Skip to content

Bump the uv group across 2 directories with 6 updates - #1985

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-31f08c88de
Open

Bump the uv group across 2 directories with 6 updates#1985
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-31f08c88de

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 6 updates in the / directory:

Package From To
nbconvert 7.17.1 7.17.2
black 26.3.1 26.10.1
jupyterlab 4.6.2 4.6.4
pillow 12.3.0 13.0.0
tornado 6.5.8 6.5.9
werkzeug 3.1.8 3.1.9

Bumps the uv group with 5 updates in the /experimental/rsqualtran directory:

Package From To
nbconvert 7.17.1 7.17.2
jupyterlab 4.6.2 4.6.4
pillow 12.3.0 13.0.0
tornado 6.5.8 6.5.9
werkzeug 3.1.8 3.1.9

Updates nbconvert from 7.17.1 to 7.17.2

Release notes

Sourced from nbconvert's releases.

v7.17.2

7.17.2

(Full Changelog)

Maintenance and upkeep improvements

Other merged PRs

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​claude (activity) | @​GruffElixir (activity) | @​minrk (activity) | @​Yann-P (activity)

Changelog

Sourced from nbconvert's changelog.

7.17.2

(Full Changelog)

Maintenance and upkeep improvements

Other merged PRs

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​claude (activity) | @​GruffElixir (activity) | @​minrk (activity) | @​Yann-P (activity)

Commits
  • e681152 Publish 7.17.2
  • 8685e15 Fix CI: fetch the classic CSS from PyPI, update dead links
  • ce4bd99 Merge commit from fork
  • 1ff189e Use org-level security policy (jupyter/.github/SECURITY.md) (#2318)
  • See full diff in compare view

Updates black from 26.3.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

  • Add --cache-dir to configure the cache directory from the command line (#5433)
  • Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)
  • Keep the parentheses around a walrus that is the only item in a set (for example {(x := f())}) when targeting Python 3.9 or older, since Python 3.8 and 3.9.0 can't parse it without them (#5502)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

... (truncated)

Commits
  • 258e7db Prepare release 26.10.1 (#5511)
  • ac1f715 Action: validate required-version better (#5510)
  • fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
  • 4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
  • 6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
  • c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
  • 8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
  • c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
  • eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
  • 939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
  • Additional commits viewable in compare view

Updates jupyterlab from 4.6.2 to 4.6.4

Release notes

Sourced from jupyterlab's releases.

v4.6.4

4.6.4

(Full Changelog)

Security fixes

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Darshan808 (activity) | @​fly1d (activity) | @​jasongrout (activity) | @​jtpio (activity) | @​JussiRoos (activity) | @​krassowski (activity) | @​MUFFANUJ (activity) | @​tomatotomata (activity) | @​zihjiang (activity)

... (truncated)

Commits

Updates pillow from 12.3.0 to 13.0.0

Release notes

Sourced from pillow's releases.

13.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Removals

Deprecations

Documentation

Dependencies

... (truncated)

Commits
  • 293218a 13.0.0 version bump
  • 262e8e4 Update release notes for Pillow 13.0.0 (#10223)
  • af56ace Validate TIFF tag values against libtiff's own field definition before TIFFSe...
  • 570df03 Validate TIFF tag values against libtiff's own field definition before TIFFSe...
  • 53318b5 Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)
  • 0a87417 Bound retained TIFF tag data by stream size (#10225)
  • 11582e5 Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)
  • 8501adc Fix test
  • ec5f1cb Take libtiff scanline geometry tags from the image, not tiffinfo/exif
  • 4b63dff Share TIFF tag data budget across frames
  • Additional commits viewable in compare view

Updates tornado from 6.5.8 to 6.5.9

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.6.0 releases/v6.5.10 releases/v6.5.9 releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2

... (truncated)

Commits
  • 75ef8b1 Merge pull request #3719 from bdarnell/fixes-659
  • 3590cb4 test: Hardcode SimpleAsyncHTTPClient in HTTP1xxLimitTestCase
  • 9fc5d6d test: Make tracemalloc optional in httpclient_test
  • 555a2ee iostream: Treat connection resets as a clean close in read_until_close
  • 3ba622f Release notes and version bump for 6.5.9
  • 41eea68 test: Fix some test issues only found by our custom tox config
  • ab1a778 Merge remote-tracking branch 'bdarnell/claude/asynchttpclient-streaming-memor...
  • 437ab5f web: Do not follow symlinks out of the static directory
  • 0394513 httputil: Apply the argument count limit to query strings
  • b798f83 http1connection: Return after reading the response that follows a 1xx
  • Additional commits viewable in compare view

Updates werkzeug from 3.1.8 to 3.1.9

Release notes

Sourced from werkzeug's releases.

3.1.9

This is the Werkzeug 3.1.9 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.9/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-9 Milestone: https://github.com/pallets/werkzeug/milestone/46?closed=1

  • safe_join on Windows does not allow special devices names with empty ADS markers on NTFS. GHSA-g6x2-hccm-hh4m
  • ProfilerMiddleware uses profiling.tracing on Python 3.15. #3207
  • uri_to_iri and iri_to_uri preserve empty username, password, and port 0. #3189
  • Improve performance of parse_options_header. #3231
  • Improve performance of parse_etags. #3231
  • Improve performance of parse_cookie. #3231
  • get_host also checks that the port is in the valid range. #3236
  • The int URL converter returns a 404 instead of 500 error when the value is longer than sys.get_int_max_str_digits(). #3237
  • Improve debugger PIN generation from cgroup data inside Podman. #3245
  • Authorization parsing basic auth disallows non-base64 characters. #3248
  • application/x-www-form-urlencoded form data is no longer limited to max_form_memory_size, only max_content_length. #3251
  • LimitedStream.readinto does not resize the buffer when it reads less than the remaining size. #3253
  • Rules with 10 or more converters in a single part assign matched values correctly. #3254
  • The invalid Range suffix length -0 is no longer accepted. #3255
Changelog

Sourced from werkzeug's changelog.

Version 3.1.9

Released 2026-09-27

  • safe_join on Windows does not allow special devices names with empty ADS markers on NTFS. :ghsa:g6x2-hccm-hh4m
  • ProfilerMiddleware uses profiling.tracing on Python 3.15. :issue:3207
  • uri_to_iri and iri_to_uri preserve empty username, password, and port 0. :issue:3189
  • Improve performance of parse_options_header. :pr:3231
  • Improve performance of parse_etags. :pr:3231
  • Improve performance of parse_cookie. :pr:3231
  • get_host also checks that the port is in the valid range. :pr:3236
  • The int URL converter returns a 404 instead of 500 error when the value is longer than sys.get_int_max_str_digits(). :issue:3237
  • Improve debugger PIN generation from cgroup data inside Podman. :issue:3245
  • Authorization parsing basic auth disallows non-base64 characters. :pr:3248
  • application/x-www-form-urlencoded form data is no longer limited to max_form_memory_size, only max_content_length. :pr:3251
  • LimitedStream.readinto does not resize the buffer when it reads less than the remaining size. :pr:3253
  • Rules with 10 or more converters in a single part assign matched values correctly. :pr:3254
  • The invalid Range suffix length -0 is no longer accepted. :pr:3255
Commits

Updates nbconvert from 7.17.1 to 7.17.2

Release notes

Sourced from nbconvert's releases.

v7.17.2

7.17.2

(Full Changelog)

Maintenance and upkeep improvements

Other merged PRs

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​claude (activity) | @​GruffElixir (activity) | @​minrk (activity) | @​Yann-P (activity)

Changelog

Sourced from nbconvert's changelog.

7.17.2

(Full Changelog)

Maintenance and upkeep improvements

Other merged PRs

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Carreau (activity) | @​claude (activity) | @​GruffElixir (activity) | @​minrk (activity) | @​Yann-P (activity)

Commits
  • e681152 Publish 7.17.2
  • 8685e15 Fix CI: fetch the classic CSS from PyPI, update dead links
  • ce4bd99 Merge commit from fork
  • 1ff189e Use org-level security policy (jupyter/.github/SECURITY.md) (#2318)
  • See full diff in compare view

Updates jupyterlab from 4.6.2 to 4.6.4

Release notes

Sourced from jupyterlab's releases.

v4.6.4

4.6.4

(Full Changelog)

Security fixes

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​Darshan808 (activity) | @​fly1d (activity) | @​jasongrout (activity) | @​jtpio (activity) | @​JussiRoos (activity) | @​krassowski (activity) | @​MUFFANUJ (activity) | @​tomatotomata (activity) | @​zihjiang (activity)

... (truncated)

Commits

@dependabot
Bump the uv group across 2 directories with 6 updates
d16172e 
Bumps the uv group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [nbconvert](https://github.com/jupyter/nbconvert) | `7.17.1` | `7.17.2` |
| [black](https://github.com/psf/black) | `26.3.1` | `26.10.1` |
| [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.6.2` | `4.6.4` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.3.0` | `13.0.0` |
| [tornado](https://github.com/tornadoweb/tornado) | `6.5.8` | `6.5.9` |
| [werkzeug](https://github.com/pallets/werkzeug) | `3.1.8` | `3.1.9` |

Bumps the uv group with 5 updates in the /experimental/rsqualtran directory:

| Package | From | To |
| --- | --- | --- |
| [nbconvert](https://github.com/jupyter/nbconvert) | `7.17.1` | `7.17.2` |
| [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.6.2` | `4.6.4` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.3.0` | `13.0.0` |
| [tornado](https://github.com/tornadoweb/tornado) | `6.5.8` | `6.5.9` |
| [werkzeug](https://github.com/pallets/werkzeug) | `3.1.8` | `3.1.9` |



Updates `nbconvert` from 7.17.1 to 7.17.2
- [Release notes](https://github.com/jupyter/nbconvert/releases)
- [Changelog](https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md)
- [Commits](jupyter/nbconvert@v7.17.1...v7.17.2)

Updates `black` from 26.3.1 to 26.10.1
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@26.3.1...26.10.1)

Updates `jupyterlab` from 4.6.2 to 4.6.4
- [Release notes](https://github.com/jupyterlab/jupyterlab/releases)
- [Changelog](https://github.com/jupyterlab/jupyterlab/blob/main/RELEASE.md)
- [Commits](https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/lsp@4.6.2...@jupyterlab/lsp@4.6.4)

Updates `pillow` from 12.3.0 to 13.0.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.3.0...13.0.0)

Updates `tornado` from 6.5.8 to 6.5.9
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.8...v6.5.9)

Updates `werkzeug` from 3.1.8 to 3.1.9
- [Release notes](https://github.com/pallets/werkzeug/releases)
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)
- [Commits](pallets/werkzeug@3.1.8...3.1.9)

Updates `nbconvert` from 7.17.1 to 7.17.2
- [Release notes](https://github.com/jupyter/nbconvert/releases)
- [Changelog](https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md)
- [Commits](jupyter/nbconvert@v7.17.1...v7.17.2)

Updates `jupyterlab` from 4.6.2 to 4.6.4
- [Release notes](https://github.com/jupyterlab/jupyterlab/releases)
- [Changelog](https://github.com/jupyterlab/jupyterlab/blob/main/RELEASE.md)
- [Commits](https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/lsp@4.6.2...@jupyterlab/lsp@4.6.4)

Updates `pillow` from 12.3.0 to 13.0.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.3.0...13.0.0)

Updates `tornado` from 6.5.8 to 6.5.9
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.8...v6.5.9)

Updates `werkzeug` from 3.1.8 to 3.1.9
- [Release notes](https://github.com/pallets/werkzeug/releases)
- [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst)
- [Commits](pallets/werkzeug@3.1.8...3.1.9)

---
updated-dependencies:
- dependency-name: nbconvert
  dependency-version: 7.17.2
  dependency-type: direct:development
  dependency-group: uv
- dependency-name: black
  dependency-version: 26.10.1
  dependency-type: direct:development
  dependency-group: uv
- dependency-name: jupyterlab
  dependency-version: 4.6.4
  dependency-type: indirect
  dependency-group: uv
- dependency-name: pillow
  dependency-version: 13.0.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: tornado
  dependency-version: 6.5.9
  dependency-type: indirect
  dependency-group: uv
- dependency-name: werkzeug
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: uv
- dependency-name: nbconvert
  dependency-version: 7.17.2
  dependency-type: indirect
  dependency-group: uv
- dependency-name: jupyterlab
  dependency-version: 4.6.4
  dependency-type: indirect
  dependency-group: uv
- dependency-name: pillow
  dependency-version: 13.0.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: tornado
  dependency-version: 6.5.9
  dependency-type: indirect
  dependency-group: uv
- dependency-name: werkzeug
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants