Skip to content

chore(deps)(deps): bump the python-dependencies group with 7 updates - #886

Merged
tschm merged 1 commit into
mainfrom
dependabot/uv/python-dependencies-e39808f391
Jul 14, 2026
Merged

chore(deps)(deps): bump the python-dependencies group with 7 updates#886
tschm merged 1 commit into
mainfrom
dependabot/uv/python-dependencies-e39808f391

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 7 updates:

Package From To
narwhals 2.23.0 2.24.0
plotly 6.8.0 6.9.0
uvicorn 0.50.2 0.51.0
marimo 0.23.13 0.23.14
hypothesis 6.156.1 6.156.6
syrupy 5.5.1 5.5.3
ty 0.0.56 0.0.59

Updates narwhals from 2.23.0 to 2.24.0

Release notes

Sourced from narwhals's releases.

Narwhals v2.24.0

Changes

✨ Enhancements

  • feat: Widen IntoSchema to accept IntoDType values and (name, dtype) pair sequences (#3756)
  • feat: add nw.list (#3694)
  • feat: Support plugin native objects in is_into_* (#3754)
  • feat: stabilize dtype conversion across pandas, pyarrow, and modin test constructors (#3749)

🐞 Bug fixes

  • fix: avoid potential sql injection in sink_parquet (#3783)
  • fix(pyarrow): Adapt for pyarrow v25.0.0 (#3771)
  • fix(ci): sync all dependencies in altair downstream test (#3767)
  • fix: Fix fill_null for Dask with expressions (#3758)
  • fix: avoid potential sql injection for join_asof (#3782)
  • fix assert_equal_data for objects where __eq__ returns non-bool (#3760)

📖 Documentation

  • docs: Add 'AI-assisted contributions' section in CONTRIBUTING.md and PR field (#3701)

🛠️ Other improvements

  • ci: fix lightgbm nightly test (#3786)
  • fix: tighten assert_equal_data (#3772)
  • remove pull requests: write from release-drafter (#3764)
  • use pyrefly coverage check instead of pyright-cov (#3747)
  • chore: prek autoupdate (#3755)
  • ci: Bump release-drafter action (#3748)
  • ci: speed up pyspark connect (#3740)
  • ci: Run pytest actions on uv.lock changes (#3738)

Thank you to all our contributors for making this release possible! @​CangyuanLi, @​EdAbati, @​FBruzzesi, @​MarcoGorelli, @​PraveenKumarSridhar, @​camriddell, @​dangotbanned, @​dependabot[bot], @​github-actions[bot], @​renovate[bot], dependabot[bot], github-actions[bot] and renovate[bot]

Commits
  • 007bbeb release: Bump version to 2.24.0
  • 71de97b ci: fix lightgbm nightly test (#3786)
  • 5b3bb00 fix: tighten assert_equal_data (#3772)
  • 7e72e00 chore(deps): lock file maintenance (#3785)
  • 23af8f6 fix: avoid potential sql injection in sink_parquet (#3783)
  • f44556b fix: avoid potential sql injection for join_asof (#3782)
  • deffd1d chore(deps): lock file maintenance (#3781)
  • 93652c3 chore(deps): lock file maintenance (#3776)
  • 2721975 ci: Remove core, typing dependency group conflict (#3773)
  • dcbbf22 feat: Widen IntoSchema to accept IntoDType values and (name, dtype) pai...
  • Additional commits viewable in compare view

Updates plotly from 6.8.0 to 6.9.0

Release notes

Sourced from plotly's releases.

v6.9.0

Fixed

  • Raise a clear ValueError when an unsupported marginal plot type is passed to Plotly Express, instead of failing later with a cryptic 'NoneType' object has no attribute 'constructor' message [#5625], with thanks to @​eugen-goebel for the contribution!

Updated

  • Update plotly.js from version 3.6.0 to version 3.7.0. See the plotly.js release notes for more information [#5639]. Notable changes include:
    • Rename sendDataToCloud modebar button to sendChartToCloud, and update to upload chart to Plotly Cloud [#7802, #7852, #7854]. NOTE: The Plotly Cloud endpoint for receiving charts is not yet functional, so this button won't complete the upload.
    • Fix stale scattergl error bars after toggling traces with mixed error bar visibility [#7773], with thanks to @​JulienIcon for the contribution!
    • Fix geo fitbounds to choose a compact longitude range when point data straddles the antimeridian [#7837], with thanks to @​SharadhNaidu for the contribution!

Full Changelog: plotly/plotly.py@v6.8.0...v6.9.0

Changelog

Sourced from plotly's changelog.

[6.9.0] - 2026-07-09

Fixed

  • Raise a clear ValueError when an unsupported marginal plot type is passed to Plotly Express, instead of failing later with a cryptic 'NoneType' object has no attribute 'constructor' message [#5625], with thanks to @​eugen-goebel for the contribution!

Updated

  • Update plotly.js from version 3.6.0 to version 3.7.0. See the plotly.js release notes for more information [#5639]. Notable changes include:
    • Rename sendDataToCloud modebar button to sendChartToCloud, and update to upload chart to Plotly Cloud [#7802, #7852, #7854]. NOTE: The Plotly Cloud endpoint for receiving charts is not yet functional, so this button won't complete the upload.
    • Fix stale scattergl error bars after toggling traces with mixed error bar visibility [#7773], with thanks to @​JulienIcon for the contribution!
    • Fix geo fitbounds to choose a compact longitude range when point data straddles the antimeridian [#7837], with thanks to @​SharadhNaidu for the contribution!
Commits
  • 495134a update date
  • 2e824d8 version changes for v6.9.0
  • c27c986 Merge pull request #5639 from plotly/update-plotlyjs-3.7.0
  • 3d63d05 typos
  • fd7e3f1 update commands.py and CONTRIBUTING.md to reflect the fact that JS build arti...
  • 9a753fe update changelog
  • 4ff6656 update built JS artifacts
  • b3facc7 update plotly.js to v3.7.0
  • 5cdb606 Merge pull request #5630 from eugen-goebel/fix-marginal-error-message-spacing
  • 8d47808 Add missing space in unsupported-marginal error message
  • Additional commits viewable in compare view

Updates uvicorn from 0.50.2 to 0.51.0

Release notes

Sourced from uvicorn's releases.

Version 0.51.0

What's Changed

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Changelog

Sourced from uvicorn's changelog.

0.51.0 (July 8, 2026)

Added

  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

  • Remove colorama from the standard extra (#3027)
Commits

Updates marimo from 0.23.13 to 0.23.14

Release notes

Sourced from marimo's releases.

0.23.14

What's Changed

This release brings anywidget composition with hot reload, an experimental debugger with per-line timing, chat AI improvements, and cached WASM exports.

Plus many fixes across charts, tables, and exports.

⭐️ Highlights

Anywidget composition and hot reload

marimo now supports anywidget's new composition API: parent widgets can render child widgets they were handed as values. Widget frontend code also hot-reloads in place as you edit it — live views re-render with widget state intact (#10127).

Read the docs for more on building custom UI plugins.

Debugger and per-line timing

An experimental debugger execution lifecycle adds frame watching to cell execution, highlighting the currently executing line and enabling debug points (#9970).

Screen.Recording.2026-06-23.at.9.53.50.AM.mov

Building on the same machinery, the experimental line_timing flag shows an elapsed-time pill on any line that has been busy for more than ~500ms (#10126).

Chat AI improvements

The AI chat panel picked up several upgrades this release:

  • Web search and fetch — the chat panel can now search and fetch from the web, adapting to your provider's native tools when available (#10052)
  • Errors as chat context — mention @error://all or a single cell's error to attach its source, traceback, and SQL schema as context chips (#10038)
  • "Fix in chat" — cell errors and tracebacks gain an option to route the failing code straight into the sidebar (#10024)
  • Prompt caching — enabled for supported providers (#10052)
Screen.Recording.2026-06-30.at.5.24.02.PM.mov

Read the docs for more on AI features.

Cached WASM exports

marimo export html-wasm --execute now bundles runtime cache into the export, so published notebooks hydrate cell outputs from cache instead of recomputing them in the browser (#9897). This lets you share interactive snapshots of executions that normally can't run in the browser at all (like a jax or torch training run) while the rest of the notebook stays live. Built on a new cell-level cached execution lifecycle, opt-in via [tool.marimo.runtime] cache_cells = true (#9895).

Screen.Recording.2026-07-08.at.4.39.03.PM.mov

Read the docs for more on exporting notebooks.

✨ Enhancements

  • Support anywidget composition and hot reload (#10127)
  • Add signatures to cache bundles to prevent tamper (#10123)
  • Add MARIMO_SESSION_COOKIE_SECURE env var for Secure session cookie (#10117)

... (truncated)

Commits
  • 5087f83 release: 0.23.14 (#10137)
  • 991e906 Fix mounting anywidget CSS in cross-realm roots (#10136)
  • f8be7db feat: experimental line_timing — green active-line highlight + per-line timer...
  • 56d8ec0 Support anywidget composition and hot reload (#10127)
  • 54b1ad9 test: add unit tests for env_to_value (#10133)
  • 0af89ee fix(export): allow WebPDF export on Windows (#10131)
  • 4312250 feat: experimental SSE transport for the kernel connection (MARIMO_SERVER_TRA...
  • 24e9ebd chore: skip flaky test (#10129)
  • 1a9d55f fix: preserve aspect ratio for images with numeric dimensions (#10130)
  • f9b74fc fix(completion): fall back to interpreter completion when jedi static analysi...
  • Additional commits viewable in compare view

Updates hypothesis from 6.156.1 to 6.156.6

Commits
  • 276c391 Bump hypothesis version to 6.156.6 and update changelog
  • c6e2305 Merge pull request #4791 from dylan-bakr/strip-auth-on-redirect
  • 988999a use add_unredirected_header instead
  • e8458dd Bump hypothesis version to 6.156.5 and update changelog
  • db2968a Merge pull request #4794 from Liam-DeVoe/publish-x86-wheels
  • a4d3a6d build 32bit wheels for windows and linux
  • 8683661 Bump hypothesis version to 6.156.4 and update changelog
  • d55de5a Merge pull request #4793 from Liam-DeVoe/abi3-wheels
  • 81be9b1 Merge pull request #4792 from HypothesisWorks/fix-version-import
  • 503f86d ship abi3 wheels
  • Additional commits viewable in compare view

Updates syrupy from 5.5.1 to 5.5.3

Release notes

Sourced from syrupy's releases.

v5.5.3

What's Changed

This release has no functional changes. It just fixes an issue where the release tag pointed to the previous commit instead of the commit with the updated pyproject.toml (see syrupy-project/syrupy#1144).

Full Changelog: syrupy-project/syrupy@v5.5.2...v5.5.3

v5.5.2

What's Changed

New Contributors

Full Changelog: syrupy-project/syrupy@v5.5.1...v5.5.2

Changelog

Sourced from syrupy's changelog.

v5.5.3 (2026-07-11)

What's Changed

Full Changelog: syrupy-project/syrupy@v5.5.2...v5.5.3

v5.5.2 (2026-07-08)

What's Changed

New Contributors

Full Changelog: syrupy-project/syrupy@v5.5.1...v5.5.2

Commits
  • 3cd3473 chore(release): 5.5.3 [skip ci]
  • fed7e9f chore(deps): update astral-sh/setup-uv action to v8.3.2 (#1149)
  • 443fc11 chore: closes #1144 (#1146)
  • 56bf157 chore(deps): update dependency hypothesis to v6.156.3 (#1150)
  • f9c725a chore(deps): update dependency mypy to v2.2.0 (#1148)
  • 3af2ccf chore(deps): update dependency hypothesis to v6.156.2 (#1147)
  • feaa22c chore(deps): update astral-sh/setup-uv action to v8.3.1 (#1145)
  • 5c59701 chore(deps): update astral-sh/setup-uv action to v8.3.0 (#1143)
  • 1cbf716 chore(release): 5.5.2 [skip ci]
  • 4f83490 fix: Fix detecting pytest-xdist when loaded via PYTEST_PLUGINS (#1142)
  • Additional commits viewable in compare view

Updates ty from 0.0.56 to 0.0.59

Release notes

Sourced from ty's releases.

0.0.59

Release Notes

Released on 2026-07-12.

Bug fixes

  • Guard descriptor classification cycles (#26690)
  • Respect init=False in dataclass field-order checks (#26749)
  • Avoid duplicate diagnostics for overloaded TypeIs (#26716)

Library support

  • Pydantic: Support custom __init__ methods (#26699)
  • Pydantic: Support field metadata in Annotated (#26650)

Core type checking

  • Allow unsound equality-based narrowing for builtins (#26414)
  • Bind Self in implicit dunder calls (#26711)
  • Correct protocol method receiver binding (#26701)
  • Exempt ParamSpec callables from the dunder descriptor heuristic (#26696)
  • Remove transitive TypeVar artifacts during collection inference (#26714)

LSP server

  • Avoid broad invalidation from file check eligibility (#26741)
  • Correct how we expand tabs in docstrings (#26679)
  • Resolve ambiguity in Google-style docstring parsing in favour of observations from popular projects (#26673)

CLI

  • Avoid allocation for every stdout write (#26698)
  • Buffer diagnostic output (#26702)

Performance

  • Cache generic context (#26745)
  • Cache known class instances (#26746)
  • Reuse common TypedDict constraints through intersections (#26747)
  • Use purpose-specific types for completion and module text (#26664)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.59

Released on 2026-07-12.

Bug fixes

  • Guard descriptor classification cycles (#26690)
  • Respect init=False in dataclass field-order checks (#26749)
  • Avoid duplicate diagnostics for overloaded TypeIs (#26716)

Library support

  • Pydantic: Support custom __init__ methods (#26699)
  • Pydantic: Support field metadata in Annotated (#26650)

Core type checking

  • Allow unsound equality-based narrowing for builtins (#26414)
  • Bind Self in implicit dunder calls (#26711)
  • Correct protocol method receiver binding (#26701)
  • Exempt ParamSpec callables from the dunder descriptor heuristic (#26696)
  • Remove transitive TypeVar artifacts during collection inference (#26714)

LSP server

  • Avoid broad invalidation from file check eligibility (#26741)
  • Correct how we expand tabs in docstrings (#26679)
  • Resolve ambiguity in Google-style docstring parsing in favour of observations from popular projects (#26673)

CLI

  • Avoid allocation for every stdout write (#26698)
  • Buffer diagnostic output (#26702)

Performance

  • Cache generic context (#26745)
  • Cache known class instances (#26746)
  • Reuse common TypedDict constraints through intersections (#26747)
  • Use purpose-specific types for completion and module text (#26664)

Contributors

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): bump the python-dependencies group with 7 updates
cb4007a 
Bumps the python-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.23.0` | `2.24.0` |
| [plotly](https://github.com/plotly/plotly.py) | `6.8.0` | `6.9.0` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.50.2` | `0.51.0` |
| [marimo](https://github.com/marimo-team/marimo) | `0.23.13` | `0.23.14` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.156.1` | `6.156.6` |
| [syrupy](https://github.com/syrupy-project/syrupy) | `5.5.1` | `5.5.3` |
| [ty](https://github.com/astral-sh/ty) | `0.0.56` | `0.0.59` |


Updates `narwhals` from 2.23.0 to 2.24.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](narwhals-dev/narwhals@v2.23.0...v2.24.0)

Updates `plotly` from 6.8.0 to 6.9.0
- [Release notes](https://github.com/plotly/plotly.py/releases)
- [Changelog](https://github.com/plotly/plotly.py/blob/main/CHANGELOG.md)
- [Commits](plotly/plotly.py@v6.8.0...v6.9.0)

Updates `uvicorn` from 0.50.2 to 0.51.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.50.2...0.51.0)

Updates `marimo` from 0.23.13 to 0.23.14
- [Release notes](https://github.com/marimo-team/marimo/releases)
- [Commits](marimo-team/marimo@0.23.13...0.23.14)

Updates `hypothesis` from 6.156.1 to 6.156.6
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.156.1...v6.156.6)

Updates `syrupy` from 5.5.1 to 5.5.3
- [Release notes](https://github.com/syrupy-project/syrupy/releases)
- [Changelog](https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md)
- [Commits](syrupy-project/syrupy@v5.5.1...v5.5.3)

Updates `ty` from 0.0.56 to 0.0.59
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.56...0.0.59)

---
updated-dependencies:
- dependency-name: narwhals
  dependency-version: 2.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: plotly
  dependency-version: 6.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: uvicorn
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: marimo
  dependency-version: 0.23.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: hypothesis
  dependency-version: 6.156.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: syrupy
  dependency-version: 5.5.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: ty
  dependency-version: 0.0.59
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from tschm as a code owner July 14, 2026 05:10
@tschm
tschm merged commit b3fda38 into main Jul 14, 2026
66 checks passed
@tschm
tschm deleted the dependabot/uv/python-dependencies-e39808f391 branch July 14, 2026 05:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tschm tschm Awaiting requested review from tschm tschm is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tschm