[dependabot]

Bumps the pip group with 11 updates in the / directory:

Package	From	To
black	26.5.1	26.10.1
types-python-dateutil	2.9.0.20260807	2.9.0.20261021
types-requests	2.33.0.20260906	2.33.0.20261006
pylint	4.1.2	4.1.3
tox	4.64.8	4.65.0
yq	4.4.0	4.4.5
giturlparse	0.15.0	0.16.0
python-dateutil	2.9.0.post0	3.0.0
gitpython	3.2.0	3.2.1
pydantic	2.13.5	2.14.1
sqlalchemy	2.0.54	2.0.55

Updates black from 26.5.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

• Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
• Keep repeated lines outside the selected --line-ranges unchanged (#5436)
• Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
• Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
• Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
• Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

• Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
• Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
• Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
• Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
• Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
• Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
• Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

• Add --cache-dir to configure the cache directory from the command line (#5433)
• Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

• Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
• Keep repeated lines outside the selected --line-ranges unchanged (#5436)
• Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
• Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
• Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
• Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)
• Keep the parentheses around a walrus that is the only item in a set (for example {(x := f())}) when targeting Python 3.9 or older, since Python 3.8 and 3.9.0 can't parse it without them (#5502)

Preview style

• Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
• Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
• Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
• Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
• Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
• Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
• Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

... (truncated)

Commits

• 258e7db Prepare release 26.10.1 (#5511)
• ac1f715 Action: validate required-version better (#5510)
• fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
• 4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
• 6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
• c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
• 8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
• c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
• eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
• 939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
• Additional commits viewable in compare view

Updates types-python-dateutil from 2.9.0.20260807 to 2.9.0.20261021

Commits

• See full diff in compare view

Updates types-requests from 2.33.0.20260906 to 2.33.0.20261006

Commits

• See full diff in compare view

Updates pylint from 4.1.2 to 4.1.3

Release notes

Sourced from pylint's releases.

v4.1.3

What's new in Pylint 4.1.3?

Release date: 2026-10-11

False Positives Fixed

• Fixed a false positive for attribute-defined-outside-init when an attribute is assigned inside the setter of an old-style, non-decorator property(fget, fset) call. The decorator form (@property / @x.setter) was already exempted by the fix for #409; the classic call form was not.

  Closes #3325

• Fix a false positive for used-before-assignment when a name bound by an earlier target of the same assignment is used by a later target, as in a = b[a] = 0.

  Closes #5955

• Fix a no-member false positive in a comprehension inside a branch that cannot run, such as if sys.platform == "win32": on Linux. Like the rest of the branch, the comprehension is no longer checked for missing members.

  Closes #7240

• Fix a false positive for used-before-assignment when a name bound by a tuple or list target of a with item is used by a later item of the same with statement.

  Closes #7545

• Fix false positives such as not-callable, not-an-iterable, unpacking-non-sequence and no-member on the result of a function whose body is only ..., like @overload and .pyi stubs. Such calls were inferred as returning None. This affected sqlalchemy.func, pydantic.Field, and the torch functions wrapped by _add_docstr, such as torch.linalg.qr.

  Closes #8138 Closes #9218 Closes #9354 Closes #10087

• Fix a false positive for protected-access when a subclass of a subscripted generic base, such as class Child(Parent[T]), accesses a protected member through that base, such as Parent._foo(self).

  Closes #8600

... (truncated)

Commits

• e75de10 Bump pylint to 4.1.3, update changelog (#11637)
• 591f6e2 [Backport maintenance/4.1.x] Fix protected-access false positive through a su...
• a537920 [Backport maintenance/4.1.x] Ignore discard variable type redefinitions (#11635)
• 4a8f61c [Backport maintenance/4.1.x] Fix duplicate-code crash when min-similarity-lin...
• 41fa1c4 [Backport maintenance/4.1.x] [pyreverse] Fix hang/RecursionError with --all-a...
• a05e2f3 [Backport maintenance/4.1.x] Fix used-before-assignment false positive for ...
• ea7996b [Backport maintenance/4.1.x] Error when several output formats write to stdou...
• 479c037 [Backport maintenance/4.1.x] Fix IndexError when Enum init has no argumen...
• e6aa780 [Backport maintenance/4.1.x] Fix unreachable false positive for raising gener...
• fc58d0b [Backport maintenance/4.1.x] Fix pyreverse crash on classes with EmptyNode in...
• Additional commits viewable in compare view

Updates tox from 4.64.8 to 4.65.0

Release notes

Sourced from tox's releases.

v4.65.0

Features - 4.65.0

• Bump the default maximum CPython minor version to 3.15 in generative environment lists. (#4136)

Bug fixes - 4.65.0

• --result-json and tox config -o create the missing parent directory of the output file instead of crashing - by SulimanAbdulrazzaq. (#4126)
• A set_env env file that is a directory or not UTF-8 fails the environment with a configuration error instead of a traceback, and a leading UTF-8 byte order mark no longer ends up in the first key - by SulimanAbdulrazzaq. (#4127)
• A reused environment with commands = [] clears env_log_dir at the start of the run instead of keeping logs from the previous run - by glaziermag. (#4130)

Improved documentation - 4.65.0

• Drop @impl from the tox_append_version_info plugin doc examples, since it made tox skip the inline plugin - by Rodrigo-Palma. (#4135)

PyPI release

Full Changelog: tox-dev/tox@4.64.10...4.65.0

v4.64.10

Bug fixes - 4.64.10

• Report an invalid configuration value as a one-line error naming the environment and key instead of a traceback, including -x overrides and values set by plugins - by hfycium. (#4118)
• A command prefixed with ! that exits with 0 now fails the environment with exit code 1; before, tox reported it as a success - by feiiiiii5. (#4119)
• Recreating an environment or clearing its temporary and log directories removes symlinks to directories, leaving their targets intact - by gaborbernat. (#4121)
• A command prefixed with ! that cannot start, such as a missing executable, now fails the environment instead of passing - by feiiiiii5. (#4125)

PyPI release

Full Changelog: tox-dev/tox@4.64.9...4.64.10

v4.64.9

Bug fixes - 4.64.9

• Resolve substitutions and file| entries in set_env overrides passed through -x or TOX_OVERRIDE. Appended blocks replace inherited values while preserving explicit keys in the same or later overrides. Preserve these

... (truncated)

Changelog

Sourced from tox's changelog.

Features - 4.65.0

• Bump the default maximum CPython minor version to 3.15 in generative environment lists. (:issue:4136)

Bug fixes - 4.65.0

• --result-json and tox config -o create the missing parent directory of the output file instead of crashing - by :user:SulimanAbdulrazzaq. (:issue:4126)
• A set_env env file that is a directory or not UTF-8 fails the environment with a configuration error instead of a traceback, and a leading UTF-8 byte order mark no longer ends up in the first key - by :user:SulimanAbdulrazzaq. (:issue:4127)
• A reused environment with commands = [] clears env_log_dir at the start of the run instead of keeping logs from the previous run - by :user:glaziermag. (:issue:4130)

Improved documentation - 4.65.0

• Drop @impl from the tox_append_version_info plugin doc examples, since it made tox skip the inline plugin - by :user:Rodrigo-Palma. (:issue:4135)

---

v4.64.10 (2026-10-08)

---

Bug fixes - 4.64.10

• Report an invalid configuration value as a one-line error naming the environment and key instead of a traceback, including -x overrides and values set by plugins - by :user:hfycium. (:issue:4118)
• A command prefixed with ! that exits with 0 now fails the environment with exit code 1; before, tox reported it as a success - by :user:feiiiiii5. (:issue:4119)
• Recreating an environment or clearing its temporary and log directories removes symlinks to directories, leaving their targets intact - by :user:gaborbernat. (:issue:4121)
• A command prefixed with ! that cannot start, such as a missing executable, now fails the environment instead of passing - by :user:feiiiiii5. (:issue:4125)

---

v4.64.9 (2026-10-05)

---

Bug fixes - 4.64.9

• Resolve substitutions and file| entries in :ref:set_env overrides passed through -x or TOX_OVERRIDE. Appended blocks replace inherited values while preserving explicit keys in the same or later overrides. Preserve these rules through section references, including native TOML arrays with extend = true. Resolve env-file selectors and values in the consuming environment. Prevent included values from overriding tox's own variables - by :user:Rodrigo-Palma. (:issue:4116)

... (truncated)

Commits

• 21d7b51 release 4.65.0
• fbe1248 feat: bump default maximum Python minor to 3.15 (#4136)
• c6dabc2 📝 docs(plugins): drop @​impl from tox_append_version_info examples (#4135)
• 5cec382 👷 ci: fix the cancelled() check that broke check.yaml (#4134)
• 96f52d2 🐛 fix(env): reset env_log_dir when a run executes no commands (#4133)
• 691ff93 ✅ test(exec): make the no_capture check actually assert (#4131)
• 2316fa4 👷 ci: upload each test job's JUnit report as an artifact (#4132)
• 023395c 🐛 fix(set_env): report unreadable env files and strip a UTF-8 BOM (#4127)
• 0bb658c ✅ test: prune duplicate tests and fold lookup tables (#4129)
• 9c6b900 🐛 fix(output): create missing parent dirs for --result-json and config -o (#4...
• Additional commits viewable in compare view

Updates yq from 4.4.0 to 4.4.5

Release notes

Sourced from yq's releases.

v4.4.5

• Preserve YAML comment placement and spacing in roundtrip mode

v4.4.4

• YAML parse: build dictionary without using pairs

v4.4.3

• Improve startup time (25%) and YAML streaming throughput (5-25%)

v4.4.2

• Use consistent quoting for y, Y, n, N literals

• Docs: fix YAML styles specification link

v4.4.1

• Defer hashlib import until YAML annotations need it
• Import argcomplete only during shell completion

Changelog

Sourced from yq's changelog.

Changes for v4.4.5 (2026-10-10)

• Preserve YAML comment placement and spacing in roundtrip mode

Changes for v4.4.4 (2026-10-10)

• YAML parse: build dictionary without using pairs

Changes for v4.4.3 (2026-10-10)

• Improve startup time (25%) and YAML streaming throughput (5-25%)

Changes for v4.4.2 (2026-10-10)

• Use consistent quoting for y, Y, n, N literals

• Docs: fix YAML styles specification link

Changes for v4.4.1 (2026-10-10)

• Defer hashlib import until YAML annotations need it
• Import argcomplete only during shell completion

Commits

• a98d746 v4.4.5
• f7ffa8f Preserve YAML comment placement and spacing in roundtrip mode
• 8ac5db0 v4.4.4
• 2daa2ca YAML parse: build dictionary without using pairs
• 89af5d4 v4.4.3
• 6bec4f4 Defer argparse formatter construction (3-4% startup time gain)
• 3da4534 Improve startup time and YAML streaming throughput
• 6df1957 v4.4.2
• 4beb94c Use consistent quoting for y, Y, n, N literals
• 0d1ebde docs: fix YAML styles specification link
• Additional commits viewable in compare view

Updates giturlparse from 0.15.0 to 0.16.0

Release notes

Sourced from giturlparse's releases.

0.16.0

Bugfixes

• Fix HTTP normalization and protocol rewrites for generic Git hosts. (#97)
• Pin ruff version to 0.15.22 (#156)

Changelog

Sourced from giturlparse's changelog.

0.16.0 (2026-10-13)

Bugfixes

• Fix HTTP normalization and protocol rewrites for generic Git hosts. (#97)
• Pin ruff version to 0.15.22 (#156)

Commits

• 4b13d0f Release 0.16.0
• 84d5fe5 chore: update AUTHORS.rst
• 95089ce Fix HTTP formatting for generic Git hosts (#162)
• 15a35ab [pre-commit.ci] pre-commit autoupdate (#163)
• 7f7eb20 [pre-commit.ci] pre-commit autoupdate (#161)
• 071dc34 [pre-commit.ci] pre-commit autoupdate (#160)
• be5b1ab [pre-commit.ci] pre-commit autoupdate (#159)
• 461fb7e [pre-commit.ci] pre-commit autoupdate (#158)
• 654a1f4 fix: pin ruff version to 0.15.22 (#157)
• 4f6fe57 [pre-commit.ci] pre-commit autoupdate (#155)
• Additional commits viewable in compare view

Updates python-dateutil from 2.9.0.post0 to 3.0.0

Release notes

Sourced from python-dateutil's releases.

3.0.0

This is the last major version of dateutil that will support any version of Python older than 3.11. The next release will be the 4.x series, which will support Python 3.11 and later. We may release fixes for serious bugs in the 3.0.x series, but there are no plans for new features there.

The biggest change in this release is a rewrite of tz.tzfile, which affects nearly every user of dateutil.tz and changes the UTC offset of nonexistent times (see below). dateutil also now depends on the tzdata package, and no longer ships its own time zone database.

Data updates

• dateutil no longer bundles a copy of the IANA time zone database. Time zone data now comes from the system (see dateutil.tz.TZPATH) or, failing that, from the new tzdata dependency, so the data version is whatever version of tzdata is installed. (gh pr #1130)

Features

• Rewrote tz.tzfile based on a backport of the zoneinfo module's pure-Python implementation. This adds support for Version 2 and Version 3 tzfile(5) binaries, resolving issues with timestamps beyond 2038 and "slim" format binaries. (gh issues #462, #1059, gh pr #1130)
• Added dateutil.tz.TZPATH and dateutil.tz.reset_tzpath to allow for runtime configuration of the IANA time zone data search path. These replace the mutable dateutil.tz.TZPATHS list, which has been removed. (gh pr #1130)
• dateutil now depends on the tzdata package, which gettz consults after the search path and before the Windows registry. On Windows this means that names that are both IANA keys and Windows time zone names, such as "UTC", now return a tzfile rather than a tzwin. (gh pr #1130)

Bugfixes

• tz.tzfile now follows PEP 495 for times that fall in a gap: with fold=0 it uses the offset from before the transition, and with fold=1 the offset from after it. Previously it always used the offset from after the transition, so for example datetime(2003, 4, 6, 2, 30, tzinfo=tz.gettz("America/New_York")) had a UTC offset of -04:00, where it now has -05:00, the same as with zoneinfo. (gh pr #1130)
• tz.tzfile objects for fixed-offset zones, such as tz.gettz("UTC"), now return their offset, DST offset and abbreviation when utcoffset, dst and tzname are called with None, as tz.tzutc, tz.tzoffset and zoneinfo.ZoneInfo do. This means that datetime.time objects with such a zone attached are now aware: time(12, tzinfo=tz.gettz("UTC")).isoformat() is now "12:00:00+00:00" rather than "12:00:00". (gh pr #1130)
• tz.tzfile now infers dst() from the standard time on both sides of each DST period, rather than only the one before it, and does so for each transition rather than for each local time type. This fixes dst() for double summer time (e.g. in Europe/London in the 1940s), for half-hour DST (e.g. in Pacific/Rarotonga) and where the standard offset changed at the same time as a DST transition (e.g. in America/Bahia_Banderas in 2010). Against the standard offsets in the tz database source, the only remaining errors are in Europe/Paris in 1944 and 1945. (gh pr #1130)
• Fixed rrulestr raising ValueError on experimental X- parameters in an RRULE line (such as GNOME Evolution's X-EVOLUTION-ENDDATE); these are now ignored as RFC 5545 permits. Fixed by @​yajo (gh pr #1374)
• Enabled pickling and deepcopy of cached rrule and rruleset instances. The cache setting is preserved, and cached results are regenerated on demand without copying locks or generators. Reported by @​niccokunzmann (gh issue #1369). Fixed by @​Jay1023CN (gh pr #1600).
• Fixed relativedelta.__ne__ raising TypeError when comparing against an unsupported type such as None; it now returns True. Reported and fixed by @​kevinkt1 (gh issue #1157, gh pr #1158)
• Raised the minimum version of six to 1.6, fixing No module named 'six.moves' errors with older versions. Reported by @​skytreader (gh issue #1415), fixed by @​jdarias3 (gh pr #1424).

Deprecations

• Deprecated the dateutil.zoneinfo module. The module now acts as a wrapper around the tzdata package and will be removed in a future version. Users are encouraged to migrate to dateutil.tz.gettz or the standard library's zoneinfo module. dateutil.zoneinfo.rebuild.rebuild no longer does anything, and by default raises RebuildDeprecationWarning as an error; filter the warning to call it as a no-op. (gh pr #1130)
• Deprecated passing gettz a relative key that refers to a file outside of every directory on TZPATH, such as "../../etc/localtime". By default this now raises dateutil.tz.DeprecatedTzKeyWarning as an error; filter the warning to keep the old behavior for now, or pass an absolute path instead. (gh pr #1130)

Documentation changes

• Added intersphinx to the docs build and cleaned up some broken links. (gh pr #1463)

Misc

• Releases are now uploaded to PyPI using trusted publishing, and the built sdist and wheel are tested on all supported platforms before upload. (gh pr #1619, #1622)
• Changes to CI, tests and release tooling that do not affect users of the package: gh pr #1417, #1462, #1464, #1465, #1466, #1467, #1468, #1469, #1470, #1499, #1501, #1504, #1576, #1577, #1578, #1581, #1585.

Changelog

Sourced from python-dateutil's changelog.

Version 3.0.0 (2026-10-21)

This is the last major version of dateutil that will support any version of Python older than 3.11. The next release will be the 4.x series, which will support Python 3.11 and later. We may release fixes for serious bugs in the 3.0.x series, but there are no plans for new features there.

The biggest change in this release is a rewrite of tz.tzfile, which affects nearly every user of dateutil.tz and changes the UTC offset of nonexistent times (see below). dateutil also now depends on the tzdata package, and no longer ships its own time zone database.

Data updates

• dateutil no longer bundles a copy of the IANA time zone database. Time zone data now comes from the system (see dateutil.tz.TZPATH) or, failing that, from the new tzdata dependency, so the data version is whatever version of tzdata is installed. (gh pr #1130)

Features

• Rewrote tz.tzfile based on a backport of the zoneinfo module's pure-Python implementation. This adds support for Version 2 and Version 3 tzfile(5) binaries, resolving issues with timestamps beyond 2038 and "slim" format binaries. (gh issues #462, #1059, gh pr #1130)
• Added dateutil.tz.TZPATH and dateutil.tz.reset_tzpath to allow for runtime configuration of the IANA time zone data search path. These replace the mutable dateutil.tz.TZPATHS list, which has been removed. (gh pr #1130)
• dateutil now depends on the tzdata package, which gettz consults after the search path and before the Windows registry. On Windows this means that names that are both IANA keys and Windows time zone names, such as "UTC", now return a tzfile rather than a tzwin. (gh pr #1130)

Bugfixes

• tz.tzfile now follows PEP 495 for times that fall in a gap: with fold=0 it uses the offset from before the transition, and with fold=1 the offset from after it. Previously it always used the offset from after the transition, so for example datetime(2003, 4, 6, 2, 30, tzinfo=tz.gettz("America/New_York")) had a UTC offset of -04:00, where it now has -05:00, the same as with zoneinfo. (gh pr #1130)
• tz.tzfile objects for fixed-offset zones, such as tz.gettz("UTC"), now return their offset, DST offset and abbreviation when utcoffset, dst and tzname are called with None, as tz.tzutc, tz.tzoffset and

... (truncated)

Commits

• 10f317f Prepare release 3.0.0
• fabac8d Run the tests against a wheel built once on a recent Python
• 21b6862 Allow pickling and deepcopy of cached recurrence rules (#1600)
• bd5fd88 Remove deprecated setuptools usage from the build
• 962f0a5 Don't fetch an unpinned setuptools_scm via setup_requires
• db944cf Update the Python version classifiers
• 3b07521 Test on Python 3.14t, 3.15 and 3.15t
• 6899421 Fix dateutil/dateutil#1157
• bc90ab4 Use trusted publishing to upload to PyPI
• 950abb6 fix(rrule): don't die on experimental properties
• Additional commits viewable in compare view

Updates gitpython from 3.2.0 to 3.2.1

Release notes

Sourced from gitpython's releases.

3.2.1

What's Changed

• prepare for next release, v3.2 by @​Byron in gitpython-developers/GitPython#2260
• objects: decode a byte mode before reading its digits by @​SashaMIT in gitpython-developers/GitPython#2261
• build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.5 to 0.16.9 in the pre-commit group by @​dependabot[bot] in gitpython-developers/GitPython#2263
• fix(submodule): validate destinations before mutation by @​Byron in gitpython-developers/GitPython#2264
• fix(util): create lock files in one exclusive step by @​radhika1314 in gitpython-developers/GitPython#2267
• fix(commit): accumulate gpgsig continuation lines in linear time by @​Keerthana-64 in gitpython-developers/GitPython#2268
• fix(index): accept a single PathLike in checkout by @​kokotatan in gitpython-developers/GitPython#2269
• fix(util): redact URL credentials without corrupting the host by @​yunaremaia in gitpython-developers/GitPython#2270
• change line for changelogs by @​CrowZhen in gitpython-developers/GitPython#2272
• fix(commit): reject identity fields that alter commit headers by @​Keerthana-64 in gitpython-developers/GitPython#2271
• fix: stop stalled remote commands when their timeout expires by @​Byron in gitpython-developers/GitPython#2277
• fix(util): reject symbolic links that alias .gitmodules by @​Keerthana-64 in gitpython-developers/GitPython#2278
• fix: send one object name or path per git stdin record by @​Keerthana-64 in gitpython-developers/GitPython#2279
• fix(stats): preserve whitespace in filenames by @​v1shay in gitpython-developers/GitPython#2280
• fix(config): preserve exact large integer values by @​xiehuanyi in gitpython-developers/GitPython#2281
• fix: resolve IterableList names independently of list attributes by @​FanWu-ai in gitpython-developers/GitPython#2283
• fix relative blocking lock 20261011 by @​Byron in gitpython-developers/GitPython#2284

New Contributors

• @​SashaMIT made their first contribution in gitpython-developers/GitPython#2261
• @​kokotatan made their first contribution in gitpython-developers/GitPython#2269
• @​yunaremaia made their first contribution in gitpython-developers/GitPython#2270
• @​CrowZhen made their first contribution in gitpython-developers/GitPython#2272
• @​v1shay made their first contribution in gitpython-developers/GitPython#2280
• @​xiehuanyi made their first contribution in gitpython-developers/GitPython#2281
• @​FanWu-ai made their first contribution in gitpython-developers/GitPython#2283

Full Changelog: gitpython-developers/GitPython@3.2.0...3.2.1

Changelog

Sourced from gitpython's changelog.

3.2.1

Security fixes for

• GHSA-83vg-56qc-22m7

If you can, also try and provide feedback on the upcoming v4 branch gitpython-developers/GitPython#2274 - patches welcome.

See the following for all changes. https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1

Commits

• c179357 prepare changelog prior to release
• 97eadb8 fix(submodule): validate destinations before mutation
• See full diff in compare view

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model()Description has been truncated