[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
astral-sh/setup-uv	action	patch	v10.3.0 → v10.3.2
charliermarsh/ruff-pre-commit	repository	patch	v0.17.0 → v0.17.2
httpx2 (changelog)	project.dependencies	minor	>=2.13.1 → >=2.16.0
pre-commit	dependency-groups	minor	>=4.6.2 → >=4.7.0
pytest-asyncio (changelog)	dependency-groups	patch	>=1.4.0 → >=1.4.1
ruff (source, changelog)	dependency-groups	patch	>=0.17.0 → >=0.17.2
vcrpy	dependency-groups	minor	>=8.3.0 → >=8.5.0

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

astral-sh/setup-uv

v10.3.2: 🌈 update known checksums for 0.13.5

Compare Source

Changes

🧰 Maintenance

• chore: update known checksums for 0.13.5 @​github-actions[bot] (#​1103)

📚 Documentation

• docs: update version references to v10.3.1 @​github-actions[bot] (#​1102)

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes

• fix: preserve cache error class names in save-cache bundle @​dannyward630 (#​1093)

🧰 Maintenance

• chore: update known checksums for 0.13.4 @​github-actions[bot] (#​1099)
• chore: update known checksums for 0.13.2/0.13.3 @​github-actions[bot] (#​1098)
• chore: update known checksums for 0.13.1 @​github-actions[bot] (#​1094)
• Verify npm dependency signatures before builds @​zaniebot (#​1027)

📚 Documentation

• docs: cache-dependency-glob matches relative to the working directory @​flange-ipb (#​1092)
• docs: update version references to v10.3.0 @​github-actions[bot] (#​1090)

⬆️ Dependency updates

• chore(deps): roll up Dependabot updates @​eifinger (#​1101)

charliermarsh/ruff-pre-commit

v0.17.2

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.17.2

v0.17.1

Compare Source

See: https://github.com/astral-sh/ruff/releases/tag/0.17.1

pydantic/httpx2 (httpx2)

v2.16.0

Compare Source

Highlights

🍪 Faster requests with large cookie jars

Building the Cookie header no longer scans every cookie in the jar. The client reuses its jar instead of copying it on every request and redirect (#​1284), only looks up the domains that can match the request host, and skips the expired cookie sweep until a cookie is due (#​1285). With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster.

Cookies from different domains are now sent from the least to the most specific domain, for example .example.org before sub.example.org, instead of in the order the domains were added. Cookies with longer paths still come first.

httpx2

Changed

• Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain (#​1285).

Fixed

• Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests (#​1284).

httpcore2

No changes since 2.15.1. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.15.1...v2.16.0

v2.15.1

Compare Source

Highlights

🔒 Flat CPU usage for long-lived clients on Linux

On Linux, the default SSL context is now configured once instead of on every handshake (#​1253). With OpenSSL older than 3.4, each handshake added a duplicate certificate lookup path, so CPU usage per request grew over the lifetime of a reused client. Certificate verification is unchanged, and Windows and macOS still use truststore.

httpx2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#​1253).

httpcore2

Fixed

• Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#​1253).

Full Changelog: pydantic/httpx2@v2.15.0...v2.15.1

v2.15.0

Compare Source

Highlights

🐍 Python 3.11+ required

httpx2 and httpcore2 no longer support Python 3.10 (#​1274). There are no other changes in this release.

httpx2

Removed

• Drop support for Python 3.10 (#​1274).

httpcore2

Removed

• Drop support for Python 3.10 (#​1274).

Full Changelog: pydantic/httpx2@v2.14.0...v2.15.0

v2.14.0

Compare Source

Highlights

🌐 CIDR ranges in NO_PROXY

NO_PROXY and mounts now match IP CIDR ranges like 192.168.0.0/16 and [fe80::]/10, so any address in the range bypasses the proxy (#​1165). Bracketed IPv6 addresses like [::1]:8080 are accepted, and unparseable NO_PROXY entries are ignored instead of failing client creation (#​1267).

🔐 FIPS-enforced Python support

httpx2 now imports on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError only when the server asks for an unavailable algorithm (#​1130).

🔌 Sturdier connections and WebSocket shutdown

HTTP/2 reads no longer block when a server lowers SETTINGS_MAX_CONCURRENT_STREAMS mid-flight (#​1217), and writing after a peer closes TLS without close_notify raises WriteError (#​1263). Sync WebSocket sessions no longer hang on exit with a full event queue (#​1123), and ASGI WebSocket reads after app shutdown no longer leak anyio exceptions (#​1233).

httpx2

Added

• Match IP CIDR ranges, like 192.168.0.0/16 and [fe80::]/10, in NO_PROXY and mounts. Requests to any address in the range now bypass the proxy; previously only the network address itself did (#​1165).
• Accept bracketed IPv6 addresses, like [::1] and [::1]:8080, in NO_PROXY (#​1267).

Changed

• Raise InvalidURL for a mounts key with an IP host followed by anything other than a valid CIDR prefix, like all://10.0.0.0/33 (#​1165).

Fixed

• Ignore NO_PROXY entries that cannot be parsed, instead of raising InvalidURL when the client is created (#​1267).
• Import httpx2 on FIPS-enforced Python builds without hashlib.md5. DigestAuth raises ProtocolError when the server asks for an unavailable algorithm (#​1130).
• Handle reads after an ASGI WebSocket app shuts down, instead of leaking anyio exceptions (#​1233).
• Stop the sync WebSocket session from hanging on exit when its event queue is full (#​1123).

httpcore2

Fixed

• Keep CONNECT and absolute-form proxy targets when the request sets the target extension (#​1262).
• Stop blocking reads when an HTTP/2 server lowers SETTINGS_MAX_CONCURRENT_STREAMS while requests are in flight (#​1217).
• Raise WriteError instead of anyio.EndOfStream when writing after the peer closes a TLS connection without close_notify (#​1263).

Full Changelog: pydantic/httpx2@v2.13.1...v2.14.0

pre-commit/pre-commit (pre-commit)

v4.7.0

Compare Source

==================

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #​3773 issue by @​cbirkhold.
  • #​3774 PR by @​cbirkhold.

pytest-dev/pytest-asyncio (pytest-asyncio)

v1.4.1: pytest-asyncio v1.4.1

Compare Source

1.4.1 - 2026-10-25

Added

• Declared support for Python 3.15 (#​1588)

Fixed

• Allow AsyncIterable as a return type for asynchronous generator fixtures decorated with pytest_asyncio.fixture (#​1090)

Notes for Downstream Packagers

• Source-tree development dependencies now use PEP 735 dependency groups and uv.lock. (#​1518)

astral-sh/ruff (ruff)

v0.17.2

Compare Source

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#​25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#​28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#​29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#​29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#​29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#​29413)

Performance

• Avoid intermediate names in lint name resolution (#​29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#​29561)
• Share postfix parsing and reduce expression copies (#​29480)

Configuration

• [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#​18961)

Documentation

• Clarify documentation and correct stale guidance (#​29374)
• [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#​29592)

Contributors

• @​fixfon
• @​MichaReiser
• @​zaniebot
• @​FrancescoPezzella
• @​anishgirianish
• @​rajveer3x
• @​charliermarsh
• @​LckyLike
• @​DaniBodor

v0.17.1

Compare Source

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#​29322)

Bug fixes

• Fix dedent with multiple leading comments (#​29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#​28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#​29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#​29366)

Rule changes

• Treat more collections and weakref containers as mutable (#​29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#​29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

kevin1024/vcrpy (vcrpy)

v8.5.0

Compare Source

What's Changed

aiohttp streaming

• Streaming a response body from response.content (read(), iter_chunked(), readline() loops, ...) while recording no longer returns an empty body (#​502)
• readline() loops on replayed responses now reach the end of the body instead of restarting from the start on each access. This fixes the infinite loop when replaying google-genai streaming responses (#​927)
• response.content is now aiohttp's own StreamReader, both when recording and on replay. iter_any() and iter_chunks() work, lines over 64 KiB are no longer refused, and readuntil(), is_eof(), total_bytes and the rest of its API are available

All three are from #​1055 — thanks @​pylaterreur!

If your tests patch vcr.stubs.aiohttp_stubs to work around #​502 or #​927 (for example by overriding MockClientResponse.content, or by putting the recorded body back with unread_data()), remove the patch: it is no longer needed, and no longer works.

Other fixes

• Fix filter_post_data_parameters crashing with UnicodeDecodeError on binary request bodies passed as bytes or bytearray, which are now left untouched, and stop it mangling form segments without a = (#​660, #​1039). Thanks @​philsong4-ai
• Fix recording aiohttp requests that upload an open file as a form field (data={"file": f}), which crashed with TypeError: cannot pickle '_io.BufferedReader' object. The file's contents are recorded and the whole file is still sent (#​737, #​1073). Thanks @​LilSpazJoekp for the report
• Fix recording aiohttp requests whose body is an async generator, e.g. a streaming upload (#​974, #​1069). Thanks @​smoltafet

Python support

• Support Python 3.14 and 3.15, and test them in CI along with their free-threaded builds, 3.14t and 3.15t (#​940, #​1058). Thanks @​pylaterreur

Full Changelog: kevin1024/vcrpy@v8.4.0...v8.5.0

v8.4.0

Compare Source

What's Changed

Behavior change: the all record mode

• Fix re-recording in the all record mode (#​1071, fixes #​578 and #​208):
  • A re-recorded interaction now replaces the interaction it matches. Before, the new one was saved next to the old one, and the stale response was replayed first on the next run.
  • With drop_unused_requests=True, the cassette is now replaced with only what was just recorded. Before, it was saved empty.
  • Behavior change: re-recording now removes every previously recorded interaction that matches a new one under your match_on setting. With loose matchers (e.g. match_on=["method"]), one new request can replace many old ones. Cassettes re-recorded in all mode also no longer accumulate responses across runs.

Fixes

• Fix httpx and httpx2 replay crashing on cassettes that store a null reason phrase, which includes cassettes recorded before 8.2.0 (#​1028, #​1029). Thanks @​dgunning
• Fix bare-host URLs such as https://example.com not matching cassettes that recorded them as https://example.com/, a regression in 8.2.0 (#​1013, #​1031). The uri matcher is otherwise as strict as before. Thanks @​DSeaStar
• Fix AttributeError: 'VCRFakeSocket' object has no attribute 'gettimeout' when niquests reuses a pooled connection with urllib3-future 2.25.901 or later (#​1056). Thanks @​pylaterreur
• Streaming (file-like or iterator) request bodies are now forwarded with Content-Length instead of chunked encoding, which some servers reject (#​1002)

Maintenance

• CI: pin the PyPy jobs to PyPy 7.3, fix a flaky urllib3 test, bump actions/checkout to v7 and ruff to 0.17.1 (#​1060, #​1059, #​1005, #​1065). Thanks @​pylaterreur

Full Changelog: kevin1024/vcrpy@v8.3.0...v8.4.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: uv.lock

Downloading cpython-3.10.22-linux-x86_64-gnu (download) (28.0MiB)
 Downloaded cpython-3.10.22-linux-x86_64-gnu (download)
Using CPython 3.10.22
error: No solution found when resolving dependencies for split (markers: python_full_version == '3.10.*' and platform_python_implementation != 'PyPy')
  cause: Because the requested Python version (>=3.10) does not satisfy Python>=3.11 and your project depends on httpx2[http2]>=2.16.0, we can conclude that your project's requirements are unsatisfiable.
         And because your project requires picimagesearch[socks], we can conclude that your project's requirements are unsatisfiable.