build(deps): bump the python-minor-and-patch group across 1 directory with 5 updates

[dependabot]

Bumps the python-minor-and-patch group with 5 updates in the / directory:

Package	From	To
numpy	2.5.3	2.5.4
spharmgrid	0.4.0	0.4.1
pydata-sphinx-theme	0.22.0	0.23.0
ruff	0.16.10	0.17.0
ty	0.0.84	0.0.86

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

• Many typing fixes and improvements,
• A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

• numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

• Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

• numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits

• a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
• 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
• 91acd87 REL: Prepare for the NumPy 2.5.4 release.
• 9cc555b Merge pull request #32956 from charris/backport-typing-1
• e04b972 TYP: dtype[void].names: allow setting with list (#32943)
• d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
• 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
• 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
• 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
• c7bcd2c TYP: place: widen mask (#32926)
• Additional commits viewable in compare view

Updates spharmgrid from 0.4.0 to 0.4.1

Release notes

Sourced from spharmgrid's releases.

v0.4.1

What's Changed

• deps: update Torch support for torch-harmonics 0.9.3 by @​mwyau in mwyau/spharmgrid#69
• ci: upgrade S2FFT, consolidate backend tests, and tighten NCL parity by @​mwyau in mwyau/spharmgrid#70
• build: add Python 3.15 support by @​mwyau in mwyau/spharmgrid#72
• release: v0.4.1 by @​mwyau in mwyau/spharmgrid#71

Full Changelog: mwyau/spharmgrid@v0.4.0...v0.4.1

Changelog

Sourced from spharmgrid's changelog.

v0.4.1 - 2026-10-10

Backend compatibility

• Updated the JAX dependency to S2FFT 1.5.0 and removed the Git source override for Python 3.13 and later. Regular GL transforms check the S2FFT 1.5.0 internal latitude-transform interface.
• Updated the PyTorch extra from torch-harmonics==0.6.5 to torch-harmonics>=0.9.3. Adjusted high-bandwidth Clenshaw–Curtis scalar and vector analysis for the released library's forward-weight normalization.

Numerical validation

• Tightened NCL 6.6.2/SPHEREPACK comparisons to operation-specific absolute tolerances (rtol=0), using measured errors from 400 comparisons across GL and CC grids, analytic and seeded random fields, and spectral selections. The largest normalized error was 3.71e-11 for CC scalar filtering with the hard T5-42 cutoff.
• Adjusted the JAX analytic vector Laplacian tolerance for the minimum-dependency environment.

CI and dependencies

• Declared Python 3.15 support for the core package. The Ubuntu unit-test matrix includes Python 3.15.
• Moved xarray_jax integration into the Python 3.14 JAX CI job and removed duplicate Torch and JAX jobs from the validation workflow. NCL/SPHEREPACK comparisons continue in the separate validation job.
• Removed the Torch Git development build, and separated the NumPy 1.x parity environment from CUDA 13 development dependencies. CUDA 13 development requires JAX 0.7 or later.

Commits

• 71826fc Merge pull request #71 from mwyau/release/v0.4.1
• 2a8512c Merge pull request #72 from mwyau/build/python-3.15
• 58b611b build: add Python 3.15 support
• 6f40f82 docs: declare Python 3.15 support in changelog
• 3283451 docs: add v0.4.1 release notes
• 353f195 release: v0.4.1
• 300b0b2 Merge pull request #70 from mwyau/ci/s2fft-1.5-simplify-validation
• 51852e4 test: tighten NCL parity tolerances
• 8d6cc5e test: increase JAX tolerance for min-deps test
• 3994da0 build: update uv.lock and code quality checks
• Additional commits viewable in compare view

Updates pydata-sphinx-theme from 0.22.0 to 0.23.0

Release notes

Sourced from pydata-sphinx-theme's releases.

v0.23.0

What's Changed

Improvements

• Loosen what keys can be cached in the sidebar by @​Yann-P in pydata/pydata-sphinx-theme#2500
• Declare color-scheme support and recommend light-dark() in the docs by @​anandghegde in pydata/pydata-sphinx-theme#2492
• Post-merge review for light-dark by @​Yann-P in pydata/pydata-sphinx-theme#2506

Fixes

• Prevent unwanted renders of PST sidebar, even if disabled in configuration by @​Yann-P in pydata/pydata-sphinx-theme#2507
• Fix shortening GitHub organization projects root links by @​Junaid-PK in pydata/pydata-sphinx-theme#2498
• Fix spacing between unnamed API return types by @​haoran3160-afk in pydata/pydata-sphinx-theme#2499

Maintenance

• Run npm audit; bump node version; add dep cooldown by @​Yann-P in pydata/pydata-sphinx-theme#2508

Dependencies

• Bump py-cov-action/python-coverage-comment-action from 4.3 to 4.5 by @​dependabot[bot] in pydata/pydata-sphinx-theme#2513
• [pre-commit.ci] pre-commit autoupdate hooks by @​pre-commit-ci[bot] in pydata/pydata-sphinx-theme#2518
• Bump astral-sh/setup-uv from 10.0.1 to 10.1.0 by @​dependabot[bot] in pydata/pydata-sphinx-theme#2489

New Contributors

• @​anandghegde made their first contribution in pydata/pydata-sphinx-theme#2492
• @​haoran3160-afk made their first contribution in pydata/pydata-sphinx-theme#2499

Full Changelog: pydata/pydata-sphinx-theme@v0.22.0...v0.23.0

v0.23.0rc0

What's Changed

Improvements

• Loosen what keys can be cached in the sidebar by @​Yann-P in pydata/pydata-sphinx-theme#2500
• Declare color-scheme support and recommend light-dark() in the docs by @​anandghegde in pydata/pydata-sphinx-theme#2492

Fixes

• Fix shortening GitHub organization projects root links by @​Junaid-PK in pydata/pydata-sphinx-theme#2498
• Prevent unwanted renders of PST sidebar, even if disabled in configuration by @​Yann-P in pydata/pydata-sphinx-theme#2507
• Fix spacing between unnamed API return types by @​haoran3160-afk in pydata/pydata-sphinx-theme#2499

Maintenance

• Run npm audit; bump node version; add dep cooldown by @​Yann-P in pydata/pydata-sphinx-theme#2508
• Post-merge review for light-dark by @​Yann-P in pydata/pydata-sphinx-theme#2506

New Contributors

• @​anandghegde made their first contribution in pydata/pydata-sphinx-theme#2492
• @​haoran3160-afk made their first contribution in pydata/pydata-sphinx-theme#2499

... (truncated)

Commits

• 560ca12 Bump 0.23.0rc0 -> 0.23.0
• 1a2a2c3 Bump astral-sh/setup-uv from 10.0.1 to 10.1.0 (#2489)
• 8a67845 [pre-commit.ci] pre-commit autoupdate hooks (#2518)
• ea0a529 Bump py-cov-action/python-coverage-comment-action from 4.3 to 4.5 (#2513)
• daccf13 Bump 0.22.0 -> 0.23.0rc0
• 642ca72 Loosen what keys can be cached in the sidebar (#2500)
• c223b82 Fix spacing between unnamed API return types (#2499)
• 9cfdc3e Run npm audit; bump node version; add dep cooldown (#2508)
• e0a5d5c Prevent unwanted renders of PST sidebar, even if disabled in configuration (#...
• 46a8149 Post-merge review for light-dark (#2506)
• Additional commits viewable in compare view

Updates ruff from 0.16.10 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

  The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

• Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

  The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

• Remove support for ruff-lsp (#28750)

  Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

• lazy-import-mismatch (TID254)
• lazy-import-immediately-resolved (TID255)
• os-path-commonprefix (RUF071)

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

• Update the default rule set (#28786)

  Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

• Update Rust crate quick-junit to 0.8.0 (#27295)

  JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

• [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

• Support Unicode dummy variable names (#28722)

  The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

• Update to Unicode 17 (#21229, #28784)

  Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

• Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits

• 5b27c1c Bump version to 0.17.0 (#29259)
• 8f362bf Integrate vendored Unicode names into Ruff
• 88a50d6 Revert upstream Unicode loose matching
• 276832a Revert upstream Unicode alias normalization
• 26911ca Vendor unicode_names2 from upstream
• 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
• bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
• 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
• dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
• ef23c9c Update default and latest Python versions for 3.15 (#28792)
• Additional commits viewable in compare view

Updates ty from 0.0.84 to 0.0.86

Release notes

Sourced from ty's releases.

0.0.86

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ty wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

• Infer empty collection branches from nonempty literals (#29131)
• Invalidate dependency metadata when environments change (#29126)
• Preserve final attribute restrictions on composite types (#29135)
• Preserve recursive structure in Annotated values (#29058)
• Specialize inherited dataclass field converters (#29192)

LSP server

• Show documentation for annotation operators on hover (#29185)

Core type checking

• Check attribute and property override types (#28556)
• Narrow tuple unions through truthiness and type checks (#29125)
• Preserve literal types when consuming dictionary literals (#29145)
• Preserve non-boolean comparison results for intersections (#28045)
• Preserve receiver specializations when calling unions of bound methods (#29015)
• Represent uninhabited truthiness explicitly (#28843)
• Solve validity type context through constraint sets (#28909)

Performance

• Avoid recursion guards for non-generic nominal targets (#29202)
• Check exact exclusions before intersection positives (#29195)

Memory usage improvements

• Share constraints in retained sequent maps (#28966)

Other changes

• Update the default Python version to 3.15 (#28792)
• Update to Unicode 17 (#21229, #28784)
• Always show fixes in the CLI (#27810)

Contributors

• @​gorewilliams
• @​carljm
• @​AlexWaygood
• @​ibraheemdev

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.86

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ty wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

• Infer empty collection branches from nonempty literals (#29131)
• Invalidate dependency metadata when environments change (#29126)
• Preserve final attribute restrictions on composite types (#29135)
• Preserve recursive structure in Annotated values (#29058)
• Specialize inherited dataclass field converters (#29192)

LSP server

• Show documentation for annotation operators on hover (#29185)

Core type checking

• Check attribute and property override types (#28556)
• Narrow tuple unions through truthiness and type checks (#29125)
• Preserve literal types when consuming dictionary literals (#29145)
• Preserve non-boolean comparison results for intersections (#28045)
• Preserve receiver specializations when calling unions of bound methods (#29015)
• Represent uninhabited truthiness explicitly (#28843)
• Solve validity type context through constraint sets (#28909)

Performance

• Avoid recursion guards for non-generic nominal targets (#29202)
• Check exact exclusions before intersection positives (#29195)

Memory usage improvements

• Share constraints in retained sequent maps (#28966)

Other changes

• Update the default Python version to 3.15 (#28792)
• Update to Unicode 17 (#21229, #28784)
• Always show fixes in the CLI (#27810)

Contributors

• @​gorewilliams

... (truncated)

Commits

• d5da069 Authenticate Docker Hub pulls (#4702)
• 00606fa Use Namespace for macOS x86-64 release builds (#4700)
• 7969505 Bump version to 0.0.86 (#4699)
• 8e2fa95 Sync the Rust toolchain with the Ruff submodule (#4701)
• 9602924 [ty] Use shared release signing actions (#4652)
• 23f569b Document module and Python environment discovery (#4635)
• 7300c73 Update prek dependencies (#4682)
• ac2d7f1 Update dependency prek to v0.5.2 (#4681)
• d7fc5ef Bump version to 0.0.85 (#4679)
• bc4fd9e Include reproducers in daily fuzz issues (#4671)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.14%. Comparing base (de0d688) to head (5072aa9).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #262   +/-   ##
=======================================
  Coverage   78.14%   78.14%           
=======================================
  Files          59       59           
  Lines        9664     9664           
  Branches     1884     1884           
=======================================
  Hits         7552     7552           
  Misses       1375     1375           
  Partials      737      737           

Flag	Coverage Δ
integration	51.33% <77.77%> (ø)
parity	17.06% <77.77%> (ø)
unit	56.98% <100.00%> (ø)
unit-jit-coverage	72.34% <100.00%> (ø)
unit-jit-disabled	73.67% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/pystormtracker/backends.py	79.01% <100.00%> (ø)
src/pystormtracker/cli.py	86.66% <100.00%> (ø)
src/pystormtracker/hodges/progress.py	85.29% <100.00%> (ø)
src/pystormtracker/utils/logging.py	86.76% <100.00%> (ø)

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.