice on an in-memory database. #2279
92e1ce9 chore: bump the action-dependencies group with 4 updates (#2278)
bf07310 build: quote var expansion (actionlint SC2086)
3c434f5 quality: use shellcheck-py to get shellcheck in GitHub CI
632f397 build: use .txt instead of .pip, even though it's a stupid extension
ffc6a4a test: only run diff-cover on pull requests
33553b3 fix: exclude the case line when an irrefutable case body is excluded (#2269)
Additional commits viewable in compare view

Updates gitpython from 3.1.50 to 3.1.62

Release notes

Sourced from gitpython's releases.

3.1.62

What's Changed

prepare next release by @Byron in gitpython-developers/GitPython#2222

Keep bare-repository worktrees non-bare by @Byron in gitpython-developers/GitPython#2224

Reject unsafe submodule checkout paths by @Byron in gitpython-developers/GitPython#2225

build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.0 to 0.16.5 in the pre-commit group by @dependabot[bot] in gitpython-developers/GitPython#2226

fix: join backslash line continuations when reading config values by @nkbeast in gitpython-developers/GitPython#2227

New Contributors

@nkbeast made their first contribution in gitpython-developers/GitPython#2227

Full Changelog: gitpython-developers/GitPython@3.1.61...3.1.62

3.1.61

Fix accidental removal of exploitable regex in Actor by bringing it back, and deprecating it.

What's Changed

Fix repository discovery precedence by @Byron in gitpython-developers/GitPython#2218

fix: wait for git daemon to listen before connecting by @Vogtinator in gitpython-developers/GitPython#2219

fix: restore Actor.name_email_regex by @Byron in gitpython-developers/GitPython#2221

New Contributors

@Vogtinator made their first contribution in gitpython-developers/GitPython#2219

Full Changelog: gitpython-developers/GitPython@3.1.60...3.1.61

3.1.60 Security

What's Changed

prepare changelog prior to release by @Byron in gitpython-developers/GitPython#2212

Preserve Git config escape semantics by @Byron in gitpython-developers/GitPython#2213

Harden diff path and actor identity parsing by @Byron in gitpython-developers/GitPython#2215

Require explicit opt-in for filesystem diffs by @Byron in gitpython-developers/GitPython#2217

Full Changelog: gitpython-developers/GitPython@3.1.59...3.1.60

3.1.59 - Security

What's Changed

prepare changelog for upcoming release by @Byron in gitpython-developers/GitPython#2207

Block file-reading Git options by @Byron in gitpython-developers/GitPython#2208

index: write blobs via git hash-object, not gitdb's odb.store by @caroescm in gitpython-developers/GitPython#2209

Block separate git directories during clone by @Byron in gitpython-developers/GitPython#2210

fix: harden config parsing boundaries by @Byron in gitpython-developers/GitPython#2211

repo.index.add() now respects worktree filters gitpython-developers/GitPython#2209

Full Changelog: gitpython-developers/GitPython@3.1.58...3.1.59

3.1.58 - Security and Fixes

What's Changed

test: allow Python startup before timeout by @Byron in gitpython-developers/GitPython#2195

... (truncated)

Commits

db47516 prepare new release
10ec385 get better commit messages from agents
b754897 test: cover subdirectory discovery and pathspec commands in bare-repo worktre...
9ebf8b6 Merge pull request #2227 from nkbeast/fix-config-backslash-continuation
a15f791 fix: parse joined config values as a whole
60dd946 fix: ignore continuation markers in config comments
075a664 fix: join backslash line continuations when reading config values
62d1e2f Merge pull request #2226 from gitpython-developers/dependabot/pre_commit/pre-...
23d0e92 build(deps): bump https://github.com/astral-sh/ruff-pre-commit
8a14adc Merge pull request #2225 from gitpython-developers/submodule-path-hardening
Additional commits viewable in compare view

Updates pre-commit from 4.6.0 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.

Regressed in 4.6.1.

#3737 issue by @mheiges.

#3743 PR by @asottile.

pre-commit v4.6.1

Fixes

Install language: node hooks via git.

Fixes npm 12.x compatibility

#3719 PR by @asottile.

#3517 issue by @ojob.

Set JULIA_DEPOT_PATH for language: julia.

#3711 PR by @damonbayer.

pre-commit-ci/runner-image#335 issue by @damonbayer.

Produce error on mistyped --repo for pre-commit autoupdate.

#3701 PR by @mxr.

#3695 issue by @mxr.

Improve performance of commit existence check in pre-push.

#3726 PR by @asottile.

#3604 issue by @ptarjan.

Avoid duplicating conflicted filenames during pre-commit run --all-files.

#3727 PR by @asottile.

#3706 issue by @RomanValov.

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

Fix language: node hooks that contain "scripts": {"build": ...} with npm 11.x.

Regressed in 4.6.1.

#3737 issue by @mheiges.

#3743 PR by @asottile.

4.6.1 - 2026-07-21

Fixes

Install language: node hooks via git.

Fixes npm 12.x compatibility

#3719 PR by @asottile.

#3517 issue by @ojob.

Set JULIA_DEPOT_PATH for language: julia.

#3711 PR by @damonbayer.

pre-commit-ci/runner-image#335 issue by @damonbayer.

Produce error on mistyped --repo for pre-commit autoupdate.

#3701 PR by @mxr.

#3695 issue by @mxr.

Improve performance of commit existence check in pre-push.

#3726 PR by @asottile.

#3604 issue by @ptarjan.

Avoid duplicating conflicted filenames during pre-commit run --all-files.

#3727 PR by @asottile.

#3706 issue by @RomanValov.

Commits

9767b6c v4.6.2
42ee3ff Merge pull request #3743 from pre-commit/npm-build-scripts-11-x
3056619 fix language: node for hooks with build scripts and npm 11.x
242ce8a v4.6.1
766e550 Merge pull request #3727 from pre-commit/dedupe
1558d06 Merge pull request #3726 from pre-commit/exists-faster
8a1c47a avoid duplicate files in --all-files during conflict
2e01c99 faster check of rev existing locally as a commit
3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
1d811d9 Return an error for invalid --repo
Additional commits viewable in compare view

Updates pyright from 1.1.411 to 1.1.414

Commits

1aa6dfe Pyright NPM Package update to 1.1.414 (#370)
5ecb4df tests: retry network tests (#369)
978501b chore: bump timeout for pylance version check
474b7be Pyright NPM Package update to 1.1.413 (#365)
4502e5d ci: auto merge version bumps (#368)
f9a9a6e [pyright updated to 1.1.412] Update Version (#364)
See full diff in compare view

Updates python-semantic-release from 10.6.0 to 10.6.2

Release notes

Sourced from python-semantic-release's releases.

v10.6.2 (2026-08-28)

This release is published under the MIT License.

🪲 Bug Fixes

cmd-changelog: Fix reading of TOML when file was created on Windows (9a56ace)

config: Validate commit author in config internally (PR#1477, 10afa8e)

⚙️ Build System

deps: Adjust importlib use to maintain 3.8 support (59fea4f)

deps: Bump rich requirement from v14.0+ to v15.0+ (PR#1464, abd942d)

deps: Bump tomlkit requirement to ~=0.15.0 (PR#1463, 429588d)

✅ Resolved Issues

#1476: Bug: GitPython v3.1.60 removed Actor.name_email_regex, breaking every config load

Detailed Changes: v10.6.1...v10.6.2

Installable artifacts are available from:

PyPi Registry

GitHub Release Assets

v10.6.1 (2026-07-06)

This release is published under the MIT License.

🪲 Bug Fixes

changelog: Fix handling of whitespace commit bodies in changelog template filter (PR#1457, d95e46e)

cmd-version: Fix non-styled error msg when strict & no new version (PR#1437, 5e8f94c)

config: Eliminate .git/ in parent dir warnings for monorepos configured with .. (PR#1444, 7a1f822)

📖 Documentation

CHANGELOG: Add v9.21.2 changelog details for website (a4115cf)

... (truncated)

Changelog

Sourced from python-semantic-release's changelog.

v10.6.2 (2026-08-28)

🪲 Bug Fixes

cmd-changelog: Fix reading of TOML when file was created on Windows (9a56ace_)

config: Validate commit author in config internally, closes [#1476](https://github.com/python-semantic-release/python-semantic-release/issues/1476)_ (PR#1477, 10afa8e)

⚙️ Build System

deps: Adjust importlib use to maintain 3.8 support (59fea4f_)

deps: Bump rich requirement from v14.0+ to v15.0+ (PR#1464, abd942d)

deps: Bump tomlkit requirement to ~=0.15.0 (PR#1463, 429588d)

.. _#1476: python-semantic-release/python-semantic-release#1476 .. _10afa8e: python-semantic-release/python-semantic-release@10afa8e .. _429588d: python-semantic-release/python-semantic-release@429588d .. _59fea4f: python-semantic-release/python-semantic-release@59fea4f .. _9a56ace: python-semantic-release/python-semantic-release@9a56ace .. _abd942d: python-semantic-release/python-semantic-release@abd942d .. _PR#1463: python-semantic-release/python-semantic-release#1463 .. _PR#1464: python-semantic-release/python-semantic-release#1464 .. _PR#1477: python-semantic-release/python-semantic-release#1477

.. _changelog-v10.6.1:

v10.6.1 (2026-07-06)

🪲 Bug Fixes

changelog: Fix handling of whitespace commit bodies in changelog template filter (PR#1457, d95e46e)

cmd-version: Fix non-styled error msg when strict & no new version, closes [#1423](https://github.com/python-semantic-release/python-semantic-release/issues/1423)_ (PR#1437, 5e8f94c)

config: Eliminate .git/ in parent dir warnings for monorepos configured with .., closes [#1418](https://github.com/python-semantic-release/python-semantic-release/issues/1418)_ (PR#1444, 7a1f822)

📖 Documentation

... (truncated)

Commits

See full diff in compare view

dependabot · 2026-09-14T08:08:20Z

Assignees

The following users could not be added as assignees: jonzeolla. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

ai-coding-guardrails

Nice work! 😎

I didn't find anything of concern

List of skipped files due to configuration

uv.lock

Risk: 🟢 Low

Reviewed with 🤟 by Zenable

…ectory with 5 updates Bumps the development-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [coverage](https://github.com/coveragepy/coveragepy) | `7.15.0` | `7.16.1` | | [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.50` | `3.1.62` | | [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.0` | `4.6.2` | | [pyright](https://github.com/RobertCraigie/pyright-python) | `1.1.411` | `1.1.414` | | [python-semantic-release](https://github.com/python-semantic-release/python-semantic-release) | `10.6.0` | `10.6.2` | Updates `coverage` from 7.15.0 to 7.16.1 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.15.0...7.16.1) Updates `gitpython` from 3.1.50 to 3.1.62 - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES) - [Commits](gitpython-developers/GitPython@3.1.50...3.1.62) Updates `pre-commit` from 4.6.0 to 4.6.2 - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md) - [Commits](pre-commit/pre-commit@v4.6.0...v4.6.2) Updates `pyright` from 1.1.411 to 1.1.414 - [Release notes](https://github.com/RobertCraigie/pyright-python/releases) - [Commits](RobertCraigie/pyright-python@v1.1.411...v1.1.414) Updates `python-semantic-release` from 10.6.0 to 10.6.2 - [Release notes](https://github.com/python-semantic-release/python-semantic-release/releases) - [Changelog](https://github.com/python-semantic-release/python-semantic-release/blob/master/CHANGELOG.rst) - [Commits](python-semantic-release/python-semantic-release@v10.6...v10.6.2) --- updated-dependencies: - dependency-name: coverage dependency-version: 7.16.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: gitpython dependency-version: 3.1.62 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: pre-commit dependency-version: 4.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: pyright dependency-version: 1.1.414 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: python-semantic-release dependency-version: 10.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

…48092

dependabot Bot assigned JonZeolla Sep 14, 2026

dependabot Bot requested a review from JonZeolla as a code owner September 14, 2026 08:08

ai-coding-guardrails Bot reviewed Sep 14, 2026

View reviewed changes

ai-coding-guardrails Bot added the zenable/risk:low Zenable assessed this PR as LOW risk. label Sep 14, 2026

dependabot Bot force-pushed the dependabot/uv/development-dependencies-70da048092 branch from 7c03fc5 to 095f8e8 Compare September 21, 2026 12:16

Merge branch 'main' into dependabot/uv/development-dependencies-70da0…

2b7511e

…48092

JonZeolla enabled auto-merge (squash) September 21, 2026 12:54

JonZeolla approved these changes Sep 21, 2026

View reviewed changes

JonZeolla merged commit 23c9462 into main Sep 21, 2026
8 checks passed

JonZeolla deleted the dependabot/uv/development-dependencies-70da048092 branch September 21, 2026 13:02

Navigation Menu

chore(deps-dev): bump the development-dependencies group across 1 directory with 5 updates - #105

chore(deps-dev): bump the development-dependencies group across 1 directory with 5 updates#105
JonZeolla merged 2 commits into
mainfrom
dependabot/uv/development-dependencies-70da048092

dependabot Bot commented on behalf of github Sep 14, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Uh oh!

ai-coding-guardrails Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

7.16.1

Version 7.16.1 — 2026-09-13

7.16.0

Version 7.16.0 — 2026-08-28

7.15.4

Version 7.15.4 — 2026-08-06

7.15.3

Version 7.15.3 — 2026-08-02

7.15.2

Version 7.15.2 — 2026-07-15

Version 7.16.1 — 2026-09-13

Version 7.16.0 — 2026-08-28

3.1.62

What's Changed

New Contributors

3.1.61

What's Changed

New Contributors

3.1.60 Security

What's Changed

3.1.59 - Security

What's Changed

3.1.58 - Security and Fixes

What's Changed

pre-commit v4.6.2

Fixes

pre-commit v4.6.1

Fixes

4.6.2 - 2026-08-10

Fixes

4.6.1 - 2026-07-21

Fixes

v10.6.2 (2026-08-28)

🪲 Bug Fixes

⚙️ Build System

✅ Resolved Issues

v10.6.1 (2026-07-06)

🪲 Bug Fixes

📖 Documentation

v10.6.2 (2026-08-28)

🪲 Bug Fixes

⚙️ Build System

v10.6.1 (2026-07-06)

🪲 Bug Fixes

📖 Documentation

Uh oh!

dependabot Bot commented on behalf of github Sep 14, 2026

Assignees

Labels

Uh oh!

ai-coding-guardrails Bot left a comment

Choose a reason for hiding this comment

Risk: 🟢 Low

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 14, 2026 •

edited

Loading