chore(deps): bump the python group across 1 directory with 88 updates

[dependabot]

Bumps the python group with 84 updates in the / directory:

Package	From	To
eclipse-zenoh	1.9.0	1.10.0
reactivex	4.1.0	5.1.0
pydantic	2.12.5	2.13.5
python-dotenv	1.2.2	1.2.3
packaging	25.0	26.3
filelock	3.23.0	3.32.4
plum-dispatch	2.5.7	2.9.0
gitpython	3.1.52	3.1.61
structlog	25.5.0	26.1.0
opencv-contrib-python	4.13.0.92	5.0.0.93
pydantic-settings	2.12.0	2.15.0
textual	3.7.1	8.2.8
terminaltexteffects	0.12.2	0.15.0
typer	0.23.1	0.27.2
ipython	8.38.0	8.39.0
plotext	5.3.2	6.0.0
numba	0.63.1	0.67.0
rerun-sdk	0.32.0	0.36.3
protobuf	6.33.5	7.36.0
cryptography	46.0.5	50.0.1
websocket-client	1.9.0	1.9.1
ipykernel	7.2.0	7.3.0
timm	1.0.24	1.0.29
open-clip-torch	3.2.0	3.3.0
gdown	6.0.0	6.1.0
tensorboard	2.20.0	2.21.0
xarm-python-sdk	1.17.3	1.18.4
portal	3.7.4	3.8.1
bosdyn-client	5.1.4	5.1.9
pyarrow	23.0.0	25.0.1
langchain-core	1.3.3	1.6.1
langchain-openai	1.1.6	1.6.0
langchain-huggingface	1.2.0	1.2.2
langchain-ollama	1.0.1	1.1.0
ollama	0.6.1	0.6.2
sounddevice	0.5.5	0.5.6
fastapi	0.129.0	0.141.1
python-multipart	0.0.27	0.0.32
sse-starlette	3.2.0	3.4.8
uvicorn	0.40.0	0.52.4
soundfile	0.13.1	0.14.0
ultralytics	8.4.14	8.4.135
pillow	12.2.0	12.3.0
lap	0.5.12	0.5.13
transformers[torch]	4.53.3	5.16.1
moondream	0.2.0	2.1.0
omegaconf	2.3.0	2.3.1
hydra-core	1.3.2	1.3.6
unitree-webrtc-connect	2.1.2	2.2.0
cyclonedds	0.10.5	11.0.1
mcap	1.3.1	1.4.0
piper-sdk	0.6.1	0.6.2
matplotlib	3.10.8	3.10.9
roboplan	0.6.0	0.6.1
onnxruntime	1.24.1	1.24.3
cupy-cuda12x	13.6.0	14.2.0
mujoco	3.10.0	3.12.0
gtsam-extended	4.3a1.post1	4.3a2.post202608240418
aiortc	1.14.0	1.15.0
aiohttp	3.14.1	3.14.3
reportlab	4.5.0	5.0.1
manifold3d	3.5.1	3.5.2
coacd	1.0.11	1.0.14
usd-core	26.5	26.8
huggingface-hub	0.36.2	1.29.0
ruff	0.14.3	0.16.5
pytest	8.3.5	9.1.1
pytest-asyncio	0.26.0	1.4.0
pytest-mock	3.15.0	3.15.1
pytest-env	1.1.5	1.7.0
pytest-rerunfailures	16.4	16.6
coverage	7.13.4	7.16.0
pre-commit	4.2.0	4.6.2
py-spy	0.4.1	0.4.2
maturin	1.13.3	1.15.0
python-lsp-server[all]	1.14.0	1.15.0
python-lsp-ruff	2.3.0	2.3.3
playwright	1.61.0	1.62.0
mypy	1.19.0	2.3.1
python-socketio	5.16.1	5.16.4
types-pyyaml	6.0.12.20250915	6.0.12.20260815
types-reportlab	4.5.0.20260509	4.5.1.20260827
types-requests	2.32.4.20260107	2.33.0.20260712
pybind11	3.0.4	3.1.0

Updates eclipse-zenoh from 1.9.0 to 1.10.0

Release notes

Sourced from eclipse-zenoh's releases.

1.10.0

What's Changed

New features 🎉

• Add scripts and CI workflows to build debian package by @​sashacmc in eclipse-zenoh/zenoh-python#733
• Expose timestamp instrumentation API by @​oteffahi in eclipse-zenoh/zenoh-python#736

Dependencies 👷

• Sync Rust toolchain by @​eclipse-zenoh-bot in eclipse-zenoh/zenoh-python#743

Other changes

• Revert "Expose timestamp instrumentation API" by @​oteffahi in eclipse-zenoh/zenoh-python#738
• Expose timestamp instrumentation API by @​oteffahi in eclipse-zenoh/zenoh-python#739

New Contributors

• @​sashacmc made their first contribution in eclipse-zenoh/zenoh-python#733

Full Changelog: eclipse-zenoh/zenoh-python@1.9.0...1.10.0

Commits

• 3bb1404 chore: Bump zenoh.* version to 1.10.0
• bf6d84f chore: Bump version to 1.10.0
• 309e10c build: Sync with eclipse-zenoh/zenoh@3118e85 from 2026-08-14 (#767)
• 3995439 build: Sync with eclipse-zenoh/zenoh@2e2128a from 2026-08-14 (#766)
• d647a6b build: Sync with eclipse-zenoh/zenoh@feb4ebe from 2026-08-13 (#765)
• b8f1172 build: Sync with eclipse-zenoh/zenoh@c23a586 from 2026-08-11 (#764)
• 5df2f47 build: Sync with eclipse-zenoh/zenoh@98fc881 from 2026-08-07 (#763)
• d08e199 build: Sync with eclipse-zenoh/zenoh@765e22b from 2026-08-06 (#762)
• d66f893 build: Sync with eclipse-zenoh/zenoh@db859f4 from 2026-08-05 (#761)
• f3ed8e2 build: Sync with eclipse-zenoh/zenoh@3ed025b from 2026-08-04 (#760)
• Additional commits viewable in compare view

Updates reactivex from 4.1.0 to 5.1.0

Release notes

Sourced from reactivex's releases.

v5.1.0

See CHANGELOG.md for details.

v5.0.0

See CHANGELOG.md for details.

v5.0.0rc2

See CHANGELOG.md for details.

v5.0.0a2

What's Changed

• Fix title header by @​dbrattli in ReactiveX/RxPY#744

Full Changelog: ReactiveX/RxPY@v5.0.0a1...v5.0.0a2

v5.0.0a1

What's Changed

• Give run a scheduler parameter by @​rmahfoud in ReactiveX/RxPY#731
• Avoid use of asyncio.get_event_loop (3.14) by @​traylenator in ReactiveX/RxPY#728
• Migrate to uv by @​dbrattli in ReactiveX/RxPY#738
• Migrate to ruff by @​dbrattli in ReactiveX/RxPY#739
• Upgrade pyright by @​dbrattli in ReactiveX/RxPY#740
• Fix subscribe_on not forwarding scheduler to the source by @​jcafhe in ReactiveX/RxPY#726
• Upgrade deps by @​dbrattli in ReactiveX/RxPY#741
• Clarify what you can do with the .subscribe Disposable by @​tmewett in ReactiveX/RxPY#686
• RxPY v5 by @​dbrattli in ReactiveX/RxPY#743

New Contributors

• @​rmahfoud made their first contribution in ReactiveX/RxPY#731
• @​tmewett made their first contribution in ReactiveX/RxPY#686

Full Changelog: ReactiveX/RxPY@v4.1.0...v5.0.0a1

Changelog

Sourced from reactivex's changelog.

5.1.0 - 2026-07-27

🚀 Features

• (operators) Add tap as an alias for do_action (#804) (95c54ac3)

🐞 Bug Fixes

• (gtk) Call gi.require_version before importing gi.repository (#749) (2b9e3f33)
• (operators) Accept concurrent.futures.Future wherever futures are accepted (#806) (19da6ac1)
• (scheduler) Use wall clock time for now() in event loop schedulers (#809) (361951c7)

View changes on Github

5.0.0 - 2026-07-20

🐞 Bug Fixes

• (scripts) Keep uv.lock in sync and scope the version sed to [project] (#802) (10ccc0a3)

View changes on Github

5.0.0-rc.2 - 2026-07-20

🐞 Bug Fixes

• (operators) Reset retry budget per subscription to fix retry+repeat (#765) (c3f19d5e)

View changes on Github

5.0.0-rc.1 - 2026-04-20

View changes on Github

• Typing: Added Action and StartableFactory to reactivex.typing.__all__, making them part of the explicit public API surface.
• Docs: Added missing docstring to on_error_resume_next operator.
• Operators: Fixed scheduler forwarding in pairwise, to_marbles, and delay_with_mapper (subscription-delay path). These operators now pass the scheduler argument through to source.subscribe(...) and, in the case of delay_with_mapper, to the subscription-delay observable, consistent with all other pipeable operators. Closes #480 (partial — the operators listed in the issue that were not yet fixed).
• CI: Skip tests/test_scheduler/test_mainloop/test_tkinterscheduler.py on PyPy (all platforms). The module creates a Tk root at import time; PyPy's _tkinter finalizer calls threading.notify_all during interpreter shutdown and aborts the xdist worker, failing whichever unrelated test was running. Previously guarded only on macOS+PyPy.
• Fix: reactivex.timer(duetime, period) now correctly resets the initial delay on each resubscription (e.g. via repeat()). Previously `nonlocal

... (truncated)

Commits

• bbfecfb chore: release reactivex@5.1.0 (#805)
• b286407 docs: correct and expand the GIL free-threading note (#811)
• 93a4f04 docs: explain how to parallelize work within a single stream (#810)
• 2271867 Revise GIL section for Python 3.13 updates (#742)
• 361951c fix(scheduler): use wall clock time for now() in event loop schedulers (#809)
• b809222 docs: read version from pyproject instead of git tags (#808)
• 19e8080 ci(deps): bump the github-actions group with 2 updates (#807)
• dd9b8ec refactor(combine-latest): simplify logic by removing redundant loops … (#736)
• 19da6ac fix(operators): accept concurrent.futures.Future wherever futures are accepte...
• 2b9e3f3 fix(gtk): call gi.require_version before importing gi.repository (#749)
• Additional commits viewable in compare view

Updates pydantic from 2.12.5 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

v2.13.3 2026-04-20

v2.13.3 (2026-04-20)

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #13096

Full Changelog: pydantic/pydantic@v2.13.2...v2.13.3

v2.13.2 2026-04-17

v2.13.2 (2026-04-17)

What's Changed

Fixes

• Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

Full Changelog: pydantic/pydantic@v2.13.1...v2.13.2

v2.13.1 2026-04-15

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #13096

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

• Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

... (truncated)

Commits

• 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
• 558379f Bump twine to v7.0.0
• 2cfd5d3 Do not check for docs build
• a735bee Fix more Clippy lints
• 7eed4a1 Fix Clippy 0.1.95 warnings
• b353bbb Prepare release v2.13.5
• 63d2ccc Count validated model fields once in smart unions
• a53ec2e Speed up PyPy CI tests
• d65e0f9 Workaround circular import error in Mypy
• 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
• Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates packaging from 25.0 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates filelock from 3.23.0 to 3.32.4

Release notes

Sourced from filelock's releases.

3.32.4

What's Changed

• 🐛 fix: retry transient denials on open and claim read by @​gaborbernat in tox-dev/filelock#705
• 🧪 test: deflake six scheduled-run failures by @​gaborbernat in tox-dev/filelock#704
• 🧪 test: cover a reclaimed private record for real by @​gaborbernat in tox-dev/filelock#706
• 🧪 test(fork): fork once the event loop has closed by @​gaborbernat in tox-dev/filelock#714
• 🔧 chore: batch dependency updates weekly on Tuesday by @​gaborbernat in tox-dev/filelock#713
• escape the hostname every marker publishes by @​dxbjavid in tox-dev/filelock#709

Full Changelog: tox-dev/filelock@3.32.3...3.32.4

3.32.3

What's Changed

• 🧪 test(strict): deflake close-fault injections on graalpy by @​gaborbernat in tox-dev/filelock#697
• 📄 docs: publish llms.txt from the docs build by @​gaborbernat in tox-dev/filelock#700
• 🐛 fix(fork): survive audit events during interpreter shutdown by @​gaborbernat in tox-dev/filelock#703

Full Changelog: tox-dev/filelock@3.32.2...3.32.3

3.32.2

What's Changed

• Fix test failures on NetBSD (#689) by @​gaborbernat in tox-dev/filelock#693
• 🧪 test(soft-rw): deflake writer phase-2 peer-marker test by @​gaborbernat in tox-dev/filelock#694
• hand back the claim when a heartbeat thread fails to start by @​dxbjavid in tox-dev/filelock#691
• 🧪 test(unix): deflake sticky-bit concurrent-unlink on graalpy by @​gaborbernat in tox-dev/filelock#695

Full Changelog: tox-dev/filelock@3.32.1...3.32.2

3.32.0

What's Changed

• 👷 ci: add Python 3.15 to the test matrix by @​gaborbernat in tox-dev/filelock#683
• 🐛 fix(packaging): let an unpacked sdist run the test suite by @​gaborbernat in tox-dev/filelock#685

Full Changelog: tox-dev/filelock@3.31.2...3.32.0

3.31.2

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

3.32.5 (2026-08-31)

---

• SoftFileLease.token and AsyncSoftFileLease.token now read None after a failed acquisition, so a contender turned away by a live holder no longer reports a token for a claim it never published. :pr:721
• Document that mode has no setter: unlike poll_interval, timeout, blocking and lifetime, it is fixed at construction and lock.mode = ... raises AttributeError. :pr:716

---

3.32.4 (2026-08-23)

---

• StrictSoftFileLock always retries a claim read whose first attempt reports the claim as pending, so a first read that itself outlasts the retry grace no longer fails closed on a claim it could have read. :pr:705
• WindowsFileLock waits out a transient STATUS_ACCESS_DENIED from NtCreateFile for up to half a second before raising PermissionError, since a peer unlinking the lock file as it releases can answer that for a moment; a real denial still fails fast. :pr:705
• Every lock class now escapes the hostname it publishes, so a host whose socket.gethostname() carries a space, a newline or a byte outside UTF-8 no longer writes a marker it reads back as malformed. Such a host used to lose a held SoftReadWriteLock read slot to a peer and could not take a write slot or a StrictSoftFileLock at all. :pr:709

---

3.32.3 (2026-08-13)

---

• The fork-safety audit hook no longer prints Exception ignored in audit hook with a TypeError when an audit event fires during interpreter shutdown, after CPython has already cleared the module globals. :pr:701

---

3.32.2 (2026-07-29)

---

• A SoftReadWriteLock or SoftFileLease acquire whose heartbeat thread fails to start now unlinks its marker and hands the claim back, instead of leaving an unrefreshed marker a peer takes while the caller believes it still holds the lock. :pr:691

---

3.32.1 (2026-07-26)

---

• Canceling an AsyncSoftReadWriteLock acquire now releases the claim instead of leaking a marker whose heartbeat wedges every contender. :pr:686

... (truncated)

Commits

• cb493d6 Release 3.32.4
• fe07a11 escape the hostname every marker publishes (#709)
• 232732f 🔧 chore: batch dependency updates weekly on Tuesday (#713)
• 2966eb5 🧪 test(fork): fork once the event loop has closed (#714)
• 61511eb build(deps): bump astral-sh/setup-uv from 10.0.0 to 10.0.1 (#712)
• f12a52f build(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.0 (#711)
• 54c7b6c [pre-commit.ci] pre-commit autoupdate (#710)
• 49f8035 🧪 test: cover a reclaimed private record for real (#706)
• bb16d39 🧪 test: deflake six scheduled-run failures (#704)
• 13b82a6 🐛 fix: retry transient denials on open and claim read (#705)
• Additional commits viewable in compare view

Updates plum-dispatch from 2.5.7 to 2.9.0

Release notes

Sourced from plum-dispatch's releases.

v2.9.0

• Support union aliases in Python 3.14 and later (@​nstarman).

v2.8.0

Starting this release, Plum will be available on PyPI as both plum-dispatch and plum.

v2.7.1

• Add faithful keyword to ModuleType.

v2.7.0

Note: All imports should now go through plum directly! That is, not plum.signature.Signature, but plum.Signature. Please do open an issue if this release breaks something that shouldn't break.

Changes:

• Significantly improve typing of the internals (#179 and #242 by @​nstarman).
• Switch to uv (#218 by @​nstarman).
• Make modules private for public/private separation (#241 by @​nstarman).
• Switch to src layout (#249 by @​nstarman).
• Improve config (#248 by @​nstarman).
• Enable mypyc builds for better performance (#247 by @​nstarman)!

v2.6.1

This release features numerous very helpful contributions and improvements by @​nstarman!

• Use dependency groups (#195).
• Treat typing_extensions as standard library and make more use of it (#226 and #232).
• Complete deprecation cycles (#230 and #236).
• Turn various arguments into positional-only (#229).
• Remove unnecessary path manipulation (#233).
• Rework tests with a dispatch fixture (#234).
• Avoid using a deprecated NumPy module (#231).
• Drops support for Python 3.9 (#228).
• Import exports from methods.py (#237).
• Fixes an incorrect overload (#238).
• Use nox for testing (#235 and #240).

#228 also fixes an important bug to do with the handling of unions (CC @​davidwyld).

v2.6.0

• Add keyword argument condition to ModuleType.

v2.5.8

• Fix precedence keyword argument (thanks @​nstarman!).
• Fix complex method override.
• Drop support for Python 8 and use e.g. list instead of typing.List (thanks @​nstarman!).

Commits

• 485380d Minor style and linter changes
• 28f5a4a Minor style changes
• b85f8e7 Remove duplicate sections
• 863138d Enable py3.14 and deprecate some alias functionality (#225)
• ad54d37 build(deps-dev): bump uv from 0.9.16 to 0.11.6 (#265)

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[greptile-apps]

Greptile Summary

This dependency refresh permits OpenCV 5, but the nearby explanatory comment still says that OpenCV 5 is deferred. The change is otherwise safe to merge because this is a non-blocking maintenance documentation issue.

Confidence Score: 4/5

Safe to merge; the only remaining issue is a non-blocking misleading dependency comment.

The confirmed issue is limited to documentation that contradicts the adjacent version constraint.

Files Needing Attention: pyproject.toml lines 129-132

T-Rex Logs

What T-Rex did

• T-Rex produced a proof for a posted P2 finding.
• T-Rex produced a second proof for another posted P2 finding.
• T-Rex executed the OpenCV constraint inspection script from the repository to validate contract constraints; the run exited with code 0 and reported SPECIFIER_PERMITS_OPENCV_5_0=True and VERDICT=CONFIRMED_INCONSISTENT.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   OpenCV major-version comment contradicts its adjacent constraint

   • Bug
     • pyproject.toml lines 129-132 state that <5 defers the OpenCV 5 major bump, while opencv-contrib-python>=4.8,<6 allows version 5.x.
   • Cause
     • The prose still describes an upper bound of <5, but the declared requirement upper bound is <6.
   • Fix
     • Update the comment to describe the actual <6 bound, or change the constraint to <5 if deferring OpenCV 5 is intended.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "chore(deps): bump the python group acros..." | Re-trigger Greptile}

[greptile-apps]

Correct OpenCV version comment

The dependency constraint permits OpenCV 5 through its <6 upper bound, but this comment still says that <5 defers the OpenCV 5 upgrade. This is non-blocking, but it can mislead future dependency maintenance; update the text to describe the actual constraint.

Suggested change

	# Contrib variant (superset of opencv-python) because cv2.legacy CSRT
	# trackers (perception/drone) are contrib-only. <5 defers the OpenCV 5
	# major bump. See also the opencv-python entry in override-dependencies.
	"opencv-contrib-python>=4.8,<5",
	"opencv-contrib-python>=4.8,<6",
	# Contrib variant (superset of opencv-python) because cv2.legacy CSRT
	# trackers (perception/drone) are contrib-only. <6 permits OpenCV 5.
	# See also the opencv-python entry in override-dependencies.
	"opencv-contrib-python>=4.8,<6",

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Artifacts

Evidence from the check

• The authored narrow Python script reads lines 129-132, parses the adjacent requirement, and checks whether OpenCV 5.0 is permitted; it provides the executable check.

Command output from the check

• Captured execution output from the static inspection script shows the parsed `<6` constraint permits 5.0 while the comment says `<5` defers OpenCV 5; the candidate is confirmed.

_{Ran code and verified through T-Rex}

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.