chore(release): 1.140.0 by aws-cdk-automation · Pull Request #5231 · aws/jsii

aws-cdk-automation · 2026-08-24T17:42:57Z

See [CHANGELOG](https://github.com/aws/jsii/blob/merge-back/1.139.0/CHANGELOG.md)

…ak/test/generated-code (#5203) Bumps [mypy](https://github.com/python/mypy) from 2.2.0 to 2.3.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's changelog</a>.</em></p> <blockquote> <h1>Mypy Release Notes</h1> <h2>Next Release</h2> <h3>Packaging changes</h3> <ul> <li>No longer provide mypyc-accelerated wheels for macOS x86_64 [mypyc-wheels <a href="https://redirect.github.com/python/mypy/issues/119">#119</a>](<a href="https://redirect.github.com/mypyc/mypy_mypyc-wheels/pull/119">mypyc/mypy_mypyc-wheels#119</a>)</li> </ul> <h2>Mypy 2.3</h2> <p>We've just uploaded mypy 2.3.0 to the Python Package Index (<a href="https://pypi.org/project/mypy/">PyPI</a>). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:</p> <pre><code>python3 -m pip install -U mypy </code></pre> <p>You can read the full documentation for this release on <a href="http://mypy.readthedocs.io">Read the Docs</a>.</p> <h3>The Upcoming Switch to the New Native Parser</h3> <p>We are planning to enable the new native parser (<code>--native-parser</code>) by default soon. We recommend that you test the native parser in your projects and report any issues in the <a href="https://github.com/python/mypy/issues">mypy issue tracker</a>.</p> <h3>Mypyc Free-threading Memory Safety</h3> <p>Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.</p> <p>List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using <code>librt.vecs.vec</code> instead of list is often significantly faster, but note that <code>vec</code> is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced <code>librt.threading.Lock</code> helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.</p> <p>Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.</p> <p>Full list of changes:</p> <ul> <li>Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21705">21705</a>)</li> <li>Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21688">21688</a>)</li> <li>Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21683">21683</a>)</li> <li>Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21679">21679</a>)</li> <li>Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21684">21684</a>)</li> </ul> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python/mypy/commit/8aabf8435357eaffceca7237f371e293b8168e54"><code>8aabf84</code></a> Drop +dev from version</li> <li><a href="https://github.com/python/mypy/commit/4d8ad2ab5e86c99581b73775f2c00b9b8265b589"><code>4d8ad2a</code></a> Update changelog for 2.3 release (<a href="https://redirect.github.com/python/mypy/issues/21728">#21728</a>)</li> <li><a href="https://github.com/python/mypy/commit/2c2154672040c52e481f423854d104e6cf172585"><code>2c21546</code></a> [mypyc] Update documentation of race conditions under free threading (<a href="https://redirect.github.com/python/mypy/issues/21726">#21726</a>)</li> <li><a href="https://github.com/python/mypy/commit/a9f62a3cf98a58a7a2607b7c81695802b39f5edc"><code>a9f62a3</code></a> [mypyc] Make attribute access memory safe on free-threaded builds (<a href="https://redirect.github.com/python/mypy/issues/21705">#21705</a>)</li> <li><a href="https://github.com/python/mypy/commit/0faa413ebf7c924a864ef5dabd70303d898e7766"><code>0faa413</code></a> Use <code>PYODIDE</code> environment variable for Emscripten cross-compilation detection...</li> <li><a href="https://github.com/python/mypy/commit/3d75cdb09f0928fa8b83e5ef03572ed878ac8d09"><code>3d75cdb</code></a> [mypyc] Borrow final attributes more aggressively (<a href="https://redirect.github.com/python/mypy/issues/21702">#21702</a>)</li> <li><a href="https://github.com/python/mypy/commit/24c237d85b48f618e655ffff1dc0f19089d9b599"><code>24c237d</code></a> [mypyc] Improve documentation of Final (<a href="https://redirect.github.com/python/mypy/issues/21713">#21713</a>)</li> <li><a href="https://github.com/python/mypy/commit/b5be217392b9b2771d1764066b9d600bf93ce7a8"><code>b5be217</code></a> [mypyc] Update free threading Python compatibility docs (<a href="https://redirect.github.com/python/mypy/issues/21711">#21711</a>)</li> <li><a href="https://github.com/python/mypy/commit/cbcb51add3094ec91b29cdd4c624943bf251b63f"><code>cbcb51a</code></a> Narrow for frozendict membership check (<a href="https://redirect.github.com/python/mypy/issues/21709">#21709</a>)</li> <li><a href="https://github.com/python/mypy/commit/af2bc0f3cc7f2f129f0c11294158d0c292692c3d"><code>af2bc0f</code></a> Sync typeshed (<a href="https://redirect.github.com/python/mypy/issues/21707">#21707</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python/mypy/compare/v2.2.0...v2.3.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mypy&package-manager=pip&previous-version=2.2.0&new-version=2.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

…runtime (#5212) Bumps [mypy](https://github.com/python/mypy) from 2.2.0 to 2.3.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's changelog</a>.</em></p> <blockquote> <h1>Mypy Release Notes</h1> <h2>Next Release</h2> <h3>Packaging changes</h3> <ul> <li>No longer provide mypyc-accelerated wheels for macOS x86_64 [mypyc-wheels <a href="https://redirect.github.com/python/mypy/issues/119">#119</a>](<a href="https://redirect.github.com/mypyc/mypy_mypyc-wheels/pull/119">mypyc/mypy_mypyc-wheels#119</a>)</li> </ul> <h2>Mypy 2.3</h2> <p>We've just uploaded mypy 2.3.0 to the Python Package Index (<a href="https://pypi.org/project/mypy/">PyPI</a>). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:</p> <pre><code>python3 -m pip install -U mypy </code></pre> <p>You can read the full documentation for this release on <a href="http://mypy.readthedocs.io">Read the Docs</a>.</p> <h3>The Upcoming Switch to the New Native Parser</h3> <p>We are planning to enable the new native parser (<code>--native-parser</code>) by default soon. We recommend that you test the native parser in your projects and report any issues in the <a href="https://github.com/python/mypy/issues">mypy issue tracker</a>.</p> <h3>Mypyc Free-threading Memory Safety</h3> <p>Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.</p> <p>List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using <code>librt.vecs.vec</code> instead of list is often significantly faster, but note that <code>vec</code> is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced <code>librt.threading.Lock</code> helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.</p> <p>Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.</p> <p>Full list of changes:</p> <ul> <li>Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21705">21705</a>)</li> <li>Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21688">21688</a>)</li> <li>Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21683">21683</a>)</li> <li>Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21679">21679</a>)</li> <li>Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21684">21684</a>)</li> </ul> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python/mypy/commit/8aabf8435357eaffceca7237f371e293b8168e54"><code>8aabf84</code></a> Drop +dev from version</li> <li><a href="https://github.com/python/mypy/commit/4d8ad2ab5e86c99581b73775f2c00b9b8265b589"><code>4d8ad2a</code></a> Update changelog for 2.3 release (<a href="https://redirect.github.com/python/mypy/issues/21728">#21728</a>)</li> <li><a href="https://github.com/python/mypy/commit/2c2154672040c52e481f423854d104e6cf172585"><code>2c21546</code></a> [mypyc] Update documentation of race conditions under free threading (<a href="https://redirect.github.com/python/mypy/issues/21726">#21726</a>)</li> <li><a href="https://github.com/python/mypy/commit/a9f62a3cf98a58a7a2607b7c81695802b39f5edc"><code>a9f62a3</code></a> [mypyc] Make attribute access memory safe on free-threaded builds (<a href="https://redirect.github.com/python/mypy/issues/21705">#21705</a>)</li> <li><a href="https://github.com/python/mypy/commit/0faa413ebf7c924a864ef5dabd70303d898e7766"><code>0faa413</code></a> Use <code>PYODIDE</code> environment variable for Emscripten cross-compilation detection...</li> <li><a href="https://github.com/python/mypy/commit/3d75cdb09f0928fa8b83e5ef03572ed878ac8d09"><code>3d75cdb</code></a> [mypyc] Borrow final attributes more aggressively (<a href="https://redirect.github.com/python/mypy/issues/21702">#21702</a>)</li> <li><a href="https://github.com/python/mypy/commit/24c237d85b48f618e655ffff1dc0f19089d9b599"><code>24c237d</code></a> [mypyc] Improve documentation of Final (<a href="https://redirect.github.com/python/mypy/issues/21713">#21713</a>)</li> <li><a href="https://github.com/python/mypy/commit/b5be217392b9b2771d1764066b9d600bf93ce7a8"><code>b5be217</code></a> [mypyc] Update free threading Python compatibility docs (<a href="https://redirect.github.com/python/mypy/issues/21711">#21711</a>)</li> <li><a href="https://github.com/python/mypy/commit/cbcb51add3094ec91b29cdd4c624943bf251b63f"><code>cbcb51a</code></a> Narrow for frozendict membership check (<a href="https://redirect.github.com/python/mypy/issues/21709">#21709</a>)</li> <li><a href="https://github.com/python/mypy/commit/af2bc0f3cc7f2f129f0c11294158d0c292692c3d"><code>af2bc0f</code></a> Sync typeshed (<a href="https://redirect.github.com/python/mypy/issues/21707">#21707</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python/mypy/compare/v2.2.0...v2.3.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mypy&package-manager=pip&previous-version=2.2.0&new-version=2.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

…=9.7.7 in /gh-pages (#5211) Updates the requirements on [mkdocs-material](https://github.com/squidfunk/mkdocs-material) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/squidfunk/mkdocs-material/releases">mkdocs-material's releases</a>.</em></p> <blockquote> <h2>mkdocs-material-9.7.7</h2> <blockquote> <p>[!WARNING]</p> <p><strong>Material for MkDocs is approaching end of life</strong></p> <p>Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates.</p> <p>The path forward is <a href="https://zensical.org">Zensical</a>, our next-generation static site generator built from first principles. If you’re planning a new documentation project or thinking about your long-term setup, we encourage you to start exploring Zensical.</p> <p>Organizations requiring support beyond this date can <a href="https://github.com/squidfunk/mkdocs-material/blob/HEAD/mailto:hello@zensical.org">get in touch</a> to discuss options.</p> <p><a href="https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/">Read the full announcement on our blog</a></p> </blockquote> <h2>Changes</h2> <ul> <li>Fixed a DOM-based XSS vulnerability in search suggestions</li> </ul> <blockquote> <p>Thanks to <a href="https://github.com/p"><code>@p</code></a>- for responsibly reporting this issue.</p> </blockquote> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG">mkdocs-material's changelog</a>.</em></p> <blockquote> <p>mkdocs-material-9.7.7 (2026-07-17)</p> <ul> <li>Fixed DOM-based XSS vulnerability in search suggestions</li> </ul> <p>mkdocs-material-9.7.6 (2026-03-19)</p> <ul> <li>Automatically disable MkDocs 2.0 warning for forks of MkDocs</li> </ul> <p>mkdocs-material-9.7.5 (2026-03-10)</p> <ul> <li>Limited version range of mkdocs to <2</li> <li>Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs)</li> </ul> <p>mkdocs-material-9.7.4 (2026-03-03)</p> <ul> <li>Hardened social cards plugin by switching to sandboxed environment</li> <li>Updated MkDocs 2.0 incompatibility warning</li> </ul> <p>mkdocs-material-9.7.3 (2026-02-24)</p> <ul> <li>Fixed <a href="https://redirect.github.com/squidfunk/mkdocs-material/issues/8567">#8567</a>: Print MkDocs 2.0 incompatibility warning to stderr</li> </ul> <p>mkdocs-material-9.7.2 (2026-02-18)</p> <ul> <li>Opened up version ranges of optional dependencies for forward-compatibility</li> <li>Added warning to 'mkdocs build' about impending MkDocs 2.0 incompatibility</li> </ul> <p>mkdocs-material-9.7.1 (2025-12-18)</p> <ul> <li>Updated requests to 2.30+ to mitigate CVE in urllib</li> <li>Fixed privacy plugin not picking up protocol-relative URLs</li> <li>Fixed <a href="https://redirect.github.com/squidfunk/mkdocs-material/issues/8542">#8542</a>: false positives and negatives captured in privacy plugin</li> </ul> <p>mkdocs-material-9.7.0 (2025-11-11)</p> <p>⚠️ Material for MkDocs is now in maintenance mode</p> <p>This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on Zensical, a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least.</p> <p>Read the full announcement on our blog: <a href="https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/">https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/</a></p> <p>This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone.</p> <p>Note on deprecated plugins: The projects and typeset plugins are included in this release, but must be considered deprecated. Both plugins proved</p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/b3e6dd886a974aa8200759ecfd7db28c598a2894"><code>b3e6dd8</code></a> Prepare 9.7.7 release</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25"><code>52fb6be</code></a> Merge commit from fork</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/901e6335cc80b0f12e46a1e34bd85e983dd78a6e"><code>901e633</code></a> Added <code>SECURITY.md</code> with EOL notice</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/5b36f2ac499a45905e246bc66bbee2858ef6556f"><code>5b36f2a</code></a> Bump js-yaml from 4.1.1 to 4.2.0 (<a href="https://redirect.github.com/squidfunk/mkdocs-material/issues/8598">#8598</a>)</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/2d11e7bc92c59b86d6ac0da2e38044fb4befa6e0"><code>2d11e7b</code></a> Bump form-data from 3.0.4 to 3.0.5 (<a href="https://redirect.github.com/squidfunk/mkdocs-material/issues/8597">#8597</a>)</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/ae05a534a8c8e1c58eb6aa55d460d309bcfce22b"><code>ae05a53</code></a> Bump esbuild from 0.27.2 to 0.28.1 (<a href="https://redirect.github.com/squidfunk/mkdocs-material/issues/8596">#8596</a>)</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/434af93166e5b90b78bba1295ca5a140fc67d0bc"><code>434af93</code></a> Bump shell-quote from 1.7.3 to 1.8.4 (<a href="https://redirect.github.com/squidfunk/mkdocs-material/issues/8593">#8593</a>)</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/4447cdadcbe8bc82570e9f1ae2b970f461b03b68"><code>4447cda</code></a> Documentation (<a href="https://redirect.github.com/squidfunk/mkdocs-material/issues/8590">#8590</a>)</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/8f8d551c9c5296dfc2a5ede35047bfb491d66bc9"><code>8f8d551</code></a> Updated copyright year (<a href="https://redirect.github.com/squidfunk/mkdocs-material/issues/8588">#8588</a>)</li> <li><a href="https://github.com/squidfunk/mkdocs-material/commit/08d8514d491782b4ac46673bcfdedb2f6fc85f3d"><code>08d8514</code></a> Bump fast-uri from 3.0.3 to 3.1.2 (<a href="https://redirect.github.com/squidfunk/mkdocs-material/issues/8587">#8587</a>)</li> <li>Additional commits viewable in <a href="https://github.com/squidfunk/mkdocs-material/compare/9.7.6...9.7.7">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

… /packages/@jsii/go-runtime-test/project in the go-deps group across 1 directory (#5214) Bumps the go-deps group with 1 update in the /packages/@jsii/go-runtime/jsii-runtime-go directory: [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty). Updates `github.com/mattn/go-isatty` from 0.0.23 to 0.0.24 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mattn/go-isatty/commit/c44dc0b9c702c76577fdb7898032969e0611efc2"><code>c44dc0b</code></a> Use TIOCGWINSZ instead of TCGETS to detect terminals (<a href="https://redirect.github.com/mattn/go-isatty/issues/97">#97</a>)</li> <li>See full diff in <a href="https://github.com/mattn/go-isatty/compare/v0.0.23...v0.0.24">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/mattn/go-isatty&package-manager=go_modules&previous-version=0.0.23&new-version=0.0.24)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>

…/packages/jsii-pacmak/lib/targets/python (#5217) Updates the requirements on [twine](https://github.com/pypa/twine) to permit the latest version. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/twine/blob/main/docs/changelog.rst">twine's changelog</a>.</em></p> <blockquote> <h2>twine 7.0.0 (2026-07-27)</h2> <p>Bugfixes ^^^^^^^^</p> <ul> <li>Specify UTF-8 encoding when reading <code>.pypirc</code> files. (<code>[#1268](pypa/twine#1268) <https://github.com/pypa/twine/issues/1268></code>_)</li> <li>Add missing subdependencies to <code>--version</code> output. (<code>[#1275](pypa/twine#1275) <https://github.com/pypa/twine/issues/1275></code>_)</li> <li>The dependency on <code>rich</code> has been bumped to avoid a hang in some environments. (<code>[#1308](pypa/twine#1308) <https://github.com/pypa/twine/issues/1308></code>_)</li> <li>Indices that respond with non-standard HTTP codes are now handled more gracefully. (<code>[#1309](pypa/twine#1309) <https://github.com/pypa/twine/issues/1309></code>_)</li> </ul> <p>Deprecations and Removals ^^^^^^^^^^^^^^^^^^^^^^^^^</p> <ul> <li>Fix uploading packages with metadata version 2.5. The fix no longer allows metadata version 2.0, which was never officially standardised. (<code>[#1317](pypa/twine#1317) <https://github.com/pypa/twine/issues/1317></code>_)</li> </ul> <p>Misc ^^^^</p> <ul> <li><code>[#1298](pypa/twine#1298) <https://github.com/pypa/twine/issues/1298></code>_</li> </ul> <h2>twine 6.2.0 (2025-09-04)</h2> <p>Features ^^^^^^^^</p> <ul> <li> <p>Automatically refresh short-lived PyPI token in long running Trusted Publishing uploads.</p> <p>In the event that a trusted publishing upload job is taking longer than the validity period of a trusted publishing token (15 minutes at the time of this writing), <em>and</em> we are already 10 minutes into that validity period, we will begin to attempt to replace the token on each subsequent request. (<code>[#1246](pypa/twine#1246) <https://github.com/pypa/twine/issues/1246></code>_)</p> </li> </ul> <p>Bugfixes ^^^^^^^^</p> <ul> <li>Fix compatibility kludge for invalid License-File metadata entries emitted by build backends to work also with <code>packaging</code> version 24.0. (<code>[#1217](pypa/twine#1217) <https://github.com/pypa/twine/issues/1217></code>_)</li> <li>Fix a couple of incorrectly rendered error messages. (<code>[#1224](pypa/twine#1224) <https://github.com/pypa/twine/issues/1224></code>_)</li> <li><code>twine</code> now enforces <code>keyring >= 21.2.0</code>, which was previously implicitly required by API usage. (<code>[#1229](pypa/twine#1229) <https://github.com/pypa/twine/issues/1229></code>_)</li> <li><code>twine</code> now catches <code>configparser.Error</code> to prevent accidental leaks of secret tokens or passwords to the user's console. (<code>[#1240](pypa/twine#1240) <https://github.com/pypa/twine/issues/1240></code>_)</li> </ul> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/twine/commit/fdb86cb45de11faeece9b274be6da7d275cdd4f9"><code>fdb86cb</code></a> Update changelog for 7.0.0 (<a href="https://redirect.github.com/pypa/twine/issues/1344">#1344</a>)</li> <li><a href="https://github.com/pypa/twine/commit/bfa7f7f037c6ba39e93813c6ad2537d13cf4b1e6"><code>bfa7f7f</code></a> changelog: backfill entries from PRs (<a href="https://redirect.github.com/pypa/twine/issues/1330">#1330</a>)</li> <li><a href="https://github.com/pypa/twine/commit/4f20c0dc374bbd54fe7cddc341e3c5ba7479917b"><code>4f20c0d</code></a> Remove monkeypatch allowing Metadata 2.0 (<a href="https://redirect.github.com/pypa/twine/issues/1317">#1317</a>)</li> <li><a href="https://github.com/pypa/twine/commit/1df249ecb442f5420d44c7782be11337daf83651"><code>1df249e</code></a> build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (<a href="https://redirect.github.com/pypa/twine/issues/1318">#1318</a>)</li> <li><a href="https://github.com/pypa/twine/commit/bea960757875c4e2800f82f95519aa0b4d9c3c04"><code>bea9607</code></a> fix: bump minimum rich dependency to 14.3.3 to prevent verbose hang (<a href="https://redirect.github.com/pypa/twine/issues/1308">#1308</a>)</li> <li><a href="https://github.com/pypa/twine/commit/ac17a17a9c01c5a2ba10f6ee142cef5aec6f56b0"><code>ac17a17</code></a> build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/pypa/twine/issues/1311">#1311</a>)</li> <li><a href="https://github.com/pypa/twine/commit/039cedfd9082b520dc37563dc0cf8a2d453a36e2"><code>039cedf</code></a> build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (<a href="https://redirect.github.com/pypa/twine/issues/1313">#1313</a>)</li> <li><a href="https://github.com/pypa/twine/commit/d465cb0930d3c6446d240902f6f782f8d5793288"><code>d465cb0</code></a> Handle non-standard HTTP status codes (<a href="https://redirect.github.com/pypa/twine/issues/1309">#1309</a>)</li> <li><a href="https://github.com/pypa/twine/commit/cab618fb122bb2d1e6c042f5bf0c5a8b8e2573bc"><code>cab618f</code></a> Bump <code>packaging >= 26.1</code> (<a href="https://redirect.github.com/pypa/twine/issues/1310">#1310</a>)</li> <li><a href="https://github.com/pypa/twine/commit/2d06e1177b1dcf94ae302e48f6fe6a4992fc89ae"><code>2d06e11</code></a> build(deps): bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 (<a href="https://redirect.github.com/pypa/twine/issues/1307">#1307</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pypa/twine/compare/6.2.0...7.0.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

Hey there! 👋 We've noticed that your Mergify configuration is using some deprecated fields. No worries—we've got your back! This automated PR updates your config to align with the newest standards, ensuring everything keeps running smoothly. Do not procrastinate! You **must upgrade** your configuration before **2026-09-30**, otherwise your configuration will stop working. ## What's Changed? - `queue_rules → commit_message_template`: The `commit_message_template` setting is deprecated. Use the declarative `commit_message_format` instead: https://docs.mergify.com/workflow/actions/merge#migrating-from-commit_message_template (deadline: 2026-09-30) ## Why This Matters Keeping your configuration up-to-date means you'll benefit from the latest features and improvements Mergify has to offer. Plus, it helps prevent any unexpected hiccups down the road. ## Got Questions? We've Got Answers! 🙌 **Is this update safe to merge?** Absolutely! We've made sure the changes are compatible with your current setup. Your workflows should continue to work just as before—if not better! **Do I need to do anything special after merging?** Nope! Just merge this PR, and you're all set. If you have any custom configurations, it's a good idea to give them a quick look to ensure everything's in order. **What if I run into issues or have concerns?** We're here to help! Feel free to [reach out to our support team](mailto:support@mergify.com) anytime. Thanks for being awesome and keeping your configuration up-to-date! If you have any thoughts or need a hand, don't hesitate to let us know. Happy merging! 🎉

…ython imports and runtime (#5182) This pr adds a repeatable checklist for verifying that a change affecting the jsii **Python** target's import behavior, lazy loading, or runtime type checking is complete and introduces no breaking changes for Python users. It is primarily meant for guiding AI agents on basic security checks to complete before "okaying" a feature pr. --- By submitting this pull request, I confirm that my contribution is made under the terms of the [Apache 2.0 license]. [Apache 2.0 license]: https://www.apache.org/licenses/LICENSE-2.0

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.4</h2> <h2>⚠️ Security Release</h2> <p>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx">https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx</a></p> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4">https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4</a></p> <h2>v3.1.3</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fixes: <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6">https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3">https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/6aeece669e4166b2446a89f17c07a3b15dfb7ed4"><code>6aeece6</code></a> Bumped v3.1.4</li> <li><a href="https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353"><code>2d50fba</code></a> fix: reject literal backslash in URI authority</li> <li><a href="https://github.com/fastify/fast-uri/commit/0549fe35b0d482233f3be2816439f3ec803603fa"><code>0549fe3</code></a> Bumped v3.1.3</li> <li><a href="https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05"><code>2a6d357</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=fast-uri&package-manager=npm_and_yarn&previous-version=3.1.2&new-version=3.1.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/aws/jsii/network/alerts). </details>

Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.16 to 7.5.19. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/node-tar/commit/be440da64e9fe80c68c755d8147328ea1cc2a9ad"><code>be440da</code></a> 7.5.19</li> <li><a href="https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3"><code>2812e93</code></a> add maxDecompressionRatio guard against explosive decompression</li> <li><a href="https://github.com/isaacs/node-tar/commit/9ecd4d2956fd915507eca018ddc1fea727fbba93"><code>9ecd4d2</code></a> 7.5.18</li> <li><a href="https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5"><code>9e78bf0</code></a> refuse to let header size be less than 0</li> <li><a href="https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b"><code>e02a4e9</code></a> pax: parse values according to known types</li> <li><a href="https://github.com/isaacs/node-tar/commit/9cbdb31e5e8dbcb97a642e0f91e2d1e342585946"><code>9cbdb31</code></a> 7.5.17</li> <li><a href="https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3"><code>7a635c2</code></a> terminate pax strings on nul bytes</li> <li>See full diff in <a href="https://github.com/isaacs/node-tar/compare/v7.5.16...v7.5.19">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tar&package-manager=npm_and_yarn&previous-version=7.5.16&new-version=7.5.19)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/aws/jsii/network/alerts). </details>

…k/test/generated-code (#5218) Bumps [pip](https://github.com/pypa/pip) from 26.1.2 to 26.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p> <blockquote> <h1>26.2 (2026-07-29)</h1> <h2>Deprecations and Removals</h2> <ul> <li> <p>Newly published packages will no longer be immediately visible to pip if the index uses caching. To install a newly published package, use <code>--refresh-package</code>. (<code>[#13680](pypa/pip#13680) <https://github.com/pypa/pip/issues/13680></code>_)</p> </li> <li> <p>Drop support for detecting legacy, non-:pep:<code>405</code>, <code>virtualenv</code> (< 20) environments. (<code>[#14062](pypa/pip#14062) <https://github.com/pypa/pip/issues/14062></code>_)</p> </li> <li> <p>Constraints files, including <code>PIP_CONSTRAINT</code>, no longer affect isolated build environments. Use <code>--build-constraint</code> or the <code>PIP_BUILD_CONSTRAINT</code> environment variable to constrain build dependencies instead.</p> <p>The <code>--use-feature=build-constraint</code> flag is now always enabled and has no effect. (<code>[#14094](pypa/pip#14094) <https://github.com/pypa/pip/issues/14094></code>_)</p> </li> </ul> <h2>Features</h2> <ul> <li> <p>Declare support for Python 3.15 (<code>[#14208](pypa/pip#14208) <https://github.com/pypa/pip/issues/14208></code>_)</p> </li> <li> <p>Support self-referential extras officially. pip has supported this by accident since version 21.2. (<code>[#11296](pypa/pip#11296) <https://github.com/pypa/pip/issues/11296></code>_)</p> </li> <li> <p>Add <code>--only-deps</code> flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with <code>--no-deps</code>, <code>-r</code>, <code>--group</code>, or <code>--requirements-from-script</code>. (<code>[#11440](pypa/pip#11440) <https://github.com/pypa/pip/issues/11440></code>_)</p> </li> <li> <p>Cache simple responses in accordance to their <code>Cache-Control</code> header instead of always revalidating on every request. To refresh cached package index responses and ensure newly published packages are found, use <code>--refresh-package <package></code>. (<code>[#13680](pypa/pip#13680) <https://github.com/pypa/pip/issues/13680></code>_)</p> </li> <li> <p>Add <code>--no-require-hashes</code> to disable automatic enablement of <code>--require-hashes</code> when encountering a requirement with hashes. (<code>[#14169](pypa/pip#14169) <https://github.com/pypa/pip/issues/14169></code>_)</p> </li> <li> <p>Honor <code>--only-final</code> when sourcing requirements with <code>-r pylock.toml</code>. (<code>[#13950](pypa/pip#13950) <https://github.com/pypa/pip/issues/13950></code>_)</p> </li> <li> <p>Add support for <code>pylock.toml</code> <code>upload-time</code> field, so <code>--uploaded-prior-to</code> works with <code>-r pylock.toml</code>. (<code>[#14168](pypa/pip#14168) <https://github.com/pypa/pip/issues/14168></code>_)</p> </li> <li> <p>Better error messages in case of conflicts with requirements from <code>-r pylock.toml</code>. (<code>[#13963](pypa/pip#13963) <https://github.com/pypa/pip/issues/13963></code>_)</p> </li> <li> <p>Add experimental support for isolating build subprocesses by creating standard virtual environments. This will fix most (if not all) subtle isolation issues that can lead to broken builds exclusive to pip. The feature can be enabled via <code>--use-feature=venv-isolation</code> and will be enabled by default in a future release.</p> <p>Note that the feature has limited compatibility with <code>--use-feature=inprocess-build-deps</code>. While most builds should work with both features enabled, there are known edge cases. <code>inprocess-build-deps</code> will not be enabled by default until they are fixed. (<code>[#14070](pypa/pip#14070) <https://github.com/pypa/pip/issues/14070></code>_)</p> </li> <li> <p>Present more informative diagnostic errors on uncaught network errors. (<code>[#14115](pypa/pip#14115) <https://github.com/pypa/pip/issues/14115></code>_)</p> </li> <li> <p>Allow opting out of Git partial clones with <code>PIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER</code>. (<code>[#11043](pypa/pip#11043) <https://github.com/pypa/pip/issues/11043></code>_)</p> </li> <li> <p>Add a <code>--no-proxy-env</code> (or <code>--proxy ""</code>) option to ignore proxies configured via non-pip environment variables or configuration files. A proxy set with <code>--proxy</code> is still used. (<code>[#5378](pypa/pip#5378) <https://github.com/pypa/pip/issues/5378></code>_)</p> </li> <li> <p>Add support for pulling username from keyring subprocess provider (<code>[#12543](pypa/pip#12543) <https://github.com/pypa/pip/issues/12543></code>_)</p> </li> <li> <p>Speedup tab autocompletion by lazy-importing certain modules. (<code>[#4768](pypa/pip#4768) <https://github.com/pypa/pip/issues/4768></code>_)</p> </li> </ul> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/pip/commit/4b6ae5c4d7d63a61a99fbecbead8dbc35cc8b357"><code>4b6ae5c</code></a> Bump for release</li> <li><a href="https://github.com/pypa/pip/commit/50b6d3cf998e141d106e72ba17380c39f979188d"><code>50b6d3c</code></a> Update AUTHORS.txt</li> <li><a href="https://github.com/pypa/pip/commit/dbddfbde3a2f57401c9ad1b910aee6d195af7b8d"><code>dbddfbd</code></a> Tweak news entries for pip 26.2 (<a href="https://redirect.github.com/pypa/pip/issues/14212">#14212</a>)</li> <li><a href="https://github.com/pypa/pip/commit/6576b7596c97bb95ce02098303d25bf82dd44943"><code>6576b75</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/14165">#14165</a> from sbidoul/refactor-pylock-hanling-sbi</li> <li><a href="https://github.com/pypa/pip/commit/0090e0065ae0087d5d6c171a4eb1821e127aa120"><code>0090e00</code></a> Address a variety of typos detected in code review</li> <li><a href="https://github.com/pypa/pip/commit/e12ddd958df6878f38f2a6f777e4653613eb4821"><code>e12ddd9</code></a> Add support for --uploaded-prior-to with -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/5eefdbcb09ab9783ab89f33fb85c48abf45eb7be"><code>5eefdbc</code></a> Better conflict report for requirements from -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/6d71ff83d64b36504761990911e797c0f5d259d1"><code>6d71ff8</code></a> Test --only-final with -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/e7d6eb9983980a6380a12e0822da2c1c560e1bb4"><code>e7d6eb9</code></a> Refactor -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/756506d154a5b5b5746e9c66bc6e52d6ae3803a9"><code>756506d</code></a> Add TODO about pylock.select and --no-binary</li> <li>Additional commits viewable in <a href="https://github.com/pypa/pip/compare/26.1.2...26.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip&package-manager=pip&previous-version=26.1.2&new-version=26.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

Ran npm-check-updates and yarn up to keep the `yarn.lock` file up-to-date.

…s/@jsii/python-runtime (#5219) Updates the requirements on [pip](https://github.com/pypa/pip) to permit the latest version. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p> <blockquote> <h1>26.2 (2026-07-29)</h1> <h2>Deprecations and Removals</h2> <ul> <li> <p>Newly published packages will no longer be immediately visible to pip if the index uses caching. To install a newly published package, use <code>--refresh-package</code>. (<code>[#13680](pypa/pip#13680) <https://github.com/pypa/pip/issues/13680></code>_)</p> </li> <li> <p>Drop support for detecting legacy, non-:pep:<code>405</code>, <code>virtualenv</code> (< 20) environments. (<code>[#14062](pypa/pip#14062) <https://github.com/pypa/pip/issues/14062></code>_)</p> </li> <li> <p>Constraints files, including <code>PIP_CONSTRAINT</code>, no longer affect isolated build environments. Use <code>--build-constraint</code> or the <code>PIP_BUILD_CONSTRAINT</code> environment variable to constrain build dependencies instead.</p> <p>The <code>--use-feature=build-constraint</code> flag is now always enabled and has no effect. (<code>[#14094](pypa/pip#14094) <https://github.com/pypa/pip/issues/14094></code>_)</p> </li> </ul> <h2>Features</h2> <ul> <li> <p>Declare support for Python 3.15 (<code>[#14208](pypa/pip#14208) <https://github.com/pypa/pip/issues/14208></code>_)</p> </li> <li> <p>Support self-referential extras officially. pip has supported this by accident since version 21.2. (<code>[#11296](pypa/pip#11296) <https://github.com/pypa/pip/issues/11296></code>_)</p> </li> <li> <p>Add <code>--only-deps</code> flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with <code>--no-deps</code>, <code>-r</code>, <code>--group</code>, or <code>--requirements-from-script</code>. (<code>[#11440](pypa/pip#11440) <https://github.com/pypa/pip/issues/11440></code>_)</p> </li> <li> <p>Cache simple responses in accordance to their <code>Cache-Control</code> header instead of always revalidating on every request. To refresh cached package index responses and ensure newly published packages are found, use <code>--refresh-package <package></code>. (<code>[#13680](pypa/pip#13680) <https://github.com/pypa/pip/issues/13680></code>_)</p> </li> <li> <p>Add <code>--no-require-hashes</code> to disable automatic enablement of <code>--require-hashes</code> when encountering a requirement with hashes. (<code>[#14169](pypa/pip#14169) <https://github.com/pypa/pip/issues/14169></code>_)</p> </li> <li> <p>Honor <code>--only-final</code> when sourcing requirements with <code>-r pylock.toml</code>. (<code>[#13950](pypa/pip#13950) <https://github.com/pypa/pip/issues/13950></code>_)</p> </li> <li> <p>Add support for <code>pylock.toml</code> <code>upload-time</code> field, so <code>--uploaded-prior-to</code> works with <code>-r pylock.toml</code>. (<code>[#14168](pypa/pip#14168) <https://github.com/pypa/pip/issues/14168></code>_)</p> </li> <li> <p>Better error messages in case of conflicts with requirements from <code>-r pylock.toml</code>. (<code>[#13963](pypa/pip#13963) <https://github.com/pypa/pip/issues/13963></code>_)</p> </li> <li> <p>Add experimental support for isolating build subprocesses by creating standard virtual environments. This will fix most (if not all) subtle isolation issues that can lead to broken builds exclusive to pip. The feature can be enabled via <code>--use-feature=venv-isolation</code> and will be enabled by default in a future release.</p> <p>Note that the feature has limited compatibility with <code>--use-feature=inprocess-build-deps</code>. While most builds should work with both features enabled, there are known edge cases. <code>inprocess-build-deps</code> will not be enabled by default until they are fixed. (<code>[#14070](pypa/pip#14070) <https://github.com/pypa/pip/issues/14070></code>_)</p> </li> <li> <p>Present more informative diagnostic errors on uncaught network errors. (<code>[#14115](pypa/pip#14115) <https://github.com/pypa/pip/issues/14115></code>_)</p> </li> <li> <p>Allow opting out of Git partial clones with <code>PIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER</code>. (<code>[#11043](pypa/pip#11043) <https://github.com/pypa/pip/issues/11043></code>_)</p> </li> <li> <p>Add a <code>--no-proxy-env</code> (or <code>--proxy ""</code>) option to ignore proxies configured via non-pip environment variables or configuration files. A proxy set with <code>--proxy</code> is still used. (<code>[#5378](pypa/pip#5378) <https://github.com/pypa/pip/issues/5378></code>_)</p> </li> <li> <p>Add support for pulling username from keyring subprocess provider (<code>[#12543](pypa/pip#12543) <https://github.com/pypa/pip/issues/12543></code>_)</p> </li> <li> <p>Speedup tab autocompletion by lazy-importing certain modules. (<code>[#4768](pypa/pip#4768) <https://github.com/pypa/pip/issues/4768></code>_)</p> </li> </ul> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/pip/commit/4b6ae5c4d7d63a61a99fbecbead8dbc35cc8b357"><code>4b6ae5c</code></a> Bump for release</li> <li><a href="https://github.com/pypa/pip/commit/50b6d3cf998e141d106e72ba17380c39f979188d"><code>50b6d3c</code></a> Update AUTHORS.txt</li> <li><a href="https://github.com/pypa/pip/commit/dbddfbde3a2f57401c9ad1b910aee6d195af7b8d"><code>dbddfbd</code></a> Tweak news entries for pip 26.2 (<a href="https://redirect.github.com/pypa/pip/issues/14212">#14212</a>)</li> <li><a href="https://github.com/pypa/pip/commit/6576b7596c97bb95ce02098303d25bf82dd44943"><code>6576b75</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/14165">#14165</a> from sbidoul/refactor-pylock-hanling-sbi</li> <li><a href="https://github.com/pypa/pip/commit/0090e0065ae0087d5d6c171a4eb1821e127aa120"><code>0090e00</code></a> Address a variety of typos detected in code review</li> <li><a href="https://github.com/pypa/pip/commit/e12ddd958df6878f38f2a6f777e4653613eb4821"><code>e12ddd9</code></a> Add support for --uploaded-prior-to with -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/5eefdbcb09ab9783ab89f33fb85c48abf45eb7be"><code>5eefdbc</code></a> Better conflict report for requirements from -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/6d71ff83d64b36504761990911e797c0f5d259d1"><code>6d71ff8</code></a> Test --only-final with -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/e7d6eb9983980a6380a12e0822da2c1c560e1bb4"><code>e7d6eb9</code></a> Refactor -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/756506d154a5b5b5746e9c66bc6e52d6ae3803a9"><code>756506d</code></a> Add TODO about pylock.select and --no-binary</li> <li>Additional commits viewable in <a href="https://github.com/pypa/pip/compare/26.1...26.2">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

Ran npm-check-updates and yarn up to keep the `yarn.lock` file up-to-date.

…n /packages/jsii-pacmak/lib/targets/python (#5221) Updates the requirements on [packaging](https://github.com/pypa/packaging) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/packaging/releases">packaging's releases</a>.</em></p> <blockquote> <h2>26.3</h2> <h2>What's Changed</h2> <h3>Features</h3> <ul> <li>Add a public <code>VersionRange</code> API and <code>SpecifierSet.to_range()</code>, representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. <code>VersionRange.to_specifier_set()</code> converts a range back to a <code>SpecifierSet</code> where a PEP 440 form exists. (<a href="https://redirect.github.com/pypa/packaging/pull/1267">#1267</a>, <a href="https://redirect.github.com/pypa/packaging/pull/1270">#1270</a>, <a href="https://redirect.github.com/pypa/packaging/pull/1298">#1298</a>)</li> <li>PEP 808: accept <code>Metadata-Version: 2.6</code>. (<a href="https://redirect.github.com/pypa/packaging/pull/1194">#1194</a>)</li> <li>Add a <code>limit</code> argument to <code>parse_tag()</code> for compressed tag sets. (<a href="https://redirect.github.com/pypa/packaging/issues/1220">#1220</a>)</li> <li>Add a <code>prefer_sdist_predicate</code> argument to <code>Pylock.select()</code> to prefer source distributions over wheels for selected packages. (<a href="https://redirect.github.com/pypa/packaging/pull/1334">#1334</a>)</li> <li>Add <code>pure_python_tags()</code> to generate the pure-Python tags for a Python version without touching the running platform. (<a href="https://redirect.github.com/pypa/packaging/pull/1346">#1346</a>)</li> <li>Add <code>SpecifierSet.is_subset()</code>, <code>SpecifierSet.is_superset()</code>, and <code>SpecifierSet.is_disjoint()</code>, which compare the versions two specifier sets accept. (<a href="https://redirect.github.com/pypa/packaging/pull/1313">#1313</a>)</li> </ul> <h3>Behavior adaptations</h3> <ul> <li>Drop support for Python 3.8; packaging now requires Python 3.9 or later. (<a href="https://redirect.github.com/pypa/packaging/pull/1157">#1157</a>)</li> <li>Prefer native <code>linux_*</code> platform tags over <code>manylinux</code> and <code>musllinux</code> tags on Linux. (<a href="https://redirect.github.com/pypa/packaging/issues/160">#160</a>)</li> </ul> <h3>Fixes for versions and specifiers</h3> <ul> <li>Raise <code>InvalidVersion</code> instead of <code>TypeError</code> when <code>Version</code> is given a non-string. (<a href="https://redirect.github.com/pypa/packaging/pull/1319">#1319</a>)</li> <li>Raise <code>InvalidVersion</code> for non-string pre-release letters passed to <code>Version.from_parts</code>. (<a href="https://redirect.github.com/pypa/packaging/pull/1241">#1241</a>)</li> <li>Fix an <code>AttributeError</code> when hashing internally trimmed versions. (<a href="https://redirect.github.com/pypa/packaging/pull/1242">#1242</a>)</li> <li>Fix <code>SpecifierSet.is_unsatisfiable</code> for post-release boundary intersections. (<a href="https://redirect.github.com/pypa/packaging/pull/1257">#1257</a>)</li> </ul> <h3>Fixes for requirements and markers</h3> <ul> <li>Make <code>Requirement.__hash__</code> consistent with <code>__eq__</code> for trailing-zero-equivalent specifiers (e.g. <code>foo==1.0.0</code> and <code>foo==1.0.0.0</code>), so equal requirements hash equal and deduplicate in sets and dicts. (<a href="https://redirect.github.com/pypa/packaging/pull/1232">#1232</a>)</li> <li>Normalize requested extra names before comparing or hashing requirements. (<a href="https://redirect.github.com/pypa/packaging/issues/644">#644</a>)</li> <li>Preserve a <code>Requirement</code>'s specifier <code>prereleases</code> override across a pickle round trip. (<a href="https://redirect.github.com/pypa/packaging/issues/1204">#1204</a>)</li> <li>Raise <code>InvalidRequirement</code> instead of <code>InvalidSpecifier</code> when a requirement contains an invalid specifier. (<a href="https://redirect.github.com/pypa/packaging/pull/1332">#1332</a>)</li> <li>Clarify the error for post-release prefix wildcards like <code>==1.0.post1.*</code>. (<a href="https://redirect.github.com/pypa/packaging/pull/1299">#1299</a>)</li> <li>Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (<a href="https://redirect.github.com/pypa/packaging/pull/1213">#1213</a>)</li> <li>Keep the parentheses of a nested group when serializing markers. (<a href="https://redirect.github.com/pypa/packaging/pull/1316">#1316</a>)</li> <li>Normalize <code>extra</code> and <code>dependency_groups</code> values in nested markers at parse time. (<a href="https://redirect.github.com/pypa/packaging/pull/1246">#1246</a>, <a href="https://redirect.github.com/pypa/packaging/pull/1310">#1310</a>)</li> <li>Raise <code>UndefinedComparison</code> when a set-valued variable like <code>extras</code> is used outside the membership form. (<a href="https://redirect.github.com/pypa/packaging/pull/1265">#1265</a>)</li> <li>Raise <code>UndefinedEnvironmentName</code> (a <code>KeyError</code> subclass) for missing environment keys during marker evaluation. (<a href="https://redirect.github.com/pypa/packaging/pull/1276">#1276</a>)</li> <li>Wrap malformed string literal errors in <code>InvalidMarker</code> / <code>InvalidRequirement</code> instead of leaking a low-level error. (<a href="https://redirect.github.com/pypa/packaging/pull/1249">#1249</a>)</li> <li>Reject requirements and markers with a trailing line break. (<a href="https://redirect.github.com/pypa/packaging/pull/1345">#1345</a>)</li> </ul> <h3>Fixes for metadata and licenses</h3> <ul> <li>Collect all <code>from_email</code> validation errors into one <code>ExceptionGroup</code> instead of raising the first. (<a href="https://redirect.github.com/pypa/packaging/pull/1268">#1268</a>)</li> <li>Accept the UTF-8 charset case-insensitively in email payloads. (<a href="https://redirect.github.com/pypa/packaging/pull/1330">#1330</a>)</li> <li>Reject malformed <code>Description-Content-Type</code> values. (<a href="https://redirect.github.com/pypa/packaging/pull/1329">#1329</a>)</li> <li>Don't rewrite user values that contain <code>{field}</code> placeholders in error messages. (<a href="https://redirect.github.com/pypa/packaging/pull/1327">#1327</a>)</li> <li>Route multipart email payloads to <code>unparsed</code> instead of asserting. (<a href="https://redirect.github.com/pypa/packaging/pull/1247">#1247</a>)</li> <li>Make <code>InvalidMetadata</code> and <code>CyclicDependencyGroup</code> picklable. (<a href="https://redirect.github.com/pypa/packaging/pull/1328">#1328</a>)</li> <li>Fold every line boundary <code>str.splitlines</code> recognizes when writing a header with <code>RFC822Message</code>. (<a href="https://redirect.github.com/pypa/packaging/pull/1356">#1356</a>)</li> </ul> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/packaging/blob/main/CHANGELOG.rst">packaging's changelog</a>.</em></p> <blockquote> <p>26.3 - 2026-08-03</p> <pre><code> Features: <ul> <li>Add a public :class:<code>~packaging.ranges.VersionRange</code> API and<br /> :meth:<code>SpecifierSet.to_range() &lt;packaging.specifiers.SpecifierSet.to_range&gt;</code>,<br /> representing the versions a specifier set accepts as an interval set that<br /> supports intersection, union, difference, complement, set relations,<br /> membership tests, and filtering.<br /> :meth:<code>~packaging.ranges.VersionRange.to_specifier_set</code> converts a range back<br /> to a :class:<code>~packaging.specifiers.SpecifierSet</code> where a PEP 440 form exists.<br /> (:pull:<code>1267</code>, :pull:<code>1270</code>, :pull:<code>1298</code>)</li> <li>PEP 808: accept <code>Metadata-Version: 2.6</code>. (:pull:<code>1194</code>)</li> <li>Add a <code>limit</code> argument to <code>parse_tag()</code> for compressed tag sets.<br /> (:issue:<code>1220</code>)</li> <li>Add a <code>prefer_sdist_predicate</code> argument to <code>Pylock.select()</code> to prefer<br /> source distributions over wheels for selected packages. (:pull:<code>1334</code>)</li> <li>Add :func:<code>~packaging.tags.pure_python_tags</code> to generate the pure-Python<br /> tags for a Python version without touching the running platform.<br /> (:pull:<code>1346</code>)</li> <li>Add :meth:<code>SpecifierSet.is_subset() &lt;packaging.specifiers.SpecifierSet.is_subset&gt;</code>, :meth:<code>~packaging.specifiers.SpecifierSet.is_superset</code>,<br /> and :meth:<code>~packaging.specifiers.SpecifierSet.is_disjoint</code>, which compare the<br /> versions two specifier sets accept. (:pull:<code>1313</code>)</li> </ul> <p>Behavior adaptations:</p> <ul> <li>Drop support for Python 3.8; packaging now requires Python 3.9 or later.<br /> (:pull:<code>1157</code>)</li> <li>Prefer native <code>linux_*</code> platform tags over <code>manylinux</code> and <code>musllinux</code><br /> tags on Linux. (:issue:<code>160</code>)</li> </ul> <p>Fixes for versions and specifiers:</p> <ul> <li>Raise <code>InvalidVersion</code> instead of <code>TypeError</code> when <code>Version</code> is given a<br /> non-string. (:pull:<code>1319</code>)</li> <li>Raise <code>InvalidVersion</code> for non-string pre-release letters passed to<br /> <code>Version.from_parts</code>. (:pull:<code>1241</code>)</li> <li>Fix an <code>AttributeError</code> when hashing internally trimmed versions.<br /> (:pull:<code>1242</code>)</li> <li>Fix <code>SpecifierSet.is_unsatisfiable</code> for post-release boundary<br /> intersections. (:pull:<code>1257</code>)</li> </ul> <p>Fixes for requirements and markers:</p> <ul> <li>Make <code>Requirement.__hash__</code> consistent with <code>__eq__</code> for<br /> trailing-zero-equivalent specifiers (e.g. <code>foo==1.0.0</code> and<br /> <code>foo==1.0.0.0</code>), so equal requirements hash equal and deduplicate in<br /> sets and dicts. (:pull:<code>1232</code>)<br /> </tr></table><br /> </code></pre></li> </ul> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/packaging/commit/929fd4b1410ac7ef61ef3f45b2f5d7e87711a9b5"><code>929fd4b</code></a> Bump for release</li> <li><a href="https://github.com/pypa/packaging/commit/f300ebf0c155e1f7ea6d62fba11dba4bac3d1944"><code>f300ebf</code></a> chore(deps): bump the pre-commit group with 5 updates (<a href="https://redirect.github.com/pypa/packaging/issues/1357">#1357</a>)</li> <li><a href="https://github.com/pypa/packaging/commit/f91d97566a966177ad7ea5a7c703b12a7273e3b1"><code>f91d975</code></a> ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (<a href="https://redirect.github.com/pypa/packaging/issues/1361">#1361</a>)</li> <li><a href="https://github.com/pypa/packaging/commit/b1a7124fe3d40c3302c029e9eb01ac3fc3496a54"><code>b1a7124</code></a> chore(deps): bump the github-actions group with 7 updates (<a href="https://redirect.github.com/pypa/packaging/issues/1358">#1358</a>)</li> <li><a href="https://github.com/pypa/packaging/commit/2d873eb6002021a8c007c933fbdab58b37a5079b"><code>2d873eb</code></a> fix(metadata): fold every line boundary when writing headers (<a href="https://redirect.github.com/pypa/packaging/issues/1356">#1356</a>)</li> <li><a href="https://github.com/pypa/packaging/commit/413d006fadf5b9b14d78ad444201d8189bff8c64"><code>413d006</code></a> docs: changelog for 26.3 (<a href="https://redirect.github.com/pypa/packaging/issues/1343">#1343</a>)</li> <li><a href="https://github.com/pypa/packaging/commit/4eb0753dba8fcaaac8eb75463374e448f0931558"><code>4eb0753</code></a> docs(metadata): explain selective field validation (<a href="https://redirect.github.com/pypa/packaging/issues/1342">#1342</a>)</li> <li><a href="https://github.com/pypa/packaging/commit/77e9ed42b6db9c5c011a5148047a356ebe42692a"><code>77e9ed4</code></a> feat(tags): add pure Python tag generator (<a href="https://redirect.github.com/pypa/packaging/issues/1346">#1346</a>)</li> <li><a href="https://github.com/pypa/packaging/commit/7cea5e88671ed14016e9ab3dd08eab064f596564"><code>7cea5e8</code></a> ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...</li> <li><a href="https://github.com/pypa/packaging/commit/45a8b3402db5ff82158f2d0eabaf8447aa7a50bf"><code>45a8b34</code></a> docs: add missing versionadded/versionchanged directives (<a href="https://redirect.github.com/pypa/packaging/issues/1344">#1344</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pypa/packaging/compare/26.2...26.3">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

…k/test/generated-code (#5222) Bumps [pip](https://github.com/pypa/pip) from 26.2 to 26.2.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p> <blockquote> <h1>26.2.1 (2026-08-04)</h1> <h2>Bug Fixes</h2> <ul> <li>Reallow keyring installed in a (non-activated) virtual environment to be be used via the <code>import</code> provider method while installing build dependencies. (<code>[#14227](pypa/pip#14227) <https://github.com/pypa/pip/issues/14227></code>_)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/pip/commit/634a6ec1a5d9dcc2433571cdb2f4c58a4bb29caf"><code>634a6ec</code></a> Bump for release</li> <li><a href="https://github.com/pypa/pip/commit/ae2eb4fed21ce9e9dabcf2d2c904c12a6a204a00"><code>ae2eb4f</code></a> Revert build dependency installer isolation for legacy build environment (<a href="https://redirect.github.com/pypa/pip/issues/14">#14</a>...</li> <li><a href="https://github.com/pypa/pip/commit/6236392d41f0623476b9dbca2f1c55b832ee7e43"><code>6236392</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/14213">#14213</a> from pypa/release/26.2</li> <li><a href="https://github.com/pypa/pip/commit/da4b2cc7e3961fc84355d516ffa0327f8e23719c"><code>da4b2cc</code></a> Bump for development</li> <li>See full diff in <a href="https://github.com/pypa/pip/compare/26.2...26.2.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip&package-manager=pip&previous-version=26.2&new-version=26.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

Ran npm-check-updates and yarn up to keep the `yarn.lock` file up-to-date.

…ges/@jsii/python-runtime (#5224) Updates the requirements on [wheel](https://github.com/pypa/wheel) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/wheel/releases">wheel's releases</a>.</em></p> <blockquote> <h2>0.48.0</h2> <ul> <li>Added a <code>--local-version</code> option to <code>wheel pack</code> to add, replace, or remove a PEP 440 local version identifier from a wheel (<a href="https://redirect.github.com/pypa/wheel/issues/570">#570</a>)</li> <li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible core metadata versions (<a href="https://redirect.github.com/pypa/wheel/issues/643">#643</a>)</li> <li>Fixed <code>wheel tags</code> producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (<a href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>)</li> <li>Fixed <code>wheel convert</code> writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (<a href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw">GHSA-vgq5-9859-3mmw</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/wheel/blob/main/docs/news.rst">wheel's changelog</a>.</em></p> <blockquote> <h1>Release Notes</h1> <p><strong>UNRELEASED</strong></p> <ul> <li>Fixed the macOS platform-tag warning always using the plural "these files" wording, even when only a single library required a higher deployment target (<code>[#697](pypa/wheel#697) <https://github.com/pypa/wheel/pull/697></code>_)</li> </ul> <p><strong>0.48.0 (2026-08-12)</strong></p> <ul> <li>Added a <code>--local-version</code> option to <code>wheel pack</code> to add, replace, or remove a PEP 440 local version identifier from a wheel (<code>[#570](pypa/wheel#570) <https://github.com/pypa/wheel/issues/570></code>_)</li> <li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible core metadata versions (<code>[#643](pypa/wheel#643) <https://github.com/pypa/wheel/issues/643></code>_)</li> <li>Fixed <code>wheel tags</code> producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (<code>[#692](pypa/wheel#692) <https://github.com/pypa/wheel/issues/692></code>_)</li> <li>Fixed <code>wheel convert</code> writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (<code>GHSA-vgq5-9859-3mmw <https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw></code>_)</li> </ul> <p><strong>0.47.0 (2026-04-22)</strong></p> <ul> <li>Added the <code>wheel info</code> subcommand to display metadata about wheel files without unpacking them (<code>[#639](pypa/wheel#639) <https://github.com/pypa/wheel/issues/639></code>_)</li> <li>Fixed <code>WheelFile</code> raising <code>Missing RECORD file</code> when the wheel filename contains uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the <code>.dist-info</code> directory inside uses normalized lowercase naming (<code>[#411](pypa/wheel#411) <https://github.com/pypa/wheel/issues/411></code>_)</li> </ul> <p><strong>0.46.3 (2026-01-22)</strong></p> <ul> <li>Fixed <code>ImportError: cannot import name '_setuptools_logging' from 'wheel'</code> when installed alongside an old version of setuptools and running the <code>bdist_wheel</code> command (<code>[#676](pypa/wheel#676) <https://github.com/pypa/wheel/issues/676></code>_)</li> </ul> <p><strong>0.46.2 (2026-01-22)</strong></p> <ul> <li>Restored the <code>bdist_wheel</code> command for compatibility with <code>setuptools</code> older than v70.1</li> <li>Importing <code>wheel.bdist_wheel</code> now emits a <code>FutureWarning</code> instead of a <code>DeprecationWarning</code></li> <li>Fixed <code>wheel unpack</code> potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)</li> </ul> <p><strong>0.46.1 (2025-04-08)</strong></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84"><code>21c4da4</code></a> Fixed the release heading format</li> <li><a href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2"><code>f06d4db</code></a> Flit no longer supports --setup-py</li> <li><a href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c"><code>1a96c3e</code></a> Created a new release</li> <li><a href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b"><code>d7d625d</code></a> Fixed wheel convert writing outside the target directory on malicious input (...</li> <li><a href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465"><code>986a440</code></a> Strip ZIP64 extra field when retagging wheels (<a href="https://redirect.github.com/pypa/wheel/issues/692">#692</a>) (<a href="https://redirect.github.com/pypa/wheel/issues/695">#695</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d"><code>0ca6f24</code></a> feat: add --local-version option to wheel pack (<a href="https://redirect.github.com/pypa/wheel/issues/694">#694</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb"><code>4a63caf</code></a> Preserve compatible metadata versions in convert (<a href="https://redirect.github.com/pypa/wheel/issues/690">#690</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a"><code>33650c6</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pypa/wheel/issues/691">#691</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2"><code>197012d</code></a> Increased the upper bound for flit-core as a build requirement</li> <li>See full diff in <a href="https://github.com/pypa/wheel/compare/0.47.0...0.48.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

…ak/test/generated-code (#5226) Bumps [mypy](https://github.com/python/mypy) from 2.3.0 to 2.3.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's changelog</a>.</em></p> <blockquote> <h3>Mypy 2.3.1</h3> <ul> <li>Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR <a href="https://redirect.github.com/python/mypy/pull/21826">21826</a>)</li> <li>Fix mypyc <code>default_factory</code> for inherited dataclass (Daniël van Noord, PR <a href="https://redirect.github.com/python/mypy/pull/21785">21785</a>)</li> <li>Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21734">21734</a>)</li> <li>Fix crash when unpacking return value from overload (Shantanu, PR <a href="https://redirect.github.com/python/mypy/pull/21830">21830</a>)</li> </ul> <h3>Acknowledgements</h3> <p>Thanks to all mypy contributors who contributed to this release:</p> <ul> <li>Agriya Khetarpal</li> <li>Ethan Sarp</li> <li>Ivan Levkivskyi</li> <li>Jingchen Ye</li> <li>Jukka Lehtosalo</li> <li>Piotr Sawicki</li> <li>Shantanu</li> <li>Tom Bannink</li> <li>Viktor Szépe</li> <li>ygale</li> </ul> <p>I'd also like to thank my employer, Dropbox, for supporting mypy development.</p> <h2>Mypy 2.2</h2> <p>We've just uploaded mypy 2.2.0 to the Python Package Index (<a href="https://pypi.org/project/mypy/">PyPI</a>). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:</p> <pre><code>python3 -m pip install -U mypy </code></pre> <p>You can read the full documentation for this release on <a href="http://mypy.readthedocs.io">Read the Docs</a>.</p> <h3>Support for Closed TypedDicts (PEP 728)</h3> <p>Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.</p> <p>You can use the <code>closed</code> keyword argument with <code>TypedDict</code>:</p> <pre lang="python"><code>HasName = TypedDict("HasName", {"name": str}) HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True) Movie = TypedDict("Movie", {"name": str, "year": int}) <p>movie: Movie = {"name": "Nimona", "year": 2023} has_name: HasName = movie # OK: HasName is open (default) has_only_name: HasOnlyName = movie # Error: HasOnlyName is closed and Movie has extra "year" key </tr></table> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python/mypy/commit/d642c4478e9e3acbe9233edbe17ffc569a1a778c"><code>d642c44</code></a> Bump version to 2.3.1</li> <li><a href="https://github.com/python/mypy/commit/a39242983d3c2cb85886a1eb6d5869180672784c"><code>a392429</code></a> [mypyc] Fix crash on double yielding Iterators (<a href="https://redirect.github.com/python/mypy/issues/21826">#21826</a>)</li> <li><a href="https://github.com/python/mypy/commit/4843e7773e7dc8fe3f1fd1319277d6d11cd6cdb3"><code>4843e77</code></a> [mypyc] Fix <code>default_factory</code> for inherited dataclass (<a href="https://redirect.github.com/python/mypy/issues/21785">#21785</a>)</li> <li><a href="https://github.com/python/mypy/commit/14f5df93ed8d1be4f4cc9c447eb2e6e619362e05"><code>14f5df9</code></a> [mypyc] Clear coroutine env on coroutine completion (<a href="https://redirect.github.com/python/mypy/issues/21734">#21734</a>)</li> <li><a href="https://github.com/python/mypy/commit/6dfa06dda6e34912279e498d35a43ba6dc30bfee"><code>6dfa06d</code></a> Fix crash when unpacking return value from overload (<a href="https://redirect.github.com/python/mypy/issues/21830">#21830</a>)</li> <li><a href="https://github.com/python/mypy/commit/a3857467da126d28b55724e8bb682019df9a503e"><code>a385746</code></a> Bump version to 2.3.1+dev</li> <li>See full diff in <a href="https://github.com/python/mypy/compare/v2.3.0...v2.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mypy&package-manager=pip&previous-version=2.3.0&new-version=2.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

Ran npm-check-updates and yarn up to keep the `yarn.lock` file up-to-date.

#5228) Bumps the go-deps group with 1 update in the /packages/@jsii/go-runtime-test/project directory: [github.com/stretchr/testify](https://github.com/stretchr/testify). Bumps the go-deps group with 1 update in the /packages/@jsii/go-runtime/jsii-runtime-go directory: [github.com/stretchr/testify](https://github.com/stretchr/testify). Updates `github.com/stretchr/testify` from 1.12.0 to 1.12.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/stretchr/testify/releases">github.com/stretchr/testify's releases</a>.</em></p> <blockquote> <h2>v1.12.1</h2> <p>This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.</p> <h2>What's Changed</h2> <ul> <li>Change yaml library to <code>go.yaml.in/yaml/v3</code> by <a href="https://github.com/harryzcy"><code>@harryzcy</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1935">stretchr/testify#1935</a></li> <li>change yaml library to go.yaml.in/yaml/v3 by <a href="https://github.com/boekkooi-impossiblecloud"><code>@boekkooi-impossiblecloud</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1772">stretchr/testify#1772</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/harryzcy"><code>@harryzcy</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1935">stretchr/testify#1935</a></li> <li><a href="https://github.com/boekkooi-impossiblecloud"><code>@boekkooi-impossiblecloud</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1772">stretchr/testify#1772</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1">https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1</a></p> <h2>What's Changed</h2> <ul> <li>Change yaml library to <code>go.yaml.in/yaml/v3</code> by <a href="https://github.com/harryzcy"><code>@harryzcy</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1935">stretchr/testify#1935</a></li> <li>change yaml library to go.yaml.in/yaml/v3 by <a href="https://github.com/boekkooi-impossiblecloud"><code>@boekkooi-impossiblecloud</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1772">stretchr/testify#1772</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/harryzcy"><code>@harryzcy</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1935">stretchr/testify#1935</a></li> <li><a href="https://github.com/boekkooi-impossiblecloud"><code>@boekkooi-impossiblecloud</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1772">stretchr/testify#1772</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1">https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/stretchr/testify/commit/959dbdacf1533e155162811ea90c90117a420463"><code>959dbda</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1935">#1935</a> from harryzcy/yaml-update</li> <li><a href="https://github.com/stretchr/testify/commit/9bb71766fa91ef21b587c3ecb8b1d00508476c62"><code>9bb7176</code></a> Update go.yaml.in/yaml/v3 to v3.0.5</li> <li><a href="https://github.com/stretchr/testify/commit/0358d0ee9e03a8754c40b22318d7edc33553edba"><code>0358d0e</code></a> change yaml library to go.yaml.in/yaml/v3</li> <li>See full diff in <a href="https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1">compare view</a></li> </ul> </details> <br /> Updates `github.com/stretchr/testify` from 1.12.0 to 1.12.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/stretchr/testify/releases">github.com/stretchr/testify's releases</a>.</em></p> <blockquote> <h2>v1.12.1</h2> <p>This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.</p> <h2>What's Changed</h2> <ul> <li>Change yaml library to <code>go.yaml.in/yaml/v3</code> by <a href="https://github.com/harryzcy"><code>@harryzcy</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1935">stretchr/testify#1935</a></li> <li>change yaml library to go.yaml.in/yaml/v3 by <a href="https://github.com/boekkooi-impossiblecloud"><code>@boekkooi-impossiblecloud</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1772">stretchr/testify#1772</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/harryzcy"><code>@harryzcy</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1935">stretchr/testify#1935</a></li> <li><a href="https://github.com/boekkooi-impossiblecloud"><code>@boekkooi-impossiblecloud</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1772">stretchr/testify#1772</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1">https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1</a></p> <h2>What's Changed</h2> <ul> <li>Change yaml library to <code>go.yaml.in/yaml/v3</code> by <a href="https://github.com/harryzcy"><code>@harryzcy</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1935">stretchr/testify#1935</a></li> <li>change yaml library to go.yaml.in/yaml/v3 by <a href="https://github.com/boekkooi-impossiblecloud"><code>@boekkooi-impossiblecloud</code></a> in <a href="https://redirect.github.com/stretchr/testify/pull/1772">stretchr/testify#1772</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/harryzcy"><code>@harryzcy</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1935">stretchr/testify#1935</a></li> <li><a href="https://github.com/boekkooi-impossiblecloud"><code>@boekkooi-impossiblecloud</code></a> made their first contribution in <a href="https://redirect.github.com/stretchr/testify/pull/1772">stretchr/testify#1772</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1">https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/stretchr/testify/commit/959dbdacf1533e155162811ea90c90117a420463"><code>959dbda</code></a> Merge pull request <a href="https://redirect.github.com/stretchr/testify/issues/1935">#1935</a> from harryzcy/yaml-update</li> <li><a href="https://github.com/stretchr/testify/commit/9bb71766fa91ef21b587c3ecb8b1d00508476c62"><code>9bb7176</code></a> Update go.yaml.in/yaml/v3 to v3.0.5</li> <li><a href="https://github.com/stretchr/testify/commit/0358d0ee9e03a8754c40b22318d7edc33553edba"><code>0358d0e</code></a> change yaml library to go.yaml.in/yaml/v3</li> <li>See full diff in <a href="https://github.com/stretchr/testify/compare/v1.12.0...v1.12.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details>

We shouldn't need them for the purposes of assembly diffs. --- By submitting this pull request, I confirm that my contribution is made under the terms of the [Apache 2.0 license]. [Apache 2.0 license]: https://www.apache.org/licenses/LICENSE-2.0

…runtime (#5230) Bumps [mypy](https://github.com/python/mypy) from 2.3.0 to 2.3.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's changelog</a>.</em></p> <blockquote> <h3>Mypy 2.3.1</h3> <ul> <li>Fix mypyc crash on double yielding Iterators (Daniël van Noord, PR <a href="https://redirect.github.com/python/mypy/pull/21826">21826</a>)</li> <li>Fix mypyc <code>default_factory</code> for inherited dataclass (Daniël van Noord, PR <a href="https://redirect.github.com/python/mypy/pull/21785">21785</a>)</li> <li>Clear mypyc coroutine env on coroutine completion (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21734">21734</a>)</li> <li>Fix crash when unpacking return value from overload (Shantanu, PR <a href="https://redirect.github.com/python/mypy/pull/21830">21830</a>)</li> </ul> <h3>Acknowledgements</h3> <p>Thanks to all mypy contributors who contributed to this release:</p> <ul> <li>Agriya Khetarpal</li> <li>Ethan Sarp</li> <li>Ivan Levkivskyi</li> <li>Jingchen Ye</li> <li>Jukka Lehtosalo</li> <li>Piotr Sawicki</li> <li>Shantanu</li> <li>Tom Bannink</li> <li>Viktor Szépe</li> <li>ygale</li> </ul> <p>I'd also like to thank my employer, Dropbox, for supporting mypy development.</p> <h2>Mypy 2.2</h2> <p>We've just uploaded mypy 2.2.0 to the Python Package Index (<a href="https://pypi.org/project/mypy/">PyPI</a>). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:</p> <pre><code>python3 -m pip install -U mypy </code></pre> <p>You can read the full documentation for this release on <a href="http://mypy.readthedocs.io">Read the Docs</a>.</p> <h3>Support for Closed TypedDicts (PEP 728)</h3> <p>Mypy now supports closed TypedDicts as specified in PEP 728. A closed TypedDict cannot have extra keys beyond those explicitly defined. This allows the type checker to determine that certain operations are safe when they otherwise wouldn't be due to the potential presence of unknown keys.</p> <p>You can use the <code>closed</code> keyword argument with <code>TypedDict</code>:</p> <pre lang="python"><code>HasName = TypedDict("HasName", {"name": str}) HasOnlyName = TypedDict("HasOnlyName", {"name": str}, closed=True) Movie = TypedDict("Movie", {"name": str, "year": int}) <p>movie: Movie = {"name": "Nimona", "year": 2023} has_name: HasName = movie # OK: HasName is open (default) has_only_name: HasOnlyName = movie # Error: HasOnlyName is closed and Movie has extra "year" key </tr></table> </code></pre></p> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python/mypy/commit/d642c4478e9e3acbe9233edbe17ffc569a1a778c"><code>d642c44</code></a> Bump version to 2.3.1</li> <li><a href="https://github.com/python/mypy/commit/a39242983d3c2cb85886a1eb6d5869180672784c"><code>a392429</code></a> [mypyc] Fix crash on double yielding Iterators (<a href="https://redirect.github.com/python/mypy/issues/21826">#21826</a>)</li> <li><a href="https://github.com/python/mypy/commit/4843e7773e7dc8fe3f1fd1319277d6d11cd6cdb3"><code>4843e77</code></a> [mypyc] Fix <code>default_factory</code> for inherited dataclass (<a href="https://redirect.github.com/python/mypy/issues/21785">#21785</a>)</li> <li><a href="https://github.com/python/mypy/commit/14f5df93ed8d1be4f4cc9c447eb2e6e619362e05"><code>14f5df9</code></a> [mypyc] Clear coroutine env on coroutine completion (<a href="https://redirect.github.com/python/mypy/issues/21734">#21734</a>)</li> <li><a href="https://github.com/python/mypy/commit/6dfa06dda6e34912279e498d35a43ba6dc30bfee"><code>6dfa06d</code></a> Fix crash when unpacking return value from overload (<a href="https://redirect.github.com/python/mypy/issues/21830">#21830</a>)</li> <li><a href="https://github.com/python/mypy/commit/a3857467da126d28b55724e8bb682019df9a503e"><code>a385746</code></a> Bump version to 2.3.1+dev</li> <li>See full diff in <a href="https://github.com/python/mypy/compare/v2.3.0...v2.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mypy&package-manager=pip&previous-version=2.3.0&new-version=2.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

mergify · 2026-08-24T18:11:55Z

Thank you for contributing! ❤️ I will now look into making sure the PR is up-to-date, then proceed to try and merge it!

mergify · 2026-08-24T18:12:07Z

Queued — the merge queue status continues in this comment ↓.

mergify · 2026-08-24T18:14:51Z

Merging (no-squash)...

mergify · 2026-08-24T18:15:06Z

mergify Bot and others added 26 commits July 18, 2026 18:55

chore(merge-back): 1.139.0 (#5208)

d7ad509

See [CHANGELOG](https://github.com/aws/jsii/blob/merge-back/1.139.0/CHANGELOG.md)

chore: npm-check-updates && yarn up (#5191)

8c82ad5

Ran npm-check-updates and yarn up to keep the `yarn.lock` file up-to-date.

chore: npm-check-updates && yarn up (#5220)

51a1e66

Ran npm-check-updates and yarn up to keep the `yarn.lock` file up-to-date.

chore: npm-check-updates && yarn up (#5223)

b241823

Ran npm-check-updates and yarn up to keep the `yarn.lock` file up-to-date.

chore: npm-check-updates && yarn up (#5227)

8481d38

Ran npm-check-updates and yarn up to keep the `yarn.lock` file up-to-date.

chore(release): 1.140.0

c2db18f

aws-cdk-automation added the pr/no-squash This PR should be merged instead of squash-merging it label Aug 24, 2026

iankhou approved these changes Aug 24, 2026

View reviewed changes

iankhou enabled auto-merge August 24, 2026 17:54

iankhou disabled auto-merge August 24, 2026 18:09

iankhou enabled auto-merge August 24, 2026 18:09

mergify Bot added the pr/ready-to-merge This PR is ready to be merged. label Aug 24, 2026

mergify Bot added the queued label Aug 24, 2026

mergify Bot merged commit 79fd58c into release Aug 24, 2026
39 checks passed

mergify Bot deleted the bump/1.140.0 branch August 24, 2026 18:15

mergify Bot removed pr/ready-to-merge This PR is ready to be merged. queued labels Aug 24, 2026

Navigation Menu

Uh oh!

chore(release): 1.140.0 - #5231

chore(release): 1.140.0#5231
mergify[bot] merged 26 commits into
releasefrom
bump/1.140.0

aws-cdk-automation commented Aug 24, 2026 •

edited

Loading

Uh oh!

mergify Bot commented Aug 24, 2026

Uh oh!

mergify Bot commented Aug 24, 2026 •

edited

Loading

Uh oh!

mergify Bot commented Aug 24, 2026

Uh oh!

mergify Bot commented Aug 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

aws-cdk-automation commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mergify Bot commented Aug 24, 2026

Uh oh!

mergify Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mergify Bot commented Aug 24, 2026

Uh oh!

mergify Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

aws-cdk-automation commented Aug 24, 2026 •

edited

Loading

mergify Bot commented Aug 24, 2026 •

edited

Loading

mergify Bot commented Aug 24, 2026 •

edited

Loading