Skip to content

build(deps-dev): bump the python-patch group with 3 updates - #5

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/uv/python-patch-68589bcae4
Oct 29, 2026
Merged

build(deps-dev): bump the python-patch group with 3 updates#5
github-actions[bot] merged 1 commit into
mainfrom
dependabot/uv/python-patch-68589bcae4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 29, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-patch group with 3 updates: graphql-core, pytest-asyncio and ruff.

Updates graphql-core from 3.3.0 to 3.3.1

Release notes

Sourced from graphql-core's releases.

v3.3.1

Patch-release GraphQL-core v3.3.1, based on GraphQL.js v17.0.2.

This patch-release supports Python 3.10 to 3.15.

This is a security release. It fixes a denial-of-service vulnerability in the validator. Upgrading is recommended for all users of GraphQL-core 3.3.

Security fix:

  • Fixed a memory leak that could be used for a denial of service (see the security advisory). When a validation was aborted because the document had more errors than allowed by max_errors (100 by default), the same error object was raised every time. Its traceback grew with each aborted validation and kept the frames of all these validations alive, including their documents. Any client could exhaust the memory of a server by sending documents with more than 100 validation errors. Now a new error is created for every aborted validation (#287). GraphQL-core 3.2 is not affected.

Bug fixes:

  • The memoization of collected subfields used the ids of objects that could be freed and reused during execution. Therefore, a field could be resolved with the selection set of another field. The cache now uses the identity of the field list like GraphQL.js and keeps the list alive during execution (#284). This was a regression in 3.3.
  • Closing a subscription did not close the source iterator if the __aiter__ method of the source returned a different object, such as an async generator (#283). This was a regression in 3.3.
  • Decimal, Fraction and NumPy scalar values, as returned by database drivers, ORMs and NumPy/pandas, can be serialized as Int, Float and Boolean again (#280). This was a regression in 3.3. Different from 3.2, non-integer values such as Decimal("2.5") are rejected as Int instead of being truncated.
  • If input values of different types shared the same default value, e.g. after extend_schema(), the default was coerced for the type that was used first (#279). Coerced default values are now memoized on the argument or input field like in GraphQL.js. Schemas that were pickled with 3.3.0 can still be unpickled.

Behavior changes:

  • A GraphQLError created while another exception is handled does not take over the traceback of that exception anymore. If the error is raised, it gets its own traceback, and the handled exception becomes its context. Errors of incremental computations and reasons of abort signals do not accumulate tracebacks anymore when they are raised repeatedly.
  • validation_aborted_error has been removed from graphql.validation.validate. It was not exported.

Other changes:

  • Improved performance when coercing literal arguments, and added a benchmark for executing fields with arguments.

Thanks to @​riodw for reporting the memory leak and to @​Fire162 for submitting a first fix (#288), to @​abraira85 for reporting and analyzing the issue with the subfields and to @​jadenfix for fixing it, to @​patrick91 for fixing the shared default values and improving performance, to @​AryanRG for fixing the subscription iterator, and to @​gabor-lbl for reporting the serialization issue.

Thanks to @​jkimbo for sponsoring this project.

Commits
  • d83193f Bump version
  • e8bd478 Memoize collected subfields on the identity of the list (#285)
  • f9fc5ad Do not let errors adopt or accumulate tracebacks
  • 3c319fd Create a new error for every aborted validation
  • f0598fe Split tests for closing the consumed source iterator
  • 6b0588f Close the consumed subscription source iterator (#286)
  • d913a61 Memoize coerced default values on the input value (#282)
  • 3be333a Only reuse memoized default values for the type they were coerced to (#279)
  • e46bc83 Serialize Decimal, Fraction and NumPy scalars (#281)
  • bdab43b Avoid per-argument work when coercing literal arguments
  • Additional commits viewable in compare view

Updates pytest-asyncio from 1.4.0 to 1.4.1

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio v1.4.1

1.4.1 - 2026-10-25

Added

  • Declared support for Python 3.15 (#1588)

Fixed

  • Allow AsyncIterable as a return type for asynchronous generator fixtures decorated with pytest_asyncio.fixture (#1090)

Notes for Downstream Packagers

  • Source-tree development dependencies now use PEP 735 dependency groups and uv.lock. (#1518)
Commits
  • 6af7f5c chore: Prepare release of v1.4.1.
  • 32ccf64 Support 3.15 (#1588)
  • 9830071 Build(deps): Bump certifi from 2026.6.17 to 2026.10.19 (#1590)
  • 0238023 Build(deps): Bump virtualenv from 21.7.13 to 21.14.13 (#1589)
  • 93893ec Build(deps): Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#1583)
  • f287e5e Build(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (#1581)
  • b71da4f Build(deps-dev): Bump hypothesis from 6.168.3 to 6.168.5 (#1582)
  • d8c51d8 Build(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#1580)
  • b12808b Build(deps): Bump virtualenv from 21.7.12 to 21.7.13 (#1578)
  • e0601f0 Build(deps-dev): Bump coverage from 7.16.1 to 7.16.2 (#1577)
  • Additional commits viewable in compare view

Updates ruff from 0.17.0 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

  • [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

  • Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
  • [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
  • [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
  • [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
  • [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

  • Avoid intermediate names in lint name resolution (#29506)
  • Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
  • Share postfix parsing and reduce expression copies (#29480)

Configuration

  • [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

  • Clarify documentation and correct stale guidance (#29374)
  • [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

... (truncated)

Commits
  • 30516b4 Bump version to 0.17.2 (#29637)
  • 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
  • 0d562aa [ty] Check inherited attribute conflicts (#28559)
  • 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
  • 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
  • b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
  • 32869b4 Avoid creating deployments for automation jobs (#29626)
  • ec891ba Link the commit in pull request report footers (#29621)
  • 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
  • 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the python-patch group with 3 updates
ac0cec1 
Bumps the python-patch group with 3 updates: [graphql-core](https://github.com/graphql-python/graphql-core), [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) and [ruff](https://github.com/astral-sh/ruff).


Updates `graphql-core` from 3.3.0 to 3.3.1
- [Release notes](https://github.com/graphql-python/graphql-core/releases)
- [Commits](graphql-python/graphql-core@v3.3.0...v3.3.1)

Updates `pytest-asyncio` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases)
- [Commits](pytest-dev/pytest-asyncio@v1.4.0...v1.4.1)

Updates `ruff` from 0.17.0 to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.0...0.17.2)

---
updated-dependencies:
- dependency-name: graphql-core
  dependency-version: 3.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-patch
- dependency-name: pytest-asyncio
  dependency-version: 1.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-patch
- dependency-name: ruff
  dependency-version: 0.17.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 29, 2026
@github-actions
github-actions Bot merged commit 4cf9864 into main Oct 29, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants