build(deps): bump the python-dependencies group across 1 directory with 4 updates by dependabot[bot] · Pull Request #494 · elixir-cloud-aai/protes

dependabot · 2026-11-14T20:17:38Z

Bumps the python-dependencies group with 4 updates in the / directory: gunicorn, ast-grep-cli, coverage and types-pyyaml.

Updates gunicorn from 26.2.0 to 27.0.0

Release notes

Sourced from gunicorn's releases.

gunicorn 27.0.0

Breaking Changes

Reject with 400 a request whose Transfer-Encoding does not end with chunked, such as gzip or identity alone, with or without Content-Length (RFC 9112 §6.3). The WSGI workers used to read such a body until the connection closed and the ASGI worker treated it as empty. Clients that send Transfer-Encoding: identity must stop sending it.

Bug Fixes

Reject whitespace between a header name and the colon (RFC 9112 §5.1).

Trim only spaces and tabs around Transfer-Encoding values (RFC 9110 §5.6.3) (#3364).

Reject a Content-Length that is not plain digits (RFC 9110 §8.6).

Reject chunk data not followed by CRLF (RFC 9112 §7.1).

Reject control characters in the request path (RFC 9112 §3.2) (#3371).

Return 414 URI Too Long for a request line over limit_request_line (RFC 9112 §3) (#2487).

ASGI: never write more body bytes than the app's Content-Length, and close the connection when the body is shorter (RFC 9112 §6.3).

ASGI: close the connection when the app returns before finishing its response (RFC 9112 §6.3).

ASGI: reject response header names and values that are not valid (RFC 9110 §5.1, §5.5).

WSGI: reject a response status that is not three digits followed by a valid reason phrase (RFC 9112 §4).

ASGI: read the body a HEAD request declares instead of serving it as the next request (RFC 9112 §6.3).

ASGI: stop buffering a request line, header, chunk-size line or trailer that never ends; the usual request limits now apply before the line terminator arrives, and trailers count against limit_request_fields.

ASGI: apply forwarded_allow_ips to HTTP/1 requests as WSGI and HTTP/2 already do: secure_scheme_headers set the scheme only from trusted proxies, and header names with underscores follow header_map.

Ignore one empty line before the request line, as the fast parser already does (RFC 9112 §2.2).

ASGI: stop gunicorn when the app reports a failed lifespan startup, instead of serving requests or rebooting the worker forever (ASGI lifespan spec) (#3778).

ASGI: close idle kept-alive connections after keepalive seconds, as the other workers do (#3734).

ASGI: give each request a shallow copy of the lifespan state, so a value one request stores in scope["state"] is not seen by the next one (ASGI lifespan spec).

ASGI: deliver websocket.disconnect as soon as the client closes the connection, instead of after the close timeout (RFC 6455 §5.5.1).

... (truncated)

Commits

237de69 gunicorn 27.0.0
77b0c63 Merge pull request #3814 from benoitc/docs/latest-changes
8c02c88 agents: list the HTTP/1 framing rules and how CI runs pylint
ea47de9 docs: describe the ASGI worker's request handling and performance
ff5ea0a docs: sort the unreleased changelog into breaking changes, fixes and changes
747ea4f Merge pull request #3813 from benoitc/fix/http1-framing-parity
c5a8b68 build: require gunicorn_h1c 0.6.14
6a52220 lint: put the two pylint disables where CI reports them
76bd679 lint: silence two pylint false positives seen under Python 3.12
2fcfc62 asgi, http: answer 501 to an unknown transfer coding on every path
Additional commits viewable in compare view

Updates ast-grep-cli from 0.51.1 to 0.51.2

Release notes

Sourced from ast-grep-cli's releases.

0.51.2

chore(deps): update rust crate tree-sitter-scala to v0.26.10 [#3085](https://github.com/ast-grep/ast-grep/issues/3085)

feat(language): define feature-gated languages with macros [#3081](https://github.com/ast-grep/ast-grep/issues/3081)

docs: fix dead wasm-pack installer link in the wasm crate README [#3084](https://github.com/ast-grep/ast-grep/issues/3084)

chore(deps): update dependency oxlint to v1.93.0 [#3082](https://github.com/ast-grep/ast-grep/issues/3082)

fix(config): do not split words at digits in convert transform [#3070](https://github.com/ast-grep/ast-grep/issues/3070)

chore(deps): update dependency web-tree-sitter to v0.27.2 [#3075](https://github.com/ast-grep/ast-grep/issues/3075)

chore(deps): update dependency node to v26 [#3069](https://github.com/ast-grep/ast-grep/issues/3069)

chore(deps): update rust crate toml_edit to v0.25.19 [#3071](https://github.com/ast-grep/ast-grep/issues/3071)

chore(deps): update rust crate tree-sitter-scala to v0.26.9 [#3072](https://github.com/ast-grep/ast-grep/issues/3072)

chore(deps): update dependency oxlint to v1.92.0 [#3074](https://github.com/ast-grep/ast-grep/issues/3074)

chore(deps): update rust crate smallvec to v1.16.5 [#3073](https://github.com/ast-grep/ast-grep/issues/3073)

chore(deps): update rust crate tree-sitter to v0.27.2 [#3076](https://github.com/ast-grep/ast-grep/issues/3076)

test(cli): verify npm packages on all platforms daily [#3068](https://github.com/ast-grep/ast-grep/issues/3068)

feat(cli): distribute musl Linux binaries [#3067](https://github.com/ast-grep/ast-grep/issues/3067)

Fail ast-grep test for unmatched IDs or when no tests run [#3065](https://github.com/ast-grep/ast-grep/issues/3065)

chore(deps): update dependency @napi-rs/cli to v3.10.12 [#3057](https://github.com/ast-grep/ast-grep/issues/3057)

chore(deps): update rust crate serde-saphyr to v2.1.1 [#3062](https://github.com/ast-grep/ast-grep/issues/3062)

chore(deps): update rust crate toml_edit to v0.25.18 [#3063](https://github.com/ast-grep/ast-grep/issues/3063)

fix(lsp): report columns in UTF-16 code units [#3060](https://github.com/ast-grep/ast-grep/issues/3060)

chore(deps): update dependency oxlint to v1.91.0 [#3061](https://github.com/ast-grep/ast-grep/issues/3061)

chore(deps): update dependency @ast-grep/napi to v0.51.1 [#3055](https://github.com/ast-grep/ast-grep/issues/3055)

Changelog

Sourced from ast-grep-cli's changelog.

0.51.2

chore(deps): update rust crate tree-sitter-scala to v0.26.10 [#3085](https://github.com/ast-grep/ast-grep/issues/3085)

feat(language): define feature-gated languages with macros [#3081](https://github.com/ast-grep/ast-grep/issues/3081)

docs: fix dead wasm-pack installer link in the wasm crate README [#3084](https://github.com/ast-grep/ast-grep/issues/3084)

chore(deps): update dependency oxlint to v1.93.0 [#3082](https://github.com/ast-grep/ast-grep/issues/3082)

fix(config): do not split words at digits in convert transform [#3070](https://github.com/ast-grep/ast-grep/issues/3070)

chore(deps): update dependency web-tree-sitter to v0.27.2 [#3075](https://github.com/ast-grep/ast-grep/issues/3075)

chore(deps): update dependency node to v26 [#3069](https://github.com/ast-grep/ast-grep/issues/3069)

chore(deps): update rust crate toml_edit to v0.25.19 [#3071](https://github.com/ast-grep/ast-grep/issues/3071)

chore(deps): update rust crate tree-sitter-scala to v0.26.9 [#3072](https://github.com/ast-grep/ast-grep/issues/3072)

chore(deps): update dependency oxlint to v1.92.0 [#3074](https://github.com/ast-grep/ast-grep/issues/3074)

chore(deps): update rust crate smallvec to v1.16.5 [#3073](https://github.com/ast-grep/ast-grep/issues/3073)

chore(deps): update rust crate tree-sitter to v0.27.2 [#3076](https://github.com/ast-grep/ast-grep/issues/3076)

test(cli): verify npm packages on all platforms daily [#3068](https://github.com/ast-grep/ast-grep/issues/3068)

feat(cli): distribute musl Linux binaries [#3067](https://github.com/ast-grep/ast-grep/issues/3067)

Fail ast-grep test for unmatched IDs or when no tests run [#3065](https://github.com/ast-grep/ast-grep/issues/3065)

chore(deps): update dependency @napi-rs/cli to v3.10.12 [#3057](https://github.com/ast-grep/ast-grep/issues/3057)

chore(deps): update rust crate serde-saphyr to v2.1.1 [#3062](https://github.com/ast-grep/ast-grep/issues/3062)

chore(deps): update rust crate toml_edit to v0.25.18 [#3063](https://github.com/ast-grep/ast-grep/issues/3063)

fix(lsp): report columns in UTF-16 code units [#3060](https://github.com/ast-grep/ast-grep/issues/3060)

chore(deps): update dependency oxlint to v1.91.0 [#3061](https://github.com/ast-grep/ast-grep/issues/3061)

chore(deps): update dependency @ast-grep/napi to v0.51.1 [#3055](https://github.com/ast-grep/ast-grep/issues/3055)

Commits

627f854 0.51.2
8063749 chore(deps): update rust crate tree-sitter-scala to v0.26.10 (#3085)
0954dc4 feat(language): define feature-gated languages with macros (#3081)
5e2bef3 docs: fix dead wasm-pack installer link in the wasm crate README (#3084)
59146fb chore(deps): update dependency oxlint to v1.93.0 (#3082)
6ee0ae4 fix(config): do not split words at digits in convert transform (#3070)
d2ae824 chore(deps): update dependency web-tree-sitter to v0.27.2 (#3075)
e44d6fd chore(deps): update dependency node to v26 (#3069)
64ae560 chore(deps): update rust crate toml_edit to v0.25.19 (#3071)
e2cd4de chore(deps): update rust crate tree-sitter-scala to v0.26.9 (#3072)
Additional commits viewable in compare view

Updates coverage from 7.17.1 to 7.17.2

Release notes

Sourced from coverage's releases.

7.17.2

Version 7.17.2 — 2026-11-04

Fix: two different scenarios failed with “attempt to write a readonly database”. These were regressions in 7.17.1. They are fixed, closing issue 2356:

When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.

coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can’t read is now reported like any other unusable data file, and is left in place.

➡️ PyPI page: coverage 7.17.2. :arrow_right: To install: python3 -m pip install coverage==7.17.2

Changelog

Sourced from coverage's changelog.

Version 7.17.2 — 2026-11-04

Fix: two different scenarios failed with "attempt to write a readonly database". These were regressions in 7.17.1. They are fixed, closing issue 2356_:

When using a version of SQLite older than 3.34.0, such as on RHEL 8 or Ubuntu 20.04, coverage combine (and pytest-cov, which combines automatically) always failed.

coverage combine and coverage debug data failed when a data file existed but had no coverage schema, for example an empty file left behind by a worker that died. A file we can't read is now reported like any other unusable data file, and is left in place.

.. _issue 2356: coveragepy/coveragepy#2356

.. _changes_7-17-1:

Commits

d0d3e1d docs: combine the two 'combine' failure descriptions
33cb85f fix: don't initialize a data file we can only read (#2360)
6e71bac docs: prep for 7.17.2
8273f72 test: fix two tests that failed on the Rocky 8 old_sqlite job
ce216fd build: a test environment for old version of SQLite
36e4a18 fix: combine failed on SQLite<3.34.0 #2356
d80ed19 build: bump version to 7.17.2
See full diff in compare view

Updates types-pyyaml from 6.0.12.20261103 to 6.0.12.20261111

Commits

See full diff in compare view

codecov · 2026-11-14T20:30:29Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f17294e) to head (8ab2c62).

Additional details and impacted files

@@            Coverage Diff            @@
##               dev      #494   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           35        35           
  Lines         3239      3239           
=========================================
  Hits          3239      3239

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…th 4 updates Bumps the python-dependencies group with 4 updates in the / directory: [gunicorn](https://github.com/benoitc/gunicorn), [ast-grep-cli](https://github.com/ast-grep/ast-grep), [coverage](https://github.com/coveragepy/coveragepy) and [types-pyyaml](https://github.com/python/typeshed). Updates `gunicorn` from 26.2.0 to 27.0.0 - [Release notes](https://github.com/benoitc/gunicorn/releases) - [Commits](benoitc/gunicorn@26.2.0...27.0.0) Updates `ast-grep-cli` from 0.51.1 to 0.51.2 - [Release notes](https://github.com/ast-grep/ast-grep/releases) - [Changelog](https://github.com/ast-grep/ast-grep/blob/main/CHANGELOG.md) - [Commits](ast-grep/ast-grep@0.51.1...0.51.2) Updates `coverage` from 7.17.1 to 7.17.2 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.17.1...7.17.2) Updates `types-pyyaml` from 6.0.12.20261103 to 6.0.12.20261111 - [Commits](https://github.com/python/typeshed/commits) --- updated-dependencies: - dependency-name: ast-grep-cli dependency-version: 0.51.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: coverage dependency-version: 7.17.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: gunicorn dependency-version: 27.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: python-dependencies - dependency-name: types-pyyaml dependency-version: 6.0.12.20261111 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from uniqueg as a code owner November 14, 2026 20:17

dependabot Bot added the type: dependencies Related to managing upstream dependencies label Nov 14, 2026

dependabot Bot force-pushed the dependabot/uv/dev/python-dependencies-a89870f012 branch from 2c36975 to 8ab2c62 Compare November 14, 2026 21:11

Navigation Menu

Repository navigation

build(deps): bump the python-dependencies group across 1 directory with 4 updates - #494

build(deps): bump the python-dependencies group across 1 directory with 4 updates#494
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/dev/python-dependencies-a89870f012

dependabot Bot commented on behalf of github Nov 14, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Nov 14, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

gunicorn 27.0.0

Breaking Changes

Bug Fixes

0.51.2

0.51.2

7.17.2

Version 7.17.2 — 2026-11-04

Version 7.17.2 — 2026-11-04

Uh oh!

codecov Bot commented Nov 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Nov 14, 2026 •

edited

Loading

codecov Bot commented Nov 14, 2026 •

edited

Loading