Skip to content

chore(deps): Bump the python group with 10 updates - #236

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-ac5f541778
Closed

chore(deps): Bump the python group with 10 updates#236
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-ac5f541778

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on pydantic[email], nh3, pyjwt[crypto], ruff, mypy, types-requests, hypothesis, numpy, geopandas and pyogrio to permit the latest version.
Updates pydantic[email] to 2.13.4

Release notes

Sourced from pydantic[email]'s releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

Fixes

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

Changelog

Sourced from pydantic[email]'s changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

Fixes

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

  • Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

GitHub release

What's Changed

Fixes

v2.13.0 (2026-04-13)

GitHub release

The highlights of the v2.13 release are available in the blog post.

... (truncated)

Commits
  • cf67d4b Fix linting
  • f0d8a21 Prepare release v2.13.4
  • 5e3fe1d Check for pydantic tag pattern in CI
  • 7f9edcc Document tagging conventions
  • b46a0c9 Adapt pydantic-core linker flags on macOS
  • 50629c8 Update to PyPy 7.3.22
  • 8522ebb Preserve RootModel core metadata
  • a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
  • 909259a Remove Logfire example in documentation
  • 2c4174c Bump libc from 0.2.155 to 0.2.185
  • Additional commits viewable in compare view

Updates nh3 from 0.3.5 to 0.3.6

Release notes

Sourced from nh3's releases.

v0.3.6

What's Changed

Full Changelog: messense/nh3@v0.3.5...v0.3.6

Commits
  • bea70df Bump version to 0.3.6
  • 788cee2 Expose ammonia's url_relative policy via url_relative kwarg (#131)
  • e76a81a Bump pyo3 from 0.28.3 to 0.29.0 (#130)
  • 8ec45a3 Add nh3.escape alias for clean_text (#127)
  • a1e0226 Document tag_attribute_values as alternate to attributes (#126)
  • 389fb79 Validate clean_content_tags conflict with tags (#125)
  • 61aad5a Bump uraimo/run-on-arch-action in the github-actions group (#124)
  • See full diff in compare view

Updates pyjwt[crypto] to 2.13.0

Release notes

Sourced from pyjwt[crypto]'s releases.

2.13.0

PyJWT 2.13.0 — Security Release

This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.

Security

  • GHSA-xgmm-8j9v-c9wx — JWK JSON accepted as HMAC secret (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by @​aradona91.

  • GHSA-jq35-7prp-9v3f — Algorithm allow-list bypass with PyJWK / PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…] allow-list was checked against the token header alg as a string only; actual verification used the algorithm bound to the PyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header alg to match the PyJWK's algorithm before verification. Reported by @​sushi-gif.

  • GHSA-w7vc-732c-9m39 — DoS via base64 decode of unused payload segment when b64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied detached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by @​thesmartshadow.

  • GHSA-993g-76c3-p5m4 — PyJWKClient accepts non-HTTP(S) URIs. PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which by default also handles file://, ftp://, and data: schemes. An application that fed an attacker-influenced URI into PyJWKClient could be coerced into reading local files or reaching other unintended schemes. PyJWKClient now rejects any URI whose scheme isn't http or https. Reported by @​KEIJOT.

  • GHSA-fhv5-28vv-h8m8 — PyJWKClient cache wiped on fetch error. A finally-block put(jwk_set=None) cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by @​eddieran.

Fixed

  • Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with InvalidKeyError instead of accepting them with only a warning. Defends against the os.getenv("JWT_SECRET", "") footgun. Thanks to @​SnailSploit and @​spartan8806 for the reports.
  • Forward per-call options (including enforce_minimum_key_length) from PyJWT.decode through to PyJWS._verify_signature. The option was previously silently dropped between the two layers, so it only took effect when set on the PyJWT instance. Thanks to @​WLUB for the report.
  • RFC 7797 §3 compliance for b64=false: the encoder now auto-adds "b64" to crit, and the decoder rejects tokens that set b64=false without listing it in crit. Thanks to @​MachineLearning-Nerd for the report.

Changed

  • Migrate the dev, docs, and tests package extras to dependency groups, by @​kurtmckee in #1152.

Upgrade notes

Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:

  • Empty HMAC keys now raise. If your app passed "" or b"" as a secret (often via a missing env var, e.g. os.getenv("JWT_SECRET", "")), encode/decode will now raise InvalidKeyError. This is the intended behavior — fix the configuration.
  • PyJWK decoding now requires the token's alg to match the JWK's algorithm. Previously a mismatch was silently honored if the header alg appeared in the allow-list. Tokens that relied on this mismatch will now fail with InvalidAlgorithmError.
  • PyJWKClient now rejects non-HTTP(S) URIs at construction time. Tests or dev environments that fetched JWKS from file:// URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct PyJWKSet.from_dict(...) directly).
  • b64=false tokens are now strictly RFC 7515 / 7797 compliant. Tokens with a non-empty compact-form payload segment, or that omit "b64" from crit, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.
  • enforce_minimum_key_length set per-call now takes effect. Callers who passed options={"enforce_minimum_key_length": True} to jwt.decode() previously got no enforcement; they will now get InvalidKeyError on undersized keys, as documented.

Full changelog: jpadilla/pyjwt@2.12.1...2.13.0

Changelog

Sourced from pyjwt[crypto]'s changelog.

v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>__

Security


- Reject JWK JSON documents passed as raw HMAC secrets in
  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that
  the existing PEM/SSH guard did not cover. Reported by @aradona91 in
  `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__.
- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during
  verification so the caller's ``algorithms=[...]`` allow-list cannot be
  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported
  by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__.
- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-
  influenced URIs cannot read local files or reach unintended schemes via
  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported
  by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__.
- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.
  The previous ``finally``-block ``put(None)`` pattern cleared the cache
  on any transient outage, turning one bad JWKS request into application-
  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__.
- Skip the unconditional base64 decode of the compact-form payload segment
  when ``b64=false`` is set in the protected header, and require that
  segment to be empty (RFC 7515 Appendix F detached form). Closes an
  unauthenticated DoS amplifier. Reported by @thesmartshadow in
  `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__.

Fixed



- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``&quot;b64&quot;`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.

Changed




    

  • Migrate the dev, docs, and tests package extras to dependency groups by @​kurtmckee in [#1152](https://github.com/jpadilla/pyjwt/issues/1152) &lt;https://github.com/jpadilla/pyjwt/pull/1152&gt;__
    • 



v2.12.1 &lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1&gt;__
</tr></table>

... (truncated)

Commits
  • 7144e45 Apply ruff format
  • d2f4bec Restore cast() calls with cross-version type: ignore for prepare_key
  • 22f478c Remove redundant casts in RSAAlgorithm.prepare_key and `ECAlgorithm.prepare...
  • 95791b1 Bundle security fixes and hardening into 2.13.0
  • dcc27a9 [pre-commit.ci] pre-commit autoupdate (#1155)
  • 9d08a9a [pre-commit.ci] pre-commit autoupdate (#1146)
  • b87c100 Bump codecov/codecov-action from 5 to 6 (#1154)
  • 40e3147 Migrate development extras to dependency groups (#1152)
  • a4e1a3d Add typing_extensions dependency for Python < 3.11 (#1151)
  • bd9700c Use PyJWK algorithm when encoding without explicit algorithm (#1148)
  • Additional commits viewable in compare view

Updates ruff from 0.15.18 to 0.15.21

Release notes

Sourced from ruff's releases.

0.15.21

Release Notes

Released on 2026-07-09.

Preview features

  • Add --add-ignore for adding ruff:ignore comments (#26346)
  • [flake8-comprehensions] Drop C409 tuple comprehension preview behavior (#25707)
  • Avoid whitespace normalization when formatting comments (#26455)
  • [pyupgrade] Lint and fix use of deprecated abc decorators (UP051) (#26417)

Bug fixes

  • Refine non-empty f-string detection (#26526)
  • Detect syntax errors in individual notebook cells (#26419)
  • [flake8-implicit-str-concat] Fix ISC003 autofix incorrectly stripping + from comments (#26554)

Rule changes

  • [flake8-executable] Mark EXE004 fix as unsafe (#26033)
  • [flake8-pyi] Mark PYI061 fixes as unsafe in Python files (#26533)
  • [pydocstyle] Skip overload-with-docstring in stub files (D418) (#26318)

Performance

  • Avoid per-token source index visitor calls (#26506)
  • Cache parenthesized expression boundaries in the formatter (#26344)
  • Improve performance of rendering edits in preview mode (#26565)
  • Inline fits_element in formatter (#26429)
  • Inline formatter printing hot paths (#26504)
  • Lazily create builtin bindings (#26510)
  • Skip empty trivia scans in the source indexer (#26507)
  • Use ICF for macOS release builds (#25780)

Formatter

  • Add --extend-exclude to ruff format (#26372)

Documentation

  • Add "How does Ruff's import sorting compare to isort?" link to README (#26530)
  • Fix Mozilla Firefox repository link in README (#26537)
  • [flake8-bandit] Fix misleading docstring for mako-templates (S702) (#26432)
  • [ruff] Fix non-triggering example for if-key-in-dict-del (RUF051) (#26433)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.21

Released on 2026-07-09.

Preview features

  • Add --add-ignore for adding ruff:ignore comments (#26346)
  • [flake8-comprehensions] Drop C409 tuple comprehension preview behavior (#25707)
  • Avoid whitespace normalization when formatting comments (#26455)
  • [pyupgrade] Lint and fix use of deprecated abc decorators (UP051) (#26417)

Bug fixes

  • Refine non-empty f-string detection (#26526)
  • Detect syntax errors in individual notebook cells (#26419)
  • [flake8-implicit-str-concat] Fix ISC003 autofix incorrectly stripping + from comments (#26554)

Rule changes

  • [flake8-executable] Mark EXE004 fix as unsafe (#26033)
  • [flake8-pyi] Mark PYI061 fixes as unsafe in Python files (#26533)
  • [pydocstyle] Skip overload-with-docstring in stub files (D418) (#26318)

Performance

  • Avoid per-token source index visitor calls (#26506)
  • Cache parenthesized expression boundaries in the formatter (#26344)
  • Improve performance of rendering edits in preview mode (#26565)
  • Inline fits_element in formatter (#26429)
  • Inline formatter printing hot paths (#26504)
  • Lazily create builtin bindings (#26510)
  • Skip empty trivia scans in the source indexer (#26507)
  • Use ICF for macOS release builds (#25780)

Formatter

  • Add --extend-exclude to ruff format (#26372)

Documentation

  • Add "How does Ruff's import sorting compare to isort?" link to README (#26530)
  • Fix Mozilla Firefox repository link in README (#26537)
  • [flake8-bandit] Fix misleading docstring for mako-templates (S702) (#26432)
  • [ruff] Fix non-triggering example for if-key-in-dict-del (RUF051) (#26433)

Contributors

... (truncated)

Commits

Updates mypy from 2.1.0 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

  • Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
  • Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
  • Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
  • Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
  • Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits
  • 8aabf84 Drop +dev from version
  • 4d8ad2a Update changelog for 2.3 release (#21728)
  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
  • 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
  • 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
  • 24c237d [mypyc] Improve documentation of Final (#21713)
  • b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
  • cbcb51a Narrow for frozendict membership check (#21709)
  • af2bc0f Sync typeshed (#21707)
  • Additional commits viewable in compare view

Updates types-requests from 2.33.0.20260518 to 2.33.0.20260712

Commits

Updates hypothesis from 6.155.7 to 6.156.6

Commits
  • 276c391 Bump hypothesis version to 6.156.6 and update changelog
  • c6e2305 Merge pull request #4791 from dylan-bakr/strip-auth-on-redirect
  • 988999a use add_unredirected_header instead
  • e8458dd Bump hypothesis version to 6.156.5 and update changelog
  • db2968a Merge pull request #4794 from Liam-DeVoe/publish-x86-wheels
  • a4d3a6d build 32bit wheels for windows and linux
  • 8683661 Bump hypothesis version to 6.156.4 and update changelog
  • d55de5a Merge pull request #4793 from Liam-DeVoe/abi3-wheels
  • 81be9b1 Merge pull request #4792 from HypothesisWorks/fix-version-import
  • 503f86d ship abi3 wheels
  • Additional commits viewable in compare view

Updates numpy from 2.4.6 to 2.5.1

Release notes

Sourced from numpy's releases.

v2.5.1 (July 4, 2026)

NumPy 2.5.1 Release Notes

The NumPy 2.5.1 is a patch release that fixes bugs discovered after the 2.5.0 release. The most noticeable is the fix is to the numpy datetime cython API which should allow downstream to support NumPy versions older than 2.5. Preparation for Python 3.15 continues along with typing improvements.

This release supports Python versions 3.12-3.14

Changes

  • The minimum supported GCC version has been updated from 9.3.0 to 10.3.0

    (gh-31843)

Contributors

A total of 10 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Adhyan Gupta +
  • Ankit Ahlawat
  • Charles Harris
  • Iason Krommydas
  • Joren Hammudoglu
  • Kumar Aditya
  • Nathan Goldbaum
  • Sebastian Berg
  • Ties Jan Hefting +
  • Vineet Kumar

Pull requests merged

A total of 20 pull requests were merged for this release.

  • #31707: MAINT: Prepare 2.5.x for further development
  • #31721: CI: fix new cython-lint errors (#31711)
  • #31723: MAINT: Update meson to match main
  • #31729: TST: use setup-sde instead of curl to get SDE binaries (#31727)
  • #31829: BUG: Relax finfo to be easier accessible for all user dtypes...
  • #31831: TYP: Fix flatiter.__next__ return type for object_ and...
  • #31832: BUG: avoid deadlocks using NpyString API (#31682)
  • #31833: BUG: fix out array leak in reduceat and accumulate when dtype...
  • #31835: BUG: fix numpy datetime cython APIs to be compatible with older...
  • #31836: TYP: Fix incorrect dtype inference of asarray([]) (#31732)
  • #31837: TYP: Fix np.ma.masked_array 2.5.0 regression
  • #31838: FIX: Refactor error handling in array_setstate to prevent typecode...
  • #31839: TST: xfail multithreaded BLAS test more generously
  • #31840: MAINT: Rename subroutine for crackfortran tests

... (truncated)

Commits
  • 5e1d03f Merge pull request #31863 from charris/prepare-2.5.1
  • ad0b66b REL: Prepare for the NumPy 2.5.1 release.
  • 9df8516 Merge pull request #31858 from charris/backport-31688
  • 4dee265 Merge pull request #31857 from charris/backport-31775
  • dc8d553 Merge pull request #31856 from charris/backport-31846
  • 67cb4a8 fix:Signed integer overflow in datetime.c (#31688)
  • baa2589 TST: Clean up imports, formatting, and assertions
  • 2fe5ba4 TEST: Refactor tests to use np.testing.assert_raises_regex per review
  • bb46581 MAINT: Remove deprecated Python recursion fix
  • 8f34214 MAINT: Move SeedSequence recursion guard to C-layer and add tests
  • Additional commits viewable in compare view

Updates geopandas from 1.1.3 to 1.1.4

Release notes

Sourced from geopandas's releases.

Version 1.1.4

What's Changed

Bug fixes:

  • Further hardening of to_postgis against SQL injection (#3800).
  • Ensure that points generated by sample_points are not sorted along x-axis (#3773).
  • Fix GeoDataFrame.explore() ignoring custom legend_kwds={"labels": ...} for categorical and boolean columns (#3496).
  • More graceful handling of keep_geom_type in the overlay() function with empty input (#3745).

Full Changelog: geopandas/geopandas@v1.1.3...v1.1.4

Changelog

Sourced from geopandas's changelog.

Version 1.1.4 (June 26, 2026)

Bug fixes:

  • Further hardening of to_postgis against SQL injection (#3800).
  • Ensure that points generated by sample_points are not sorted along x-axis (#3773).
  • Fix GeoDataFrame.explore() ignoring custom legend_kwds={"labels": ...} for categorical and boolean columns (#3496).
  • More graceful handling of keep_geom_type in the overlay() function with empty input (#3745).
Commits
  • 91ec4af RLS: v1.1.4
  • b5d685f DOC: add changelog for 1.1.4
  • 158d993 BUG: further to_postgis hardening (#3800)
  • ce95930 BUG: honor legend_kwds["labels"] for categorical and boolean columns in explo...
  • 22bf845 BUG: overlay with empty input handles keep geom dtype gracefully (#3745)
  • 866a7f0 BUG: ensure that points from random sampling are not sorted (#3773)
  • 76b16ca DOC: update Code of Conduct reporting form link (#3794)
  • 3a04a5c switch to NumFOCUS Code of Conduct (#3671)
  • 6fedb19 BLD: setuptools 77+ required for PEP 639 support (#3746)
  • See full diff in compare view

Updates pyogrio from 0.12.1 to 0.13.0

Release notes

Sourced from pyogrio's releases.

Version v0.13.0

Improvements

  • Support reading Time type columns by default (was already supported with use_arrow=False) (#617).
  • Add list_drivers_details() function to list the available drivers with more detailed properties like the long driver names, whether read/append/write is supported by the driver, the help topic URL, etc (#656).
  • Add whether append is supported in list_drivers (#559)
  • Add vsi_curl_clear_cache() function to allow users to clear the local GDAL vsi cache associated with /vsicurl/ (and related file systems) (#605).
  • Improve performance of read_dataframe (especially if a filter is used) and write_dataframe without Arrow (#577, #674).
  • Unlock the GIL during GDAL functions that can take significant time to improve performance when multithreading (#572).

Bug fixes

  • Fix error in write_dataframe with use_arrow=False when writing an object-type column with datetimes without any time zone offsets or with a mix of offsets and no offsets (#634).
  • Fix writing non-string object columns with arrow (#630).
  • Fix writing empty string category columns with arrow fails (#621).
  • Fix overwriting a corrupt fileGDB directory (#600).
  • Fix attribute data being incorrectly written with KML driver (#650).

Packaging

  • The GDAL library included in the wheels is upgraded from 3.11.4 to 3.12.4 (#658).
  • The wheels for Python 3.11+ are now distributed on PyPI as a single ABI3 wheel per platform (#660).
Changelog

Sourced from pyogrio's changelog.

0.13.0 (2026-06-26)

Improvements

  • Support reading Time type columns by default (was already supported with use_arrow=False) (#617).
  • Add list_drivers_details() function to list the available drivers with more detailed properties like the long driver names, whether read/append/write is supported by the driver, the help topic URL, etc (#656).
  • Add whether append is supported in list_drivers (#559)
  • Add vsi_curl_clear_cache() function to allow users to clear the local GDAL vsi cache associated with /vsicurl/ (and related file systems) (#605).
  • Improve performance of read_dataframe (especially if a filter is used) and write_dataframe without Arrow (#577, #674).
  • Unlock the GIL during GDAL functions that can take significant time to improve performance when multithreading (#572).

Bug fixes

  • Fix error in write_dataframe with use_arrow=False when writing an object-type column with datetimes without any time zone offsets or with a mix of offsets and no offsets (#634).
  • Fix writing non-string object columns with arrow (#630).
  • Fix writing empty string category columns with arrow fails (#621).
  • Fix overwriting a corrupt fileGDB directory (#600).
  • Fix attribute data being incorrectly written with KML driver (#650).

Packaging

  • The GDAL library included in the wheels is upgraded from 3.11.4 to 3.12.4 (#658).
  • The wheels for Python 3.11+ are now distributed on PyPI as a single ABI3 wheel per platform (#660).
Commits
  • d5ce9ca RLS: v0.13.0
  • 84624c0 TST: adjust test_write_read_datetime_tz_offsets_None for pandas bug (#677)
  • eb85372 ENH: add list_drivers_details function (#656)
  • 0847a9a BUG: fix error writing a column with mix of datetimes with and without timezo...
  • 21524a6 DOC/RLS: update 0.13 changelog (#675)
  • a464882 CI: force to use latest GDAL in nightly CI (#676)
  • 97945d1 BLD: use Limited C API for building abi3 wheels (#661)
  • 7d8423c ENH: add whether append is supported in list_drivers (#559)
  • 10d5bd8 PERF: use lists instead of memoryview for short lists of field types and indi...
  • 1c62bb4 Bump actions/checkout from 6 to 7 (#673)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the python group with 10 updates
f72c601 
Updates the requirements on [pydantic[email]](https://github.com/pydantic/pydantic), [nh3](https://github.com/messense/nh3), [pyjwt[crypto]](https://github.com/jpadilla/pyjwt), [ruff](https://github.com/astral-sh/ruff), [mypy](https://github.com/python/mypy), [types-requests](https://github.com/python/typeshed), [hypothesis](https://github.com/HypothesisWorks/hypothesis), [numpy](https://github.com/numpy/numpy), [geopandas](https://github.com/geopandas/geopandas) and [pyogrio](https://github.com/geopandas/pyogrio) to permit the latest version.

Updates `pydantic[email]` to 2.13.4
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.7.0...v2.13.4)

Updates `nh3` from 0.3.5 to 0.3.6
- [Release notes](https://github.com/messense/nh3/releases)
- [Commits](messense/nh3@v0.3.5...v0.3.6)

Updates `pyjwt[crypto]` to 2.13.0
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.10.0...2.13.0)

Updates `ruff` from 0.15.18 to 0.15.21
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.18...0.15.21)

Updates `mypy` from 2.1.0 to 2.3.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.1.0...v2.3.0)

Updates `types-requests` from 2.33.0.20260518 to 2.33.0.20260712
- [Commits](https://github.com/python/typeshed/commits)

Updates `hypothesis` from 6.155.7 to 6.156.6
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.155.7...v6.156.6)

Updates `numpy` from 2.4.6 to 2.5.1
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.4.6...v2.5.1)

Updates `geopandas` from 1.1.3 to 1.1.4
- [Release notes](https://github.com/geopandas/geopandas/releases)
- [Changelog](https://github.com/geopandas/geopandas/blob/v1.1.4/CHANGELOG.md)
- [Commits](geopandas/geopandas@v1.1.3...v1.1.4)

Updates `pyogrio` from 0.12.1 to 0.13.0
- [Release notes](https://github.com/geopandas/pyogrio/releases)
- [Changelog](https://github.com/geopandas/pyogrio/blob/main/CHANGES.md)
- [Commits](geopandas/pyogrio@v0.12.1...v0.13.0)

---
updated-dependencies:
- dependency-name: pydantic[email]
  dependency-version: 2.13.4
  dependency-type: direct:production
  dependency-group: python
- dependency-name: nh3
  dependency-version: 0.3.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: pyjwt[crypto]
  dependency-version: 2.13.0
  dependency-type: direct:production
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.15.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: types-requests
  dependency-version: 2.33.0.20260712
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: hypothesis
  dependency-version: 6.156.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: numpy
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: geopandas
  dependency-version: 1.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: pyogrio
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 15, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 1, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python-ac5f541778 branch August 1, 2026 08:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants