Skip to content

Bump the python-dependencies group across 1 directory with 5 updates - #55

Merged
spudone merged 1 commit into
masterfrom
dependabot/uv/python-dependencies-fcce7f9a84
Sep 1, 2026
Merged

Bump the python-dependencies group across 1 directory with 5 updates#55
spudone merged 1 commit into
masterfrom
dependabot/uv/python-dependencies-fcce7f9a84

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 5 updates in the / directory:

Package From To
holidays 0.102 0.103
pyinstaller 6.22.0 6.22.2
uvicorn 0.52.3 0.52.4
yfinance 1.6.0 1.7.0
websockets 17.0.1 17.1

Updates holidays from 0.102 to 0.103

Release notes

Sourced from holidays's releases.

v0.103

Version 0.103

Released August 17, 2026

New Contributors:

Full Changelog: vacanza/holidays@v0.102...v0.103

Changelog

Sourced from holidays's changelog.

Version 0.103

Released August 17, 2026

Commits

Updates pyinstaller from 6.22.0 to 6.22.2

Release notes

Sourced from pyinstaller's releases.

v6.22.2

Please see the v6.22.2 section of the changelog for a list of the changes since v6.22.1.

v6.22.1

Please see the v6.22.1 section of the changelog for a list of the changes since v6.22.0.

Changelog

Sourced from pyinstaller's changelog.

6.22.2 (2026-08-17)

Bugfix


* (Windows) Fix spurious security validation error when a ``onefile``
  executable is launched from a symlinked directory or a junction.
  (:issue:`9508`)

6.22.1 (2026-08-15)


Bugfix

  • Fix invalid spec file generation when :option:--hide-console option is given (regression introduced in v6.22.0). (:issue:9503)
  • (NetBSD) Fix binary dependency analysis. (:issue:9505)
  • (NetBSD) Fix/improve NetBSD support: add the is_netbsd platform flag, treat NetBSD as a Unix platform, and search /usr/local/lib for shared libraries, as is already done for FreeBSD and OpenBSD. (:issue:9496)
  • (OpenBSD) Fix binary dependency analysis. (:issue:9505)

Incompatible Changes


* (POSIX) Executables built in ``onedir`` mode with ``setuid`` bit set
  now validate the owner and permissions on their contents directory
  (typically the ``_internal`` directory); the owner ID must match the
  effective user ID under which the process is running, and the
  permissions on the directory need to be `0700`. This aims to prevent
  unprivileged users from modifying contents of an application that
  runs in privileged mode. (:issue:`9492`)
* (POSIX) When running as a ``onefile`` child process (on POSIX platforms
  other than OpenBSD and AIX), the bootloader now attempts to verify
  the parent process executable via ``procfs`` lookup. This check is
  mandatory for ``onefile`` executables with ``setuid`` bit set; if the
  relevant ``procfs`` entry is inaccessible (for example, due to ``procfs``
  not being mounted, as is the case on FreeBSD by default, or due to access
  being blocked by local security policy), the process will exit with
  security validation error message. For regular ``onefile`` executables
  (without ``setuid`` bit set), the parent-process check is enforced when the
  relevant ``procfs`` entry is accessible, and skipped when it happens to be
  inaccessible. (:issue:`9492`)
* (POSIX) When running as a ``onefile`` child process and the executable
  has ``setuid`` bit set, the bootloader now validates the owner and
  permissions on the (inherited) temporary directory. The owner ID of the
</tr></table>

... (truncated)

Commits
  • 19f42e7 Release v6.22.2. [skip ci]
  • 72bbdb4 bootloader: Windows: use QueryFullProcessImageNameW for executable resolution
  • 0d6941c tests: add test to ensure security validation works with symlinked executables
  • 6e00368 Tests: Requirements: Scheduled weekly dependency update for week 33 (#9506)
  • 22ea0f2 Release v6.22.1. [skip ci]
  • e709c04 bootloader: relax parent-process validation requirements on POSIX platforms
  • e0388d3 bootloader: relax parent-process validation requirements on FreeBSD
  • 92afdf8 tests: test_application_home_directory_hijack: handle 8.3 short paths
  • 4b509a2 tests: improve logging in test_application_home_directory_hijack
  • 66b0249 doc: document the new security validation and its implications
  • Additional commits viewable in compare view

Updates uvicorn from 0.52.3 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
Commits

Updates yfinance from 1.6.0 to 1.7.0

Release notes

Sourced from yfinance's releases.

1.7.0

Main change:

  • history_metadata now lazy-loads tradingPeriods

Fixes for:

  • proxy
  • stock-split price-repair

Full changelog #2959

Thanks @​amosli

Changelog

Sourced from yfinance's changelog.

1.7.0

Features / improvements:

  • Make history_metadata lazy-load 'tradingPeriods' #2922 Fixes
  • Improve robustness of YfData when behind a SOCKS5 proxy #2953 Price repair:
  • Fix bug in volume-validation of stock-split-repair #2958
Commits
  • 3d9d2f0 Version 1.7.0
  • 43f3021 Merge pull request #2959 from ranaroussi/dev
  • 686a031 Minor test fix
  • fdede94 Merge pull request #2953 from amosli/fix/cookie-crumb-proxy-resilience
  • 5c1f64e Fixes for PR #2958
  • c732994 Merge pull request #2958 from ranaroussi/fix/price-repair-split-volume-valida...
  • ba7b650 Fix proxy wipe and make cookie/crumb failures non-fatal
  • 0f29c85 Fix bug in volume-validation of stock-split-repair, that was wrongly blocking...
  • baeca64 Merge pull request #2918 from dokson/fix/drop-nospam-extra
  • 5261b4d Drop unusable nospam extra and py2 cruft
  • Additional commits viewable in compare view

Updates websockets from 17.0.1 to 17.1

Release notes

Sourced from websockets's releases.

17.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits
  • e87ea9b Release version 17.1.
  • caf68ab Minor whitespace normalization.
  • f4c73b7 Accept pathlib.Path objects in path arguments.
  • b1e4a14 Clarify when the new asyncio implementation became the default.
  • c7cc7ed Move process_exception to the Sans-I/O layer.
  • 2543503 Support reconnecting in the threading implementation.
  • 1c8fb09 Follow redirects in the sync implementation.
  • 1f7f0e5 Deprecate calling connect() directly.
  • c06d5c5 Support overriding host/post in the sync client.
  • 885e69b Add tests for connecting without a context manager.
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python-dependencies group across 1 directory with 5 updates
82160f2 
Bumps the python-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [holidays](https://github.com/vacanza/holidays) | `0.102` | `0.103` |
| [pyinstaller](https://github.com/pyinstaller/pyinstaller) | `6.22.0` | `6.22.2` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.3` | `0.52.4` |
| [yfinance](https://github.com/ranaroussi/yfinance) | `1.6.0` | `1.7.0` |
| [websockets](https://github.com/python-websockets/websockets) | `17.0.1` | `17.1` |



Updates `holidays` from 0.102 to 0.103
- [Release notes](https://github.com/vacanza/holidays/releases)
- [Changelog](https://github.com/vacanza/holidays/blob/dev/CHANGES.md)
- [Commits](vacanza/holidays@v0.102...v0.103)

Updates `pyinstaller` from 6.22.0 to 6.22.2
- [Release notes](https://github.com/pyinstaller/pyinstaller/releases)
- [Changelog](https://github.com/pyinstaller/pyinstaller/blob/develop/doc/CHANGES.rst)
- [Commits](pyinstaller/pyinstaller@v6.22.0...v6.22.2)

Updates `uvicorn` from 0.52.3 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.3...0.52.4)

Updates `yfinance` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/ranaroussi/yfinance/releases)
- [Changelog](https://github.com/ranaroussi/yfinance/blob/main/CHANGELOG.rst)
- [Commits](ranaroussi/yfinance@1.6.0...1.7.0)

Updates `websockets` from 17.0.1 to 17.1
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@17.0.1...17.1)

---
updated-dependencies:
- dependency-name: holidays
  dependency-version: '0.103'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: pyinstaller
  dependency-version: 6.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: uvicorn
  dependency-version: 0.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: yfinance
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: websockets
  dependency-version: '17.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 31, 2026
@spudone
spudone merged commit 4830817 into master Sep 1, 2026
1 check passed
@dependabot
dependabot Bot deleted the dependabot/uv/python-dependencies-fcce7f9a84 branch September 1, 2026 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@spudone