[dependabot]

Bumps the uv group with 26 updates in the / directory:

Package	From	To
pydantic	2.14.1	2.14.2
xlsxwriter	3.3.0	3.3.1
anthropic	2.3.0	2.4.0
snaptrade-python-sdk	13.0.49	13.0.52
mypy	2.4.0	2.4.1
pytest	9.1.1	9.2.0
pandas-stubs	3.0.5.260914	3.1.0.261029
types-pyyaml	6.0.12.20260906	6.0.12.20261103
types-requests	2.33.0.20261006	2.33.0.20261030
growthbook	3.2.2	4.0.0
opentelemetry-api	1.45.1	1.45.2
anyio	4.15.1	4.16.0
filelock	4.2.4	4.2.7
fonttools	4.67.0	4.68.0
frozendict	2.4.7	2.5.1
narwhals	2.27.1	2.28.0
opentelemetry-semantic-conventions	0.66b1	0.66b2
pip	26.2.2	26.3
platformdirs	4.13.6	4.14.3
pydantic-core	2.50.1	2.50.2
python-dateutil	2.9.0.post0	4.0.0
python-multipart	0.0.32	0.0.33
pytz	2026.5	2026.6
tzdata	2026.5	2026.6
watchdog	6.0.0	7.0.0
websockets	17.3	17.4

Updates pydantic from 2.14.1 to 2.14.2

Release notes

Sourced from pydantic's releases.

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.

Packaging

• Bump PyO3 to 0.30.1, jiter to 0.18.0, use PyFrozenDict by @​Viicos in #14003
• Bump speedate to v0.18.0 by @​Viicos in #14007
• Publish pydantic-core wheels for PyPy 8.0 (pp80 ABI) by @​Viicos in #14083

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Lazily call repr of values during nested union serialization by @​Viicos in #14082
• Skip decorator field checks when no field decorators exist by @​alexmojaki in #14111
• Avoid heap allocation for small JSON model field buffers by @​alexmojaki in #14113

Fixes

• Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

  JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

  from pydantic import BaseModel, ConfigDict
  from pydantic.alias_generators import to_camel
  class Page(BaseModel):
  model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
  page_size: int = 10
  
  Page.model_validate_json('{"page_size": 50}')
  Before: Page(page_size=10)
  After: ValidationError (extra_forbidden)

  See the pull request for the full list of behavior changes. This change addresses GHSA-qpmf-fgh3-ff25.

• Ignore extra data matching a field name in TypedDict and dataclasses with extra=allow by @​Viicos in #14090. Addresses GHSA-3r8g-cqwr-jr29.

• Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

• Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

• Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

• Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

• Implement recursion guard for validate_strings() by @​Viicos in #14029

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.2 (2026-10-29)

GitHub release

What's Changed

Packaging

• Bump PyO3 to 0.30.1, jiter to 0.18.0, use PyFrozenDict by @​Viicos in #14003
• Bump speedate to v0.18.0 by @​Viicos in #14007
• Publish pydantic-core wheels for PyPy 8.0 (pp80 ABI) by @​Viicos in #14083

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Lazily call repr of values during nested union serialization by @​Viicos in #14082
• Skip decorator field checks when no field decorators exist by @​alexmojaki in #14111
• Avoid heap allocation for small JSON model field buffers by @​alexmojaki in #14113

Fixes

• Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

  JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

  from pydantic import BaseModel, ConfigDict
  from pydantic.alias_generators import to_camel
  class Page(BaseModel):
  model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
  page_size: int = 10
  
  Page.model_validate_json('{"page_size": 50}')
  Before: Page(page_size=10)
  After: ValidationError (extra_forbidden)

  See the pull request for the full list of behavior changes.

• Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

• Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

• Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

• Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

• Implement recursion guard for validate_strings() by @​Viicos in #14029

• Support named tuples in Sequence serialization by @​Viicos in #14033

... (truncated)

Commits

• aa540ac Update changelog for v2.14.2
• 6cde12f Update changelog for v2.14.2
• 2db7c25 Fix deep copy of self-referential models
• d783154 Update changelog for v2.14.2
• df49b6c Avoid heap allocation for small JSON model field buffers
• cd93e69 Skip decorator field checks when no field decorators exist
• 2771e57 Make JSON validation by iteration consistent with Python approach
• 8102e3f Avoid Python tuple allocation during model fields validation
• dd139b5 Bump pydantic.v1 namespace to v1.10.27
• 66155f9 Prepare release v2.14.2
• Additional commits viewable in compare view

Updates xlsxwriter from 3.3.0 to 3.3.1

Changelog

Sourced from xlsxwriter's changelog.

Release 3.3.1 - October 28 2026

• Fixed performance issue where positioning objects such as images and comments on a worksheet with a custom default row height.

  :issue:1210.

• Fixed a (different) performance issue where positioning a large number of objects such as comments on a worksheet with custom row heights or column widths.

  :issue:1217.

• Fixed off by one error in the worksheet :func:set_first_sheet() method.

  :issue:1187.

• Fixed issue where :func:autofit() hid a column that had a user defined width narrower than the autofit width.

  :issue:1219.

• Fixed issue where :func:add_table() didn't detect a duplicate header name when a user defined header matched a default ColumnN header.

  :issue:1215.

• Fixed issue where the strings_to_formulas Workbook option didn't prevent :func:write() from converting strings like {=SUM(A1:B1*A2:B2)} to array formulas.

  :issue:1212.

• Fixed :func:set_column() rounding a half-pixel width to the nearest even pixel, which made some widths one pixel narrower than in 3.2.9.

  :issue:1221.

• Fixed unescaped double quotes, and incorrect string lengths for characters such as emojis, in text type conditional formats.

  :issue:1206.

• Fixed issue where "future" functions such as ISFORMULA() weren't prefixed with _xlfn. in :func:conditional_format() and :func:data_validation() formulas. See :ref:formula_future.

  :issue:1171.

... (truncated)

Commits

• af5927c Prep for release 3.3.1
• 5167156 utility: use UTF-16 lengths for Excel string limit checks
• d4f5125 worksheet: handle future functions in conditional format and validation formulas
• 1742949 cond format: fix quotes and lengths in text rules
• f8087a5 worksheet: fix set_column half-pixel rounding
• 27f7a97 worksheet: apply strings_to_formulas option to array formula strings
• 3210175 worksheet: check table headers for duplicates with default names
• be0d80f worksheet: fix autofit() hiding columns with user defined properties
• e5ad575 worksheet: fix perf issue with large number of objects and custom width/height
• a880ecc url: validate hyperlink tooltip length when it is set
• Additional commits viewable in compare view

Updates anthropic from 2.3.0 to 2.4.0

Release notes

Sourced from anthropic's releases.

v2.4.0

Features

• api: add GA methods for analytics, spend limits and RBAC
• api: add named beta types for unified metrics and RBAC delete responses
• api: add shared analytics order and increase request actor types
• api: add tool_use_limit_reached_error and compaction_limit_reached_error session error types
• api: add types for analytics group_by and spend limit period filters
• api: add user_profile_id to External Keys and Workspaces

Bug Fixes

• api: make spend_limit nullable in the spend limit increase request approve response
• api: require always-sent analytics fields and drop the unused project product field
• client: let pydantic validate params types that accept omit

Chores

• ci: remove unused build upload steps
• docs: clarify the Slack channel id description
• docs: clarify what disabling the Compliance API stops
• docs: clarify what the capability_access_all role action grants
• docs: link Dreams model fields to the supported models section
• docs: update example user ID in Admin API examples
• internal: add a section for each repository's own review rules
• internal: plainer wording in worker comments

Documentation

• client: add missing await to the async parse() docstring example
• examples: keep the message threads example valid on Sonnet 5.5
• examples: use current model IDs
• readme: point to the docs site for documentation
• link to the SDK documentation instead of removed README sections

Changelog

Sourced from anthropic's changelog.

2.4.0 (2026-11-02)

Features

• api: add GA methods for analytics, spend limits and RBAC
• api: add named beta types for unified metrics and RBAC delete responses
• api: add shared analytics order and increase request actor types
• api: add tool_use_limit_reached_error and compaction_limit_reached_error session error types
• api: add types for analytics group_by and spend limit period filters
• api: add user_profile_id to External Keys and Workspaces

Bug Fixes

• api: make spend_limit nullable in the spend limit increase request approve response
• api: require always-sent analytics fields and drop the unused project product field
• client: let pydantic validate params types that accept omit

Chores

• ci: remove unused build upload steps
• docs: clarify the Slack channel id description
• docs: clarify what disabling the Compliance API stops
• docs: clarify what the capability_access_all role action grants
• docs: link Dreams model fields to the supported models section
• docs: update example user ID in Admin API examples
• internal: add a section for each repository's own review rules
• internal: plainer wording in worker comments

Documentation

• client: add missing await to the async parse() docstring example
• examples: keep the message threads example valid on Sonnet 5.5
• examples: use current model IDs
• readme: point to the docs site for documentation
• link to the SDK documentation instead of removed README sections

Commits

• 5752c13 release: 2.4.0
• c2cf85f Merge pull request #1079 from anthropics/synced/published
• 62b05ab feat(api): add named beta types for unified metrics and RBAC delete responses
• fb176c1 chore(docs): clarify the Slack channel id description
• c94ad93 chore(internal): plainer wording in worker comments and private names (#1085)
• 2d29fcb chore(docs): link Dreams model fields to the supported models section
• caf6c5b codegen metadata
• 174bfb6 feat(api): add tool_use_limit_reached_error and compaction_limit_reached_erro...
• 760525d codegen metadata
• 1b413ea codegen metadata
• Additional commits viewable in compare view

Updates snaptrade-python-sdk from 13.0.49 to 13.0.52

Commits

• See full diff in compare view

Updates mypy from 2.4.0 to 2.4.1

Changelog

Sourced from mypy's changelog.

Mypy 2.4.1

• Process overloads as a whole in two-phase type checking (Ivan Levkivskyi, PR 22231)
• Skip recursive setup for frame-private nested functions in mypyc (Piotr Sawicki, PR 22187)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• A5rocks
• Adam Dangoor
• Alex Waygood
• Ali Hamdan
• Brian Helba
• Chad Dombrova
• David Foster
• dnwpark
• Edgar Ramírez Mondragón
• Giorgos Michas
• Ivan Levkivskyi
• Jelle Zijlstra
• Jukka Lehtosalo
• Marc Mueller
• Michael R. Crusoe
• NIYONSHUTI Emmanuel
• Piotr Sawicki
• Shantanu
• themylogin
• Vaggelis Danias
• Willy Bruns

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

... (truncated)

Commits

• ad02a35 Skip test for 2.4.1
• cad7794 Finalize version to 2.4.1
• d9cbcbc Add changelog for Mypy 2.4.1 (#22310)
• 2860baa Process overloads as a whole in two-phase type-checking (#22231)
• 9b3e307 [mypyc] Skip recursive setup for frame-private nested functions (#22187)
• 10ad5f6 Bump ast-serialize to 0.12.1 (#22093)
• 350052f Bump ast-serialize to 0.12.0 (#22087)
• f7d08cf Bump version to 2.4.1+dev
• See full diff in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

• #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

• #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

  Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

• #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

  • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
  • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

  pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

• #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

• #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

• #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

  They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

• #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

• #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

• #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
• #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
• #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

• #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits

• ae1d0ff Prepare release version 9.2.0
• 143ce31 pre-commit: exclude codespell on generated release announcements
• 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
• a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
• 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
• 41d12cd docs: clarify typing for yield fixtures
• b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
• 16f87a7 docs: improve getting-started.rst test execution description
• 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
• ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
• Additional commits viewable in compare view

Updates pandas-stubs from 3.0.5.260914 to 3.1.0.261029

Commits

• 2a4a9c1 Version 3.1.0.261029
• 9490b69 BLD: update to pandas 3.1.0 and adapt stubs and tests (#2036)
• 0bdb355 TYP: reject complex ordering for Series and Index (#2016)
• fadb447 TYP: drop the unreachable Series.rmatmul(DataFrame) and document operator...
• f72cd2a TYP: Remove mode property from BaseBuffer protocol #1956 (#2041)
• 9dccbf5 DOC: require public API status before adding stubs (#2039)
• e201493 TST: use canonical IANA time zones in tests (#2033)
• 8dd6d91 TST: 🌙 fix nightly dtype warnings and Index.where test data (#2028)
• 36a22a8 TYP: Include missing values in scalar indexer returns (#1946)
• 1026204 TYP: accept list bounds in DataFrame.clip (#2022)
• Additional commits viewable in compare view

Updates types-pyyaml from 6.0.12.20260906 to 6.0.12.20261103

Commits

• See full diff in compare view

Updates types-requests from 2.33.0.20261006 to 2.33.0.20261030

Commits

• See full diff in compare view

Updates growthbook from 3.2.2 to 4.0.0

Release notes

Sourced from growthbook's releases.

v4.0.0

4.0.0 (2026-10-30)

⚠ BREAKING CHANGES

• Targeting conditions are strict about types: values are no longer converted between types, negated operators always give the opposite result of their positive form, booleans are not ordered, and version operators need two strings or two numbers. Conditions that use an operator or saved group type the SDK does not support always fail, even under $not or $nor. Only strings and numbers can be hash attributes; other values (booleans, arrays, objects, 0 and "") count as missing. Percentage rollouts no longer include one extra hash bucket. Hashing uses UTF-16 code units, like the JavaScript SDK, which changes bucketing only for ids and experiment or feature keys that contain characters outside the Basic Multilingual Plane, such as emoji. Experiments use fallbackAttribute only when sticky bucketing is enabled.

Features

• add GrowthBookClient.reduce_payload and core.reduce_payload to shrink a payload to what one user needs (6a9b3fd)
• align with spec 0.12.0 (strict types, condition edge cases, bucketing, payload reduction) (#153) (6a9b3fd)

Bug Fixes

• ignore non-ASCII digits in query string overrides (#154) (cbbd34b)

Changelog

Sourced from growthbook's changelog.

4.0.0 (2026-10-30)

⚠ BREAKING CHANGES

• Targeting conditions are strict about types: values are no longer converted between types, negated operators always give the opposite result of their positive form, booleans are not ordered, and version operators need two strings or two numbers. Conditions that use an operator or saved group type the SDK does not support always fail, even under $not or $nor. Only strings and numbers can be hash attributes; other values (booleans, arrays, objects, 0 and "") count as missing. Percentage rollouts no longer include one extra hash bucket. Hashing uses UTF-16 code units, like the JavaScript SDK, which changes bucketing only for ids and experiment or feature keys that contain characters outside the Basic Multilingual Plane, such as emoji. Experiments use fallbackAttribute only when sticky bucketing is enabled.

Features

• add GrowthBookClient.reduce_payload and core.reduce_payload to shrink a payload to what one user needs (6a9b3fd)
• align with spec 0.12.0 (strict types, condition edge cases, bucketing, payload reduction) (#153) (6a9b3fd)

Bug Fixes

• ignore non-ASCII digits in query string overrides (#154) (cbbd34b)

Commits

• 962ca8f chore(main): release 4.0.0 (#155)
• 6a9b3fd feat!: align with spec 0.12.0 (strict types, condition edge cases, bucketing,...
• cbbd34b fix: ignore non-ASCII digits in query string overrides (#154)
• See full diff in compare view

Updates opentelemetry-api from 1.45.1 to 1.45.2

Release notes

Sourced from opentelemetry-api's releases.

Version 1.45.2/0.66b2

This is a patch release on the previous 1.45.1/0.66b1 release, fixing the issue(s) below.

Added

• opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

• opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.45.2/0.66b2 (2026-10-29)

Added

• opentelemetry-sdk, opentelemetry-configuration, opentelemetry-exporter-prometheus: enforce metric cardinality limits (default 2000) with the otel.metric.overflow attribute, configurable through View(aggregation_cardinality_limit=...), reader cardinality_limits and declarative configuration (#5809)

Fixed

• opentelemetry-api: limit traceparent header length to 512 characters in TraceContextTextMapPropagator during extraction (#5818)

Commits

• ad75594 [release/v1.45.x-0.66bx] Prepare release 1.45.2/0.66b2 (#5862)
• 78123a2 [release/v1.45.x-0.66bx] Backport metric cardinality limits and traceparent p...
• See full diff in compare view

Updates anyio from 4.15.1 to 4.16.0

Release notes

Sourced from anyio's releases.

4.16.0

New features

• Added BlockingPortal.call_async() for asynchronously calling into an event loop with optional abandonment on cancellation (#1342; PR by @​davidbrochart)
• Added SOCK_SEQPACKET support to connect_unix() and create_unix_listener() (#1349; PR by @​theunkn0wn1)

Other changes

• Changed UDP sockets on the asyncio backend to make send() wait until the datagram has been passed to the operating system (#1294; PR by @​graingert)

Bug fixes

• Fixed documentation implying that use_uvloop=True falls back to the standard event loop when uvloop (winloop on Windows) is not installed, and showed how to skip the corresponding pytest backend variant when the dependency is missing (#645; PR by @​GruffElixir)
• Fixed get_current_task() on the asyncio backend raising an opaque TypeError: cannot create weak reference to 'NoneType' object instead of a clear error when called from a callback scheduled via loop.call_soon_threadsafe() (e.g. from within from_thread.run_sync()), where asyncio.current_task() is legitimately None (#773; PR by @​AmirF194)
• Fixed CancelScope on the asyncio backend swallowing a native Task.cancel() that was delivered in the same event loop iteration as the scope's own cancellation (such as a move_on_after() deadline expiring), which left the host task with a pending cancellation request that never raised CancelledError (#1214)
• Fixed UDP socket closing hanging if a datagram send was still in flight (#1237; PR by @​graingert)
• Fixed concurrent aclose_forcefully() calls on asyncio socket streams returning before the underlying socket was closed (#1273; PR by @​graingert)
• Fixed aclose() on sockets not checkpointing, and thus failing to raise a cancellation exception when called inside a cancelled scope (affected UNIX socket streams and UNIX datagram sockets on asyncio, and all sockets on Trio) (#1288; PR by @​graingert)
• Fixed aclose() on asyncio TCP socket listeners not checkpointing, and leaking the listening socket if cancelled while another task was waiting in accept() (#1289; PR by @​graingert)
• Fixed accept() on asyncio UNIX socket listeners hanging forever, and leaving the listening socket registered with the event loop, when the listener was closed by another task (#1289; PR by @​graingert)
• Fixed send() on asyncio TCP and UDP sockets returning normally, despite the data being discarded, when the socket was closed by another task (or, for TCP, the connection was lost) while send() was waiting for the operating system to accept the data (#1289; PR by @​graingert)
• Fixed SocketStream.send() on the asyncio backend handing its data to a paused transport after a previous send() was cancelled (#1299; PR by @​graingert)
• Fixed sleep() treating a negative delay (including -inf) inconsistently across backends (asyncio returned immediately; Trio raised ValueError) by raising ValueError on all backends (#1306; PR by @​BetterAndBetterII)
• Fixed create_tcp_listener() occasionally failing with a message like Could not create 2 listeners with a consistent port when an ephemeral port is requested and IPv6 is enabled and the dual-stack path is not available or a specific local host name was given (#1313)
• Fixed AsyncFile not shielding against cancellation while closing (#1314)
• Fixed TemporaryDirectory.cleanup() reacting to cancellation prematurely when the host task was already cancelled, causing the actual cleanup operation to be skipped (#1316; PR by @​Yasser-Ameur)
• Fixed a NaN deadline being accepted on asyncio while Trio raised ValueError, which silently disabled the timeout (fail_after(math.nan) returned instead of raising TimeoutError); CancelScope now rejects it on both backends (#1317; PR by @​dylanpulver)
• Fixed FileReadStream and FileWriteStream leaving files open when cancelled during context manager exit, including unflushed writes (#1318; PR by @​Kuang-xianxin)
• Fixed Condition.notify() and Condition.notify_all() failing when the underlying lock was acquired directly rather than through the condition (#1319; PR by @​GruffElixir)
• Fixed importing AnyIO with loaders that do not provide __file__, such as PyOxidizer, raising TypeError instead of falling back to eager imports (#1322; PR by @​skulitom)
• Fixed text receive streams silently discarding incomplete characters at end-of-file instead of applying the configured decoding error handler (#1339; PR by @​Aurelucien)
• Fixed Semaphore(fast_acquire=True) losing its fast-acquire behavior when instantiated outside a running event loop (#1348; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider permanently failing with an AttributeError on every subsequent use if the first attempt to start its blocking portal failed (#1350; PR by @​Yasser-Ameur)
• Fixed create_udp_socket() silently ignoring the local_port argument when local_host was omitted, making the socket bind to a random ephemeral port instead of the requested one (#1351; PR by @​januththedev)
• Fixed worker threads on the asyncio backend never returning to the idle pool (and thus never being reused or pruned) when a to_thread.run_sync() call was cancelled after it had been queued for the worker but before the worker thread had picked it up (#1352; PR by @​Zac-HD)
• Fixed pytest plugin running Hypothesis async tests only on the first parametrized backend instead of each backend (#1353; PR by @​DYNOSuprovo)
• Fixed TypeError when subclassing an existing TypedAttributeSet subclass, and this subclass contains type annotations (#1358; PR by @​pasmud)
• Fixed Lock.locked() (and Condition.locked()) raising NoEventLoopError when the lock was created outside a running event loop (#1362; PR by @​00200200)
• Fixed connect_tcp() leaking a connected socket when an enclosing cancel scope was cancelled before the connection attempt task group exited (#1364; PR by @​charan-rathore)
• Fixed create_connected_udp_socket() silently ignoring local_port when local_host was not given: the local address was left unset, so the OS picked an ephemeral port instead of the requested one (#1365; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider not passing the exception raised in its with block on to the start_blocking_portal() context manager it wraps (#1366; PR by @​feiiiiii5)
• Fixed anyio.itertools.islice() not consuming the first start items when stop <= start (#1372; PR by @​Rodrigo-Palma)
• Fixed BufferedByteReceiveStream.receive_exactly() and receive_until() returning buffered data after explicit closure instead of raising ClosedResourceError (#1378; PR by @​kokotatan)
• Fixed a TLS stream sending records the peer could no longer decrypt after a cancelled send() lost an already-encrypted record; the stream now raises BrokenResourceError on further use instead (#1385; PR by @​Kayvan-Zahiri)
• Fixed close() on memory object streams not waking up tasks blocked in send() or receive() on the same stream (#1391)
• Fixed anyio.itertools.product() acquiring and consuming unused input iterables when repeat=0 (#1394; PR by @​sricharanreddycheruku)
• Fixed SpooledTemporaryFile rolling over to disk on writes when max_size is zero (the default) (#1397; PR by @​fhgffy)
• Fixed Trio UDP sockets remaining open when initialization failed or was cancelled (#1400; PR by @​adenzhou1350)
• Fixed SpooledTemporaryFile.rollover() moving the current file position to the end of the file (#1401; PR by @​fhgffy)
• Fixed cancellation during temporary directory creation leaving the directory behind while its context manager is retained (#1403; PR by @​adenzhou1350)

... (truncated)

Commits

• 0ddd02d Released version 4.16.0
• 576892e Fixed certain pending tasks not woken up by the closing of memory object stre...
• 02ff4f8 Added BlockingPortal.call_async() (#1343)
• 1af29a4 Moved documentation code snippets into separate, checked files (#1445)
• f01c041 [pre-commit.ci] pre-commit autoupdate (#1448)
• 95a0143 Test with blockbuster and uvloop on Python 3.15 too
• 4d51154 Modernized the memory object stream tests
• 1e4b448 Fixed the as_connectable() example in the networking docs (#1442)
• cd21b36 Fixed TypedAttributeSet not collecting annotations from superclasses (#1358)
• b7f8c68 [pre-commi...

  Description has been truncated

[coldtea-pr-lens]

Note

dependabot[bot] opened this pull request, so PR Lens left it undrawn. Comment @pr-lens draw to draw it

_{github.comment.notice: false in .github/pr-lens.yml turns this note off}

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-06T09:38:35.692042Z We couldn’t complete this review. Comment @codex review to try again.	4e80bac	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8a791b84-f247-4f78-a6f3-14e40504e2a9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.