chore(deps): update pyshacl requirement from ~=0.31 to ~=0.40

[dependabot]

Updates the requirements on pyshacl to permit the latest version.

Release notes

Sourced from pyshacl's releases.

2026-07-08 - v0.40.0 - Oxigraph support

Added

Compatibility with Oxigraph stores.

• PySHACL can now validate a graph that is loaded into a PyOxigraph pyoxigraph.Store instance.
• New DataGraph graph abstraction layer that wraps RDFLib Graph/Dataset and, when installed, pyoxigraph.Store.
• Validation and SHACL Rules expansion can use an Oxigraph-backed data graph for faster SPARQL execution.
• Install with the new optional extra: pip install pyshacl[oxigraph].
• Pass a pyoxigraph.Store directly to validate() or shacl_rules().

SHACL Functions and SHACL-JS Functions now register and execute on both RDFLib and Oxigraph SPARQL engines.

• SPARQL constraints can invoke SHACL Functions as SPARQL extension functions when using an Oxigraph-backed data graph.

Python 3.13 support in the test matrix.

• pyduktape2 dependency is now version-split for Python 3.13+.

Changed

Dropped rdflib.ConjunctiveGraph support throughout the codebase. Breaking

• ConjunctiveGraph has been deprecatd in RDFLib for a long time, it will be gone in RDFLib 8. Removing it now from PySHACL to prevent compatibility issues later.
• Multigraph inputs must be an rdflib.Dataset; bare rdflib.Graph remain supported for single-graph use.

Adapted to RDFLib 7.3+ API changes

• default_context has been replaced with default_graph, and contexts() replaced with graphs().
• Resolves #316
• Thanks @​torsknod2

Updated minimum dependency versions:

• rdflib[html]>=7.3.0,<8.0
• owlrl>=7.6.1,<8
• validate_each() now returns a dict keyed by input index (int) instead of by source identifier.
• Internal validation and rules expansion now operate on the DataGraph wrapper rather than raw RDFLib graph objects.
• SPARQL prefix resolution for shapes graphs stored in a Dataset now reads sh:declare blocks from the default graph.
• DASH conformance checking now enumerates named graphs with Dataset.graphs() instead of the deprecated contexts() API.

Fixed

• OWL owl:imports over HTTP no longer leaves closed HTTPResponse objects that trigger finalizer errors during garbage collection.
  • Fixes #319
  • Thanks @​gaoflow

Removed

• Support for rdflib.ConjunctiveGraph as a data graph, shapes graph, or ontology graph input type. Breaking

Changelog

Sourced from pyshacl's changelog.

[0.40.0] - 2026-07-08

Added

• Compatibility with Oxigraph stores.
  • PySHACL can now validate a graph that is loaded into a PyOxigraph pyoxigraph.Store instance.
  • New DataGraph graph abstraction layer that wraps RDFLib Graph/Dataset and, when installed, pyoxigraph.Store.
  • Validation and SHACL Rules expansion can use an Oxigraph-backed data graph for faster SPARQL execution.
  • Install with the new optional extra: pip install pyshacl[oxigraph].
  • Pass a pyoxigraph.Store directly to validate() or shacl_rules().
• SHACL Functions and SHACL-JS Functions now register and execute on both RDFLib and Oxigraph SPARQL engines.
  • SPARQL constraints can invoke SHACL Functions as SPARQL extension functions when using an Oxigraph-backed data graph.
• Python 3.13 support in the test matrix.
  • pyduktape2 dependency is now version-split for Python 3.13+.

Changed

• Dropped rdflib.ConjunctiveGraph support throughout the codebase. Breaking
  • ConjunctiveGraph has been deprecatd in RDFLib for a long time, it will be gone in RDFLib 8. Removing it now from PySHACL to prevent compatibility issues later.
  • Multigraph inputs must be an rdflib.Dataset; bare rdflib.Graph remain supported for single-graph use.
• Adapted to RDFLib 7.3+ API changes: default_context has been replaced with default_graph, and contexts() replaced with graphs().
  • Resolves #316
  • Thanks @​torsknod2
• Updated minimum dependency versions:
  • rdflib[html]>=7.3.0,<8.0
  • owlrl>=7.6.1,<8
• validate_each() now returns a dict keyed by input index (int) instead of by source identifier.
• Internal validation and rules expansion now operate on the DataGraph wrapper rather than raw RDFLib graph objects.
• SPARQL prefix resolution for shapes graphs stored in a Dataset now reads sh:declare blocks from the default graph.
• DASH conformance checking now enumerates named graphs with Dataset.graphs() instead of the deprecated contexts() API.

Fixed

• OWL owl:imports over HTTP no longer leaves closed HTTPResponse objects that trigger finalizer errors during garbage collection.
  • Fixes #319
  • Thanks @​gaoflow

Removed

• Support for rdflib.ConjunctiveGraph as a data graph, shapes graph, or ontology graph input type. Breaking

[0.31.0] - 2026-01-16

Added

• Support for validating multiple target data graphs.
  • Default "combine" mode loads all given data graphs into a single Dataset and validates all at once.
  • New "validate-each" mode validates each data graph independently and returns multiple results.
  • CLI now accepts multiple data graph paths and adds a --validate-each flag.
  • New validate_each() entrypoint for per-graph validation in library code.

Fixed

• SPARQL constraint validation no longer misidentifies VALUES in property paths or predicate names.
  • Fixes #301
• Validation report text output is now deterministic.

... (truncated)

Commits

• 9eeb9bf v0.40.0 release bump
• 68a76a3 Merge pull request #324 from RDFLib/big_updates
• da039d8 Rollup of recent changes, see changelog for details
• f9717d7 Fixed missed wire-up of the max_depth option in the Validator CLI
• a77551d Merge remote-tracking branch 'origin/master' into big_updates
• 1b44988 Remove ConjuntiveGraph usage from rdf loader tool, and switch from default_co...
• 68e07f8 Merge pull request #322 from gaoflow/fix-319-httpresponse-close
• 361f8e7 Fix HTTPResponse cleanup for owl imports
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)