build(deps): bump the patch-and-minor group with 7 updates

[dependabot]

Bumps the patch-and-minor group with 7 updates:

Package	From	To
mypy	2.1.0	2.3.0
tox	4.56.1	4.58.0
coverage	7.15.0	7.15.2
ruff	0.15.20	0.16.0
boto3	1.43.41	1.43.57
certifi	2026.6.17	2026.7.22
charset-normalizer	3.4.7	3.4.9

Updates mypy from 2.1.0 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

• No longer provide mypyc-accelerated wheels for macOS x86_64 [mypyc-wheels #119](mypyc/mypy_mypyc-wheels#119)

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

• Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)
• Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)
• Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)
• Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)
• Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits

• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• 0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
• 3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
• 24c237d [mypyc] Improve documentation of Final (#21713)
• b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
• cbcb51a Narrow for frozendict membership check (#21709)
• af2bc0f Sync typeshed (#21707)
• Additional commits viewable in compare view

Updates tox from 4.56.1 to 4.58.0

Release notes

Sourced from tox's releases.

v4.58.0

What's Changed

• 👷 ci: run the test matrix against Python 3.15 by @​gaborbernat in tox-dev/tox#4001

Full Changelog: tox-dev/tox@4.57.2...4.58.0

v4.57.2

What's Changed

• 🐛 fix(session): fix package env failure cascade and state corruption by @​gaborbernat in tox-dev/tox#3991
• 🐛 fix(pkg): repair editable fallback and sdist-wheel root handling by @​gaborbernat in tox-dev/tox#3992
• 🐛 fix(pylock): install exactly what the lock file specifies by @​gaborbernat in tox-dev/tox#3994
• 🐛 fix(cache): self-heal wrong-shape tox-info content by @​gaborbernat in tox-dev/tox#3996
• 🐛 fix(config): rebuild loader chains per config set by @​gaborbernat in tox-dev/tox#3993
• 🐛 fix(pip): stable rendering of set options in install cache by @​gaborbernat in tox-dev/tox#3995
• 🐛 fix(pep723): honor metadata behind a BOM, fail cleanly on bad blocks by @​gaborbernat in tox-dev/tox#3997
• 🐛 fix(run): honor the fail-fast contract, resilient teardown by @​gaborbernat in tox-dev/tox#3999
• 🐛 fix(cli): honor tox c -o, clean devenv ALL error, correct provision pin by @​gaborbernat in tox-dev/tox#3998
• 🐛 fix(ux): four run-edge polish fixes by @​gaborbernat in tox-dev/tox#4000

Full Changelog: tox-dev/tox@4.57.1...4.57.2

v4.57.1

What's Changed

• Run sequentially for run-parallel -p 0 instead of at CPU count by @​chuenchen309 in tox-dev/tox#3989
• Do not let a lone quote in a set_env value swallow the marker by @​chuenchen309 in tox-dev/tox#3988

Full Changelog: tox-dev/tox@4.57.0...4.57.1

v4.57.0

What's Changed

• 💰 Surface the org itself in the FUNDING config by @​webknjaz in tox-dev/tox#3979
• Replace prettier with mdformat and yamlfmt by @​gaborbernat in tox-dev/tox#3984
• 📦 build: use test dependency group in internal envs by @​gaborbernat in tox-dev/tox#3985
• ✨ feat(python): match free-threaded and debug interpreter builds by @​chuenchen309 in tox-dev/tox#3986

New Contributors

• @​chuenchen309 made their first contribution in tox-dev/tox#3986

Full Changelog: tox-dev/tox@4.56.4...4.57.0

... (truncated)

Changelog

Sourced from tox's changelog.

Miscellaneous internal changes - 4.58.0

• Test against Python 3.15 (beta) in CI and declare its classifier - by :user:gaborbernat. (:issue:4001)

---

v4.57.2 (2026-07-21)

---

Bug fixes - 4.57.2

• Fix package environment creation failures being misreported:

  • discard the partially registered configuration on failure, so the real error surfaces instead of a spurious duplicate configuration definition;
  • report the first creation failure in definition order, not a hash-random one;
  • build the PEP 517 frontend lazily, so tox c and tox l work when pyproject.toml cannot be read. (:issue:3987)

• Fix state corruption in the environment creation machinery:

  • a failed run environment build no longer removes shared package environments other run environments still use;
  • a run environment registers with its package environment once, not twice with triple-counted usage;
  • circular depends reports the cycle as an error instead of a raw traceback;
  • Skip raised by a plugin for a package environment marks the run environment package-skipped instead of crashing with UnboundLocalError. (:issue:3991)

• Fix two packaging regressions:

  • package = editable on a build backend without PEP-660 support now falls back to editable-legacy with a warning instead of crashing, also when the project metadata is static;
  • editable and wheel environments running after an sdist-wheel environment build from the project sources again, instead of a stale temporary copy that made source edits invisible. (:issue:3992)

• An environment serving as both a run environment and a package environment now behaves predictably:

  • one defined through a [testenv:...]-style section and referenced by package_env inherits from pkgenv/env_pkg_base as documented, instead of silently keeping run environment defaults;
  • one listed in env_list while referenced as a package environment is reported as a configuration conflict up front, instead of failing late with cannot run packaging environment or silently disappearing from tox l. (:issue:3993)

• pylock.toml installs now match the lock file:

  • a package locked once per Python range installs only the version matching the environment's interpreter;
  • packages locked to a local directory, VCS repository, or archive install from that source instead of resolving the name against the package index;
  • locked hashes are verified when every entry carries one;
  • changing a pip environment variable such as PIP_INDEX_URL reinstalls, as it already did for deps.

... (truncated)

Commits

• 69e1bdc release 4.58.0
• ea8734e 👷 ci: run the test matrix against Python 3.15 (#4001)
• 2d8d5ae release 4.57.2
• b74d78b 🐛 fix(ux): four run-edge polish fixes (#4000)
• 09dad3d 🐛 fix(cli): honor tox c -o, clean devenv ALL error, correct provision pin (#3...
• fa6ec2b 🐛 fix(run): honor the fail-fast contract, resilient teardown (#3999)
• b1b0159 🐛 fix(pep723): honor metadata behind a BOM, fail cleanly on bad blocks (#3997)
• a111ec6 🐛 fix(pip): stable rendering of set options in install cache (#3995)
• e969723 🐛 fix(config): rebuild loader chains per config set (#3993)
• 6a9b6a5 🐛 fix(cache): self-heal wrong-shape tox-info content (#3996)
• Additional commits viewable in compare view

Updates coverage from 7.15.0 to 7.15.2

Release notes

Sourced from coverage's releases.

7.15.2

Version 7.15.2 — 2026-07-15

• Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

7.15.1

Version 7.15.1 — 2026-07-12

• Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare.
• A number of performance improvements thanks to Paul Kehrer, in pull requests 2213, 2214, 2215, 2216, 2218, 2220, and 2221.

➡️  PyPI page: coverage 7.15.1. :arrow_right:  To install: python3 -m pip install coverage==7.15.1

Changelog

Sourced from coverage's changelog.

Version 7.15.2 — 2026-07-15

• Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

• Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

• A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213 .. _pull 2214: coveragepy/coveragepy#2214 .. _pull 2215: coveragepy/coveragepy#2215 .. _pull 2216: coveragepy/coveragepy#2216 .. _pull 2218: coveragepy/coveragepy#2218 .. _pull 2220: coveragepy/coveragepy#2220 .. _pull 2221: coveragepy/coveragepy#2221 .. _pull 2224: coveragepy/coveragepy#2224

.. _changes_7-15-0:

Commits

• 50d8659 docs: sample HTML for 7.15.2
• b5eed20 docs: prep for 7.15.2
• 78cab6e fix: reduce memory use during reporting. #2229 (#2231)
• b4c1fda build: bump version to 7.15.2
• da63bed docs: sample HTML for 7.15.1
• bc35e64 docs: prep for 7.15.1
• 182b010 perf: resolve sysmon branch events lazily, one pair at a time (#2221)
• ee271ee perf: compute multiline maps cheaply in the sysmon core (#2220)
• 1441b96 chore: bump the action-dependencies group with 6 updates (#2225)
• dd80635 fix: escape context labels in html report inline script block (#2224)
• Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Updates boto3 from 1.43.41 to 1.43.57

Commits

• 7b06b40 Merge branch 'release-1.43.57'
• f5fdd1c Bumping version to 1.43.57
• 6af728c Add changelog entries from botocore
• 72a153d Merge branch 'release-1.43.56'
• 5092de5 Merge branch 'release-1.43.56' into develop
• b1b9ff3 Bumping version to 1.43.56
• c7d2f6e Add changelog entries from botocore
• 2a09bb6 Merge branch 'release-1.43.55'
• cad396b Merge branch 'release-1.43.55' into develop
• ffe76ba Bumping version to 1.43.55
• Additional commits viewable in compare view

Updates certifi from 2026.6.17 to 2026.7.22

Commits

• f4bc676 2026.07.22 (#428)
• 4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427)
• 01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426)
• eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425)
• 474e6fc Include tests in the source distribution (#424)
• a31ef39 Bump actions/setup-python from 6.2.0 to 6.3.0 (#420)
• 98eb2c7 Bump actions/checkout from 6.0.3 to 7.0.0 (#419)
• See full diff in compare view

Updates charset-normalizer from 3.4.7 to 3.4.9

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

• Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

Version 3.4.8

3.4.8 (2026-07-06)

Fixed

• Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
• Unnecessary json import at runtime (#753)
• Inverse capitalization not seen by noise detector (#731)

Changed

• No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.
• Micro-optimizations in our noise / coherence measurements.
• No longer using regex search by default for our preemptive charset mark algorithm.
• Raised upperbound of setuptools to v83.
• Raised upperbound of mypy(c) to v2.1.

Removed

• Redundant UTF7 BOM marker (#730)

Changelog

Sourced from charset-normalizer's changelog.

3.4.9 (2026-07-07)

Fixed

• Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

3.4.8 (2026-07-06)

Fixed

• Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
• Unnecessary json import at runtime (#753)
• Inverse capitalization not seen by noise detector (#731)

Changed

• No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.
• Micro-optimizations in our noise / coherence measurements.
• No longer using regex search by default for our preemptive charset mark algorithm.
• Raised upperbound of setuptools to v83.
• Raised upperbound of mypy(c) to v2.1.

Removed

• Redundant UTF7 BOM marker (#730)

Commits

• cc68407 Merge pull request #772 from jawah/fix-regression-fallback-path
• 152b923 chore: release 3.4.9
• 2bc2607 fix: unicodedecodeerror in fallback path
• be252d7 chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#767)
• 71c7bdd chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#768)
• aeea391 chore(deps): bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#758)
• a6f8feb Merge pull request #770 from jawah/unblock-ci
• 528e16c chore: add osv-scanner.toml
• 5993498 chore: ast_serialize musl missing prebuilt riscv,s390x,ppc64le
• aa2ddd8 Release 3.4.8 (#766)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

☂️ Code Coverage

current status: ✅

Overall Coverage

Statements	Covered	Coverage	Threshold	Status
680	556	82%	70%	🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: 9222904 by action🐍

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud