Bump the python-dependencies group across 1 directory with 27 updates

[dependabot]

Bumps the python-dependencies group with 27 updates in the / directory:

Package	From	To
bleak	2.0.0	3.0.2
customtkinter	5.2.2	6.0.0
fit-tool	0.9.15	0.9.16
keyring	25.6.0	25.7.0
requests	2.33.0	2.34.2
ruff	0.15.21	0.16.5
mypy	2.2.0	2.3.1
types-requests	2.32.4.20250913	2.33.0.20260712
types-setuptools	80.9.0.20250822	84.0.0.20260812
pyinstaller	6.21.0	6.22.2
pyinstaller-hooks-contrib	2026.6	2026.7
ast-serialize	0.6.0	0.8.0
bitstruct	8.22.1	8.23.0
certifi	2026.6.17	2026.7.22
cffi	2.1.0	2.1.1
charset-normalizer	3.4.9	3.5.1
cryptography	49.0.0	50.0.1
idna	3.18	3.19
jaraco-functools	4.5.0	4.6.0
librt	0.13.0	0.15.0
packaging	26.2	26.3
pygments	2.20.0	2.21.0
pyobjc-core	12.2.1	12.2.2
pyobjc-framework-cocoa	12.2.1	12.2.2
pyobjc-framework-corebluetooth	12.2.1	12.2.2
pyobjc-framework-libdispatch	12.2.1	12.2.2
setuptools	83.0.0	84.0.0

Updates bleak from 2.0.0 to 3.0.2

Release notes

Sourced from bleak's releases.

v3.0.2

Changed

• Changed default value of BlueZNotifyArgs.use_start_notify to True. Fixes #1951.

v3.0.1

Fixed

• Fixed AttributeError in start_notify() and stop_notify() on Android. Fixes #1834.

v3.0.0

Migration guide

There are only some small breaking changes, so hopefully most users can upgrade without any changes.

The exception is if your project is handling OS-specific exceptions on the GATT read and write methods. These exceptions are now wrapped in BleakGATTProtocolError to have a consistent cross-platform exception. If you need to support multiple versions of Bleak, you can catch both exceptions.

For example, if you caught BleakDBusError and parsed the string to get the GATT error, you can now catch BleakGATTProtocolError instead and it has a code property to get the actual error code.

Another change of note is the deprecation of the adapter keyword argument. We know there are lots of users of this, so we intend to have a long deprecation cycle for this (several years). If you need to support multiple versions of Bleak, you can pass both the old kwarg adapter="hci0" and the new bluez={"adapter": "hci0"} and optionally suppress the deprecation warning. Otherwise, you can just replace the old arg with the new arg as seen in the previous example.

Changelog

Added

• Added adapter attribute to bleak.args.bluez.BlueZClientArgs and bleak.args.bluez.BlueZScannerArgs.
• Added bluez keyword argument to BleakClient.
• Added new bleak.args.bluez.BlueZClientArgs class.
• Added bleak.exc.BleakGATTProtocolError and bleak.exc.BleakGATTProtocolErrorCode classes.
• Added type hints and documentation for use_cached kwarg for read_gatt_char() and read_gatt_descriptor() methods in BleakClient.
• Added support for "use_cached" kwarg to read_gatt_char() and read_gatt_descriptor() methods in BlueZ backend.

Changed

• Deprecated adapter keyword argument in BleakScanner and BleakClient.
• Changed GATT read and write methods to raise BleakGATTProtocolError when a GATT protocol error occurs.
• Changed start/stop scanning on CoreBluetooth so that the isScanning property is not checked anymore.
• Changed BleakClient.write_gatt_descriptor() to raise ValueError when attempting to write to the descriptor 0x2902 (Client Characteristic Configuration Descriptor, CCCD). Use start_notify() and stop_notify() instead.

Fixed

• Fixed occasional EOFError when disconnecting in BlueZ backend. Fixes #1921.
• Fixed a potential deadlock when turning off Bluetooth manually while starting scanning on CoreBluetooth.
• Fixed reading descriptors 0x2900, 0x2902 and 0x2903 on CoreBluetooth backend.
• Fixed cyclic references problem in CoreBluetooth backend causing memory leaks.
• Fixed typehint for BleakScanner.__aexit__().

... (truncated)

Changelog

Sourced from bleak's changelog.

3.0.2_ (2026-05-02)

Changed

• Changed default value of BlueZNotifyArgs.use_start_notify to True. Fixes #1951.

3.0.1_ (2026-03-25)

Fixed

• Fixed AttributeError in start_notify() and stop_notify() on Android. Fixes #1834.

3.0.0_ (2026-03-22)

Added

• Added adapter attribute to bleak.args.bluez.BlueZClientArgs and bleak.args.bluez.BlueZScannerArgs.
• Added bluez keyword argument to BleakClient.
• Added new bleak.args.bluez.BlueZClientArgs class.
• Added bleak.exc.BleakGATTProtocolError and bleak.exc.BleakGATTProtocolErrorCode classes.
• Added type hints and documentation for use_cached kwarg for read_gatt_char() and read_gatt_descriptor() methods in BleakClient.
• Added support for "use_cached" kwarg to read_gatt_char() and read_gatt_descriptor() methods in BlueZ backend.

Changed

• Deprecated adapter keyword argument in BleakScanner and BleakClient.
• Changed GATT read and write methods to raise BleakGATTProtocolError when a GATT protocol error occurs.
• Changed start/stop scanning on CoreBluetooth so that the isScanning property is not checked anymore.
• Changed BleakClient.write_gatt_descriptor() to raise ValueError when attempting to write to the descriptor 0x2902 (Client Characteristic Configuration Descriptor, CCCD). Use start_notify() and stop_notify() instead.

Fixed

• Fixed occasional EOFError when disconnecting in BlueZ backend. Fixes #1921.
• Fixed a potential deadlock when turning off Bluetooth manually while starting scanning on CoreBluetooth.
• Fixed reading descriptors 0x2900, 0x2902 and 0x2903 on CoreBluetooth backend.
• Fixed cyclic references problem in CoreBluetooth backend causing memory leaks.
• Fixed typehint for BleakScanner.__aexit__().

Removed

• Removed undocumented/deprecated device keyword argument from BleakScannerBlueZDBus and BleakClientBlueZDBus.

2.1.1_ (2025-12-31)

Changed

... (truncated)

Commits

• bb49377 v3.0.2
• 0682aff tests: coverage for BleakBlueZClient.stop_notify()
• f0c9e84 backends/bluez/client: add local variables for char_path
• 9c30511 backends/bluezdbus: make sure stop_notify matches start_notify
• 9f6069f backends/bluez: change default to use StartNotify
• 058c4e2 backends/winrt: avoid scanner crash on old Windows version
• 58d2a65 docs: set minimum Windows version to 11, version 22000
• 91b200e docs/troubleshooting: remove trailing whitespace
• 3341211 typings/corebluetooth: fix retrievePeripheralsWithIdentifiers parameter type
• 06d6e46 backends/winrt: simplify BleakClientWinRT.__init__ to use address string
• Additional commits viewable in compare view

Updates customtkinter from 5.2.2 to 6.0.0

Changelog

Sourced from customtkinter's changelog.

[6.0.0] - 2026-01-21

Added

• Showroom App, immediately available with the library installation
• Gold theme
• set(), index(), len() methods for those widgets that were suitable to use them
• Attribute to CTkSegmentedButton to make it vertically instead of horizontally
• Attribute to CTkTabview to configure the font for its CTkSegmentedButton
• Possibility to add a border to CTkLabel
• Mouse Wheel detection to CTkSlider and improved it on CTkScrollbar

Changed

• CTkButton triggers the command when the Mouse Button is released
• CTkEntry and CTkTextbox lose focus when you click somewhere else
• Clicking the Dropdown button again closes the menu for CTkComboBox and CTkOptionMenu
• Improved/fixed configure() and cget() methods for all widgets
• Improved Tab renaming for CTkTabview
• Improved drag behavior for CTkScrollbar
• Properly managed borders for CTkScrollableFrame
• Fixed a bug that prevented setting a custom Icon for CTkToplevel
• Fixed many bugs related to missing invocations or wrong names
• Widgets on CTkScrollableFrame get scrolled properly when the mouse is over them and the mouse wheel is used

[5.2.0] - 2022-05-02

Added

• Mostly bug fixes

[5.1.0] - 2022-05-02

Added

• Added CTkScrollableFrame

Changed

• Changed license to MIT

[5.0.0] - 2022-11-13

Added

• Added CTkTextbox with automatic x and y scrollbars, corner_radius, border_width, border_spacing
• Added CTkSegmentedButton
• Added CTkTabview
• Added .cget() method to all widgets and windows
• Added .bind() and .focus() methods to almost all widgets
• Added 'anchor' option to CTkButton to position image and text inside the button
• Added 'anchor' option to CTkOptionMenu and 'justify' option to CTkComboBox
• Added CTkFont class
• Added CTkImage class to replace PIL.ImageTk.PhotoImage, supports scaling and two images for appearance mode, supports configuring
• Added missing configure options for multiple widgets

Changed

• Changed value for transparent colors (same as background) from None to 'transparent'
• Changed 'text_font' attribute to 'font' in all widgets, changed 'dropdown_text_font' to 'dropdown_font'
• Changed 'dropdown_color' attribute to 'dropdown_fg_color' for combobox, optionmenu

... (truncated)

Commits

• 35f9542 Bump to 6.0.0
• 30a03ea update CHANGELOG.md
• b430997 Guard CTkLabel border theme reads for backwards compatibility with older cust...
• c12c9ab Improved scroll behavior for CTkScrollableFrame
• a796f6e Bump to 5.3.0
• 8c85d9b Fixed some bugs with the previous changes
• 51b3435 Updated CHANGELOG in preparation for the release
• 73bc7ad Recreated 3 Pull Requests that weren't perfect
• 73ca84f Improved user experience
• b33e220 Added new utility methods to all widgets
• Additional commits viewable in compare view

Updates fit-tool from 0.9.15 to 0.9.16

Release notes

Sourced from fit-tool's releases.

v0.9.16

Release v0.9.16 (2026-08-05)

Features & Improvements

• Expose a stable package-level public API (FitFile, FitFileBuilder, exceptions, version constants) via from fit_tool import ..., documented in the README. Existing deep imports remain supported. (#SHA-5)
• Introduce a wire-layer MVP (fit_tool/wire) with raw header/record models and a stateful decoder that keeps immutable definition snapshots. FitFile.from_bytes decodes via the wire layer and projects to existing typed messages while keeping public API behavior compatible. (#SHA-7)
• Unify stream and in-memory FIT decoding on one state machine (FitDecoder over the wire layer) so definition snapshots, developer-field registration, and CRC handling stay aligned between FitFile.from_bytes and iter_*. (#SHA-8)
• Add a composable validation API (validate_fit_file, FitFile.validate) with WIRE / PROFILE / FILE_TYPE levels and report or raise modes. Builder strict=True now delegates to the same checks. (#SHA-9)
• Split generated message construction into explicit create (MessageClass()) and decode (MessageClass.from_definition(...)) paths; MessageFactory uses the definition factory. (#SHA-10)
• Expand decode-time component / accumulator coverage to all Profile main-field sources via a generated registry (fit_tool/profile/component_registry.py), with nested expansion (e.g. compressed speed → enhanced speed) and modular accumulator rollover. Subfield-gated components remain deferred to subfield work. (#SHA-15)
• Fix Profile subfield resolution: match reference field values (AND across multi-ref maps), apply the active subfield's type/scale/offset/units, expand components declared on that subfield, and report ambiguous multi-matches as PROFILE validation errors (decode still uses the first match). (#SHA-16)
• Retain unknown native field ids on known messages during decode as UnknownField (with raw_bytes for later PRESERVATION rewrite). Unedited to_bytes(preserve=True) remains bit-identical via wire_document. (#SHA-17)
• Post-edit PRESERVATION: per-record dirty tracking (field mutations mark Record.dirty) so to_bytes(preserve=True) re-encodes only edited records and copies source_bytes for the rest (unknown fields and other records survive). Opt-in ConformanceLevel.PRESERVATION reports loss when unknown-field raw_bytes were cleared. Structural mark_dirty() / add / remove still force a full projected re-encode. (#SHA-18)
• Encode policies: explicit EncodeMode.PRESERVE / EncodeMode.CANONICAL on FitFile.to_bytes (legacy preserve= still works). Canonical rebuilds all records with normalized sizes/CRCs; strict=True validates first and never clamps invalid values. Policy matrix documented in README and design doc §6. (#SHA-19)
• PROFILE validation supports selectable scopes (ProfileScope.CORE / DOMAIN / FULL). Default strict / DEFAULT_LEVELS remain CORE (developer fields + ambiguous subfields). DOMAIN and FULL add data-driven native base-type and closed-enum checks from a gen-exported field catalog (fit_tool.profile.field_catalog) derived from the bundled Profile. FULL is opt-in only via validate_fit_file(..., profile_scope=ProfileScope.FULL). (#SHA-20)
• FILE_TYPE validation for Workout files: required workout / workout_step messages and fields (num_valid_steps, step message_index / duration_type / target_type). Activity behavior unchanged; other file_id.type values (e.g. Course) still fail closed. SDK Workout fixtures validate clean under FILE_TYPE. (#SHA-21)
• FILE_TYPE validation for Course files: required course / lap / record / timer

... (truncated)

Changelog

Sourced from fit-tool's changelog.

Release v0.9.16 (2026-08-05)

Features & Improvements

• Expose a stable package-level public API (FitFile, FitFileBuilder, exceptions, version constants) via from fit_tool import ..., documented in the README. Existing deep imports remain supported. (#SHA-5)
• Introduce a wire-layer MVP (fit_tool/wire) with raw header/record models and a stateful decoder that keeps immutable definition snapshots. FitFile.from_bytes decodes via the wire layer and projects to existing typed messages while keeping public API behavior compatible. (#SHA-7)
• Unify stream and in-memory FIT decoding on one state machine (FitDecoder over the wire layer) so definition snapshots, developer-field registration, and CRC handling stay aligned between FitFile.from_bytes and iter_*. (#SHA-8)
• Add a composable validation API (validate_fit_file, FitFile.validate) with WIRE / PROFILE / FILE_TYPE levels and report or raise modes. Builder strict=True now delegates to the same checks. (#SHA-9)
• Split generated message construction into explicit create (MessageClass()) and decode (MessageClass.from_definition(...)) paths; MessageFactory uses the definition factory. (#SHA-10)
• Expand decode-time component / accumulator coverage to all Profile main-field sources via a generated registry (fit_tool/profile/component_registry.py), with nested expansion (e.g. compressed speed → enhanced speed) and modular accumulator rollover. Subfield-gated components remain deferred to subfield work. (#SHA-15)
• Fix Profile subfield resolution: match reference field values (AND across multi-ref maps), apply the active subfield's type/scale/offset/units, expand components declared on that subfield, and report ambiguous multi-matches as PROFILE validation errors (decode still uses the first match). (#SHA-16)
• Retain unknown native field ids on known messages during decode as UnknownField (with raw_bytes for later PRESERVATION rewrite). Unedited to_bytes(preserve=True) remains bit-identical via wire_document. (#SHA-17)
• Post-edit PRESERVATION: per-record dirty tracking (field mutations mark Record.dirty) so to_bytes(preserve=True) re-encodes only edited records and copies source_bytes for the rest (unknown fields and other records survive). Opt-in ConformanceLevel.PRESERVATION reports loss when unknown-field raw_bytes were cleared. Structural mark_dirty() / add / remove still force a full projected re-encode. (#SHA-18)
• Encode policies: explicit EncodeMode.PRESERVE / EncodeMode.CANONICAL on FitFile.to_bytes (legacy preserve= still works). Canonical rebuilds all records with normalized sizes/CRCs; strict=True validates first and never clamps invalid values. Policy matrix documented in README and design doc §6. (#SHA-19)
• PROFILE validation supports selectable scopes (ProfileScope.CORE / DOMAIN / FULL). Default strict / DEFAULT_LEVELS remain CORE (developer fields + ambiguous subfields). DOMAIN and FULL add data-driven native base-type and closed-enum checks from a gen-exported field catalog (fit_tool.profile.field_catalog) derived from the bundled Profile. FULL is opt-in only via validate_fit_file(..., profile_scope=ProfileScope.FULL). (#SHA-20)
• FILE_TYPE validation for Workout files: required workout / workout_step messages and fields (num_valid_steps, step message_index / duration_type / target_type). Activity behavior unchanged; other file_id.type values (e.g. Course) still fail closed. SDK Workout fixtures validate clean under FILE_TYPE. (#SHA-21)
• FILE_TYPE validation for Course files: required course / lap / record / timer events and fields (aligned with Garmin Course rules and real device exports).

... (truncated)

Commits

• 467323b chore(release): prepare 0.9.16 changelog and version bump (#64)
• d349b74 ci(release): split publish workflow into build, publish, and release jobs (#63)
• 10daab3 fix(release): harden tag-based publish workflow and document process (#62)
• 93b6e0a chore: upgrade garmin fit sdk profile version 21.212.0 (#61)
• 3fc6125 SHA-12: slim README; move capability boundary to docs (#59)
• 14bda00 SHA-23: Stage 5 capability matrix and release-note rollup (#58)
• 514ae61 SHA-20: PROFILE scopes CORE/DOMAIN/FULL with gen field catalog (#57)
• 4339fd3 SHA-22: FILE_TYPE Course 规则（J）(#56)
• 98a80b8 SHA-21: FILE_TYPE validation for Workout files (#55)
• 4f20c12 SHA-19: encode policies PRESERVE vs CANONICAL (#54)
• Additional commits viewable in compare view

Updates keyring from 25.6.0 to 25.7.0

Changelog

Sourced from keyring's changelog.

v25.7.0

Features

• Improved support for KWallet 6. (#728)

Bugfixes

• Removed cruft from Python 3.8. (#722)

Commits

• 38c0401 Finalize
• e5b7d2a Revert "Disable type checking on filter call. Fixes #659."
• 2ce2d46 Add news fragment.
• 4bb5ece Merge pull request #722 from hugovk/rm-3.8
• d7c0aa4 Merge branch 'main' into rm-3.8
• ea1d763 Merge pull request #721 from hugovk/fix-tests
• 30eea9d Merge https://github.com/jaraco/skeleton
• fb6e52c Merge pull request #724 from dachucky/patch-1
• 9ff8459 Generalize the guidance around tox.
• e7fbfa7 Prefer imperative third-person voice.
• Additional commits viewable in compare view

Updates requests from 2.33.0 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

• @​k223kim made their first contribution in psf/requests#7433

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
• Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

• 6e83187 v2.34.2
• 84d10f0 Move Request.headers back to Mapping (#7441)
• b7b549b v2.34.1
• e511bc7 Fix mutability issues with headers input types (#7431)
• 5691f59 Update JsonType containers to read-based collections (#7436)
• 2144213 Constrain Response.reason to str (#7437)
• 6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
• 0b401c7 v2.34.0
• 86b378d Align Session.get parameters with requests.get (#7429)
• a4f9a59 Port bpo-39057 to Requests (#7427)
• Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.16.5

Release notes

Sourced from ruff's releases.

0.16.5

Release Notes

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

Install ruff 0.16.5

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex"

Download ruff 0.16.5

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.5

Released on 2026-08-27.

Preview features

• Allow rules without codes (#28049)
• Introduce category selectors (#27666)
• Update preview default rules and categories (#27877)

Bug fixes

• [flake8-async] Detect blocking generic HTTP requests (ASYNC210) (#28024)
• [flake8-datetimez] Allow timezone-safe strptime chains (DTZ007) (#28023)
• [flake8-simplify] Respect side effects in lambda defaults (SIM401) (#28000)

Server

• Fix duplicated "of" in ClientOptions doc comment (#27978)

Documentation

• Document rule acceptance guidelines (#27910)
• Document the new category selectors (#27906)

Contributors

• @​AlexWaygood
• @​sharkdp
• @​jelle-openai
• @​charliermarsh
• @​ntBre
• @​aarushkandukoori

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

... (truncated)

Commits

• 9e4938c Bump 0.16.5 (#28110)
• aad0e90 Allow rules without codes (#28049)
• 5fdab73 Update preview default rules and categories (#27877)
• 29c8e5b Document rule acceptance guidelines (#27910)
• 50a4d7f Document the new category selectors (#27906)
• ada8795 Introduce category selectors (#27666)
• d894723 [ty] Infer lambda parameters through callable type aliases (#28109)
• 2685fde [ty] Narrow functional enum members in == and match (#28103)
• efcffd2 [ty] Intersection simplifications with subtype-related generic specialization...
• eb78048 [ty] Bump ecosystem-analyzer for HTML escaping (#28104)
• Additional commits viewable in compare view

Updates mypy from 2.2.0 to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• Additional commits viewable in compare view

Updates types-requests from 2.32.4.20250913 to 2.33.0.20260712

Commits

• See full diff in compare view

Updates types-setuptools from 80.9.0.20250822 to 84.0.0.20260812

Commits

• See full diff in compare view

Updates pyinstaller from 6.21.0 to 6.22.2

Release notes

Sourced from pyinstaller's releases.

v6.22.2

Please see the v6.22.2 section of the changelog for a list of the changes since v6.22.1.

v6.22.1

Please see the v6.22.1 section of the changelog for a list of the changes since v6.22.0.

v6.22.0

Please see the v6.22.0 section of the changelog for a list of the changes since v6.21.0.

Changelog

Sourced from pyinstaller's changelog.

6.22.2 (2026-08-17)

Bugfix

* (Windows) Fix spurious security validation error when a ``onefile``
  executable is launched from a symlinked directory or a junction.
  (:issue:`9508`)
6.22.1 (2026-08-15)
Bugfix

• Fix invalid spec file generation when :option:--hide-console option is given (regression introduced in v6.22.0). (:issue:9503)
• (NetBSD) Fix binary dependency analysis. (:issue:9505)
• (NetBSD) Fix/improve NetBSD support: add the is_netbsd platform flag, treat NetBSD as a Unix platform, and search /usr/local/lib for shared libraries, as is already done for FreeBSD and OpenBSD. (:issue:9496)
• (OpenBSD) Fix binary dependency analysis. (:issue:9505)

Incompatible Changes

* (POSIX) Executables built in ``onedir`` mode with ``setuid`` bit set
  now validate the owner and permissions on their contents directory
  (typically the ``_internal`` directory); the owner ID must match the
  effective user ID under which the process is running, and the
  permissions on the directory need to be `0700`. This aims to prevent
  unprivileged users from modifying contents of an application that
  runs in privileged mode. (:issue:`9492`)
* (POSIX) When running as a ``onefile`` child process (on POSIX platforms
  other than OpenBSD and AIX), the bootloader now attempts to verify
  the parent process executable via ``procfs`` lookup. This check is
  mandatory for ``onefile`` executables with ``setuid`` bit set; if the
  relevant ``procfs`` entry is inaccessible (for example, due to ``procfs``
  not being mounted, as is the case on FreeBSD by default, or due to access
  being blocked by local security policy), the process will exit with
  security validation error message. For regular ``onefile`` executables
  (without ``setuid`` bit set), the parent-process check is enforced when the
  relevant ``procfs`` entry is accessible, and skipped when it happens to be
  inaccessible. (:issue:`9492`)
* (POSIX) When running as a ``onefile`` child process and the executable
  has ``setuid`` bit set, the bootloader now validates the owner and
  permissions on the (inherited) temporary directory. The owner ID of the
</tr></table> 

... (truncated)

Commits

• 19f42e7 Release v6.22.2. [skip ci]
• 72bbdb4 bootloader: Windows: use QueryFullProcessImageNameW for executable resolution
• 0d6941c tests: add test to ensure security validation works with symlinked executables
• 6e00368 Tests: Requirements: Scheduled weekly dependency update for week 33 (#9506)
• 22ea0f2 Release v6.22.1. [skip ci]
• e709c04 bootloader: relax parent-process validation requirements on POSIX platforms
• e0388d3 bootloader: relax parent-process validation requirements on FreeBSD
• 92afdf8 tests: test_application_home_directory_hijack: handle 8.3 short paths
• 4b509a2 tests: improve logging in test_application_home_directory_hijack
• 66b0249 doc: document the new security validation and its implications
• Additional commits viewable in compare view

Updates pyinstaller-hooks-contrib from 2026.6 to 2026.7

Release notes

Sourced from pyinstaller-hooks-contrib's releases.

v2026.7

Please see the changelog for more details

Changelog

Sourced from pyinstaller-hooks-contrib's changelog.

2026.7 (2026-08-24)

New hooks

* Add hook for ``procrastinate``, which loads its SQL data files via
  ``importlib.resources`` and its own distribution metadata via
  ``importlib.metadata``. (`[#1036](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/1036)
  <https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/1036>`_)
Updated hooks

• Add hook for timezonefinder_data to collect data files that were previously part of timezonefinder and were moved into dedicated package/dist with v8.3.0. ([#1041](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/1041) <https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/1041>_)
• Update pygraphviz hook for improved compatibility with pygraphviz 2.0 and its new binary wheels that are available for macOS, Windows, and Linux. ([#1031](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/1031) <https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/1031>_)
• Update tkinterdnd2 hook to detect Tcl/Tk 9 and collect the {platform}-{arch}-tcl9 sub-directory, which became available in tkinterdnd2 v0.6.0 wheels. ([#1033](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/1033) <https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/1033>_)

...

Description has been truncated