Skip to content

chore(deps): bump the uv group with 5 updates - #84

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-52cac5fd28
Open

chore(deps): bump the uv group with 5 updates#84
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-52cac5fd28

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 5 updates:

Package From To
bidsschematools 1.2.4 1.2.7
typer 0.26.8 0.27.0
ruff 0.15.20 0.16.0
datalad 1.6.0 1.6.1
mypy 2.1.0 2.3.0

Updates bidsschematools from 1.2.4 to 1.2.7

Commits
  • e37e210 chore: Bump schema package to 1.2.7
  • 3ff7542 fix(ci): Drop test.pypi.org publication
  • 4102480 chore: Bump schema package to 1.2.7-dev
  • ce7a599 chore: Bump schema package to 1.2.6
  • ffc78c7 fix(ci): Fix download-artifact target
  • 59d3faa chore: Bump schema package to 1.2.6-dev
  • 315475d chore: Bump schema package to 1.2.5
  • 24105db [SCHEMA] Warn when *_beh.tsv contains onset and duration (#2467)
  • 9e2ccac [FIX][SCHEMA] Phenotype subjects are a subset of participants.tsv (#2468)
  • 5adc48b [FIX] Replace non-existent len with existent length (#2466)
  • Additional commits viewable in compare view

Updates typer from 0.26.8 to 0.27.0

Release notes

Sourced from typer's releases.

0.27.0

Breaking Changes

Internal

Changelog

Sourced from typer's changelog.

0.27.0 (2026-07-15)

Breaking Changes

Internal

Commits

Updates ruff from 0.15.20 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

  • Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

  • Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

  • Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

    import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os

  • Fixes are now shown in check and format --check output:

    ❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted

    This example also shows off the Markdown formatting.

  • format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

    ❯ ruff format --check --output-format github .
::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

    See the CLI help or documentation for the full list of supported formats.

  • The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

  • Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

  • Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

  • Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

    import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os

  • Fixes are now shown in check and format --check output:

    ❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted

    This example also shows off the Markdown formatting.

  • format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

    

    • 






... (truncated)





Commits

    

  • a2635fd Bump 0.16.0 (#27136)
    • 

  • 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
    • 

  • 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
    • 

  • 17ef711 Stabilize --add-ignore (#27125)
    • 

  • ef912bb Add newly stabilized rules to defaults (#27055)
    • 

  • b30f040 Stabilize new default rules (#27035)
    • 

  • bcd70c5 Exclude Markdown files from format-dev runs (#27052)
    • 

  • 87e51e2 Fix format --check spans for syntax errors (#27045)
    • 

  • afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
    • 

  • a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
    • 

  • Additional commits viewable in compare view
    • 







Updates datalad from 1.6.0 to 1.6.1



Release notes

Sourced from datalad's releases.




1.6.1


🐛 Bug Fixes


    

  • 

    get_toppath() now returns None instead of crashing with TypeError when
called on a path whose existence can't be verified (e.g. a broken symlink or
a nonexistent directory).  Discovered while investigating
#7882.
(by @​LiamDGray)
    

    • 

  • 

    BF: terminate child before closing stdout/stderr on process timeout.  [PR #7866](datalad/datalad#7866) (by @​yarikoptic)
    

    • 

  • 

    Fix get_dataset_root() to reject an ancestor .git/ that is reached only by crossing a symlink boundary.  Previously, cwd inside a symlink whose apparent parent contained an unrelated .git/ (e.g. an abandoned git init with no commits) caused datalad status / datalad rerun to bind to that parent, while git and git-annex correctly followed the symlink to the real dataset.  The existing "symlink itself is a dataset" fallback now handles that case; the test_bf1886 semantics (symlink → subdataset within outer dataset resolves to outer) is preserved via a realpath-ancestry check.  Fixes #7882 via [PR #7883](datalad/datalad#7883) (by @​yarikoptic)
    

    • 

  • 

    create-sibling no longer requires git-annex on the target (remote or local) when the source dataset is a plain-git dataset (--no-annex, i.e. marked with a .noannex file).  Previously it errored out with No working git-annex installation. It's required on the remote machine to create a sibling even though no annex functionality would be used.  Via [PR #7888](datalad/datalad#7888) (by @​yarikoptic)
    

    • 



🔩 Dependencies


    

  • Bump minimum required Git version from 2.25.0 to 2.31.0.  The -c key=value config-override propagation to subprocesses added in
[PR #7858](datalad/datalad#7858) relies on
Git's GIT_CONFIG_COUNT / GIT_CONFIG_KEY_<n> / GIT_CONFIG_VALUE_<n>
environment mechanism, which was introduced in Git 2.31.0 (2021-03).
On older Git the CLI override was silently ignored.  This bump makes the
requirement explicit at startup rather than manifesting as a silent
feature loss.  Git 2.31 is available on all currently-supported LTS
distributions.
Via [PR #7887](datalad/datalad#7887)
(by @​yarikoptic)
    • 



🏠 Internal


    

  • Pin asv<0.6.6 and asv-runner<0.2.2 in .github/workflows/benchmarks.yml.  Starting with asv-runner 0.2.2 (released 2026-06-27), do_setup_cache() invokes any class-level setup(self) method it can bind with no positional args -- for the save_run benchmarks that means setup() runs before setup_cache() has written bm_heavy.tar, breaking every Benchmarks CI run since #7402.  asv itself needs pinning too because asv 0.6.6 requires asv-runner>=0.2.5, and tools/ci/benchmark-travis-pr.sh re-runs pip install asv unconditionally which would otherwise defeat the pin.  Reported upstream at airspeed-velocity/asv_runner#52.  [PR #7886](datalad/datalad#7886) (by @​yarikoptic)
    • 








Changelog

Sourced from datalad's changelog.




1.6.1 (2026-07-23)


🐛 Bug Fixes


    

  • 

    get_toppath() now returns None instead of crashing with TypeError when
called on a path whose existence can't be verified (e.g. a broken symlink or
a nonexistent directory).  Discovered while investigating
#7882.
(by @​LiamDGray)
    

    • 

  • 

    BF: terminate child before closing stdout/stderr on process timeout.  [PR #7866](datalad/datalad#7866) (by @​yarikoptic)
    

    • 

  • 

    Fix get_dataset_root() to reject an ancestor .git/ that is reached only by crossing a symlink boundary.  Previously, cwd inside a symlink whose apparent parent contained an unrelated .git/ (e.g. an abandoned git init with no commits) caused datalad status / datalad rerun to bind to that parent, while git and git-annex correctly followed the symlink to the real dataset.  The existing "symlink itself is a dataset" fallback now handles that case; the test_bf1886 semantics (symlink → subdataset within outer dataset resolves to outer) is preserved via a realpath-ancestry check.  Fixes #7882 via [PR #7883](datalad/datalad#7883) (by @​yarikoptic)
    

    • 

  • 

    create-sibling no longer requires git-annex on the target (remote or local) when the source dataset is a plain-git dataset (--no-annex, i.e. marked with a .noannex file).  Previously it errored out with No working git-annex installation. It's required on the remote machine to create a sibling even though no annex functionality would be used.  Via [PR #7888](datalad/datalad#7888) (by @​yarikoptic)
    

    • 



🔩 Dependencies


    

  • Bump minimum required Git version from 2.25.0 to 2.31.0.  The -c key=value config-override propagation to subprocesses added in
[PR #7858](datalad/datalad#7858) relies on
Git's GIT_CONFIG_COUNT / GIT_CONFIG_KEY_<n> / GIT_CONFIG_VALUE_<n>
environment mechanism, which was introduced in Git 2.31.0 (2021-03).
On older Git the CLI override was silently ignored.  This bump makes the
requirement explicit at startup rather than manifesting as a silent
feature loss.  Git 2.31 is available on all currently-supported LTS
distributions.
Via [PR #7887](datalad/datalad#7887)
(by @​yarikoptic)
    • 



🏠 Internal


    

  • Pin asv<0.6.6 and asv-runner<0.2.2 in .github/workflows/benchmarks.yml.  Starting with asv-runner 0.2.2 (released 2026-06-27), do_setup_cache() invokes any class-level setup(self) method it can bind with no positional args -- for the save_run benchmarks that means setup() runs before setup_cache() has written bm_heavy.tar, breaking every Benchmarks CI run since #7402.  asv itself needs pinning too because asv 0.6.6 requires asv-runner>=0.2.5, and tools/ci/benchmark-travis-pr.sh re-runs pip install asv unconditionally which would otherwise defeat the pin.  Reported upstream at airspeed-velocity/asv_runner#52.  [PR #7886](datalad/datalad#7886) (by @​yarikoptic)
    • 










Commits

    

  • b36f9b6 [skip ci] Update docs/source/changelog.rst and CITATION.cff
    • 

  • ccb3e51 [skip ci] Update CHANGELOG
    • 

  • d8c135a Merge pull request #7885 from LiamDGray/bf-get-toppath-crash
    • 

  • b6830ba Merge pull request #7866 from datalad/bf-sigpipe-141
    • 

  • 67989fb Merge pull request #7888 from datalad/bf-noannex
    • 

  • 9f5df6f BF(TST): satisfy mypy in test_sigpipe_on_timeout, add changelog
    • 

  • ea37c77 BF: terminate child before closing stdout/stderr on process timeout
    • 

  • f736847 BF: create-sibling - don't require git-annex on target for no-annex datasets
    • 

  • 12c17c5 TST: minor consistency tuneup for temp directory name
    • 

  • 48a7b69 Merge pull request #7883 from yarikoptic/bf-7882
    • 

  • Additional commits viewable in compare view
    • 







Updates mypy from 2.1.0 to 2.3.0



Changelog

Sourced from mypy's changelog.




Mypy Release Notes


Next Release


Packaging changes



Mypy 2.3


We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI).
Mypy is a static type checker for Python. This release includes new features, performance
improvements and bug fixes. You can install it as follows:


python3 -m pip install -U mypy



You can read the full documentation for this release on Read the Docs.


The Upcoming Switch to the New Native Parser


We are planning to enable the new native parser (--native-parser) by
default soon. We recommend that you test the native parser in your projects and report
any issues in the mypy issue tracker.


Mypyc Free-threading Memory Safety


Free-threaded Python builds that don't have the GIL require additional synchronization
primitives or lock-free algorithms to ensure memory safety when there are race conditions
(for example, when a thread reads a list item while another thread writes the same list
item concurrently). This release greatly improves memory safety of free threading.


List operations are now memory-safe on free threaded Python builds, even in the presence of
race conditions. This has some performance cost. For list-heavy workloads, using
librt.vecs.vec instead of list is often significantly faster, but note that vec is not
(and likely won't be) fully memory safe, and the user is expected to avoid race conditions.
The newly introduced librt.threading.Lock helps with this. Using variable-length tuples
can also be more efficient than lists, since tuples are immutable and don't require
expensive synchronization to ensure memory safety.


Instance attribute access is also (mostly) memory safe now on free-threaded builds in
the presence of race conditions. We are planning to fix the remaining unsafe cases in a
future release.


Full list of changes:


    

  • Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
    • 

  • Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
    • 

  • Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
    • 

  • Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
    • 

  • Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)
    • 






... (truncated)





Commits

    

  • 8aabf84 Drop +dev from version
    • 

  • 4d8ad2a Update changelog for 2.3 release (#21728)
    • 

  • 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
    • 

  • a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
    • 

  • 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
    • 

  • 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
    • 

  • 24c237d [mypyc] Improve documentation of Final (#21713)
    • 

  • b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
    • 

  • cbcb51a Narrow for frozendict membership check (#21709)
    • 

  • af2bc0f Sync typeshed (#21707)
    • 

  • Additional commits viewable in compare view
    • 







Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • 

  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • 

  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    • 




    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          chore(deps): bump the uv group with 5 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          4cf9763
        
      

    

  

    

      
Bumps the uv group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [bidsschematools](https://github.com/bids-standard/bids-specification) | `1.2.4` | `1.2.7` |
| [typer](https://github.com/fastapi/typer) | `0.26.8` | `0.27.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.16.0` |
| [datalad](https://github.com/datalad/datalad) | `1.6.0` | `1.6.1` |
| [mypy](https://github.com/python/mypy) | `2.1.0` | `2.3.0` |


Updates `bidsschematools` from 1.2.4 to 1.2.7
- [Release notes](https://github.com/bids-standard/bids-specification/releases)
- [Changelog](https://github.com/bids-standard/bids-specification/blob/master/Release_Protocol.md)
- [Commits](bids-standard/bids-specification@schema-1.2.4...schema-1.2.7)

Updates `typer` from 0.26.8 to 0.27.0
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.26.8...0.27.0)

Updates `ruff` from 0.15.20 to 0.16.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.16.0)

Updates `datalad` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/datalad/datalad/releases)
- [Changelog](https://github.com/datalad/datalad/blob/maint/CHANGELOG.md)
- [Commits](datalad/datalad@1.6.0...1.6.1)

Updates `mypy` from 2.1.0 to 2.3.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.1.0...v2.3.0)

---
updated-dependencies:
- dependency-name: bidsschematools
  dependency-version: 1.2.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: typer
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: ruff
  dependency-version: 0.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv
- dependency-name: datalad
  dependency-version: 1.6.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: uv
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  python:uv

  Pull requests that update python:uv code

  labels


      Aug 1, 2026

    

  












  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews







    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file
  

    python:uv

  Pull requests that update python:uv code








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      0 participants