[dependabot]

Bumps the python-minor-patch group with 13 updates in the / directory:

Package	From	To
celery	5.6.3	5.7.0
flower	2.1.0	2.2.0
cryptography	50.0.1	50.0.2
tzdata	2026.3	2026.6
pyjwt	2.13.0	2.15.1
aiohttp	3.14.3	3.14.5
pyturso	0.7.2	0.8.3
pre-commit	4.6.2	4.7.0
ruff	0.16.6	0.17.4
ty	0.0.80	0.0.100
pytest	9.1.1	9.2.0
commitizen	4.18.0	4.19.3
django-stubs	6.1.0	6.1.2

Updates celery from 5.6.3 to 5.7.0

Release notes

Sourced from celery's releases.

v5.7.0

Celery 5.7.0

We're pleased to announce Celery 5.7.0, a new stable release of Celery.

This release brings substantial improvements to task workflows, worker reliability, result handling, scheduling, and broker connectivity. It also includes new integrations, improved Python compatibility, performance optimizations, and a large number of bug fixes contributed by the community.

A significant part of this release focuses on making complex Canvas workflows more reliable and efficient, improving worker behavior during broker disconnections and shutdown, and making result-backend state handling more consistent.

Highlights

• More reliable Canvas workflows: Improved chains, groups, chords, nested workflows, callbacks, errbacks, and failure propagation. Several fixes also reduce unnecessary message growth in complex chains and chords.
• Improved worker reliability: Better connection recovery, graceful shutdown, prefork process management, autoscaling, and handling of worker-process loss.
• More predictable task results: Improved result-state consistency, retry handling, ignore_result behavior, and concurrent AsyncResult tracking.
• Timezone and scheduling improvements: More reliable ETA, countdown, expiration, crontab, solar schedules, and Celery Beat behavior across daylight-saving-time transitions.
• New Pydantic integration behavior: Tasks configured with pydantic=True can accept Pydantic model instances.
• New pymemcache result backend support: Adds support for using pymemcache as a result backend.
• Improved Redis result backend: New expiration settings for chord and failure results, improved Pub/Sub handling, and more reliable chord accounting.
• Better Python compatibility: Python 3.10 is now the minimum supported version, with compatibility work for newer Python versions, including Python 3.14.
• Improved worker operations: Cgroup-aware automatic concurrency detection and additional worker-management improvements.

What's New

Canvas, Chains, Groups, and Chords

Celery 5.7 includes extensive improvements to Canvas execution and composition, particularly for nested workflows and complex chains and chords.

• Fixed failure propagation through chained tasks into chord bodies.
• Improved chord failure handling when a chord header or a chained chord fails.
• Fixed chord error handling when the chord body is itself a chain.
• Improved handling of empty groups and chains, including empty groups inside chains and group headers.
• Chains are now constructed in a single pass instead of repeatedly folding signatures with the | operator.
• Reduced unnecessary message growth in chains of chords, chains of groups, implicit chords, and standalone chord bodies.
• Improved nested group handling and preservation of group IDs.
• Fixed duplicate nodes in GroupResult.as_tuple() after groups in chains.
• Improved GroupResult fan-out behavior in chains.
• Fixed eager execution behavior for chains containing Ignore or Reject.
• Avoided unnecessary result-backend access when eagerly applying groups inside chains.
• Improved task replacement with chains containing groups, including cases that previously could hang.
• Improved callback execution when a task is replaced by a chain, ensuring callbacks are not invoked repeatedly.
• Fixed eager-chain callback behavior so that chain links are dispatched once at the appropriate point.
• Improved propagation of task options, ETA, and countdown values to chord headers.
• Corrected the handling of link and link_error options on chords so they are applied to the chord body.
• Improved errback argument classification and handling of new-style errback calls.
• Preserved group errback mutability and improved stamped-header merging and revocation.
• Improved signature cloning and option isolation, preventing cloned signatures from sharing mutable keyword arguments with their originals.
• Fixed argument forwarding through nested chains during eager execution.
• Improved map and starmap option merging.

These changes make complex Canvas compositions more predictable and reduce unnecessary broker traffic and message growth.

... (truncated)

Changelog

Sourced from celery's changelog.

5.7.0

:release-date: 2026-11-05 :release-by: Asif Saif Uddin

Celery v5.7.0 Stable Release is now available for testing and deploy to production. Please help us test this version and report any issues.

What's Changed Since 5.7.0rc1

This section summarizes the changes made since the Celery 5.7.0rc1 pre-release.

Canvas, Chains, Groups, and Chords

• Run a replaced task's callbacks once when it is replaced with a chain (:ghpull:10927`).
• Fix chord link and link-error options so they are passed to the body only (:ghpull:10778`).
• Fix stamped header revocation (:ghpull:10884`).
• Count each chord header task only once in the Redis backend (:ghpull:10919`).
• Fix Redis chord claim cleanup ownership (:ghpull:10998`).
• Fail the chord when chord_unlock retry is refused by the broker (:ghpull:10959`).

Task Execution and Result Handling

• Fix retry argument conflicts when switching calling conventions (:ghpull:10895`).
• Pass values to backend hooks by position again (:ghpull:10918`).
• Don't mark a task REVOKED while another worker is running it (:ghpull:10922`).
• Keep the first SUCCESS in the database, MongoDB, and Cassandra backends (:ghpull:10920, :ghpull:10944, :ghpull:10945`).
• Don't record FAILURE when on_success raises after SUCCESS was stored (:ghpull:10759`).
• Don't fail a task whose SUCCESS was stored before the worker was lost (:ghpull:10752`).
• Fix a worker hang in WorkerLostError when result_backend_always_retry=True (:ghpull:10960`).
• Fix send_task() overriding ignore_result defaults (:ghpull:10953`).
• Preserve ignore_result overrides across task retries (:ghpull:10958`).
• Make Task.apply() respect the task.ignore_result default (:ghpull:11001`).
• Don't store RETRY for an ignored result when retrying after a lost worker (:ghpull:11009`).
• Track every AsyncResult waiting on a task ID (:ghpull:10956`).
• Allow ResultSet.add() after the set's results are ready (:ghpull:10930`).
• Use the documented retry defaults in the database backend (:ghpull:10921`).
• Fix Manager warning output during retries (:ghpull:10948`).
• Wait between retries when the broker refuses a callback publish (:ghpull:10975`).
• Merge signature options in map and starmap apply_async() (:ghpull:10787`).
• Stop gating task publishing signals on cached receiver lists (:ghpull:10791`).

Worker Operations

... (truncated)

Commits

• 6fcdbf9 Bump version: 5.7.0rc1 → 5.7.0 (#11025)
• 4a1d6f4 Make beat's pidbox stop test tolerate slow runners (#11024)
• 6a80d47 Added changelog and new features for celery v5.7.0 stable version (#11016)
• 6b67b23 Fix dead Akismet and vine zipball links in the docs (#11021)
• e82fa93 Chore(deps): Bump azure-identity from 1.26.0 to 1.27.0
• 2fe0ead Chore(deps): Bump google-cloud-storage from 3.15.0 to 3.17.1 (#11013)
• 89ce900 Fix#10997 - redis chord claim cleanup ownership (#10998)
• 5d83c46 Don't store RETRY for an ignored result when retrying after a lost worker (#1...
• 1f435e5 Use Cuba's 2025 fall-back in the midnight DST tests
• 98b7ba9 Update kombu version to 5.7.0 (#11007)
• Additional commits viewable in compare view

Updates flower from 2.1.0 to 2.2.0

Release notes

Sourced from flower's releases.

v2.2.0

Security

• Added CSRF protection for cookie-authenticated sessions
• Added protection against cross-site state-changing requests
• Added an OAuth state check to all login handlers
• Restricted the post-login redirect to local paths
• Enabled TLS certificate validation for the RabbitMQ management API
• Escaped all table cells on the tasks and workers pages
• Escaped load average values in the workers grid
• Added HttpOnly and SameSite to session cookies
• Added the X-Content-Type-Options: nosniff header
• Limited CORS headers to the unauthenticated API
• Served API error messages as plain text

Features

• Added a logout link for OAuth sessions #1074
• Added a timeout option to the task apply API
• Added a page size selector to the tasks page #1518
• Linked task names to a list of all tasks with that name
• Linked the task counts on the workers page to the matching tasks
• Honored the column order of the tasks_columns option #1262
• Added thousands separators to task counts #1374
• Formatted durations and showed a dash for missing values
• Added search examples as placeholder text
• Made wide tables scroll sideways and shortened UUIDs on mobile
• Limited worker page task lists to 50 entries by default #1087
• Removed the Retried column from the workers page
• Named browser tabs by page

Performance and reliability

• Made persistent state saves atomic #1403
• Fixed startup failing on a corrupt persistent state database #1398
• Added a warning when state saving dominates the save interval
• Reapplied --max-tasks to restored persistent state #1380
• Honored the --purge-offline-workers grace period after worker-offline events #1190
• Inspected a worker lazily on its first page visit #1388
• Fetched worker task lists only when inspecting a single worker
• Validated the --broker-api URL at startup
• Required both --certfile and --keyfile when either is set
• Validated task API query parameters and publish payloads

Bug fixes

• Fixed worker task table column widths #1521 by @​ShubhAtWork
• Fixed the default RabbitMQ management API URL to use the management port #1232
• Fixed the theme dropdown not closing and stuck navbar tooltips
• Fixed a server error on the task page for tasks without a name

... (truncated)

Commits

• 4d4a9ac Set release version
• b884844 Exclude compiled and hidden files from the sdist
• fba84ef Merge remote-tracking branch 'origin/master' into 2.0
• ea34f92 Fix broken and moved links in the docs
• 1336fbd Fix the unpicklable state test on Python 3.10 to 3.13
• 0f04846 Open the state shelves with context managers
• 8034099 Apply the ruff style rewrites to the package
• b14b43d Fix the ruff errors in the tests
• b9f7189 Apply ruff's safe fixes and literal rewrites to the package
• ff33bc8 Tidy the task API test bodies and name lookups
• Additional commits viewable in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.
.. _v50-0-1:

Commits

• 4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
• 70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
• a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
• See full diff in compare view

Updates tzdata from 2026.3 to 2026.6

Release notes

Sourced from tzdata's releases.

2026.6: Release of upstream tzdata 2026f

Version 2026.6

Upstream version 2026f released 2026-10-28T06:16:49+00:00

Briefly:

Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07. No more leap seconds, and leap second tables no longer expire. Improve 1965/1966 data for Brazil.

Changes to future timestamps

Cuba will not fall back to -05 on 2026-11-01 and instead plans to maintain -04 through 2027-11-07.

Changes to past timestamps

In 1965 Brazil ended DST on 03-31 at 24:00 not 00:00, and in 1966 it ended DST on 03-01 at 01:00 not 00:00. (Thanks to Daniel Dias Rodrigues.)

Changes to documentation and commentary

Documentation and commentary now reflect leap seconds’ demise.

Changes to commentary

Discussion on timekeeping in northwestern Ontario has been updated to reflect that provincial regulation has been issued to allow these areas to stay aligned with America/Winnipeg and follow Manitoba’s adoption of year-round -05 after all. (Thanks to Aoun Khan, Chris Walton, and Heitor David Pinto.)

Discussion on timekeeping in Saskatchewan has been updated to document its new Time Act, 2026 which comes into force on 2026-10-30. (Thanks to Heitor David Pinto.) No change is expected.

2026.5: Release of upstream tzdata 2026e

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00.

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on

... (truncated)

Changelog

Sourced from tzdata's changelog.

Version 2026.6

Upstream version 2026f released 2026-10-28T06:16:49+00:00

Briefly:

Cuba will not fall back 2026-11-01; stays on -04 through 2027-11-07. No more leap seconds, and leap second tables no longer expire. Improve 1965/1966 data for Brazil.

Changes to future timestamps

Cuba will not fall back to -05 on 2026-11-01 and instead plans to maintain -04 through 2027-11-07.

Changes to past timestamps

In 1965 Brazil ended DST on 03-31 at 24:00 not 00:00, and in 1966 it ended DST on 03-01 at 01:00 not 00:00. (Thanks to Daniel Dias Rodrigues.)

Changes to documentation and commentary

Documentation and commentary now reflect leap seconds’ demise.

Changes to commentary

Discussion on timekeeping in northwestern Ontario has been updated to reflect that provincial regulation has been issued to allow these areas to stay aligned with America/Winnipeg and follow Manitoba’s adoption of year-round -05 after all. (Thanks to Aoun Khan, Chris Walton, and Heitor David Pinto.)

Discussion on timekeeping in Saskatchewan has been updated to document its new Time Act, 2026 which comes into force on 2026-10-30. (Thanks to Heitor David Pinto.) No change is expected.

---

Version 2026.5

Upstream version 2026e released 2026-09-30T00:14:38+00:00

Briefly:

Manitoba moves to permanent -05 on 2026-10-31.

Changes to future timestamps

Manitoba’s 2026-03-08 spring forward was its last foreseeable clock change, as it moved to permanent -05 thereafter. Model this with its traditional abbreviation EST. Although the change to permanent -05 legally takes place on 2026-10-31, temporarily model the change to occur on 2026-11-01 at 02:00 for the same reason as other recent temporary hacks. (Caution: see “NOTE FOR 2026b

... (truncated)

Commits

• 0d4342c Update tzdata to version 2026f (#157)
• 9493aab Update tzdata to version 2026e (#154)
• b4d2086 Update tzdata to version 2026d (#153)
• 91a9022 Switch keyserver used for tarball GPG verification (#152)
• c97164f Bump the actions group with 3 updates (#150)
• 6c7fa78 Stop testing 3.8 and 3.9, test 3.15 and PyPy3 (#148)
• d165386 Bump the Actions group with 2 updates (#149)
• See full diff in compare view

Updates pyjwt from 2.13.0 to 2.15.1

Release notes

Sourced from pyjwt's releases.

2.15.1

See the 2.15.1 changelog for complete release details.

2.15.0

See the 2.15.0 changelog for complete release details.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>__

Fixed

- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`[#1209](https://github.com/jpadilla/pyjwt/issues/1209) <https://github.com/jpadilla/pyjwt/issues/1209>`__).
v2.15.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&gt;__
Security

• Wrap recursion errors from deeply nested JWT payloads in DecodeError instead of exposing a raw RecursionError.

Added

- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__
Changed

• JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS payload, so a cache hit no longer re-parses every key. JWKSetCache.put() accepts either form and raises PyJWKSetError for anything else. As a result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance for as long as it stays cached, rather than a freshly built one per call in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
• PyJWKClient.fetch_data() now raises PyJWKClientError("The JWKS endpoint did not return a JSON object") when the endpoint response is not a JSON object, instead of returning it for get_jwk_set() to reject. Callers reaching the JWKS through get_jwk_set() see the same error as before in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
</tr></table> 

... (truncated)

Commits

• 7d5ef55 chore: prepare 2.15.1 release
• 7bf3252 Accept canonical Base64URL padding in JWT segments (#1216)
• 1d41a64 chore: prepare 2.15.0 release
• 9bc0665 fix: make recursive payload tests deterministic
• 5fde08a fix: normalize recursive JWT payload errors
• 171062d utils: mention bytes in force_bytes type error (#1173)
• c9d4d53 docs/conf: drop duplicate 'and' from read() docstring (#1174)
• 2763752 Add support for Python 3.15 (#1202)
• 4adcd02 Catch http.client.HTTPException in PyJWKClient.fetch_data (#1201)
• 9e501d9 fix: correct docstring typo in _validate_jti (#1179)
• Additional commits viewable in compare view

Updates aiohttp from 3.14.3 to 3.14.5
Updates pyturso from 0.7.2 to 0.8.3

Release notes

Sourced from pyturso's releases.

v0.8.3

Install turso_cli 0.8.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tursodatabase/turso/releases/download/v0.8.3/turso_cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/tursodatabase/turso/releases/download/v0.8.3/turso_cli-installer.ps1 | iex"

Download turso_cli 0.8.3

File	Platform	Checksum
turso_cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
turso_cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
turso_cli-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
turso_cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
turso_cli-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
turso_cli-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo tursodatabase/turso

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.8.3-pre.2

Install turso_cli 0.8.3-pre.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/tursodatabase/turso/releases/download/v0.8.3-pre.2/turso_cli-installer.sh | sh

Install prebuilt binaries via powershell script

</tr></table> 

... (truncated)

Changelog

Sourced from pyturso's changelog.

Changelog

0.8.0 -- 2026-09-28

Added

• Add rule on helper functions (Mikaël Francoeur)
• core/schema: Fix ALTER TABLE ADD/DROP COLUMN dropping column type size parameters (Sergei Iarymov)
• testing: add an FTS stress workload and Antithesis singleton (Pedro Muniz)
• core/translate: run ADD COLUMN DEFAULT type check only on STRICT tables (Ryan Lin)
• perf/fts: add search benchmarks, CPU profiles, and peak heap measurements (Pedro Muniz)
• core/vdbe: add AggStep fast paths for float sum, avg and count (Pekka Enberg)
• sqlite/conformance: add generated-column coverage from the issue backlog (Glauber Costa)
• simulator: add power loss (Pavan Nambi)
• add valgrind to the devcontainer (Mikaël Francoeur)
• Add aristo intent on partial writes (Mikaël Francoeur)
• perf: add join optimizer benchmarks and metrics (Jussi Saurio)
• postgres: support WITHIN GROUP aggregates (Joe Sluis)
• Add per-seed timeouts to differential_fuzzer CI runs so pathological queries fail faster (Jussi Saurio)
• bindings/c: implement sqlite3_strnicmp (Ishwar)
• bindings/dotnet: support batches on embedded replicas (Marc-André Moreau)
• fts/testing: add FTS workload to concurrent simulator (Preston Thorpe)
• serverless/compat: add reconnect support (Ishwar)
• serverless/js: fix broken README links and add repository field (Pure Tech)
• bindings/c: implement sqlite3_total_changes64 (Ishwar)
• bindings/dotnet: add connection-string embedded replicas (Marc-André Moreau)
• postgres: support quit and exit commands in tursopg cli (Joe Sluis)
• bindings/dotnet: add advanced sync database options (Marc-André Moreau)
• core/schema: add collation property in to_sql output for btree table (thomas kim)
• bindings/dotnet: add managed pull replica API (Marc-André Moreau)
• postgres: implement pg_get_expr function (Joe Sluis)
• core: make autovacuum an additive cargo feature (Pekka Enberg)
• Add snapshot tests for multi-index with intersection (Mikaël Francoeur)
• serverless/rust: add Builder::with_auth_token_fn for rotating tokens (Glauber Costa)
• Add ARGS variable to run-cli Makefile target (Mikaël Francoeur)
• Introduce Affinity::None (Mikaël Francoeur)
• add sqltest instructions (Mikaël Francoeur)
• Add EXPLAIN QUERY PLAN format=json (Mikaël Francoeur)
• bindings/tcl: implement [db status] statement counters (Pekka Enberg)
• core/storage: add more tests for codec interface (Avinash Sajjanshetty)
• Support virtual columns in covering indexes (Mikaël Francoeur")
• Support virtual columns in covering indexes (Mikaël Francoeur)
• bindings/c: implement sqlite3_set_authorizer, sqlite3_db_config, sqlite3_extended_result_codes (Glauber Costa)
• add select star benchmark (Mikaël Francoeur)
• core: implement PRAGMA count_changes (roboturso)
• add missing field to fix build (Mikaël Francoeur)
• core: support NULLS FIRST/LAST in indexes (Mikaël Francoeur)
• core/translate: add full window frame support (Jussi Saurio)
• core/storage: add page codec interface (Avinash Sajjanshetty)
• add missing argument to fix build (Mikaël Francoeur)
• postgres: implement session information functions (Michael)

... (truncated)

Commits

• 607bff9 Turso 0.8.3
• bffb321 Update CHANGELOG.md
• 54e1bfa Turso 0.8.3-pre.2
• 39cb28b Merge 'core/mvcc: publish upgraded logical-log header only after its write su...
• 38ef629 Merge 'core/mvcc: keep finalized state of transactions still in txs during GC...
• ff9f39b Merge 'core/mvcc: keep late commits in the logical log on passive-flag TRUNCA...
• 8a4dc8e Merge 'core/mvcc: make B-tree deletion and conflict checking atomic' from Ped...
• cddf026 Merge 'core/mvcc: keep the outer transaction when nextval's inner commit is a...
• 3b4d4ed Merge 'core/mvcc: stop AUTOINCREMENT from overwriting a row inserted with exp...
• 93c4f2f Merge 'core/mvcc: skip a redundant index seek only for a key that matches one...
• Additional commits viewable in compare view

Updates pre-commit from 4.6.2 to 4.7.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.7.0

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Changelog

Sourced from pre-commit's changelog.

4.7.0 - 2026-10-12

Fixes

• Fix language: node hooks during commit with -a or inside a submodule.
  • Regressed in 4.6.1.
  • #3773 issue by @​cbirkhold.
  • #3774 PR by @​cbirkhold.

Commits

• 65bb884 v4.7.0
• 73926c1 Merge pull request #3774 from cbirkhold/node-no-git-env-npm-install
• 860d07d don't leak GIT_* env into npm install for language: node
• 9ad8a0a Merge pull request #3775 from pre-commit/contextlib-chdir
• 9905e88 use contextlib.chdir
• 59cb792 Merge pull request #3771 from pre-commit/all-repos_autofix_py311-plus
• 2be1701 remove triple-nested withs for 3.14 coverage
• 4c8d22a py311+
• c429238 Merge pull request #3770 from pre-commit/pre-commit-ci-update-config
• f49e251 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

Updates ruff from 0.16.6 to 0.17.4

Release notes

Sourced from ruff's releases.

0.17.4

Release Notes

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.4

Released on 2026-11-05.

Preview features

• [flake8-logging-format] Avoid behavior changes and syntax errors in fixes (G004) (#27419)
• [security] Implement tarfile-ignore-zeros-true (#28680)

Bug fixes

• Accept a bare raise before a semicolon (#29761)
• Allow match identifiers after a semicolon (#29760)
• Fix panic on BOM-prefixed files in diagnostic renderer (#30017)
• [flake8-simplify] Report collapsible elif clauses after a multi-statement if branch (SIM102) (#29814)

Rule changes

• Show more nonprinting characters in diagnostic fix diffs (#30062)

Performance

• Coalesce source slices when formatting attributes (#29841)
• Collect return statements with a statement-only visitor (#29911)
• [pyflakes] Defer value comparisons for repeated dictionary keys (F601, F602) (#29739)
• Format node fields directly when comment handling is unnecessary (#29853)
• Reduce formatter source-slice overhead (#29855)
• Reuse a callee's qualified name across lint rules (#29916)
• Skip invalid string character checks when the source contains none (#29883)
• Use a Bloom filter for formatter comment lookups (#29852)
• Use a concrete buffer for ordinary writes (#29819)

CLI

• Give NO_COLOR precedence in Ruff and ty diagnostics (#29898)
• Honor CLICOLOR=0 in Ruff and ty diagnostics (#29910)

Documentation

• Correct the documented version and src defaults for ruff-action (#29880)
• [flake8-bugbear] Make B014 example error out-of-the-box (#29941)
• [flake8-no-pep420] Document preview behavior (INP001) (#29764)
• [isort] Expand I001 documentation (#29843)

Other changes

• [syntax-errors] Extend __debug__ write check to attribute targets (#27908)

Contributors

... (truncated)

Commits

• 05cdc36 Bump version to 0.17.4 (#30073)
• c6b17c2 [ty] Freshen method typevars before owner specialization (#29543)
• 4b0b407 [ty] Preserve unions inferred during fixpoint iteration (#29927)
• 1dd3e9e Show more nonprinting characters in diagnostic fix diffs (#30062)
• 32be8e7 [ty] Skip fixpoint iteration for simple generic calls (#30054)
• 926ccc8 [ty] Handle output errors when generating shell completions (#29997)
• c86652a [ty] Skip active Conda and Pixi environments during discovery if the environm...
• c9150f0 Add project walltime benchmarks for Ruff (#30061)
• 64989ec [ty] Report invalid module globs once per override pattern (#30031)
• 367a563 [ty] Fix conditional type and tuple annotations (#29987)
• Additional commits viewable in compare view

Updates ty from 0.0.80 to 0.0.100

Release notes

Sourced from ty's releases.

0.0.100

Release Notes

Released on 2026-11-09.

Breaking changes

• Distinguish attributes missing from some union members (#29944)
• Give abstract class instantiation its own diagnostic rule (#29948)
• Separate missing and inconsistent overload implementation diagnostics (#29953)
• Split invalid-key into three TypedDict diagnostic rules (#29955)
• Split out lost-keyword-for-regular-parameter from incompatible-method-override (#30143)

Bug fixes

• Fix partial application of ParamSpec decorators (#30150)
• Offer inlay hint edits only for valid annotation targets (#30208)
• Preserve distinct bytes keys during narrowing (#30207)

Diagnostic improvements

• Explain why a rule was removed in configuration and ignore comments (#30128)
• Rename incompatible override rules (#30142)

Memory usage improvements

• Avoid caching bundled stub source during parsing (#30181)
• Defer formatting details for suppressed diagnostics (#30169)

Other changes

• Avoid repeated scans when merging class MROs (#30095)
• Cache context-free specialized alias values (#30099)
• Cache raw signatures for overload declarations (#30106)
• Cache the previous declaration in an overload set (#30110)
• Check constraint equivalence by searching for counterexamples (#30093)
• Collect namespace members once per metaclass (#30165)
• Index lazy enclosing snapshots by symbol name (#30088)
• Reduce redundant work in structural recursive type inference (#29975)
• Reject incompatible fixed tuple contexts as elements are inferred (#30183)
• Reuse the incoming flow after boolean expressions without assignments (#30097)
• Skip repeated type constraints for collection literals (#30089)
• Skip union checks for incomparable types (#30102)

Contributors

• @​mtshiba
• @​charliermarsh
• @​AlexWaygood
• @​MichaReiser

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.100

Released on 2026-11-09.

Breaking changes

• Distinguish attributes missing from some union members (#29944)
• Give abstract class instantiation its own diagnostic rule (#29948)
• Separate missing and inconsistent overload implementation diagnostics (#29953)
• Split invalid-key into three TypedDict diagnostic rules (#29955)
• Split out lost-keyword-for-regular-parameter from incompatible-method-override (#30143)

Bug fixes

• Fix partial application of ParamSpec decorators (#30150)
• Offer inlay hint edits only for valid annotation targets (#30208)
• Preserve distinct bytes keys during narrowing (#30207)

Diagnostic improvements

• Explain why a rule was removed in configuration and ignore comments (#30128)
• Rename incompatible override rules (#30142)

Memory usage improvements

• Avoid caching bundled stub source during parsing (#30181)
• Defer formatting details for suppressed diagnostics (#30169)

Other changes

• Avoid repeated scans when merging class MROs (#30095)
• Cache context-free specialized alias values (#30099)
• Cache raw signatures for overload declarations (#30106)
• Cache the previous declaration in an overload set (#30110)
• Check constraint equivalence by searching for counterexamples (#30093)
• Collect namespace members once per metaclass (#30165)
• Index lazy enclosing snapshots by symbol name (#30088)
• Reduce redundant work in structural recursive type inference (#29975)
• Reject incompatible fixed tuple contexts as elements are inferred (#30183)
• Reuse the incoming flow after boolean expressions without assignments (#30097)
• Skip repeated type constraints for collection literals (#30089)
• Skip union checks for incomparable types (#30102)

Contributors

• @​mtshiba
• @​charliermarsh
• @​AlexWaygood
• @​MichaReiser
• @​sharkdp

... (truncated)

Commits

• 6c90fe0 Bump version to 0.0.100 (#4987)
• f2bbbc4 Update PyCharm setup instructions for 2026.3 (#4978)
• 92925a1 Update benchmarks for ty 0.0.99 (#4957)
• 9b48f40 Bump version to 0.0...

  Description has been truncated