Bump the python-dependencies group with 6 updates by dependabot[bot] · Pull Request #636 · statisticsnorway/datadoc-editor

dependabot · 2026-06-24T09:17:02Z

Bumps the python-dependencies group with 6 updates:

Package	From	To
dapla-toolbelt-metadata	`0.17.0`	`0.17.1`
dash	`4.2.0`	`4.3.0`
ssb-dash-components	`0.11.1`	`0.11.2`
ruff	`0.15.17`	`0.15.19`
pytest	`9.1.0`	`9.1.1`
cryptography	`48.0.1`	`46.0.7`

Updates dapla-toolbelt-metadata from 0.17.0 to 0.17.1

Release notes

Sourced from dapla-toolbelt-metadata's releases.

v0.17.1

Changes

👷 Continuous Integration

Bump the github-action-dependencies group across 1 directory with 5 updates (#434) @dependabot[bot]

📦 Dependencies

Bump urllib3 from 2.6.3 to 2.7.0 (#431) @dependabot[bot]

Bump the github-action-dependencies group across 1 directory with 5 updates (#434) @dependabot[bot]

Bump cryptography from 46.0.7 to 48.0.1 (#441) @dependabot[bot]

Bump aiohttp from 3.13.4 to 3.14.1 (#442) @dependabot[bot]

Bump starlette from 1.0.0 to 1.3.1 (#443) @dependabot[bot]

Bump idna from 3.11 to 3.15 (#432) @dependabot[bot]

Bump the python-dependencies group across 1 directory with 31 updates (#435) @dependabot[bot]

Commits

abcb8e5 Merge pull request #444 from statisticsnorway/release/v0.17.1
73441e8 Release version 0.17.0 -> 0.17.1
08f6192 Merge pull request #431 from statisticsnorway/dependabot/uv/urllib3-2.7.0
ae89461 Merge pull request #434 from statisticsnorway/dependabot/github_actions/githu...
e419dcf Merge pull request #441 from statisticsnorway/dependabot/uv/cryptography-48.0.1
96b2da8 Merge pull request #442 from statisticsnorway/dependabot/uv/aiohttp-3.14.1
3f1528c Merge pull request #443 from statisticsnorway/dependabot/uv/starlette-1.3.1
0da44b9 Merge pull request #432 from statisticsnorway/dependabot/uv/idna-3.15
7e8ab05 Merge pull request #435 from statisticsnorway/dependabot/uv/python-dependenci...
c5c2a83 Bump starlette from 1.0.0 to 1.3.1
Additional commits viewable in compare view

Updates dash from 4.2.0 to 4.3.0

Release notes

Sourced from dash's releases.

v4.3.0

Added

#3796 MCP: Add configure_mcp_server() to toggle which content the MCP server exposes (include_layout, include_callbacks, include_clientside_callbacks, include_pages, expose_callback_docstrings). Only the parameters explicitly passed are updated; omitted parameters retain their current value.

#3710 MCP: Framework utilities, types for interacting with layout

#3711 MCP: CallbackAdapter for representing callback-related data in MCP-friendly format

#3712 MCP: Resources for exposing app layout, components, and pages

#3731 MCP: Expose callbacks as Tools

#3747 MCP: Support pattern-matching callbacks in Tools

#3748 MCP: Format callback results for LLM consumption (rendered graphs, markdown tables)

#3749 MCP: get_dash_component Tool and callback execution

#3750 MCP: Server routes, mcp_enabled function decorator, and Streamable HTTP transport

#3766 MCP: Support background callbacks in Tools

Changed

#3796 MCP: Remove the mcp_expose_docstrings Dash() constructor argument; callback docstring exposure is now controlled via configure_mcp_server(expose_callback_docstrings=...).

Fixed

#3817 Fix background callback context serialisation for non-dict request args on the FastAPI and Quart backends. Fixes #3816.

#3805 Fix FastAPI POST routes deadlock caused by middleware consuming request body. Fixes #3801.

#3813 Fix websockets using incorrect path when deployed behind a proxy

#3830 MCP: Respond to the Streamable HTTP GET (SSE) request with an empty event stream instead of 405 Method Not Allowed

v4.3.0rc0

Added

#3710 MCP: Framework utilities, types for interacting with layout

#3711 MCP: CallbackAdapter for representing callback-related data in MCP-friendly format

#3712 MCP: Resources for exposing app layout, components, and pages

#3731 MCP: Expose callbacks as Tools

#3747 MCP: Support pattern-matching callbacks in Tools

#3748 MCP: Format callback results for LLM consumption (rendered graphs, markdown tables)

#3749 MCP: get_dash_component Tool and callback execution

#3750 MCP: Server routes, mcp_enabled function decorator, and Streamable HTTP transport

#3766 MCP: Support background callbacks in Tools

Changelog

Sourced from dash's changelog.

[4.3.0] - 2026-06-18

Added

#3796 MCP: Add configure_mcp_server() to toggle which content the MCP server exposes (include_layout, include_callbacks, include_clientside_callbacks, include_pages, expose_callback_docstrings). Only the parameters explicitly passed are updated; omitted parameters retain their current value.

Changed

#3796 MCP: Remove the mcp_expose_docstrings Dash() constructor argument; callback docstring exposure is now controlled via configure_mcp_server(expose_callback_docstrings=...).

Fixed

#3817 Fix background callback context serialisation for non-dict request args on the FastAPI and Quart backends. Fixes #3816.

#3805 Fix FastAPI POST routes deadlock caused by middleware consuming request body. Fixes #3801.

#3813 Fix websockets using incorrect path when deployed behind a proxy

#3830 MCP: Respond to the Streamable HTTP GET (SSE) request with an empty event stream instead of 405 Method Not Allowed

[4.3.0rc0] - 2026-05-21

Added

#3710 MCP: Framework utilities, types for interacting with layout

#3711 MCP: CallbackAdapter for representing callback-related data in MCP-friendly format

#3712 MCP: Resources for exposing app layout, components, and pages

#3731 MCP: Expose callbacks as Tools

#3747 MCP: Support pattern-matching callbacks in Tools

#3748 MCP: Format callback results for LLM consumption (rendered graphs, markdown tables)

#3749 MCP: get_dash_component Tool and callback execution

#3750 MCP: Server routes, mcp_enabled function decorator, and Streamable HTTP transport

#3766 MCP: Support background callbacks in Tools

Commits

d95db60 Merge pull request #3832 from plotly/master-4.3.0
904e5ed ci: skip Typing Tests on PRs targeting master
b3babe4 build artifacts
0c89b98 Merge branch 'dev' into master-4.3.0
86d02b4 Merge pull request #3831 from plotly/release/4.3.0
16e09f2 Version bump of component suites
adb6bb2 bump version
27b8c45 Merge pull request #3807 from plotly/mcp
7fe7a32 Fix failing mcp test
ff4d66d Merge remote-tracking branch 'origin/dev' into mcp
Additional commits viewable in compare view

Updates ssb-dash-components from 0.11.1 to 0.11.2

Updates ruff from 0.15.17 to 0.15.19

Release notes

Sourced from ruff's releases.

0.15.19

Release Notes

Released on 2026-06-23.

Preview features

Support human-readable names when hovering suppression comments and in code actions (#26114)

Bug fixes

Fall back to default settings when editor-only settings are invalid (#26244)

Fix panic when inserting text at a notebook cell boundary (#26111)

Rule changes

[pylint] Update fix suggestions for __floor__, __trunc__, __length_hint__, and __matmul__ variants (PLC2801) (#26239)

Performance

Avoid allocating when parsing single string literals (#26200)

Avoid reallocating singleton call arguments (#26223)

Lazily create source files for lint diagnostics (#26226)

Optimize formatter text width and indentation (#26236)

Reserve capacity for builtin bindings (#26229)

Skip repeated-key checks for singleton dictionaries (#26228)

Use ArrayVec for qualified name segments (#26224)

Documentation

[flake8-pyi] Note that PYI051 is an opinionated stylistic rule (#26179)

[pyupgrade] Clarify UP029 as a Python 2 compatibility rule (#26243)

Other changes

Publish Ruff crates to crates.io (#26271)

Contributors

@MakenRosa

@MichaReiser

@trilamsr

@ntBre

@sanjibani

@charliermarsh

Install ruff 0.15.19

Install prebuilt binaries via shell script

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.19

Released on 2026-06-23.

Preview features

Support human-readable names when hovering suppression comments and in code actions (#26114)

Bug fixes

Fall back to default settings when editor-only settings are invalid (#26244)

Fix panic when inserting text at a notebook cell boundary (#26111)

Rule changes

[pylint] Update fix suggestions for __floor__, __trunc__, __length_hint__, and __matmul__ variants (PLC2801) (#26239)

Performance

Avoid allocating when parsing single string literals (#26200)

Avoid reallocating singleton call arguments (#26223)

Lazily create source files for lint diagnostics (#26226)

Optimize formatter text width and indentation (#26236)

Reserve capacity for builtin bindings (#26229)

Skip repeated-key checks for singleton dictionaries (#26228)

Use ArrayVec for qualified name segments (#26224)

Documentation

[flake8-pyi] Note that PYI051 is an opinionated stylistic rule (#26179)

[pyupgrade] Clarify UP029 as a Python 2 compatibility rule (#26243)

Other changes

Publish Ruff crates to crates.io (#26271)

Contributors

@MakenRosa

@MichaReiser

@trilamsr

@ntBre

@sanjibani

@charliermarsh

0.15.18

Released on 2026-06-18.

Preview features

... (truncated)

Commits

7f04365 Bump version to 0.15.19 (#26291)
a30ba16 [ty] Infer definite equality comparison results (#26290)
bcd2028 [ty] Avoid recursion when projecting narrowing constraints (#26276)
c0e083e [ty] Avoid bypassing lazy constraints for Divergent (#26288)
fb13596 Record configured crates.io packages (#26281)
85da759 [ty] Fix ParamSpec callable signature extraction for callable instances (#26279)
4c98a81 [ty] Make multi-arm TypeOf cycle recovery monotonic (#26275)
7b84361 [ty] Preserve regular kind for callable instances (#26253)
93c8c59 [flake8-pyi] Note that PYI051 is an opinionated stylistic rule (#26179)
bc9bb05 [ty] Infer types for names bound in match patterns (#25940)
Additional commits viewable in compare view

Updates pytest from 9.1.0 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

#14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.

#14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".

#14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.

#14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

Commits

cf470ec Prepare release version 9.1.1
e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
501c4bc Merge pull request #14596 from bluetech/doc-classmethod
b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
9a567e0 [automated] Update plugin list (#14617) (#14618)
ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
Additional commits viewable in compare view

Updates cryptography from 48.0.1 to 46.0.7

Changelog

Sourced from cryptography's changelog.

48.0.1 - 2026-06-09
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.
.. _v48-0-0:
48.0.0 - 2026-05-04
BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed. cryptography now requires Python 3.9 or later.

BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm now raises ValueError. Previously, such CRLs were parsed successfully and only rejected during signature validation.

Added support for :doc:/hazmat/primitives/asymmetric/mlkem and :doc:/hazmat/primitives/asymmetric/mldsa when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels.

Note: Going forward, we do not guarantee that all functionality in cryptography will be available when building against OpenSSL. See :doc:/statements/state-of-openssl for more information.

.. _v47-0-0:

47.0.0 - 2026-04-24
* Support for Python 3.8 is deprecated and will be removed in the next
  ``cryptography`` release.
* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves
  (``SECT*`` classes) has been removed. These curves are rarely used and
  have additional security considerations that make them undesirable.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.
  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
  continue to be supported.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1.
* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or
  keys with unsupported explicit curve encodings now raises
  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of
  ``ValueError``. This change affects
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,
  and :meth:`~cryptography.x509.Certificate.public_key` when called on
  certificates with unsupported public key algorithms.
</tr></table> 

... (truncated)

Commits

622d672 46.0.7 release (#14602)
91d7288 Cherry-pick #14542 (#14543)
06e120e bump version for 46.0.5 release (#14289)
0eebb9d EC check key on cofactor > 1 (#14287)
bedf6e1 fix openssl version on 46 branch (#14220)
e6f44fc bump for 46.0.4 and drop win arm64 due to CI issues (#14217)
c0af4dd release 46.0.3 (#13681)
99efe5a bump version for 46.0.2 (#13531)
e735cfc release 46.0.1 (#13450)
4e457ff Explicitly specify python in mac uv build invocation (#13447)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-dependencies group with 6 updates: | Package | From | To | | --- | --- | --- | | [dapla-toolbelt-metadata](https://github.com/statisticsnorway/dapla-toolbelt-metadata) | `0.17.0` | `0.17.1` | | [dash](https://github.com/plotly/dash) | `4.2.0` | `4.3.0` | | ssb-dash-components | `0.11.1` | `0.11.2` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.17` | `0.15.19` | | [pytest](https://github.com/pytest-dev/pytest) | `9.1.0` | `9.1.1` | | [cryptography](https://github.com/pyca/cryptography) | `48.0.1` | `46.0.7` | Updates `dapla-toolbelt-metadata` from 0.17.0 to 0.17.1 - [Release notes](https://github.com/statisticsnorway/dapla-toolbelt-metadata/releases) - [Commits](statisticsnorway/dapla-toolbelt-metadata@v0.17.0...v0.17.1) Updates `dash` from 4.2.0 to 4.3.0 - [Release notes](https://github.com/plotly/dash/releases) - [Changelog](https://github.com/plotly/dash/blob/dev/CHANGELOG.md) - [Commits](plotly/dash@v4.2.0...v4.3.0) Updates `ssb-dash-components` from 0.11.1 to 0.11.2 Updates `ruff` from 0.15.17 to 0.15.19 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.17...0.15.19) Updates `pytest` from 9.1.0 to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.1.0...9.1.1) Updates `cryptography` from 48.0.1 to 46.0.7 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.1...46.0.7) --- updated-dependencies: - dependency-name: dapla-toolbelt-metadata dependency-version: 0.17.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: dash dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: ssb-dash-components dependency-version: 0.11.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: ruff dependency-version: 0.15.19 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: cryptography dependency-version: 46.0.7 dependency-type: indirect update-type: version-update:semver-major dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jun 24, 2026

dependabot Bot requested a review from a team as a code owner June 24, 2026 09:17

mmwinther approved these changes Jun 24, 2026

View reviewed changes

mmwinther merged commit 4e22839 into master Jun 24, 2026
16 checks passed

mmwinther deleted the dependabot/uv/python-dependencies-47aeda25cb branch June 24, 2026 09:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the python-dependencies group with 6 updates#636

Bump the python-dependencies group with 6 updates#636
mmwinther merged 1 commit into
masterfrom
dependabot/uv/python-dependencies-47aeda25cb

dependabot Bot commented on behalf of github Jun 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 24, 2026

v0.17.1

Changes

👷 Continuous Integration

📦 Dependencies

v4.3.0

Added

Changed

Fixed

v4.3.0rc0

Added

[4.3.0] - 2026-06-18

Added

Changed

Fixed

[4.3.0rc0] - 2026-05-21

Added

0.15.19

Release Notes

Preview features

Bug fixes

Rule changes

Performance

Documentation

Other changes

Contributors

Install ruff 0.15.19

Install prebuilt binaries via shell script

0.15.19

Preview features

Bug fixes

Rule changes

Performance

Documentation

Other changes

Contributors

0.15.18

Preview features

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant