internal: bump the uv-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the uv-dependencies group with 7 updates in the / directory:

Package	From	To
httpx2	2.9.1	2.10.0
polars	1.43.0	1.43.2
pyarrow	25.0.0	25.0.1
tox	4.58.0	4.59.0
coverage	7.15.2	7.15.4
pylint	4.0.6	4.0.7
ruff	0.16.0	0.16.2

Updates httpx2 from 2.9.1 to 2.10.0

Release notes

Sourced from httpx2's releases.

v2.10.0

Highlights

🚀 Performance and memory improvements

• Sending large HTTP/2 request bodies no longer copies the body quadratically - sending a 256 MiB body went from ~36s to under 0.1s (pydantic/httpx2#1127).
• SSE parsing is up to 35x faster on highly fragmented streams (pydantic/httpx2#1117).
• Cookie extraction is now skipped for responses without a Set-Cookie header, making typical requests roughly 8% faster (pydantic/httpx2#1107).

🕸️ WebAssembly / Emscripten support

httpx2 now runs on Pyodide / Emscripten, using a JavaScript fetch-based transport defined in httpx2-jsfetch (pydantic/httpx2#1119, pydantic/httpx2#1114). Thanks @​hoodmane!

httpx2

Added

• Add support for running on WebAssembly / Emscripten via Pyodide by @​hoodmane in pydantic/httpx2#1119
• Add max_event_size to cap SSE event buffering by @​Kludex in pydantic/httpx2#1071
• Add RFC 9110 status code constants by @​mbeijen in pydantic/httpx2#1069
• Add support for Python 3.15 by @​hugovk in pydantic/httpx2#1090

Changed

• Improve SSE chunk buffering performance by @​Kludex in pydantic/httpx2#1117
• Skip cookie extraction without Set-Cookie by @​Kludex in pydantic/httpx2#1107
• Return str | None instead of Any from Headers.get by @​ItsDrike in pydantic/httpx2#1121

Fixed

• Enforce WebSocket max message size across fragments by @​Kludex in pydantic/httpx2#1085
• Ignore unsolicited and duplicate Pong frames by @​Kludex in pydantic/httpx2#1122

httpcore2

Added

• Add support for Python 3.15 by @​hugovk in pydantic/httpx2#1090

Changed

• Avoid quadratic copying when sending large HTTP/2 request bodies by @​Kludex in pydantic/httpx2#1127

Fixed

• Propagate the original exception instead of raising KeyError when an HTTP/2 stream fails by @​yhay81 in pydantic/httpx2#1093
• Start TLS for the wss scheme in SOCKS5 proxy connections by @​Kludex in pydantic/httpx2#1104

🙏 New Contributors

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.10.0 (August 9th, 2026)

Added

• Add support for running on WebAssembly / Emscripten via Pyodide, using a JavaScript fetch-based transport defined in httpx2-jsfetch. (#1119)
• Add max_event_size to cap SSE event buffering. (#1071)
• Add RFC 9110 status code constants. (#1069)
• Add support for Python 3.15. (#1090)

Changed

• Improve SSE chunk buffering performance. (#1117)
• Skip cookie extraction for responses without Set-Cookie headers. (#1107)
• Return str | None instead of Any from Headers.get. (#1121)

Fixed

• Enforce the WebSocket max message size across fragmented messages. (#1085)
• Ignore unsolicited and duplicate WebSocket Pong frames. (#1122)

Commits

• a966320 Version 2.10.0 (#1129)
• dee1d1a Return str | None instead of Any from Headers.get (#1121)
• dec24ad Use httpx2-jsfetch on Emscripten (#1119)
• 454b8b2 Ignore unsolicited and duplicate Pong frames (#1122)
• cbfc0e0 Improve SSE chunk buffering performance (#1117)
• ad141d8 Refactor SSE parser coordination (#1118)
• e0b0124 Make _client depend on the _transports package instead of its submodules ...
• e52f963 Skip dependencies not needed on Emscripten (#1114)
• 5d9eedc Add max_event_size to cap SSE event buffering (#1071)
• 55fad71 Bump the python-packages group across 1 directory with 15 updates (#1112)
• Additional commits viewable in compare view

Updates polars from 1.43.0 to 1.43.2

Release notes

Sourced from polars's releases.

Python Polars 1.43.2

⚠️ Deprecations

• Deprecate casts from Categorical to integer dtypes (#28525)
• Deprecate not setting the plan_stage argument in show_graph() (#28391)

🚀 Performance improvements

• Pushdown len() to concat/union inputs (#28570)

✨ Enhancements

• Issue FutureWarning on using from_arrow of ArrowStreamExportable (#28442)
• Add infer_schema_files parameter to scan_csv (#28440)

🐞 Bug fixes

• Properly propagate enum metadata for iceberg column mapping (#28580)
• Correctly write parquet field IDs for enums and categoricals (#28581)
• Fix arrow C interop binview offset (#28623)
• Fix duplicate hive values in hive pre-partition rewrite (#28621)
• Double-counted offset for Arrow export of sliced Series(Array) (#28602)
• Struct/List/Array equality handling in sort and join (#28601)
• More careful slice pushdown into joins (#28578)
• Preserve ordering in sliced unions (#28576)
• Drop input sortedness when casting to a string (#28574)
• Clear sortedness flags in StringChunked substring kernels (#28573)
• Bad mask handling when reading optional parquet column (#28547)
• Any operation on Unknown(Int) and Unknown(Float) should result in Unknown(Float) (#28545)
• Flip nulls_last after Expr.reverse() (#28572)
• Fix high blocking thread use in sink_parquet with async local path (#28543)
• Serialize LazyFrames backed by bytes (#28568)
• Release GIL in SQLContext.execute() (#28549)
• Propagate nulls_last in function_expr_sortedness (#28544)
• Incorrect slicing when a join requires sorting (#28541)

🛠️ Other improvements

• Fix duckdb delta extension install collision (#28607)

Thank you to all our contributors for making this release possible! @​BitWeaverDev, @​Matt711, @​Samoilov2004, @​borchero, @​dancsi, @​dsprenkels, @​kdn36, @​masumi-ryugo, @​nameexhaustion and @​ritchie46

Python Polars 1.43.1

🚀 Performance improvements

• Optimize not(bool_f) to not_bool_f (#28474)

✨ Enhancements

... (truncated)

Commits

• ae588a9 fix: Properly propagate enum metadata for iceberg column mapping (#28580)
• f6c766a fix: Correctly write parquet field IDs for enums and categoricals (#28581)
• 12f83f5 Python Polars 1.43.2 (#28625)
• 1ec0668 fix: Fix arrow C interop binview offset (#28623)
• af24b92 perf: Pushdown len() to concat/union inputs (#28570)
• e79bdb0 fix: Fix duplicate hive values in hive pre-partition rewrite (#28621)
• 7a6cdbc fix: Double-counted offset for Arrow export of sliced Series(Array) (#28602)
• a2b0b2a fix: Struct/List/Array equality handling in sort and join (#28601)
• 9aca544 ci: Fix duckdb delta extension install collision (#28607)
• 7d6483b fix(rust): Use try_new in StructArray construction in polars-json (#27489)
• Additional commits viewable in compare view

Updates pyarrow from 25.0.0 to 25.0.1

Release notes

Sourced from pyarrow's releases.

Apache Arrow 25.0.1

Release Notes URL: https://arrow.apache.org/release/25.0.1.html

Apache Arrow 25.0.1 RC1

Release Notes: Release Candidate: 25.0.1 RC1

Apache Arrow 25.0.1 RC0

Release Notes: Release Candidate: 25.0.1 RC0

Commits

• beccec0 MINOR: [Release] Update versions for 25.0.1
• 7bdf01a MINOR: [Release] Update .deb/.rpm changelogs for 25.0.1
• 91dbae1 MINOR: [Release] Update CHANGELOG.md for 25.0.1
• 849d463 GH-50808: [Python] Narrow Feather deprecation to V1 format (#50685)
• e70ebf5 GH-50600: [Release] Pin Python version in Conda verification
• f5037be GH-50578: [C++][FlightRPC][ODBC] Always return SQL_NO_DATA from GetMoreResult...
• 1491589 GH-50503: [Parquet] Remove SVE128 unpack (#50611)
• d1eaaed GH-50326: [Python] Convert arrays to Python objects without per-element Scala...
• fe14135 GH-50428: [C++] Better mimalloc configuration on macOS (#50549)
• 8fb632a GH-50383: [Release] Remove deprecated -f flag on conda create environment (#5...
• See full diff in compare view

Updates tox from 4.58.0 to 4.59.0

Release notes

Sourced from tox's releases.

v4.59.0

What's Changed

• 🐛 fix(type): cast set value in _render_options by @​gaborbernat in tox-dev/tox#4003
• docs: fix typo 'set the the' -> 'set then the' in config reference by @​LaRoyBot in tox-dev/tox#4002
• 👷 ci: pin coverage to the ctrace core by @​gaborbernat in tox-dev/tox#4009
• 🔥 chore: remove the misc changelog category by @​gaborbernat in tox-dev/tox#4012
• ✅ test: seed the virtualenv wheel image up front by @​gaborbernat in tox-dev/tox#4011
• ✨ feat(plugin): type the plugin and internal API surfaces by @​gaborbernat in tox-dev/tox#4014
• ✅ test: raise timeout for missing-interpreter discovery tests by @​gaborbernat in tox-dev/tox#4018
• 📝 docs: mark the INI configuration format as deprecated by @​gaborbernat in tox-dev/tox#4017

New Contributors

• @​LaRoyBot made their first contribution in tox-dev/tox#4002

Full Changelog: tox-dev/tox@4.58.0...4.59.0

Changelog

Sourced from tox's changelog.

Features - 4.59.0

• The plugin and internal APIs now declare their types, and the code base passes mypy --strict and pyrefly next to ty - by :user:gaborjbernat.

  • :meth:ConfigSet.get <tox.config.sets.ConfigSet.get> returns a configuration value after checking it against its declared type, so plugins can drop cast around conf["key"] reads.
  • The :func:tox_on_install <tox.plugin.spec.tox_on_install> hook and :class:Installer <tox.tox_env.installer.Installer> type their arguments as :data:InstallArguments <tox.tox_env.installer.InstallArguments>; installer subclasses may narrow it through the new second type parameter.
  • :class:Parsed <tox.config.cli.parser.Parsed> declares the CLI option surface, so options.<name> reads type-check.
  • :meth:ConfigSet.add_config <tox.config.sets.ConfigSet.add_config> accepts default=None for optional values and infers the value type from callable defaults.
  • The journal, the environment cache, and execute metadata hold JsonValue content; structured set_env entries match the SetEnvEntry shape. (:issue:4014)

Improved documentation - 4.59.0

• Mark the INI configuration format as deprecated throughout the documentation - by :user:gaborbernat.

  • The tutorial, the configuration reference, and the migration how-to state that INI keeps working for existing projects but is frozen and receives no new features.
  • Every INI example tab, the configuration discovery diagram, and the man page carry a deprecation marker.
  • The tutorial no longer suggests generating a tox.ini via tox quickstart. (:issue:4017)

Contributor-facing changes - 4.59.0

• Remove the misc changelog category, and align the changelog filename check with the categories towncrier accepts - by :user:gaborbernat. (:issue:4012)

---

v4.58.0 (2026-07-21)

---

Commits

• cb7eeca release 4.59.0
• da75cad 📝 docs: mark the INI configuration format as deprecated (#4017)
• ef7dc3a ✅ test: raise timeout for missing-interpreter discovery tests (#4018)
• c76344d [pre-commit.ci] pre-commit autoupdate (#4016)
• 7be33b8 ✨ feat(plugin): type the plugin and internal API surfaces (#4014)
• 2e247dc ✅ test: raise timeout for tests hitting real PyPI (#4011)
• 2c1f86f 🔥 chore: remove the misc changelog category (#4012)
• 59302d8 build(deps): bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#4008)
• 08333ee [pre-commit.ci] pre-commit autoupdate (#4010)
• 0bbe8c4 👷 ci: pin coverage to the ctrace core (#4009)
• Additional commits viewable in compare view

Updates coverage from 7.15.2 to 7.15.4

Release notes

Sourced from coverage's releases.

7.15.4

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
• Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.
• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️  PyPI page: coverage 7.15.3. :arrow_right:  To install: python3 -m pip install coverage==7.15.3

Changelog

Sourced from coverage's changelog.

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn't escaped where it's dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare <pull 2227_>_.

• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare <pull 2226_>_.

• Wheels are now provided for Python 3.15.

.. _pull 2226: coveragepy/coveragepy#2226 .. _pull 2227: coveragepy/coveragepy#2227

.. _changes_7-15-3:

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>. Closes issue 2200.

• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios <pull 2239_>_.

• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: coveragepy/coveragepy#2200 .. _pull 2234: coveragepy/coveragepy#2234 .. _pull 2239: coveragepy/coveragepy#2239 .. _pull 2240: coveragepy/coveragepy#2240

.. _changes_7-15-2:

Commits

• 4c0e7ff docs: sample HTML for 7.15.4
• db4cc32 docs: prep for 7.15.4
• c33085c style: start gradual move to ruff 0.16
• 53a0fd5 fix: neutralize control characters in lcov report fields (#2226)
• b64d53d build: make 3.15 wheels
• 53792ab build: show the python version for kits
• f6b03c7 chore: make upgrade_one package=cibuildwheel
• d9b660a chore: make upgrade
• b128a31 docs: oops, move this entry to the correct place
• a7a2c15 fix: escape filename urls in html report href attributes (#2227)
• Additional commits viewable in compare view

Updates pylint from 4.0.6 to 4.0.7

Commits

• c6768d3 Bump pylint to 4.0.7, update changelog (#11246)
• e96ce2b Stop invalid-name from treating TypedDict instances as classes
• 893294e [Backport maintenance/4.0.x] Fix crash in comparison-with-callable on a proxi...
• 8cd74d4 Fix a crash on calls unpacking dicts with non-string keys
• bc618ad Fix too-many-lines being reported at another module's pragma line
• 3e1ee47 [Backport maintenance/4.0.x] Fix bad-string-format-type false positives for...
• 7ca8116 [Backport maintenance/4.0.x] Fix useless-parent-delegation false positive o...
• 14275a1 [Backport maintenance/4.0.x] Fix literal-comparison suggestion corrupting i...
• a87eaa6 [Backport maintenance/4.0.x] Fix nested-min-max dropping arguments after th...
• bdd017f [Backport maintenance/4.0.x] Fix too-many-locals counting PEP 695 type para...
• Additional commits viewable in compare view

Updates ruff from 0.16.0 to 0.16.2

Release notes

Sourced from ruff's releases.

0.16.2

Release Notes

Released on 2026-08-06.

Bug fixes

• [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

• Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

• @​MeGaGiGaGon
• @​charliermarsh
• @​epage
• @​sharkdp
• @​ntBre

Install ruff 0.16.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.ps1 | iex"

Download ruff 0.16.2

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
ruff-i686-pc-windows-msvc.zip	x86 Windows	checksum
ruff-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ruff-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
ruff-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz	PPC64 Linux	checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
ruff-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
ruff-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.2

Released on 2026-08-06.

Bug fixes

• [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

• Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

• @​MeGaGiGaGon
• @​charliermarsh
• @​epage
• @​sharkdp
• @​ntBre

0.16.1

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

... (truncated)

Commits

• 5b48a04 Bump 0.16.2 (#27555)
• 1b9e5fc Update Swatinem/rust-cache action to v2.9.2 (#27568)
• c4e86fc [ty] Add helper extension methods for half-range and equality constraints (#2...
• 17a00de [ty] Reuse primer commands in memory reports (#27553)
• 6ea296b [ty] Normalize type labels in structured docstrings (#26923)
• 2fc445f [ty] Diagnose invalid getattr calls (#27502)
• 22c7823 [ty] Enable (but downrank) auto-import completion suggestions from stub-only ...
• 05160d5 [ty] Diagnose invalid descriptor __get__ calls (#27400)
• baea3d0 [ty] Expose strict analysis options in the playground (#27543)
• c88946e [ty] Bump ecosystem-analyzer for strict project settings (#27542)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions