chore(deps): bump the python-maintenance group across 1 directory with 11 updates

[dependabot]

Bumps the python-maintenance group with 11 updates in the / directory:

Package	From	To
httpx2	2.7.0	2.12.0
typing-extensions	4.15.0	4.16.0
anyio	4.12.1	4.14.2
sounddevice	0.5.3	0.5.6
botocore	1.42.97	1.43.76
pytest	9.0.3	9.1.1
ruff	0.14.7	0.16.4
inline-snapshot	0.31.1	0.35.4
azure-identity	1.25.1	1.25.3
trio	0.31.0	0.34.0
hatchling	1.27.0	1.32.0

Updates httpx2 from 2.7.0 to 2.12.0

Release notes

Sourced from httpx2's releases.

v2.12.0

Highlights

🛡️ Bounded response decompression

httpx2 now decodes gzip, deflate, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (pydantic/httpx2#1126).

📦 Shared Zstandard API

Python 3.13 and earlier now use backports.zstd, which provides the same bounded incremental decompression API as compression.zstd on Python 3.14 and later (pydantic/httpx2#1146).

httpx2

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier by @​Kludex in pydantic/httpx2#1146

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails by @​Kludex in pydantic/httpx2#1126

httpcore2

No changes since 2.11.0. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.11.0...v2.12.0

v2.11.0

Highlights

🌐 Public origin API

httpx2 now includes an immutable and hashable Origin value object, available through URL.origin. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (pydantic/httpx2#1134).

🛠️ Request compatibility and validation

• Explicit Transfer-Encoding headers now take precedence over body-derived Content-Length headers (pydantic/httpx2#1137).
• Deprecated status code aliases are available again (pydantic/httpx2#1135).
• Multipart part headers are validated before serialization (pydantic/httpx2#1142).

httpx2

Added

• Add the public Origin value object and URL.origin property by @​Kludex in pydantic/httpx2#1134

Changed

• Require Brotli 1.2.0 or later for the brotli extra by @​Kludex in pydantic/httpx2#1141

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.12.0 (August 18th, 2026)

Changed

• Use backports.zstd for Zstandard decoding on Python 3.13 and earlier. (#1146)

Fixed

• Bound peak memory while streaming compressed responses and close response streams when decoding fails. (#1126)

2.11.0 (August 18th, 2026)

Added

• Add the public Origin value object and URL.origin property for normalized, hashable origin comparisons. (#1134)

Changed

• Require Brotli 1.2.0 or later for the brotli extra. (#1141)

Fixed

• Restore deprecated status code aliases. (#1135)
• Extract HTTP/2 release notes from changelog headings correctly. (#1136)
• Respect explicit Transfer-Encoding headers and expose buffered request body lengths to WSGI applications. (#1137)
• Validate multipart part header names and values before serialization. (#1142)

2.10.0 (August 9th, 2026)

Added

• Add support for running on WebAssembly / Emscripten via Pyodide, using a JavaScript fetch-based transport defined in httpx2-jsfetch. (#1119)
• Add max_event_size to cap SSE event buffering. (#1071)
• Add RFC 9110 status code constants. (#1069)
• Add support for Python 3.15. (#1090)

Changed

• Improve SSE chunk buffering performance. (#1117)
• Skip cookie extraction for responses without Set-Cookie headers. (#1107)
• Return str | None instead of Any from Headers.get. (#1121)

Fixed

... (truncated)

Commits

• 71ae23b Version 2.12.0 (#1147)
• 4fd0c70 Decode compressed response bodies incrementally (#1126)
• d588e52 Use backports.zstd on Python 3.13 and earlier (#1146)
• 344589d Version 2.11.0 (#1143)
• de96d81 Validate multipart part headers (#1142)
• 51c3269 Require brotli 1.2.0 in the brotli extra (#1141)
• 829b93a Respect explicit Transfer-Encoding headers (#1137)
• 4fa6c8e Fix changelog extraction regex for H2 release headings (#1136)
• 8a6f370 Restore deprecated status code aliases (#1135)
• d03f1ec Add public Origin API (#1134)
• Additional commits viewable in compare view

Updates typing-extensions from 4.15.0 to 4.16.0

Release notes

Sourced from typing-extensions's releases.

4.16.0

No changes since 4.16.0rc2.

Changes since 4.15.0:

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
• Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
• Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
• Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
• Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
• Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
• Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
• Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
• Add support for pickling sentinels.
• Sentinels now preserve their identity when copied or deep-copied.
• Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
• The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
• Deprecate arbitrary attribute assignments to sentinels.
• Deprecate subclassing sentinels.
• Add support for Python 3.15.
• Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

4.16.0rc2

Changes since 4.16.0rc1:

• Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

Changes since 4.15.0:

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
• Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
• Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
• Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
• Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
• Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
• Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
• Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
• Add support for pickling sentinels.
• Sentinels now preserve their identity when copied or deep-copied.
• Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
• The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
• Deprecate arbitrary attribute assignments to sentinels.
• Deprecate subclassing sentinels.
• Add support for Python 3.15.

4.16.0rc1

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.

... (truncated)

Changelog

Sourced from typing-extensions's changelog.

Release 4.16.0 (July 2, 2025)

No user-facing changes since 4.16.0rc2.

Release 4.16.0rc2 (June 25, 2026)

• Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

Release 4.16.0rc1 (June 24, 2026)

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
• Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
• Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
• Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
• Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
• Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
• Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
• Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
• Add support for pickling sentinels.
• Sentinels now preserve their identity when copied or deep-copied.
• Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
• The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
• Deprecate arbitrary attribute assignments to sentinels.
• Deprecate subclassing sentinels.
• Add support for Python 3.15.

Commits

• f29cd28 Prepare relase 4.16.0 (#774)
• 4317461 Bump version to 4.16.0rc2.dev (#772)
• 4f71098 Prepare release 4.16.0rc2 (#771)
• 37ed08a Remove use of asyncio.coroutines.iscoroutinefunction() (#769)
• 8dcc559 Improve TypedDict documentation (#770)
• 224f8d5 Post-release followups for 3.16.0rc1 (#767)
• 777de3e Prepare release 4.16.0rc1 (#766)
• 890be90 Type variable tuple variance (#741)
• 0e05458 Pin SQLAlchemy third-party tests to pytest==9.0.3 (#765)
• d277746 docs: add version compatibility table (#733)
• Additional commits viewable in compare view

Updates anyio from 4.12.1 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

• Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
• Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
• Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
• Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
• Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
• Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
• Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
• Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)

4.14.1

• Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
• Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)

4.14.0

• Added support for Python 3.15

• Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)

• Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)

• Added support for custom capacity limiters in async path and file I/O functions and classes

• Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)

• Changed TaskGroup.start_soon() to return a TaskHandle

• Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)

• Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope

• Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)

• Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)

• Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)

• Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:

  • TaskGroup.start_soon()
  • TaskGroup.start()
  • anyio.from_thread.run()

  This reverts an earlier change from v3.7.0 which was made in error. (#1153)

• Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)

• Changed several classes (and their subclasses) to have __slots__ (with __weakref__):

  • anyio.CancelScope

... (truncated)

Commits

• c384f99 Bumped up the version
• dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
• 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
• 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
• be24b04 Relaxed timeouts to fix test flakiness
• 8113506 Fix test flakiness caused by slow callback duration logging
• 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
• 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
• f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
• 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
• Additional commits viewable in compare view

Updates sounddevice from 0.5.3 to 0.5.6

Release notes

Sourced from sounddevice's releases.

python-sounddevice 0.5.6

https://pypi.org/project/sounddevice/0.5.6/

• Fix architecture detection on Windows ARM64

python-sounddevice 0.5.5

https://pypi.org/project/sounddevice/0.5.5/

• Fix bug from previous release

python-sounddevice 0.5.4

https://pypi.org/project/sounddevice/0.5.4/

• provide wheels for ARM64/Windows (WoA)

Changelog

Sourced from sounddevice's changelog.

0.5.6 (2026-08-17):

• Fix architecture detection on Windows ARM64

0.5.5 (2026-01-23):

• Fix bug from previous release__

__ spatialaudio/python-sounddevice#621

0.5.4 (2026-01-21):

• provide wheels for ARM64/Windows (WoA)

Commits

• bd3f0df Release 0.5.6
• 9e55e73 Fix architecture detection on Windows ARM64 (#631)
• e8e7bef Bump actions/setup-python from 6 to 7
• dfa004d GitHub Actions: Upgrade from ubuntu-22.04 to ubuntu-24.04 (#634)
• 950d205 update link
• fd24bd3 Bump actions/checkout from 6 to 7
• 88de286 CI: bump Python versions
• 0f16231 Bump idna from 3.11 to 3.15 in the uv group across 1 directory
• 2634256 Bump urllib3 from 2.6.3 to 2.7.0 in the uv group across 1 directory
• 715d988 Bump actions/download-artifact from 7 to 8
• Additional commits viewable in compare view

Updates botocore from 1.42.97 to 1.43.76

Commits

• 648ecf4 Merge branch 'release-1.43.76'
• 8593448 Bumping version to 1.43.76
• 6285571 Update to latest models
• 4429ee4 Merge branch 'release-1.43.75'
• 10e7b5c Merge branch 'release-1.43.75' into develop
• 9f7ad33 Bumping version to 1.43.75
• dc86db8 Update to latest models
• 4c9ef8d Merge branch 'release-1.43.74'
• eaa56d0 Merge branch 'release-1.43.74' into develop
• 4c5118b Bumping version to 1.43.74
• Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates ruff from 0.14.7 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot

... (truncated)

Commits

• 11c76bf Bump 0.16.4 (#27937)
• d53c8c5 Isolate playground builds from deployment credentials (#27839)
• cab001e Disable uv preview for releases and pre-commit hooks (#27939)
• f8d575f [ty] Clarify writing guidance for human readers (#27912)
• ca45fae Set --preview and --default-index for the uv-lock hook (#27935)
• 4827bf7 Export UV_DEFAULT_INDEX in release.sh (#27934)
• d1087a4 [ty] Handle assignment expressions in string annotations (#27921)
• 680cce4 [ty] Optimize inherited recursive protocol comparisons (#27922)
• 974d3cb Upgrade ecosystem-analyzer and mypy_primer to the latest upstream pins (#27932)
• b169b40 Install cargo tools locked (#27929)
• Additional commits viewable in compare view

Updates inline-snapshot from 0.31.1 to 0.35.4

Release notes

Sourced from inline-snapshot's releases.

0.35.4

Fixed

• Prevented --inline-snapshot=trim from changing snapshots when a test body fails or pytest is limited with -k, a test path, or a test node ID. Skipped tests and fixture teardown errors do not prevent trimming. A message now explains why trimming was disabled when it was requested implicitly. An explicit --inline-snapshot=trim overrides this safeguard.

• Fixed a crash during session finalization when pytest's capture plugin is disabled.

0.35.3

Added

• Added Builder.create_set() for creating set expressions in customization functions.

Fixed

• Fixed set snapshot serialization to be deterministic for partially ordered values such as incomparable frozenset members.

• Fixed a crash when an unknown --inline-snapshot flag is provided, without running report finalization or modifying external snapshot tracking files.

0.35.2

Fixed

• fix passing PYTHONPATH, PYTHONWARNINGS, and PYTHONDONTWRITEBYTECODE while running the test suite.

0.35.1

Fixed

• fix passing PYTEST_DISABLE_PLUGIN_AUTOLOAD and PYTEST_PLUGINS while running the test suite.

0.35.0

Changed

• inline-snapshot now tracks source files that use external() in .inline-snapshot/files_using_external.txt (inside storage-dir) and uses this tracked list to detect and trim unused external snapshots.

• The tool.inline-snapshot.test-dir configuration option is only used as a compatibility fallback when files_using_external.txt does not exist yet.

• Documentation examples now use rich terminal snapshots to show pytest output with colors and formatting.

0.34.2

Fixed

• Fixed snapshot updates when pytest reuses stale assertion-rewrite cache files after a test folder is moved, which could leave cached code objects pointing at the old source path (#369).

0.34.1

Fixed

... (truncated)

Changelog

Sourced from inline-snapshot's changelog.

0.35.4 — 2026-08-11

Fixed

• Prevented --inline-snapshot=trim from changing snapshots when a test body fails or pytest is limited with -k, a test path, or a test node ID. Skipped tests and fixture teardown errors do not prevent trimming. A message now explains why trimming was disabled when it was requested implicitly. An explicit --inline-snapshot=trim overrides this safeguard.

• Fixed a crash during session finalization when pytest's capture plugin is disabled.

0.35.3 — 2026-07-27

Added

• Added Builder.create_set() for creating set expressions in customization functions.

Fixed

• Fixed set snapshot serialization to be deterministic for partially ordered values such as incomparable frozenset members.

• Fixed a crash when an unknown --inline-snapshot flag is provided, without running report finalization or modifying external snapshot tracking files.

0.35.2 — 2026-07-16

Fixed

• fix passing PYTHONPATH, PYTHONWARNINGS, and PYTHONDONTWRITEBYTECODE while running the test suite.

0.35.1 — 2026-07-16

Fixed

• fix passing PYTEST_DISABLE_PLUGIN_AUTOLOAD and PYTEST_PLUGINS while running the test suite.

0.35.0 — 2026-07-15

Changed

• inline-snapshot now tracks source files that use external() in .inline-snapshot/files_using_external.txt (inside storage-dir) and uses this tracked list to detect and trim unused external snapshots.
• The tool.inline-snapshot.test-dir configuration option is only used as a compatibility fallback when files_using_external.txt does not exist yet.

... (truncated)

Commits

• a416e93 ci: action update
• e018414 bump: version 0.35.3 → 0.35.4
• 9f89136 Merge pull request #382 from 15r10nk/fix/trim-only-complete-runs
• f82451b fix: disable trim when pytest deselects tests
• a9e2851 fix: only trim snapshots after complete test runs
• 9cc6975 fix: handle disabled pytest capture plugin (#389)
• e1f02cd chore: sponsor changes (#387)
• 4fcbf9f chore: added openai to the list of my sponsors (#386)
• 6c37407 test: mask parts of the external terminal output (#385)
• 4485eac bump: version 0.35.2 → 0.35.3
• Additional commits viewable in compare view

Updates azure-identity from 1.25.1 to 1.25.3

Commits

• a989ea4 [Identity] Prep patch release
• 7972883 [Identity] Adjust refresh logic (#45496)
• 04764a9 add psscript to convert apiview json files to md (

[openai-sdks]

OkTest Summary

❌ Failed for Python SDK PR #3746.

View OkTest run #33217302262

_{SDK merge (eb16c55b7222) · head (a2ea7c4d0686) · base (1cfa80ab6b4b) · OkTest (2b1bdfd25e98)}

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

34 mixed files remain; 0 existing customizations changed.

Compared 1cfa80ab6b4b → a2ea7c4d0686. Generated baselines verified.

34 existing customizations unchanged

• api.md
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py
• src/openai/init.py
• src/openai/_client.py
• src/openai/resources/audio/transcriptions.py
• src/openai/resources/audio/translations.py
• src/openai/resources/beta/beta.py
• src/openai/resources/beta/responses/responses.py
• src/openai/resources/beta/threads/runs/runs.py
• src/openai/resources/beta/threads/threads.py
• src/openai/resources/chat/completions/completions.py
• src/openai/resources/embeddings.py
• src/openai/resources/files.py
• src/openai/resources/realtime/realtime.py
• src/openai/resources/responses/responses.py
• src/openai/resources/uploads/uploads.py
• src/openai/resources/vector_stores/file_batches.py
• src/openai/resources/vector_stores/files.py
• src/openai/resources/videos.py
• src/openai/resources/webhooks/init.py
• src/openai/resources/webhooks/webhooks.py
• src/openai/types/chat/init.py
• src/openai/types/chat/chat_completion_message_tool_call.py
• src/openai/types/fine_tuning/fine_tuning_job_integration.py
• src/openai/types/responses/init.py
• src/openai/types/responses/response.py
• src/openai/types/responses/response_function_web_search.py
• src/openai/types/responses/response_function_web_search_param.py
• src/openai/types/responses/tool.py
• src/openai/types/responses/tool_param.py
• src/openai/types/webhooks/init.py
• tests/api_resources/test_videos.py

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 33217347015 --repo openai/openai-python \
  --name castiron-custom-code-33217347015-1 --dir /tmp/castiron-custom-code-33217347015-1
git apply --stat /tmp/castiron-custom-code-33217347015-1/custom-code.patch
cat /tmp/castiron-custom-code-33217347015-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 1cfa80ab6b4bd48e3566f05992027b2ff460f2c5 a2ea7c4d06864a19737b121d9ca1823d1c320450
python3 scripts/castiron/custom_code_report.py report \
  --base 1cfa80ab6b4bd48e3566f05992027b2ff460f2c5 \
  --head a2ea7c4d06864a19737b121d9ca1823d1c320450 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-a2ea7c4d0686
cat /tmp/castiron-custom-code-a2ea7c4d0686/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3473ab58ea

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Restore the release-please marker in uv.lock

Restore # x-release-please-version on this version entry. The dependency-locks job in .github/workflows/ci.yml line 65 explicitly asserts that the exact marked line exists; because this update removes the comment, that job fails on every pull request and push before lint or tests can run.

Useful? React with 👍 / 👎.

[jbeckwith-oai]

Requesting changes because this grouped update introduces multiple verified compatibility, CI, and build-supply-chain regressions.

1. HTTPX2 introduces a default 1 MiB SSE event cap. The proposed httpx2==2.12.0 defines DEFAULT_MAX_EVENT_SIZE_BYTES = 1024 * 1024, and both Client.sse() and AsyncClient.sse() use it by default. Upstream's own test_max_event_size_applies_by_default demonstrates that a valid 2 MiB event raises SSEError, despite the original upstream proposal describing this setting as opt-in. This is incompatible with this repository's explicit policy against arbitrary fixed event/payload limits. The OpenAI SDK currently uses its own uncapped decoder, so the confirmed regression is in the upgraded public underlying transport SSE APIs; it must not be hidden by increasing or overriding the limit. Defer this HTTPX2/HTTPCore2 update until the upstream default preserves valid large events. Evidence: https://github.com/pydantic/httpx2/blob/v2.12.0/src/httpx2/httpx2/_config.py#L251 and https://github.com/pydantic/httpx2/blob/v2.12.0/tests/httpx2/test_sse.py#L379-L399.

2. The Hatchling upgrade leaves a new executable build dependency unconstrained. Hatchling 1.32.0 adds tomlkit as a runtime dependency, resolved here to tomlkit==0.15.1, but neither [dependency-groups].build nor [tool.uv].build-constraint-dependencies pins it. This violates the existing explicit, reviewed isolated-build dependency policy. Either defer the Hatchling upgrade or add the identical exact tomlkit==0.15.1 pin to both reviewed build lists and regenerate the lockfile. Evidence: https://github.com/pypa/hatch/releases/tag/hatchling-v1.32.0.

3. Release automation and the dependency-lock check are broken. The editable openai package entry in uv.lock drops the required # x-release-please-version marker. The dependency lock freshness job fails with AssertionError: Preserve the uv.lock release-please marker and project version. Restore the exact marked line after any lock regeneration.

4. The Python support-policy check is broken. pyproject.toml rewrites the existing Bedrock requirement from botocore>=1.40.0,<2 to botocore<2,>=1.40.0. Although semantically equivalent, the repository's deterministic policy check requires the original literal and fails with RuntimeError: Package metadata does not contain the unmarked requirement 'botocore>=1.40.0,<2'. Restore the existing spelling; do not weaken the checker or change the Python floor.

5. The Ruff upgrade fails required CI on unrelated existing code. Ruff 0.14.7 -> 0.16.3 makes detect-breaking-changes report 12 previously clean violations across four unrelated scripts/castiron files. Retain the existing compatible Ruff version; do not expand this dependency PR into unrelated Castiron cleanup or suppressions.

The separate Agents SDK mypy failure is not evidence of a regression from these updated dependency versions: that job checks out an older Agents revision and actually installs httpx2==2.9.1 and typing-extensions==4.14.1. Current Agents main already handles the optional call_id, and current SDK main has removed the stale downstream job. Do not change generated SDK types or public APIs to mask that unrelated failure.

Please separate or defer incompatible upgrades, restore the existing release/Python-policy invariants, preserve reviewed build dependency closure, and rerun lock freshness, build/package metadata, lint, supported Python versions, HTTPX2, and unchanged large-payload regression coverage before requesting approval.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a2ea7c4d06

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the canonical Botocore requirement spelling

Restore this requirement to botocore>=1.40.0,<2. Although the reordered specifiers are semantically equivalent, the python-policy CI job runs scripts/check-python-version-policy.py, which requires that exact metadata string; after the separately reported lock marker is restored, every non-scheduled CI run still fails here with Package metadata does not contain the unmarked requirement 'botocore>=1.40.0,<2'.

Useful? React with 👍 / 👎.