Bump the python-requirements group across 1 directory with 6 updates

[dependabot]

Updates the requirements on python-fsutil, python-benedict, coverage, mypy, pytest and tox to permit the latest version.
Updates python-fsutil from 0.16.1 to 0.17.0

Release notes

Sourced from python-fsutil's releases.

0.17.0

• Add support for file-like objects in get_file_hash.
• Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. #186 (thanks to @​SAY-5)
• Harden Content-Disposition filename sanitization in download_file to prevent path traversal. #181
• Bump requirements and pre-commit hooks.

Changelog

Sourced from python-fsutil's changelog.

0.17.0 - 2026-07-07

• Add support for file-like objects in get_file_hash.
• Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. #186 (thanks to @​SAY-5)
• Harden Content-Disposition filename sanitization in download_file to prevent path traversal. #181
• Bump requirements and pre-commit hooks.

Commits

• deb6684 Update CHANGELOG and version.
• fc91d14 Add support for file-like objects in get_file_hash.
• e1d342b Bump pre-commit hooks.
• 88a2ed4 Harden Content-Disposition filename sanitization in download_file to preven...
• 0fe73fd Bump the python-requirements group across 1 directory with 7 updates (#188)
• 1429dce Bump the github-actions group across 1 directory with 4 updates (#187)
• 4abb5aa Fix IndexError in convert_size_bytes_to_string for sizes >= 1024 YB. (#186)
• c98dbf6 Bump pre-commit hooks.
• 8854ed2 Fix HIGH-level OpenSSF Scorecard code scanning alerts (VulnerabilitiesID) (#175)
• 8693f3e Update SECURITY.md.
• Additional commits viewable in compare view

Updates python-benedict from 0.36.0 to 0.38.0

Release notes

Sourced from python-benedict's releases.

0.38.0

• Fix keylists / keypaths to handle non-string dict keys holding lists. (by @​Sanjays2402 in #583)
• Fix match to anchor string patterns and consume the full keypath. (by @​gaoflow in #579)
• Fix query-string serializer to accept array/bracketed keys and trailing &. (#586)
• Reject empty keypath_separator. (by @​CodingFeng101 in #580)
• Fix int parsing to catch OverflowError. #578 (#584)
• Bump requirements and pre-commit hooks.

0.37.0

• Add optional schema kwarg support (python-benedict[schema] with pydantic v2) to all from_* and to_* I/O methods. (#565)
• Add indexes=True option to flatten / unflatten for list/tuple flattening with round-trip support. (#561)
• Add deep argument support to filter method to apply the predicate recursively to all nested dicts.
• Add deep argument support to remove method to remove the key(s) at every nesting level.
• Add deep argument support to rename method to rename the key at every nesting level.
• Reduce dependencies making the core installation super lightweight. #567
• Swap uiri/toml encoder for tomli_w. #439
• Fix yaml serializer to use safe_dump and add pickle security warning (CWE-502). (#563)
• Fix orjson and requests requirements to address CVE-2025-67221 and CVE-2024-27454. (#562)
• Add CONTRIBUTING.md.
• Bump requirements and pre-commit hooks.

Changelog

Sourced from python-benedict's changelog.

0.38.0 - 2026-07-07

• Fix keylists / keypaths to handle non-string dict keys holding lists. (by @​Sanjays2402 in #583)
• Fix match to anchor string patterns and consume the full keypath. (by @​gaoflow in #579)
• Fix query-string serializer to accept array/bracketed keys and trailing &. (#586)
• Reject empty keypath_separator. (by @​CodingFeng101 in #580)
• Fix int parsing to catch OverflowError. #578 (#584)
• Bump requirements and pre-commit hooks.

0.37.0 - 2026-05-09

• Add optional schema kwarg support (python-benedict[schema] with pydantic v2) to all from_* and to_* I/O methods. (#565)
• Add indexes=True option to flatten / unflatten for list/tuple flattening with round-trip support. (#561)
• Add deep argument support to filter method to apply the predicate recursively to all nested dicts.
• Add deep argument support to remove method to remove the key(s) at every nesting level.
• Add deep argument support to rename method to rename the key at every nesting level.
• Reduce dependencies making the core installation super lightweight. #567
• Swap uiri/toml encoder for tomli_w. #439
• Fix yaml serializer to use safe_dump and add pickle security warning (CWE-502). (#563)
• Fix orjson and requests requirements to address CVE-2025-67221 and CVE-2024-27454. (#562)
• Add CONTRIBUTING.md.
• Bump requirements and pre-commit hooks.

Commits

• a922d1a Update CHANGELOG and version.
• a87b689 fix: handle non-string dict keys holding lists in keylists/keypaths (#583)
• 1383959 fix: anchor string patterns in match() to consume full keypath. (#579)
• c437b99 Fix query-string: accept array/bracketed keys and trailing & (#586)
• f99b35a Merge branch 'main' of https://github.com/fabiocaccamo/python-benedict
• 479caa1 Reject empty keypaths separator. (#580)
• c987439 Reject empty keypaths separator. (#580)
• c7c934f Apply review fixes for keypaths separator handling (#585)
• f3bc063 Address review comments on PR #578: catch OverflowError in _parse_int and fix...
• 9120d48 Bump python-fsutil.
• Additional commits viewable in compare view

Updates coverage to 7.16.0

Release notes

Sourced from coverage's releases.

7.16.0

Version 7.16.0 — 2026-08-28

• When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266.
• The Coverage.switch_context() method now returns the previous context.
• Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268.
• Fixes to validation of options and configuration settings:
  • Negative precision settings now always cause useful error messages (pull 2261).
  • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing “Couldn’t use data file …: user-defined function raised exception” error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262).
  • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren’t strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263).
  • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can’t reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with “Can’t combine statement coverage data with branch data”. Each named concurrency library is now properly considered (pull 2270).
• Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265).

➡️  PyPI page: coverage 7.16.0. :arrow_right:  To install: python3 -m pip install coverage==7.16.0

Changelog

Sourced from coverage's changelog.

Version 7.16.0 — 2026-08-28

• When combining files, now path separator slashes will automatically be converted to the local file system style. This makes it less necessary to define [paths] configuration to combine data across operating systems. Fixes issue 2266_.

• The :meth:.Coverage.switch_context method now returns the previous context.

• Fix: previously, a [paths] pattern would be replaced everywhere in a file path when it was only meant to be replaced once, in the leading portion of the path. This is now fixed, in pull 2268_.

• Fixes to validation of options and configuration settings:

  • Negative precision settings now always cause useful error messages (pull 2261_).

  • An invalid regex in the --contexts option (or the [report] contexts setting) reported a confusing "Couldn't use data file ...: user-defined function raised exception" error. Now it raises a proper configuration error naming the bad regex, like other regex settings do (pull 2262_).

  • Non-string values in TOML configuration settings now produce a helpful error message instead of a traceback. This affects list settings whose elements aren't strings (like omit, exclude_lines, or a [paths] entry), file settings like data_file, and any wrong-typed value in the [paths] section (pull 2263_).

  • coverage run refuses run-affecting command-line options like --branch alongside --concurrency=multiprocessing, since they can't reach the subprocesses. The check only recognized multiprocessing as the entire option value, so --concurrency=multiprocessing,thread slipped through and failed later with "Can't combine statement coverage data with branch data". Each named concurrency library is now properly considered (pull 2270_).

• Fix: coverage annotate -d DIR raised an AssertionError if any measured file had an extension other than .py, such as a .pyw file on Windows. The original extension is now restored on the annotated copy (pull 2265_).

.. _pull 2261: coveragepy/coveragepy#2261 .. _pull 2262: coveragepy/coveragepy#2262 .. _pull 2263: coveragepy/coveragepy#2263 .. _pull 2265: coveragepy/coveragepy#2265 .. _issue 2266: coveragepy/coveragepy#2266 .. _pull 2268: coveragepy/coveragepy#2268

... (truncated)

Commits

• 3e9fc16 docs: prep for 7.16.0
• 38be8d1 build: control check-manifest explicitly
• 8eb1266 docs(build): no longer commit sample_html
• 1a8b3fa docs: remove sample_html
• aeaa79b docs: linklint is now sphinx-linklint
• d5eaf3f test: a branchless way to re-add extensions
• 57e52fd docs: adjust CHANGES for #2270
• b9d304d fix: check for multiprocessing in a --concurrency list (#2270)
• a6ef928 chore: make upgrade
• 070461f chore: bump the action-dependencies group with 4 updates (#2271)
• Additional commits viewable in compare view

Updates mypy to 2.3.1

Changelog

Sourced from mypy's changelog.

Mypy 2.3.1

• Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR 21826)
• Fix mypyc default_factory for inherited dataclass (Daniël van Noord, PR 21785)
• Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR 21734)
• Fix crash when unpacking return value from overload (Shantanu, PR 21830)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• Agriya Khetarpal
• Ethan Sarp
• Ivan Levkivskyi
• Jingchen Ye
• Jukka Lehtosalo
• Piotr Sawicki
• Shantanu
• Tom Bannink
• Viktor Szépe
• ygale

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.2

We've just uploaded mypy 2.2.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support for Closed TypedDicts (PEP 728)

Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.

You can use the closed keyword argument with TypedDict:

HasName = TypedDict("HasName", {"name": str})
HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True)
Movie = TypedDict("Movie", {"name": str, "year": int})
movie: Movie = {"name": "Nimona", "year": 2023}
has_name: HasName = movie  # OK: HasName is open (default)
has_only_name: HasOnlyName = movie  # Error: HasOnlyName is closed and Movie has extra "year" key
</tr></table>

... (truncated)

Commits

• d642c44 Bump version to 2.3.1
• a392429 [mypyc] Fix crash on double yielding Iterators (#21826)
• 4843e77 [mypyc] Fix default_factory for inherited dataclass (#21785)
• 14f5df9 [mypyc] Clear coroutine env on coroutine completion (#21734)
• 6dfa06d Fix crash when unpacking return value from overload (#21830)
• a385746 Bump version to 2.3.1+dev
• 8aabf84 Drop +dev from version
• 4d8ad2a Update changelog for 2.3 release (#21728)
• 2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
• a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
• Additional commits viewable in compare view

Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates tox to 4.61.1

Release notes

Sourced from tox's releases.

v4.61.1

What's Changed

• 🐛 fix(schema): declare prefix in the labeled factor group's not clause by @​gaborbernat in tox-dev/tox#4051

Full Changelog: tox-dev/tox@4.61.0...4.61.1

Changelog

Sourced from tox's changelog.

Bug fixes - 4.61.1

• Publish a JSON Schema that compiles under SchemaStore's validator again, so editors pick up the configuration keys added since 4.56 - by :user:gaborbernat. (:issue:4051)

Contributor-facing changes - 4.61.1

• Check tox's JSON Schema with SchemaStore's own validator on every pull request that changes it, and again before the release sync opens a pull request there - by :user:gaborbernat. (:issue:4051)

---

v4.61.0 (2026-08-28)

---

Features - 4.61.0

• A labeled factor group can now declare a default for {factor:label} to fall back on when no factor of that group is active in the environment name. Setting TOX_FACTOR_<label> resolves that label to a given value for a single run - by :user:gaborbernat. (:issue:4045)
• A factor range now takes a label when you nest it under one, as in factors = [{ py_version = { prefix = "3.", start = 12, stop = 14 } }], which makes {factor:py_version} available for ranges - by :user:gaborbernat. (:issue:4046)

Bug fixes - 4.61.0

• Values passed via --override/-x or TOX_OVERRIDE now resolve substitutions such as {posargs}, {env:VAR} and {env_name}, instead of reaching the environment as literal text - by :user:gaborbernat. (:issue:4047)

Improved documentation - 4.61.0

• Point the virtualenv discovery link in the explanation documentation at its current location. (:issue:4042)

Contributor-facing changes - 4.61.0

• Replace the deprecated load_module call in the documentation configuration, which Python 3.15 removes - by :user:gaborbernat. (:issue:4043)

---

v4.60.1 (2026-08-25)

---

Bug fixes - 4.60.1

... (truncated)

Commits

• c8c010a release 4.61.1
• cd8c1fa 🐛 fix(schema): declare prefix in the labeled factor group's not clause (#4051)
• aa8f46c release 4.61.0
• 8ef0326 ✨ feat(toml): declare factor group defaults and per-run overrides (#4050)
• e489adb 🐛 fix(config): substitute inside override values (#4048)
• c1af929 ✨ feat(toml): allow labeling a range factor group (#4049)
• 930190c Replace deprecated load_module in docs conf (#4043)
• 2a4a215 docs: fix dead virtualenv discovery link in explanation.rst (#4042)
• e91ca3b release 4.60.1
• 59e984f Report an empty TOML command value as a handled error (#4041)
• Additional commits viewable in compare view