chore(deps): bump the minor-and-patch group across 1 directory with 86 updates

[dependabot]

Bumps the minor-and-patch group with 86 updates in the / directory:

Package	From	To
analysis-runner	3.2.2	3.2.6
cpg-flow	1.3.1	1.3.3
cpg-utils	5.6.0	5.7.0
pip-audit	2.7.3	2.10.1
pre-commit	4.0.1	4.6.0
pip-tools	7.4.1	7.5.3
aiohappyeyeballs	2.6.0	2.7.1
aiohttp	3.13.3	3.14.1
anyio	4.12.1	4.14.2
asttokens	3.0.1	3.0.2
avro	1.11.3	1.12.1
azure-core	1.32.0	1.41.0
azure-identity	1.25.1	1.25.3
azure-mgmt-core	1.5.0	1.6.0
azure-storage-blob	12.24.0	12.30.0
azure-storage-file-datalake	12.18.0	12.25.0
bokeh	3.3.4	3.9.1
boto3	1.35.81	1.43.46
botocore	1.35.81	1.43.46
cfgv	3.4.0	3.5.0
charset-normalizer	3.4.0	3.4.9
click	8.1.7	8.4.2
cloudpathlib	0.20.0	0.24.0
commonmark	0.9.1	0.9.2
contourpy	1.3.1	1.3.2
deprecated	1.2.15	1.3.1
distlib	0.3.9	0.4.3
filelock	3.16.1	3.29.7
frozendict	2.4.6	2.4.7
frozenlist	1.5.0	1.8.0
google-auth	2.37.0	2.55.2
google-cloud-artifact-registry	1.19.0	1.22.0
google-cloud-core	2.4.1	2.6.0
google-cloud-secret-manager	2.22.0	2.29.0
google-crc32c	1.6.0	1.8.0
google-resumable-media	2.7.2	2.10.0
googleapis-common-protos	1.66.0	1.75.0
graphql-core	3.2.6	3.2.11
grpc-google-iam-v1	0.14.1	0.14.4
grpcio	1.68.1	1.82.1
grpcio-status	1.48.2	1.82.1
humanize	4.11.0	4.16.0
identify	2.6.3	2.6.19
idna	3.10	3.18
jedi	0.19.2	0.20.0
jinja2	3.1.5	3.1.6
jmespath	1.0.1	1.1.0
markupsafe	3.0.2	3.0.3
matplotlib-inline	0.2.1	0.2.2
metamist	7.13.4	7.14.1
msal	1.31.1	1.37.0
msal-extensions	1.2.0	1.3.1
multidict	6.1.0	6.7.1
nodeenv	1.9.1	1.10.0
oauthlib	3.2.2	3.3.1
orjson	3.10.12	3.11.9
parsimonious	0.10.0	0.11.0
parso	0.8.5	0.8.7
platformdirs	4.3.6	4.10.0
propcache	0.2.1	0.5.2
proto-plus	1.25.0	1.28.1
pyasn1	0.6.1	0.6.4
pyasn1-modules	0.4.1	0.4.2
pygments	2.18.0	2.20.0
pyjwt	2.10.1	2.13.0
pyyaml	6.0.2	6.0.3
requests	2.32.5	2.34.2
rsa	4.9	4.9.1
s3transfer	0.10.4	0.19.1
tabulate	0.9.0	0.10.0
tenacity	9.0.0	9.1.4
tornado	6.5.4	6.5.7
traitlets	5.14.3	5.15.1
typer	0.15.1	0.26.8
typing-extensions	4.12.2	4.16.0
urllib3	2.2.3	2.7.0
uvloop	0.21.0	0.22.1
wcwidth	0.3.0	0.8.2
yarl	1.18.3	1.24.2
build	1.2.2.post1	1.5.0
cachecontrol	0.14.1	0.14.4
license-expression	30.4.0	30.4.4
msgpack	1.1.0	1.2.1
packageurl-python	0.16.0	0.17.6
pyparsing	3.2.0	3.3.2
wheel	0.45.1	0.47.0

Updates analysis-runner from 3.2.2 to 3.2.6

Commits

• See full diff in compare view

Updates cpg-flow from 1.3.1 to 1.3.3

Release notes

Sourced from cpg-flow's releases.

v1.3.3

What's Changed

• Add python-package-scanner, SBOM and remove Sonarqube by @​nevoodoo in populationgenomics/cpg-flow#157
• avoid ARG_MAX overflow when passing SBOM to jq by @​nevoodoo in populationgenomics/cpg-flow#174
• Consolidate release flow into single workflow by @​nevoodoo in populationgenomics/cpg-flow#172
• Bump vulnerable packages by @​nevoodoo in populationgenomics/cpg-flow#175

Full Changelog: populationgenomics/cpg-flow@v1.3.2...v1.3.3

v1.3.2

What's Changed

• Clean up workflows and packaging by @​nevoodoo in populationgenomics/cpg-flow#139
• Refactor workflows to use release-based triggers by @​nevoodoo in populationgenomics/cpg-flow#156
• chore(deps): bump the actions group with 10 updates by @​dependabot[bot] in populationgenomics/cpg-flow#153
• chore(deps): bump the minor-and-patch group with 13 updates by @​dependabot[bot] in populationgenomics/cpg-flow#154
• chore(deps-dev): bump black from 25.12.0 to 26.3.1 in the major group by @​dependabot[bot] in populationgenomics/cpg-flow#155
• Use marker-based PR comments in Docker workflow by @​nevoodoo in populationgenomics/cpg-flow#158
• feat(metamist): flag all cohort fails once by @​MattWellie in populationgenomics/cpg-flow#165
• fix(target.py): default to sg_hash by @​MattWellie in populationgenomics/cpg-flow#168
• Upgrade to hail 138 by @​MattWellie in populationgenomics/cpg-flow#169
• fix(metamist.py): add backoff in cohort query by @​MattWellie in populationgenomics/cpg-flow#152

New Contributors

• @​dependabot[bot] made their first contribution in populationgenomics/cpg-flow#153

Full Changelog: populationgenomics/cpg-flow@v1.3.1...v1.3.2

Changelog

Sourced from cpg-flow's changelog.

CHANGELOG

Commits

• a588848 Bump vulnerable packages (#175)
• 19e19c1 Consolidate release flow into single workflow (#172)
• 40db6d6 avoid ARG_MAX overflow when passing SBOM to jq (#174)
• 6f97f85 Add python-package-scanner, SBOM and remove Sonarqube (#157)
• ab5765c Merge pull request #152 from populationgenomics/backoff_when_querying_for_coh...
• 58fef3f LINT
• a52604f uv version bump
• 72486ff reset to 1.3.1
• 7f3880b bumpversion
• 25a4b97 Merge branch 'main' into backoff_when_querying_for_cohorts
• Additional commits viewable in compare view

Updates cpg-utils from 5.6.0 to 5.7.0

Commits

• See full diff in compare view

Updates pip-audit from 2.7.3 to 2.10.1

Release notes

Sourced from pip-audit's releases.

v2.10.1

Fixed

• Fixed a KeyError crash when an OSV vulnerability record contains an affected entry that omits the optional ranges field (#1046)

v2.10.0

Added

• pip-audit now supports the --osv-url URL flag, which can be used to retrieve vulnerabilities from a custom OSV service. This is useful for organizations that host their own mirror of the OSV database, or that have custom OSV records (#810)

• pip-audit now supports the Ecosyste.ms vulnerability service with --vulnerability-service=esms (#903).

Changed

• The minimum version of Python is now 3.10 (#905)

Fixed

• Fixed a bug where pip-audit would fail to parse pyproject.toml files containing TOML 1.0.0 features (#910)

• CycloneDX JSON/XML output now correctly links vulnerabilities to their affected components via the affects field (#980)

v2.9.0

Added

• pip-audit now supports PEP 751 lockfiles. These lockfiles can be audited in "project" mode by passing --locked to pip-audit (#888)

v2.8.0

Added

• pip-audit now allows some CLI flags to be configured via environment variables (#755)

Changed

... (truncated)

Changelog

Sourced from pip-audit's changelog.

[2.10.1]

Fixed

• Fixed a KeyError crash when an OSV vulnerability record contains an affected entry that omits the optional ranges field (#1046)

[2.10.0]

Added

• pip-audit now supports the --osv-url URL flag, which can be used to retrieve vulnerabilities from a custom OSV service. This is useful for organizations that host their own mirror of the OSV database, or that have custom OSV records (#810)

• pip-audit now supports the Ecosyste.ms vulnerability service with --vulnerability-service=esms (#903).

Changed

• The minimum version of Python is now 3.10 (#905)

Fixed

• Fixed a bug where pip-audit would fail to parse pyproject.toml files containing TOML 1.0.0 features (#910)

• CycloneDX JSON/XML output now correctly links vulnerabilities to their affected components via the affects field (#980)

[2.9.0]

Added

• pip-audit now supports PEP 751 lockfiles. These lockfiles can be audited in "project" mode by passing --locked to pip-audit (#888)

[2.8.0]

Added

... (truncated)

Commits

• 8894eb8 Merge pull request #1056 from pypa/copilot/release-2101
• 1c625b7 Update version in README.md to 2.10.1
• fd2094b Prep 2.10.1 release
• 58d2488 build(deps): bump github/codeql-action from 4.35.2 to 4.36.1 (#1052)
• 8df9420 build(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 (#1044)
• 3f618d3 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1053)
• 4849132 Restrict OIDC token to publish job (#1050)
• c1eb69a Fix KeyError when OSV affected entry omits optional ranges field (#1046)
• 68de07f Merge pull request #1054 from pypa/fix/1047
• ef31c9e Formatting fixes
• Additional commits viewable in compare view

Updates pre-commit from 4.0.1 to 4.6.0

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.0

Features

• pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.
  • #3662 PR by @​asottile.

Fixes

• pre-commit hook-impl: --hook-type is required.
  • #3661 PR by @​asottile.

pre-commit v4.5.1

Fixes

• Fix language: python with repo: local without additional_dependencies.
  • #3597 PR by @​asottile.

pre-commit v4.5.0

Features

• Add pre-commit hazmat.
  • #3585 PR by @​asottile.

pre-commit v4.4.0

Features

• Add --fail-fast option to pre-commit run.
  • #3528 PR by @​JulianMaurin.
• Upgrade ruby-build / rbenv.
  • #3566 PR by @​asottile.
  • #3565 issue by @​MRigal.
• Add language: unsupported / language: unsupported_script as aliases for language: system / language: script (which will eventually be deprecated).
  • #3577 PR by @​asottile.
• Add support docker-in-docker detection for cgroups v2.
  • #3535 PR by @​br-rhrbacek.
  • #3360 issue by @​JasonAlt.

Fixes

• Handle when docker gives SecurityOptions: null.
  • #3537 PR by @​asottile.
  • #3514 issue by @​jenstroeger.
• Fix error context for invalid stages in .pre-commit-config.yaml.
  • #3576 PR by @​asottile.

pre-commit v4.3.0

Features

• language: docker / language: docker_image: detect rootless docker.
  • #3446 PR by @​matthewhughes934.
  • #1243 issue by @​dkolepp.
• language: julia: avoid startup.jl when executing hooks.
  • #3496 PR by @​ericphanson.
• language: dart: support latest dart versions which require a higher sdk lower bound.
  • #3507 PR by @​bc-lee.

... (truncated)

Changelog

Sourced from pre-commit's changelog.

4.6.0 - 2026-04-21

Features

• pre-commit hook-impl: allow --hook-dir to be missing to enable easier usage with git 2.54+ git hooks.
  • #3662 PR by @​asottile.

Fixes

• pre-commit hook-impl: --hook-type is required.
  • #3661 PR by @​asottile.

4.5.1 - 2025-12-16

Fixes

• Fix language: python with repo: local without additional_dependencies.
  • #3597 PR by @​asottile.

4.5.0 - 2025-11-22

Features

• Add pre-commit hazmat.
  • #3585 PR by @​asottile.

4.4.0 - 2025-11-08

Features

• Add --fail-fast option to pre-commit run.
  • #3528 PR by @​JulianMaurin.
• Upgrade ruby-build / rbenv.
  • #3566 PR by @​asottile.
  • #3565 issue by @​MRigal.
• Add language: unsupported / language: unsupported_script as aliases for language: system / language: script (which will eventually be deprecated).
  • #3577 PR by @​asottile.
• Add support docker-in-docker detection for cgroups v2.
  • #3535 PR by @​br-rhrbacek.
  • #3360 issue by @​JasonAlt.

Fixes

• Handle when docker gives SecurityOptions: null.
  • #3537 PR by @​asottile.
  • #3514 issue by @​jenstroeger.
• Fix error context for invalid stages in .pre-commit-config.yaml.
  • #3576 PR by @​asottile.

... (truncated)

Commits

• f35134b v4.6.0
• 2a51ffc Merge pull request #3662 from pre-commit/hook-impl-optional-hook-dir
• d7dee32 make --hook-dir optional for hook-impl
• 965aeb1 Merge pull request #3661 from pre-commit/hook-impl-required
• 2eacc06 --hook-type is required for hook-impl
• f5678bf Merge pull request #3657 from pre-commit/pre-commit-ci-update-config
• 054cc5b [pre-commit.ci] pre-commit autoupdate
• 5c0f302 Merge pull request #3652 from pre-commit/pre-commit-ci-update-config
• a5d9114 [pre-commit.ci] pre-commit autoupdate
• 129a1f5 Merge pull request #3641 from pre-commit/mxr-patch-1
• Additional commits viewable in compare view

Updates pip-tools from 7.4.1 to 7.5.3

Release notes

Sourced from pip-tools's releases.

v7.5.3

2026-02-11

Bug fixes

• The option --unsafe-package is now normalized -- by @​shifqu.

  PRs and issues: #2150

• Fixed a bug in which pip-compile lost any index URL options when looking up hashes -- by @​sirosen.

  This caused errors when a package was only available from an extra index, and caused pip-compile to incorrectly drop index URL options from output, even when they were present in the input requirements.

  PRs and issues: #2220, #2294, #2305

• Fixed removal of temporary files used when reading requirements from stdin -- by @​sirosen.

Features

• pip-tools is now tested against Python 3.14 and 3.14t in CI, and marks them as supported in the core packaging metadata -- by @​webknjaz.

  PRs and issues: #2255

• pip-tools is now compatible with pip 26.0 -- by @​sirosen.

  PRs and issues: #2319, #2320

Removals and backward incompatible breaking changes

• Removed support for Python 3.8 -- by @​sirosen.

Improved documentation

• The change log management infra now allows the maintainers to add notes before and after the regular categories -- by @​webknjaz.

  PRs and issues: #2287, #2322

• Added documentation clarifying that pip-compile reads the existing output file as a constraint source, and how to use --upgrade to refresh dependencies -- by @​maliktafheem.

  PRs and issues: #2307

... (truncated)

Changelog

Sourced from pip-tools's changelog.

v7.5.3

2026-02-09

Bug fixes

• The option --unsafe-package is now normalized -- by {user}shifqu.

  PRs and issues: {issue}2150

• Fixed a bug in which pip-compile lost any index URL options when looking up hashes -- by {user}sirosen.

  This caused errors when a package was only available from an extra index, and caused pip-compile to incorrectly drop index URL options from output, even when they were present in the input requirements.

  PRs and issues: {issue}2220, {issue}2294, {issue}2305

• Fixed removal of temporary files used when reading requirements from stdin -- by {user}sirosen.

Features

• pip-tools is now tested against Python 3.14 and 3.14t in CI, and marks them as supported in the core packaging metadata -- by {user}webknjaz.

  PRs and issues: {issue}2255

• pip-tools is now compatible with pip 26.0 -- by {user}sirosen.

  PRs and issues: {issue}2319, {issue}2320

Removals and backward incompatible breaking changes

• Removed support for Python 3.8 -- by {user}sirosen.

Improved documentation

• The change log management infra now allows the maintainers to add notes before and after the regular categories -- by {user}webknjaz.

  PRs and issues: {issue}2287, {issue}2322

• Added documentation clarifying that pip-compile reads the existing output file as a constraint source, and how to use --upgrade to refresh dependencies -- by {user}maliktafheem.

  PRs and issues: {issue}2307

... (truncated)

Commits

• 5f31d8a Merge pull request #2332 from sirosen/fix-release-version-normalization
• 106f1d6 Fix CI workflow to normalize versions (for release)
• 3a0f5ed Merge pull request #2329 from sirosen/release/v7.5.3
• e4bd31d Merge pull request #2328 from jazzband/pre-commit-ci-update-config
• 08107ab Update changelog for version 7.5.3
• 5b4d130 Merge pull request #2325 from sirosen/ensure-tmpfile-cleanup
• cc6a2b9 Apply feedback/suggestions from review
• fc53265 [pre-commit.ci] pre-commit autoupdate
• 6c27507 Add 'tempfile_compat' to handle windows tmp files
• 9ac94db Fix leak of temp files when reading from stdin
• Additional commits viewable in compare view

Updates aiohappyeyeballs from 2.6.0 to 2.7.1

Release notes

Sourced from aiohappyeyeballs's releases.

v2.7.1 (2026-07-01)

Performance Improvements

• Use defaultdict to help with performance (#239, e10f335)

Refactoring

• Collapse collect-then-remove pattern in utils helpers (#227, 0dd3fd1)

• Merge identical except blocks in _connect_sock cleanup (#229, b7c186e)

• Simplify _interleave_addrinfos family grouping (#226, fdf6548)

---

Detailed Changes: v2.7.0...v2.7.1

v2.7.0 (2026-05-20)

Features

• Add Python 3.14 support (#224, 10e7d43)

---

Detailed Changes: v2.6.2...v2.7.0

v2.6.2 (2026-05-20)

Bug Fixes

• Clear error on empty addr_infos in start_connection (#222, 55dd76a)

Refactoring

• Optimize obtaining event-loop down to 1 line (#185, 02a7029)

Testing

• Stop verify_no_lingering_tasks from leaking an event loop (#221, ce43beb)

---

Detailed Changes: v2.6.1...v2.6.2

v2.6.1 (2025-03-12)

Bug Fixes

... (truncated)

Changelog

Sourced from aiohappyeyeballs's changelog.

v2.7.1 (2026-07-01)

Performance improvements

• Use defaultdict to help with performance (e10f335)

Refactoring

• Simplify _interleave_addrinfos family grouping (fdf6548)
• Collapse collect-then-remove pattern in utils helpers (0dd3fd1)
• Merge identical except blocks in _connect_sock cleanup (b7c186e)

v2.7.0 (2026-05-20)

Features

• Add python 3.14 support (10e7d43)

v2.6.2 (2026-05-20)

Bug fixes

• Clear error on empty addr_infos in start_connection (55dd76a)

Testing

• Stop verify_no_lingering_tasks from leaking an event loop (ce43beb)

Refactoring

• Optimize obtaining event-loop down to 1 line (02a7029)

v2.6.1 (2025-03-12)

Bug fixes

• Resolve typeerror on import for python < 3.9.2 (2042c82)

Commits

• 4dfc926 2.7.1
• e10f335 perf: use defaultdict to help with performance (#239)
• 338277b chore: stop tracking .DS_Store files (#251)
• 1697869 ci: add codspeed benchmark suite for addrinfo reordering hot paths (#250)
• d40a848 chore(deps-dev): bump starlette from 1.0.1 to 1.3.1 (#242)
• 51d4266 chore(deps-dev): bump cryptography from 46.0.7 to 48.0.1 (#243)
• 2df44b3 chore(pre-commit.ci): pre-commit autoupdate (#241)
• 3e3cb61 chore(deps-dev): bump pytest from 9.0.3 to 9.1.1 (#244)
• 922dcd7 chore(deps-ci): bump the github-actions group with 4 updates (#245)
• 70461c5 ci: drop .github/FUNDING.yml to inherit org-wide config (#247)
• Additional commits viewable in compare view

Updates aiohttp from 3.13.3 to 3.14.1

Changelog

Sourced from aiohttp's changelog.

3.14.1 (2026-06-07)

Bug fixes

• Fixed a race condition in :py:class:~aiohttp.TCPConnector where closing the connector while a DNS resolution was in-flight could raise :py:exc:AttributeError instead of :py:exc:~aiohttp.ClientConnectionError -- by :user:goingforstudying-ctrl.

  Related issues and pull requests on GitHub: :issue:12497.

• Fixed CancelledError not closing a connection -- by :user:aiolibsbot.

  Related issues and pull requests on GitHub: :issue:12795.

• Tightened up some websocket parser checks -- by :user:Dreamsorcerer.

  Related issues and pull requests on GitHub: :issue:12817.

• Fixed :class:~aiohttp.CookieJar dropping the host-only flag of cookies when persisted with :meth:~aiohttp.CookieJar.save and reloaded with :meth:~aiohttp.CookieJar.load, so a cookie set without a Domain attribute is again scoped to the exact host that set it after a reload; the absolute expiration deadline is now persisted as well, so a reloaded cookie keeps its original lifetime instead of being rescheduled from the load time. :meth:~aiohttp.CookieJar.load now replaces the jar contents rather than merging onto prior state, and loaded cookies pass through the same acceptance rules as :meth:~aiohttp.CookieJar.update_cookies, so a cookie for an IP-address host is dropped when loaded into a jar created without unsafe=True -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:12824.

• Scoped :class:~aiohttp.DigestAuthMiddleware credentials to the origin of the first request it handles, so a redirect to a different origin no longer triggers a digest response computed from the configured credentials; a challenge from another origin is only answered when that origin falls within a protection space advertised by the anchor origin through the RFC 7616 domain directive -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:12825.

• Fixed the C HTTP parser not enforcing max_line_size on a request target or response reason phrase that is split across multiple reads; each fragment was checked on its own, so an accumulated line could exceed the limit without raising LineTooLong. The accumulated length is now checked, matching the pure-Python parser -- by :user:bdraco.

  Related issues and pull requests on GitHub:

... (truncated)

Commits

• 9c35d03 Release v3.14.1 (#12864)
• 38b956c [PR #12861/59684b5c backport][3.14] Revert "Drop list compression (#12857)" (...
• 8f31009 [PR #12857/69dff14d backport][3.14] Drop list compression (#12858)
• dfdfa9d [PR #12830/93a2b1c3 backport][3.14] Bound pipelined request queue per connect...
• 0e9cedd [PR #12827/ccf218ab backport][3.14] Numeric ipv4 resolver bypass (#12849)
• a762eda [PR #12831/1ac92dae backport][3.14] Payload close on disconnect (#12843)
• a329a7a [PR #12824/60b85e98 backport][3.14] Preserve host-only cookie scope across Co...
• 4f7480e [PR #12828/13b635d7 backport][3.14] Bounded unread compressed drain (#12845)
• 5ab61bb [PR #12826/36df6c13 backport][3.14] Enforce max_line_size on fragmented reque...
• 3912667 [3.14] Add test that env proxy auth is scoped to the redirect-selected proxy ...
• Additional commits viewable in compare view

Updates anyio from 4.12.1 to 4.14.2

Release notes

Sourced from anyio's releases.

4.14.2

• Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
• Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
• Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
• Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
• Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
• Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
• Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
• Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)

4.14.1

• Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
• Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)

4.14.0

• Added support for Python 3.15

• Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)

• Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)

• Added support for custom capacity limiters in async path and file I/O functions and classes

• Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)

• Changed TaskGroup.start_soon() to return a TaskHandle

• Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)

• Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope

• Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)

• Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)

• Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)

• Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:

  • TaskGroup.start_soon()
  • TaskGroup.start()
  • anyio.from_thread.run()

  This reverts an earlier change from v3.7.0 which was made in error. (#1153)

• Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)

• Changed several classes (and their subclasses) to have __slots__ (with __weakref__):

  • anyio.CancelScope

... (truncated)

Commits

• c384f99 Bumped up the version
• dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
• 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
• 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
• be24b04 Relaxed timeouts to fix test flakiness
• 8113506 Fix test flakiness caused by slow callback duration logging
• 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
• 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
• f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
• 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
• Additional commits viewable in compare view

Updates asttokens from 3.0.1 to 3.0.2

Release notes

Sourced from asttokens's releases.

v3.0.2

What's Changed

• Modernize type annotations by @​AlexWaygood in gristlabs/asttokens#172
• Fix pypy CI by skipping redundant mypy runs on it by @​dsagal in gristlabs/asttokens#173
• Fix IndexError on source mixing lone CR with LF line endings (#105) by