chore(deps): bump the maintenance group with 17 updates

[dependabot]

Bumps the maintenance group with 17 updates:

Package	From	To
asgiref	3.11.1	3.12.1
certifi	2026.6.17	2026.7.22
cffi	2.0.0	2.1.0
charset-normalizer	3.4.7	3.4.9
django	6.0.6	6.0.7
grpcio	1.81.1	1.83.0
keystoneauth1	5.14.0	5.15.0
oslo-config	10.5.0	10.6.0
oslo-i18n	6.8.0	6.9.0
oslo-serialization	5.10.0	5.11.0
stevedore	5.8.0	5.9.0
typing-extensions	4.15.0	4.16.0
setuptools	82.0.1	83.0.0
ruff	0.15.20	0.16.0
coverage	7.14.3	7.15.2
pip-tools	7.5.3	7.6.0
pytz	2026.2	2026.3.post1

Updates asgiref from 3.11.1 to 3.12.1

Changelog

Sourced from asgiref's changelog.

3.12.1 (2026-07-14)

• Restored the previous SyncToAsync.call internal code shape, which was relied on by some APM services. (#572)

  Note, this change was available whilst maintaining the underlying fix (from #564). It does not constitute an API stability promise. Ideally APMs are not monkey patching internal APIs, and future changes will be made here if needed.

3.12.0 (2026-07-14)

• AsyncToSync no longer captures the running event loop on instantiation. (#562)

  This resolves a series of deadlocks that users experienced after asgiref 3.9.0, particularly with pytest-asyncio. pytest-asyncio stops the event loop between tests, and long-running unawaited futures could find themselves trying to schedule work onto a stopped loop, and so would never complete. Ideally, code should be structured to await long-running futures before returning, but this change should help users experiencing issues here.

  The loop is now resolved when the callable is invoked rather than when it is created. If async_to_sync is called from within sync_to_async, the parent event loop is still used, as before.

  The possibility of deadlock therefore remains in some nested patterns. For example, an async function may call a long-running sync_to_async function that itself uses async_to_sync; if the outer function returns before the sync future completes, the parent event loop may already be stopped, and the nested calls cannot be driven to completion.

  This is not a bug in asgiref — the same patterns deadlock in plain asyncio. As above, restructure your code to await the sync_to_async future before exiting the driving coroutine.

• Fixed an event loop deadlock when exiting ThreadSensitiveContext while its executor thread was still blocked waiting on the event loop. (#535)

• Dropped support for EOL Python 3.9.

• Fixed StatelessServer.run() failing on Python 3.14, where asyncio.get_event_loop() no longer creates an event loop if none exists. It now uses asyncio.run(). (#559)

• Fixed Local leaking data between unrelated sync threads when sys.flags.thread_inherit_context is enabled (Python 3.14+), so a newly

... (truncated)

Commits

• ef9d4b8 Releasing 3.12.1
• 34fba63 Restore previous SyncToAsync.call internal code shape.
• a43900c Separate mypy from tests extra.
• 1b7c338 Releasing 3.12.0
• 157d9d4 Renovate precommit (#552)
• deda0d4 Test free-threading builds and fix Local data leak for thread_inherit_context...
• a54250a Don’t capture the event loop in AsyncToSync.__init__ (#562)
• 836356a Use asyncio.run in StatelessServer.run (#561)
• e04afd5 Dropped support for Python 3.9. (#543)
• 95d2430 Fixed #535: ThreadSensitiveContext.aexit blocking the event loop. (#563)
• Additional commits viewable in compare view

Updates certifi from 2026.6.17 to 2026.7.22

Commits

• f4bc676 2026.07.22 (#428)
• 4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427)
• 01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426)
• eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425)
• 474e6fc Include tests in the source distribution (#424)
• a31ef39 Bump actions/setup-python from 6.2.0 to 6.3.0 (#420)
• 98eb2c7 Bump actions/checkout from 6.0.3 to 7.0.0 (#419)
• See full diff in compare view

Updates cffi from 2.0.0 to 2.1.0

Release notes

Sourced from cffi's releases.

v2.1.0

• Added support for Python 3.15 and support for C extensions generated by CFFI to target the new abi3t free-threaded ABI.
• Dropped support for Python 3.9.
• Added cffi-gen-src CLI to generate CFFI C extension source for alternate build backend support.
• Fixed crashes inside __delitem__.
• Fixed "string too big" error under MSVC.
• Fixed mingw builds.
• Added support for arm64 iOS wheels.

Commits

• d9f6f70 New release 2.1.0
• 02a7b0e Misc pre-2.1 release/packaging cleanup (#253)
• 1362e5d Move cffi-gen-src release note to 2.1.0 notes
• a797055 Make error message when embedding version test fails more friendly
• f1f40a8 Update changelog
• dc62c93 Delete missed cp39 Windows builds
• a341180 Update version numbers to prepare for v2.1 release
• 9f04d85 Mark test using inet_ntoa as thread-unsafe
• 5f12702 Fix flaky pytest-run-parallel CI crash
• 26b3d3a Merge branch 'main' into integrate-buildtool
• Additional commits viewable in compare view

Updates charset-normalizer from 3.4.7 to 3.4.9

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

• Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

Version 3.4.8

3.4.8 (2026-07-06)

Fixed

• Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
• Unnecessary json import at runtime (#753)
• Inverse capitalization not seen by noise detector (#731)

Changed

• No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.
• Micro-optimizations in our noise / coherence measurements.
• No longer using regex search by default for our preemptive charset mark algorithm.
• Raised upperbound of setuptools to v83.
• Raised upperbound of mypy(c) to v2.1.

Removed

• Redundant UTF7 BOM marker (#730)

Changelog

Sourced from charset-normalizer's changelog.

3.4.9 (2026-07-07)

Fixed

• Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

3.4.8 (2026-07-06)

Fixed

• Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
• Unnecessary json import at runtime (#753)
• Inverse capitalization not seen by noise detector (#731)

Changed

• No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.
• Micro-optimizations in our noise / coherence measurements.
• No longer using regex search by default for our preemptive charset mark algorithm.
• Raised upperbound of setuptools to v83.
• Raised upperbound of mypy(c) to v2.1.

Removed

• Redundant UTF7 BOM marker (#730)

Commits

• cc68407 Merge pull request #772 from jawah/fix-regression-fallback-path
• 152b923 chore: release 3.4.9
• 2bc2607 fix: unicodedecodeerror in fallback path
• be252d7 chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#767)
• 71c7bdd chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#768)
• aeea391 chore(deps): bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#758)
• a6f8feb Merge pull request #770 from jawah/unblock-ci
• 528e16c chore: add osv-scanner.toml
• 5993498 chore: ast_serialize musl missing prebuilt riscv,s390x,ppc64le
• aa2ddd8 Release 3.4.8 (#766)
• Additional commits viewable in compare view

Updates django from 6.0.6 to 6.0.7

Commits

• e2a4246 [6.0.x] Bumped version for 6.0.7 release.
• a5de13f [6.0.x] Fixed CVE-2026-53878 -- Prevented newlines from being accepted in Dom...
• 38dfbd2 [6.0.x] Fixed CVE-2026-53877 -- Prevented heap buffer over-read when creating...
• 64f9a2b [6.0.x] Fixed CVE-2026-48588 -- Prevented caching of responses that set cooki...
• c26957a [6.0.x] Fixed flatpages synopsis in docs.
• 0b60f44 [6.0.x] Added FILE_UPLOAD_DIRECTORY_PERMISSIONS to docs settings index.
• d928e30 [6.0.x] Fixed #37172 -- Linked to upload handlers section in FILE_UPLOAD_* se...
• e18935c [6.0.x] Fixed #37158 -- Reordered the contribution checklist sections.
• 490eb9c [6.0.x] Fixed document referenced in multiple toctrees warning in docs/intern...
• 748a9b5 [6.0.x] Fixed duplicate target name in docs/internals/howto-release-django.txt.
• Additional commits viewable in compare view

Updates grpcio from 1.81.1 to 1.83.0

Release notes

Sourced from grpcio's releases.

Release v1.83.0

This is release 1.83.0 (garden) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [Security] Default to Post-Quantum Cryptography in TLS key exchange. (#42560)
• [authz] don't pass RBAC policy by value when constructing authorization engine. (#42636)

C#

• Migrate CSharp Grpc.Tools to new DotNet Version. (#42661)
• [C#] Tools - Build: Fix protoc SIGSEGV on ARM64 by aligning max-page-size and migrating to manylinux_2_28. (#42590)

Python

• [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower bound to allow 6.x. (#43001)
• [Python] Add abort_with_status to the aio ServicerContext ABC. (#42733)
• [Python] Update lower bound for protobuf from 6.33.5 to 7.35.1. (#42914)
• [Python] Pyright typeCheckingMode - standard. (#42739)
• [Python] Support Python 3.15 - Upgrade bazel dep rules_python to 2.0.2. (#42637)
• [Python] Hide internal symbols from Python's cygrpc shared object. (#42325)
• [Python] Handle custom Interceptor exceptions in InterceptedCall APIs . (#42593)

Release v1.82.1

This is release gRPC Core 1.82.1 (glacier).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

What's Changed

Python

• [Backport][v1.82.x][Python] Update lower bound for protobuf from 6.33.5 to 7.35.1 by @​asheshvidyut in grpc/grpc#42920

Full Changelog: grpc/grpc@v1.82.0...v1.82.1

Release v1.82.0

This is release gRPC Core 1.82.0 (glacier).

... (truncated)

Commits

• c876f4d [Release] Bump version to 1.83.0 (on v1.83.x branch) (#43036)
• b5c40cd [Backport][v1.83.x][Python] grpc-status: Relax protobuf dependency lower boun...
• 9c223f1 [Release] Bump version to 1.83.0-pre1 (on v1.83.x branch) (#42936)
• b215f80 [Release] Bump core version to 56.0.0 for upcoming release (#42934)
• cf95af0 [Python] Add abort_with_status to the aio ServicerContext ABC (#42733)
• 725c173 Automated rollback of commit 8848182a65239ce4a7a26650c82aee3ec7ed1eee.
• 821431b [PH2] Induced Frames and Reset Frames for PH2
• 6d0b58e disable metadata_publish_to_app_tag experiment
• 41d533a Implement Weighted Random Shuffling and CDS Weight Normalization for pick_fir...
• 8848182 [xDS] split up the grpc_xds_client BUILD target (#42872)
• Additional commits viewable in compare view

Updates keystoneauth1 from 5.14.0 to 5.15.0

Updates oslo-config from 10.5.0 to 10.6.0

Updates oslo-i18n from 6.8.0 to 6.9.0

Updates oslo-serialization from 5.10.0 to 5.11.0

Updates stevedore from 5.8.0 to 5.9.0

Updates typing-extensions from 4.15.0 to 4.16.0

Release notes

Sourced from typing-extensions's releases.

4.16.0

No changes since 4.16.0rc2.

Changes since 4.15.0:

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
• Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
• Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
• Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
• Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
• Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
• Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
• Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
• Add support for pickling sentinels.
• Sentinels now preserve their identity when copied or deep-copied.
• Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
• The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
• Deprecate arbitrary attribute assignments to sentinels.
• Deprecate subclassing sentinels.
• Add support for Python 3.15.
• Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

4.16.0rc2

Changes since 4.16.0rc1:

• Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

Changes since 4.15.0:

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
• Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
• Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
• Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
• Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
• Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
• Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
• Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
• Add support for pickling sentinels.
• Sentinels now preserve their identity when copied or deep-copied.
• Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
• The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
• Deprecate arbitrary attribute assignments to sentinels.
• Deprecate subclassing sentinels.
• Add support for Python 3.15.

4.16.0rc1

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.

... (truncated)

Changelog

Sourced from typing-extensions's changelog.

Release 4.16.0 (July 2, 2025)

No user-facing changes since 4.16.0rc2.

Release 4.16.0rc2 (June 25, 2026)

• Avoid a DeprecationWarning when deprecated is applied to a coroutine function on Python 3.14.0.

Release 4.16.0rc1 (June 24, 2026)

• Make typing_extensions.TypeAliasType's __module__ attribute writable. Backport of CPython PR #149172.
• Fix setting of __required_keys__ and __optional_keys__ when inheriting keys with the same name.
• Add support for AsyncIterator, io.Reader, io.Writer and os.PathLike protocols as bases for other protocols.
• Fix incorrect behaviour on Python 3.9 and Python 3.10 that meant that calling isinstance with typing_extensions.Concatenate[...] or typing_extensions.Unpack[...] as the first argument could have a different result in some situations depending on whether or not a profiling function had been set using sys.setprofile. This affected both CPython and PyPy implementations. Patch by Brian Schubert.
• Fix __init_subclass__() behavior in the presence of multiple inheritance involving an @deprecated-decorated base class. Backport of CPython PR #138210 by Brian Schubert.
• Raise TypeError when attempting to subclass typing_extensions.ParamSpec on Python 3.9. The typing implementation has always raised an error, and the typing_extensions implementation has raised an error on Python 3.10+ since typing_extensions v4.6.0. Patch by Brian Schubert.
• Add the bound, covariant, contravariant, and infer_variance parameters to TypeVarTuple.
• Officially support the bound, covariant, contravariant and infer_variance parameters to ParamSpec. Improve the validation of these parameters at runtime.
• Rename typing_extensions.Sentinel to typing_extensions.sentinel, following the name that has been adopted for builtins.sentinel on Python 3.15. typing_extensions.Sentinel is retained as a soft-deprecated alias for backwards compatibility.
• Add support for pickling sentinels.
• Sentinels now preserve their identity when copied or deep-copied.
• Deprecate passing name as a keyword argument or repr as a positional argument to the sentinel constructor.
• The default repr of a sentinel X = sentinel("X") is now X rather than <X>.
• Deprecate arbitrary attribute assignments to sentinels.
• Deprecate subclassing sentinels.
• Add support for Python 3.15.

Commits

• f29cd28 Prepare relase 4.16.0 (#774)
• 4317461 Bump version to 4.16.0rc2.dev (#772)
• 4f71098 Prepare release 4.16.0rc2 (#771)
• 37ed08a Remove use of asyncio.coroutines.iscoroutinefunction() (#769)
• 8dcc559 Improve TypedDict documentation (#770)
• 224f8d5 Post-release followups for 3.16.0rc1 (#767)
• 777de3e Prepare release 4.16.0rc1 (#766)
• 890be90 Type variable tuple variance (#741)
• 0e05458 Pin SQLAlchemy third-party tests to pytest==9.0.3 (#765)
• d277746 docs: add version compatibility table (#733)
• Additional commits viewable in compare view

Updates setuptools from 82.0.1 to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

• Require Python 3.10 or later.

Bugfixes

• MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

• pypa/distutils#334

Commits

• 6519f72 Bump version: 82.0.1 → 83.0.0
• d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
• a2df31e Capture removal of dry_run parameter in changelog.
• 00144dc Moved newsfragment to the release where it occurred.
• a4a5a2b Add news fragment.
• 77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
• 3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
• bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
• a2bc3ac Fix broken intersphinx reference to build's installation docs
• 2d6a739 Use stacked parametrize decorators instead of itertools.product
• Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

  ❯ ruff format --check --output-format github .
  ::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted

  See the CLI help or documentation for the full list of supported formats.

• The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

• Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

• Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.

• Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:

  import math  # ruff: ignore[F401]
  ruff: ignore[F401]
  import os

• Fixes are now shown in check and format --check output:

  ❯ ruff format --check .
  unformatted: File would be reformatted
   --> try.md:1:1
    |
  1 | ```python
    - import   math
  2 + import math
  3 | ```
    |
  1 file would be reformatted

  This example also shows off the Markdown formatting.

• format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

• a2635fd Bump 0.16.0 (#27136)
• 3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
• 2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
• 17ef711 Stabilize --add-ignore (#27125)
• ef912bb Add newly stabilized rules to defaults (#27055)
• b30f040 Stabilize new default rules (#27035)
• bcd70c5 Exclude Markdown files from format-dev runs (#27052)
• 87e51e2 Fix format --check spans for syntax errors (#27045)
• afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
• a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
• Additional commits viewable in compare view

Updates coverage from 7.14.3 to 7.15.2

Release notes

Sourced from coverage's releases.

7.15.2

Version 7.15.2 — 2026-07-15

• Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

7.15.1

Version 7.15.1 — 2026-07-12

• Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare.
• A number of performance improvements thanks to Paul Kehrer, in pull requests 2213, 2214, 2215, 2216, 2218, 2220, and 2221.

➡️  PyPI page: coverage 7.15.1. :arrow_right:  To install: python3 -m pip install coverage==7.15.1

7.15.0

Version 7.15.0 — 2026-07-02

• Since 7.14.0, reporting commands implicitly combine parallel data files. Now those commands have a new option --keep-combined to retain the data files after combining them instead of the default, which is to delete them. Finishes issue 2198.
• Fix: the LCOV report would incorrectly count excluded functions as uncovered, as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen.
• When running your program, coverage now correctly sets yourmodule.__spec__.loader as strongly recommended, avoiding the deprecation warning described in issue 2208. Thanks, A5rocks.
• Fix: with Python 3.10, running with the -I (isolated mode) option didn’t correctly omit the current directory from the module search path, as described in issue 2103. That is now fixed thanks to Ilia Sorokin.

➡️  PyPI page: coverage 7.15.0. :arrow_right:  To install: python3 -m pip install coverage==7.15.0

Changelog

Sourced from coverage's changelog.

Version 7.15.2 — 2026-07-15

• Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

• Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

• A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213 .. _pull 2214: coveragepy/coveragepy#2214 .. _pull 2215: coveragepy/coveragepy#2215 .. _pull 2216: coveragepy/coveragepy#2216 .. _pull 2218: coveragepy/coveragepy#2218 .. _pull 2220: coveragepy/coveragepy#2220 .. _pull 2221: coveragepy/coveragepy#2221 .. _pull 2224: coveragepy/coveragepy#2224

.. _changes_7-15-0:

Version 7.15.0 — 2026-07-02

• Since 7.14.0, reporting commands implicitly combine parallel data files. Now those commands have a new option --keep-combined to retain the data files after combining them instead of the default, which is to delete them. Finishes issue 2198_.

• Fix: the LCOV report would incorrectly count excluded functions as uncovered, as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen <pull 2206_>.

• When running your program, coverage now correctly sets

... (truncated)

Commits

• 50d8659 docs: sample HTML for 7.15.2
• b5eed20 docs: prep for 7.15.2
• 78cab6e fix: reduce memory use during reporting. #2229 (#2231)
• b4c1fda build: bump version to 7.15.2
• da63bed docs: sample HTML for 7.15.1
• bc35e64 docs: prep for 7.15.1
• 182b010 perf: resolve sysmon branch events lazily, one pair at a time (#2221)
• ee271ee perf: compute multiline maps cheaply in the sysmon core (#2220)
• 1441b96 chore: bump the action-dependencies group with 6 updates (#2225)
• dd80635 fix: escape context labels in html report inline script block (#2224)
• Additional commits viewable in compare view

Updates pip-tools from 7.5.3 to 7.6.0

Release notes

Sourced from pip-tools's releases.

v7.6.0

2026-07-13

Features

• The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by @​Dzhud.

  PRs and issues: #1142

• Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by @​miettal.

  PRs and issues: #2288

• pip-tools is now compatible with pip 26.1 -- @​gaborbernat.

  PRs and issues: #2379

Improved documentation

• Fixed the contents sidebar for the index doc -- by @​sirosen.

  PRs and issues: #2169

• pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

  Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

  PRs and issues: #2318

• pip-tools' documentation now features a section titled "Reference" covering the CLI commands and configuration. Configuration documentation has been removed from the readme.

  -- by @​sirosen

Contributor-facing changes

• CI testing now runs on Intel and ARM macOS runners, and is pinned to a specific macOS version -- by @​sirosen.

  PRs and issues: #2079, #2132, #2348

• pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

  Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

  PRs and issues: #2278, #2318

• Started running {pypi}zizmor as a part of CI pipelines to improve security of how we configure GitHub Actions CI/CD -- by @​webknjaz.

  PRs and issues: #2327

• pip-tools docs now support GitHub Flavored Markdown admonition blocks -- by @​webknjaz.

... (truncated)

Changelog

Sourced from pip-tools's changelog.

v7.6.0

2026-07-13

Features

• The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by {user}Dzhud.

  PRs and issues: {issue}1142

• Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by {user}miettal.

  PRs and issues: {issue}2288

• pip-tools is now compatible with pip 26.1 -- {user}gaborbernat.

  PRs and issues: {issue}2379

Improved documentation

• Fixed the contents sidebar for the index doc -- by {user}sirosen.

  PRs and issues: {issue}2169

  ...

  Description has been truncated