chore(deps): bump the python group across 2 directories with 15 updates

[dependabot]

Bumps the python group with 13 updates in the / directory:

Package	From	To
faiss-cpu	1.15.0	1.15.1
openai	3.8.0	3.29.0
build	1.6.0	1.6.1
charset-normalizer	3.5.1	3.5.2
idna	3.19	3.20
iniconfig	2.3.0	2.3.1
ruff	0.16.6	0.17.0
httpcore2	2.12.0	2.13.1
httpx2	2.12.0	2.13.1
jiter	0.16.0	0.17.0
pydantic	2.13.5	2.14.1
pydantic-core	2.46.5	2.50.1
build	1.6.0	1.6.1
charset-normalizer	3.5.1	3.5.2
idna	3.19	3.20
setuptools	84.0.0	``
iniconfig	2.3.0	2.3.1
ruff	0.16.6	0.17.0
faiss-cpu	1.15.0	1.15.1
httpcore2	2.12.0	2.13.1
httpx2	2.12.0	2.13.1
jiter	0.16.0	0.17.0
openai	3.8.0	3.29.0
pydantic	2.13.5	2.14.1
pydantic-core	2.46.5	2.50.1

Bumps the python group with 15 updates in the /requirements directory:

Package	From	To
setuptools	84.0.0	``
numpy	2.4.6	2.5.4
faiss-cpu	1.15.0	1.15.1
openai	3.8.0	3.29.0
pyarrow	25.0.1	26.0.0
build	1.6.0	1.6.1
charset-normalizer	3.5.1	3.5.2
idna	3.19	3.20
iniconfig	2.3.0	2.3.1
ruff	0.16.6	0.17.0
httpcore2	2.12.0	2.13.1
httpx2	2.12.0	2.13.1
jiter	0.16.0	0.17.0
pydantic	2.13.5	2.14.1
pydantic-core	2.46.5	2.50.1
build	1.6.0	1.6.1
charset-normalizer	3.5.1	3.5.2
idna	3.19	3.20
setuptools	84.0.0	``
iniconfig	2.3.0	2.3.1
ruff	0.16.6	0.17.0
faiss-cpu	1.15.0	1.15.1
httpcore2	2.12.0	2.13.1
httpx2	2.12.0	2.13.1
jiter	0.16.0	0.17.0
numpy	2.4.6	2.5.3
openai	3.8.0	3.29.0
pyarrow	25.0.1	26.0.0
pydantic	2.13.5	2.14.1
pydantic-core	2.46.5	2.50.1

Updates faiss-cpu from 1.15.0 to 1.15.1

Release notes

Sourced from faiss-cpu's releases.

v1.15.1

See CHANGELOG.md for the full list of changes.

Changelog

Sourced from faiss-cpu's changelog.

[1.15.1] - 2026-09-15

Added

• 3b3711c112fbf7dfb9c64b6fcf90ffc3ca412548 Add explicit IVFPQ scanner distance modes (#5632)
• 4fdbc9dc18adbfef3cd410a2446aa4c757320a8a Support ZeroCopyIOReader for IndexRaBitQ deserialization (#5629)
• b5a14632a6f2bfdc824c86d683b9d6e9205c2604 Run the eight SIMD kernel tests that no build executed (#5620)
• e6bd1d252caa5b9315a04390269d382845984ae2 Add AVX512 VPOPCNT dynamic dispatch level (#5531)
• 7f4cedda9c384de652c7bd5690db0f808d668216 Add staged RaBitQ storage to HNSW (#5526)
• cfbf4ec5ff68d0bca4701d0b24b8a0736e110932 SVS: allow option to disable vector storing (#5525)
• cda4f6e7133c629e502c2ea9bc51e0ef51847ab1 Expose IndexBinaryIVF.set_direct_map_type via the C API (#5451)
• 256980cb6ea6610e4b0edf497a038086df8bbfce Add SVE low-dimensional nearest fast path and spherical SuperKMeans support (#5530)
• 3a716ead1a3c4562fe6e96d982d26789c58e19ed Add Windows ARM64 support to CI (#5544)
• 7059eaf7da7eddda62e71367e684d4bdedd7f94f Add AVX512 bitplane kernel for multi-bit RaBitQ inner product (#5522)
• a424dcb809fd725c44dd976d9063febd4837d16a faiss HNSW: add opt-in deterministic lock-free graph build (faiss::hnsw_deterministic_build) (#5486)
• da3191e754b49ca67b6503a9262e96ce5a3d8ed8 IDSelectorWithContext: extend context hook to IVFPQ/PQR, multibit RaBitQ, and Panorama scanners (#5491)
• edddbc998e858f16330f9b226dfd72f73d4d1d46 IDSelectorWithContext: scan-context hook for locality-aware selectors (#5490)

Changed

• 3bb48643ab8ea9e50162b354d2463270acd6ed9c Pin faiss-gpu-cuvs RAPIDS deps to the 26.06 build series (#5643)
• 6bbb068ad8dab612b84304400846da1b14539085 Measure 20-byte Hamming codes eight at a time (#5587)
• 3c7042f17a467c38d99f490ef39e4dfa615dc510 Let the binary Hamming paths reach the VPOPCNT kernels
• 9f993087b07e83f026248addb01dd99e99b15a3e Name the SIMD level masks after what they hold (#5600)
• e2cf9e1ebf24c14b888fa69eee96713aa6d64b1a Accept ragged code sizes in faiss::hammings(), and fix the vectorization axis for wide codes (#5520)
• 545550f6a27031c2269881d97237fd6a5bef15df Use unittest assertions and f-strings in test_index_composite (#5571)
• af9eeffcf70d7795107c2b0511bdba507ac45339 Reserve cs vector capacity in hammings_knn_mc_impl to avoid reallocations (#5548)
• 317a207bcacfcfa695d98289c3f4ea562b782837 ARM SVE optimization for L2 distance kernels adapted to new simd_impl structure (#5098)
• 2027d3b33144dbf19674b540ec0e31b2f842b1cc Make cuVS dispatch opt-in rather than build-implied (#5529)
• a39e2606887bbacc6c8f54e783c4b42da00cf4b3 Fold multi-GPU CAGRA build into train(), delete trainMultiGpu (#5521)
• 1f93154314afbef210f0ebebeab840da22f9ec7d Revert D114685755: Fold multi-GPU CAGRA build into train(), delete trainMultiGpu
• 6644dcfa5576221b1a4417fd766a8b2af71d869e Fold multi-GPU CAGRA build into train(), delete trainMultiGpu (#5500)
• 80a16564f86530dbf0bfaf96c2b71feffeb5093f Enable Faiss dynamic dispatch for OVIS and VeST fbpkgs (#5515)
• 2688c34f942c8462d97c8632c720a53653456270 Parallelize the k-means++ D^2 seeding update (#5457)
• 76c67b7b736ca80c2b3ea29528434d6583adc88b Update default Panorama batch size to 1024 (#5441)
• 3b50babc5914570576b09da043f64dfd7d62a075 Optimize RVV batch-4 distance kernels (#5469)

Fixed

• 7c3b55c01b8418dc044881625a260fceae9c712b Make Panorama bounds checks overflow-safe (#5616)
• fb2d57a3121c073828d2ed7d04ccf09d8bea771c Fix leak and unbounded lists[] in OnDisk invlist deserialization (#5560)
• fc13c81fb8b22f76e4c2c7bd2f027bd049b9a207 Stop aarch64 falling back to SIMDLevel::NONE in faiss dispatch (#5572)
• 00928e3f7628b8288c17cfece5ee9600a8287f56 Fix ROCm CI: build in a dedicated conda env instead of the runner's broken base (#5545)
• 1e5780fbbfbe191f3ed3517f93ace8301239e9b2 Fix OOB read in Panorama::reconstruct via IndexPreTransform (T287094917) (#5562)
• 2ed4c106e9fb9686e7727e5daf8ad6ad1e164109 Fix: Windows SIMD detection (#5497)
• b4c66ba6031d1f659163e43430f8ce745b0dbe79 Fix reverse_index_factory/get_code_size round-trip for HNSW, IMI and IVFPQR (#5564)
• c0084f5cd2534236acda05cf7b8e0fc8062ddec3 Clamp EDEN unbiased L2 distances to be non-negative (#5569)
• 6457e941f5f4808303bb480679cb78df0df51934 Contain DirectoryArchiver entries within the extraction root (#5561)
• ac60182fc009476c91a2788e639191d1f624157f RaBitQ: Fix zero residual sign convention (#5553)
• 1a0cfa64e015923d5009d8c7d917aa591e9eac9a Apply the deserialization byte limit to SVS IVF (#5568)
• 718002f7cf269f3f3752dde04a4cc3f8eabb0050 Fix distance conversion in IndexBinaryFromFloat for non-L2 metrics (#5549)
• 02ea14372c9983f3eaa15698512180dc62ea234d Fix range_search_max_results to respect all similarity metrics (#5533)
• bd7087453e6d2262b6e6c76ab0cfa1e2dfeddebf fix(faiss): use is_similarity_metric for IndexShardsIVF merge (#5541)

... (truncated)

Commits

• 75c755c Add missing CHANGELOG entry for #5632 in v1.15.1 (#5651)
• d63faea Increment to next release, v1.15.1 (#5645)
• 3b3711c Add explicit IVFPQ scanner distance modes (#5632)
• 3bb4864 Pin faiss-gpu-cuvs RAPIDS deps to the 26.06 build series (#5643)
• 7c3b55c Make Panorama bounds checks overflow-safe (#5616)
• fb2d57a Fix leak and unbounded lists[] in OnDisk invlist deserialization (#5560)
• a74867c faiss HNSW: delete the flag and the lock-based graph build (#5611)
• 4fdbc9d Support ZeroCopyIOReader for IndexRaBitQ deserialization (#5629)
• b5a1463 Run the eight SIMD kernel tests that no build executed (#5620)
• 6bbb068 Measure 20-byte Hamming codes eight at a time (#5587)
• Additional commits viewable in compare view

Updates openai from 3.8.0 to 3.29.0

Release notes

Sourced from openai's releases.

v3.29.0

3.29.0 (2026-10-11)

Features

• api: add billing_not_active session error code (#4052) (c88b320)
• api: add shida to named Live voices (#4053) (7352cf5)
• api: add vault updates and metadata filters (#4047) (e72f493)
• api: align beta pagination limits and non-null parameters (#4057) (800899e)

Chores

• api: clarify decision creation documentation (#4054) (16d3d3b)
• api: clarify Decisions question and answer descriptions (#4051) (895d617)
• api: document 128-character safety identifiers (#4050) (2c1ae52)
• api: document decision choice constraints (#4055) (b7a1990)
• api: document Files API rate-limit responses (#4049) (f6a3459)

v3.28.0

3.28.0 (2026-10-09)

Features

• api: add agent environment suspension and expiration (#4046) (6aa25a9)

Chores

• deps: bump astral-sh/setup-uv from 10.1.0 to 10.2.0 (#4026) (8bfffd4)
• deps: bump CodeQL init and analyze to 4.38.2 (#4025) (4f5e618)
• deps: update PyJWT security constraint to 2.14.0 (#3991) (aaed2a7)

v3.27.0

3.27.0 (2026-10-09)

Features

• api: add prewarmed hosted environments (#4043) (c511a77)

v3.26.1

3.26.1 (2026-10-08)

Bug Fixes

• api: correct custom voice creation parameters (#4038) (b9bc5c1)

... (truncated)

Changelog

Sourced from openai's changelog.

3.29.0 (2026-10-11)

Features

• api: add billing_not_active session error code (#4052) (c88b320)
• api: add shida to named Live voices (#4053) (7352cf5)
• api: add vault updates and metadata filters (#4047) (e72f493)
• api: align beta pagination limits and non-null parameters (#4057) (800899e)

Chores

• api: clarify decision creation documentation (#4054) (16d3d3b)
• api: clarify Decisions question and answer descriptions (#4051) (895d617)
• api: document 128-character safety identifiers (#4050) (2c1ae52)
• api: document decision choice constraints (#4055) (b7a1990)
• api: document Files API rate-limit responses (#4049) (f6a3459)

3.28.0 (2026-10-09)

Features

• api: add agent environment suspension and expiration (#4046) (6aa25a9)

Chores

• deps: bump astral-sh/setup-uv from 10.1.0 to 10.2.0 (#4026) (8bfffd4)
• deps: bump CodeQL init and analyze to 4.38.2 (#4025) (4f5e618)
• deps: update PyJWT security constraint to 2.14.0 (#3991) (aaed2a7)

3.27.0 (2026-10-09)

Features

• api: add prewarmed hosted environments (#4043) (c511a77)

3.26.1 (2026-10-08)

Bug Fixes

• api: correct custom voice creation parameters (#4038) (b9bc5c1)

3.26.0 (2026-10-06)

... (truncated)

Commits

• 7e1643a release: 3.29.0 (#4048)
• 800899e feat(api): align beta pagination limits and non-null parameters (#4057)
• b7a1990 chore(api): document decision choice constraints (#4055)
• 16d3d3b chore(api): clarify decision creation documentation (#4054)
• 7352cf5 feat(api): add shida to named Live voices (#4053)
• c88b320 feat(api): add billing_not_active session error code (#4052)
• 895d617 chore(api): clarify Decisions question and answer descriptions (#4051)
• 2c1ae52 chore(api): document 128-character safety identifiers (#4050)
• f6a3459 chore(api): document Files API rate-limit responses (#4049)
• e72f493 feat(api): add vault updates and metadata filters (#4047)
• Additional commits viewable in compare view

Updates build from 1.6.0 to 1.6.1

Release notes

Sourced from build's releases.

1.6.1

What's Changed

• chore[v1]: prepare for v1.6.1 by @​henryiii in pypa/build#1181

Full Changelog: pypa/build@1.6.0...1.6.1

Changelog

Sourced from build's changelog.

#################### 1.6.1 (2026-09-10) ####################

---

Bugfixes

---

• Avoid trying to detect symlinks on Windows, regression in 1.6.0 - by :user:henryiii (:issue:1175) (:issue:1175)

---

Documentation

---

• Fix doubled backslashes in the Windows pip config path (%APPDATA%\pip\pip.ini) in the docs - by :user:aroh3006 (:issue:1149)

---

Miscellaneous

---

• :issue:1168, :issue:1170, :issue:1178

#################### 1.6.0 (2026-08-27) ####################

---

Features

---

• Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
• The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
• The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
• Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
• Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds
  • by :user:gaborbernat (:issue:655)
• Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
• On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

---

Bugfixes

---

... (truncated)

Commits

• 89cccef chore: prepare for 1.6.1
• a6f707a ci: support releases from v* branches (#1178)
• 7785161 docs: fix doubled backslashes in Windows pip config path (#1149)
• 244b250 fix: always use copies for the isolated venv on Windows (#1176)
• c93ca6f build(deps): bump re-actors/alls-green from 1.2.2 to 1.3.0 in the github-acti...
• e02ffd3 pre-commit: bump repositories (#1173)
• aad39a8 docs: fix changelog page heading levels and sidebar (#1171)
• 5c3fd46 docs: use PyPI ref directly (#1172)
• 1c5bd6c 🐛 fix(release): format generated changelog (#1170)
• 7f0cc7e 🔧 build(type): replace mypy with pyrefly (#1168)
• See full diff in compare view

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates idna from 3.19 to 3.20

Release notes

Sourced from idna's releases.

v3.20

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Commits

• d55e65e Release 3.20
• 0c0824a Pre-release 3.20rc0
• bd7c316 Note Python 3.15 support in the 3.20 changelog
• b6cce85 Merge pull request #276 from kjd/unicode-18
• 9a4bc59 Update to Unicode 18.0.0
• dfab5a0 Merge branch 'python-3.15'
• 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
• cd17392 Merge pull request #274 from kjd/fix-decode-length-check
• c5796d7 Skip the decode round-trip check for domains past encode's length limit
• d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
• Additional commits viewable in compare view

Updates iniconfig from 2.3.0 to 2.3.1

Release notes

Sourced from iniconfig's releases.

Version 2.3.1

Fixes

• Parsing values with many continuation lines is now linear instead of quadratic in time (#78, regarding #77).
• A leading UTF-8 BOM is now stripped when reading INI files. Files saved by Windows editors used to fail with ParseError (#76, thanks @​Pitchfork-and-Torch).

Internal

• iniconfig._parse.ParsedLine.value is now a list of lines. This is private API.

Docs

• The README example now uses IniConfig.parse() (#79, thanks @​MbappeWU).
• Fixed the issue tracker link (#74, thanks @​stefan6419846).

Full diff: pytest-dev/iniconfig@v2.3.0...v2.3.1

What's Changed

• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#71
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#72
• Fix link to issues by @​stefan6419846 in pytest-dev/iniconfig#74
• parse_lines: keep values as list of lines, join once by @​RonnyPfannschmidt in pytest-dev/iniconfig#78
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci[bot] in pytest-dev/iniconfig#73
• test: expect sorted all after ruff autofix by @​RonnyPfannschmidt in pytest-dev/iniconfig#80
• docs: use parse API in the README example by @​MbappeWU in pytest-dev/iniconfig#79
• Strip leading UTF-8 BOM when reading INI files by @​Pitchfork-and-Torch in pytest-dev/iniconfig#76
• changelog: add BOM stripping (#76) to 2.3.1 by @​RonnyPfannschmidt in pytest-dev/iniconfig#81

New Contributors

• @​stefan6419846 made their first contribution in pytest-dev/iniconfig#74
• @​MbappeWU made their first contribution in pytest-dev/iniconfig#79
• @​Pitchfork-and-Torch made their first contribution in pytest-dev/iniconfig#76

Full Changelog: pytest-dev/iniconfig@v2.3.0...v2.3.1

Changelog

Sourced from iniconfig's changelog.

2.3.1

• fix quadratic parse time for values with many continuation lines (#78, regarding #77)
• strip a leading UTF-8 BOM when reading INI files, which previously raised ParseError (#76)
• internal: iniconfig._parse.ParsedLine.value is now a list of lines

Commits

• 316fbfa changelog: add BOM stripping (#76) to 2.3.1 (#81)
• d2dcb72 Strip leading UTF-8 BOM when reading INI files (#76)
• 40d8c03 Merge pull request #79 from MbappeWU/codex/docs-parse-inline-comments
• 48359c3 Merge pull request #80 from pytest-dev/claude/fix-iniconfig-test-eukh2n
• b153213 test: expect sorted all after ruff RUF022 autofix
• 4fddfab Merge pull request #73 from pytest-dev/pre-commit-ci-update-config
• 15852c2 [pre-commit.ci] auto fixes from pre-commit.com hooks
• 2e68639 [pre-commit.ci] pre-commit autoupdate
• 23c9e08 docs: use parse API in the README example
• e038536 Merge pull request #78 from RonnyPfannschmidt/claude/dazzling-einstein-h8zq7m
• Additional commits viewable in compare view

Updates ruff from 0.16.6 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

  The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

• Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

  The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

• Remove support for ruff-lsp (#28750)

  Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

• lazy-import-mismatch (TID254)
• lazy-import-immediately-resolved (TID255)
• os-path-commonprefix (RUF071)

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits

• 5b27c1c Bump version to 0.17.0 (#29259)
• 8f362bf Integrate vendored Unicode names into Ruff
• 88a50d6 Revert upstream Unicode loose matching
• 276832a Revert upstream Unicode alias normalization
• 26911ca Vendor unicode_names2 from upstream
• 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
• bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
• 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
• dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
• ef23c9c Update default and latest Python versions for 3.15 (#28792)
• Additional commits viewable in compare view

Updates httpcore2 from 2.12.0 to 2.13.1

Release notes

Sourced from httpcore2's releases.

v2.13.1

Highlights

📤 Accurate file upload lengths

Passing a file as content= now calculates Content-Length from its remaining bytes, respecting the current file position (#1214).

🔐 Reliable proxy TLS and HTTP/2 negotiation

TLS hostname overrides now apply inside HTTP proxy tunnels without affecting the proxy's own TLS connection (#1223). HTTP/2 is advertised first when enabled, and HTTP/1.1 is omitted when disabled (#1155).

🧹 Clean WebSocket shutdown

The sync WebSocket keepalive thread now exits cleanly when a ping races with connection shutdown (#1228).

httpx2

Fixed

• Calculate Content-Length from the remaining bytes when a file is passed as content=, respecting its current position (#1214).
• Stop the sync WebSocket keepalive thread cleanly when a ping races with connection shutdown (#1228).

httpcore2

Fixed

• Honor the sni_hostname extension for TLS inside HTTP proxy tunnels without applying it to the proxy's TLS connection (#1223).
• Prefer HTTP/2 during TLS protocol negotiation when enabled, and stop advertising HTTP/1.1 when it is disabled (#1155).

Full Changelog: pydantic/httpx2@v2.13.0...v2.13.1

v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (pydantic/httpx2#1140, pydantic/httpx2#1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (pydantic/httpx2#1204).

httpx2

Changed

• Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in pydantic/httpx2#1179

Fixed

... (truncated)

Commits

• d91c9f4 Correct the upcoming release version to 2.13.1 (#1228)
• 62a607d Prepare version 2.14.0 (#1227)
• 392bbed Honor the TLS hostname override in proxy tunnels ...

  Description has been truncated

[gloryfromca]

Blocking: restore Python 3.10 compatibility and the setuptools build backend in the generated locks.

I reviewed the full diff, lock inputs, consuming CI/release workflows, relevant history, supported-version compatibility, test changes, and repository architecture/guidance (no AGENTS.md, CLAUDE.md, or CONTEXT*.md files were present). No tests were weakened; this revision only changes generated requirements files.

Local results: repository asset, file-size, inventory, and release-version checks passed; core/script tests passed (86); engine lint and format checks passed; engine tests passed (177). The branch's required CI nevertheless reproduces both inline failures: Python 3.10 cannot install the CI lock, and Python packaging cannot load its backend. The separate Hermes adapter timeout was not raised because I could not tie it concretely to a changed dependency.

[gloryfromca]

Blocking: keep the CI lock installable on the supported Python 3.10 runtime.

The project declares Python >=3.10 and the core workflow installs this file on Python 3.10, but pyarrow==26.0.0 requires Python >=3.11. The required 3.10 job therefore stops during make install-ci with No matching distribution found for pyarrow==26.0.0, before any tests can run. The universal lock needs a Python-version split (or another compatible constraint) for 3.10.

[gloryfromca]

Blocking: restore the explicit setuptools input to the generated build lock.

requirements/build.in still names setuptools, and every package workflow installs this lock before invoking python -m build --no-isolation. With setuptools omitted here, the required core, plugin-package, and release jobs all fail with Backend 'setuptools.build_meta' is not available. A fresh compile also emits setuptools, confirming this deletion is not needed for the updated build package.