chore(deps): update python dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
anyio (changelog)	==4.9.0 -> ==4.11.0
argcomplete (changelog)	==3.6.2 -> ==3.6.3
astroid	==3.3.10 -> ==3.3.11
backrefs	==5.8 -> ==5.9
bandit (source, changelog)	==1.8.3 -> ==1.8.6
black (changelog)	==25.1.0 -> ==25.11.0
boto3	==1.38.36 -> ==1.40.74
boto3	==1.38.41 -> ==1.40.74
botocore	==1.38.36 -> ==1.40.74
botocore	==1.38.41 -> ==1.40.74
bracex	==2.5.post1 -> ==2.6
build (changelog)	==1.2.2.post1 -> ==1.3.0
bump-my-version	==1.1.2 -> ==1.2.4
certifi	==2025.6.15 -> ==2025.11.12
charset-normalizer (changelog)	==3.4.2 -> ==3.4.4
click (changelog)	==8.2.1 -> ==8.3.1
commitizen (changelog)	==4.8.3 -> ==4.10.0
contourpy (changelog)	==1.3.2 -> ==1.3.3
coverage	==7.9.1 -> ==7.11.3
distlib	==0.3.9 -> ==0.4.0
docutils (changelog)	==0.21.2 -> ==0.22.3
filelock	==3.18.0 -> ==3.20.0
flake8 (changelog)	==7.2.0 -> ==7.3.0
fonttools	==4.58.3 -> ==4.60.1
fonttools	==4.58.4 -> ==4.60.1
identify	==2.6.12 -> ==2.6.15
idna (changelog)	==3.10 -> ==3.11
iniconfig	==2.1.0 -> ==2.3.0
isort (changelog)	==6.0.1 -> ==6.1.0
jaraco-functools	==4.2.1 -> ==4.3.0
keyring	==25.6.0 -> ==25.7.0
kiwisolver (changelog)	==1.4.8 -> ==1.4.9
mando	==0.7.1 -> ==0.8.2
markdown (changelog)	==3.8.2 -> ==3.10
markupsafe (changelog)	==3.0.2 -> ==3.0.3
matplotlib	==3.10.3 -> ==3.10.7
mkdocs-material (changelog)	==9.6.14 -> ==9.7.0
more-itertools	==10.7.0 -> ==10.8.0
mypy (changelog)	==1.15.0 -> ==1.18.2
nh3	==0.2.21 -> ==0.3.2
pandas	==2.2.3 -> ==2.3.3
platformdirs (changelog)	==4.3.8 -> ==4.5.0
pre-commit	==4.2.0 -> ==4.4.0
prometheus-client	==0.22.1 -> ==0.23.1
prompt-toolkit	==3.0.51 -> ==3.0.52
pycodestyle (changelog)	==2.13.0 -> ==2.14.0
pydantic (changelog)	==2.11.7 -> ==2.12.4
pydantic-core	==2.33.2 -> ==2.41.5
pydantic-settings (changelog)	==2.10.0 -> ==2.12.0
pyflakes	==3.3.2 -> ==3.4.0
pylint (changelog)	==3.3.6 -> ==3.3.9
pymdown-extensions	==10.16 -> ==10.17.1
pyparsing	==3.2.3 -> ==3.2.5
pytest (changelog)	==8.3.5 -> ==8.4.2
pytest-benchmark (changelog)	==5.1.0 -> ==5.2.3
pytest-cov (changelog)	==6.1.1 -> ==6.3.0
pytest-mock (changelog)	==3.14.0 -> ==3.15.1
python-dotenv	==1.1.0 -> ==1.2.1
pyyaml (source)	==6.0.2 -> ==6.0.3
questionary	==2.1.0 -> ==2.1.1
requests (source, changelog)	==2.32.4 -> ==2.32.5
rich	==14.0.0 -> ==14.2.0
rich-click	==1.8.9 -> ==1.9.4
ruff (source, changelog)	==0.11.6 -> ==0.14.5
s3transfer	==0.13.0 -> ==0.14.0
scipy	==1.15.3 -> ==1.16.3
stevedore	==5.4.1 -> ==5.5.0
termcolor (changelog)	==2.3.0 -> ==2.5.0
twine	==6.1.0 -> ==6.2.0
types-python-dateutil (changelog)	==2.9.0.20241206 -> ==2.9.0.20251115
types-pyyaml (changelog)	==6.0.12.20250402 -> ==6.0.12.20250915
types-requests (changelog)	==2.32.0.20250328 -> ==2.32.4.20250913
typing-extensions (changelog)	==4.14.0 -> ==4.15.0
typing-inspection (changelog)	==0.4.1 -> ==0.4.2
virtualenv	==20.31.2 -> ==20.35.4
wcmatch	==10.0 -> ==10.1
wcwidth	==0.2.13 -> ==0.2.14

---

Release Notes

agronholm/anyio (anyio)

v4.11.0

Compare Source

• Added support for cancellation reasons (the reason parameter to CancelScope.cancel()) (#​975)
• Bumped the minimum version of Trio to v0.31.0
• Added the ability to enter the event loop from foreign (non-worker) threads by passing the return value of anyio.lowlevel.current_token() to anyio.from_thread.run() and anyio.from_thread.run_sync() as the token keyword argument (#​256)
• Added pytest option (anyio_mode = "auto") to make the pytest plugin automatically handle all async tests (#​971)
• Added the anyio.Condition.wait_for() method for feature parity with asyncio (#​974)
• Changed the default type argument of anyio.abc.TaskStatus from Any to None (#​964)
• Fixed TCP listener behavior to guarantee the same ephemeral port is used for all socket listeners when local_port=0 (#​857; PR by @​11kkw and @​agronholm)
• Fixed inconsistency between Trio and asyncio where a TCP stream that previously raised a BrokenResourceError on send() would still raise BrokenResourceError after the stream was closed on asyncio, but ClosedResourceError on Trio. They now both raise a ClosedResourceError in this scenario. (#​671)

v4.10.0

Compare Source

• Added the feed_data() method to the BufferedByteReceiveStream class, allowing users to inject data directly into the buffer
• Added various class methods to wrap existing sockets as listeners or socket streams:
  • SocketListener.from_socket()
  • SocketStream.from_socket()
  • UNIXSocketStream.from_socket()
  • UDPSocket.from_socket()
  • ConnectedUDPSocket.from_socket()
  • UNIXDatagramSocket.from_socket()
  • ConnectedUNIXDatagramSocket.from_socket()
• Added a hierarchy of connectable stream classes for transparently connecting to various remote or local endpoints for exchanging bytes or objects
• Added context manager mix-in classes (anyio.ContextManagerMixin and anyio.AsyncContextManagerMixin) to help write classes that embed other context managers, particularly cancel scopes or task groups (#​905; PR by @​agronholm and @​tapetersen)
• Added the ability to specify the thread name in start_blocking_portal() (#​818; PR by @​davidbrochart)
• Added anyio.notify_closing to allow waking anyio.wait_readable and anyio.wait_writable before closing a socket. Among other things, this prevents an OSError on the ProactorEventLoop. (#​896; PR by @​graingert)
• Incorporated several documentation improvements from the EuroPython 2025 sprint (special thanks to the sprinters: Emmanuel Okedele, Jan Murre, Euxenia Miruna Goia and Christoffer Fjord)
• Added a documentation page explaining why one might want to use AnyIO's APIs instead of asyncio's
• Updated the to_interpreters module to use the public concurrent.interpreters API on Python 3.14 or later
• Fixed anyio.Path.copy() and anyio.Path.copy_into() failing on Python 3.14.0a7
• Fixed return annotation of __aexit__ on async context managers. CMs which can suppress exceptions should return bool, or None otherwise. (#​913; PR by @​Enegg)
• Fixed rollover boundary check in SpooledTemporaryFile so that rollover only occurs when the buffer size exceeds max_size (#​915; PR by @​11kkw)
• Migrated testing and documentation dependencies from extras to dependency groups
• Fixed compatibility of anyio.to_interpreter with Python 3.14.0b2 (#​926; PR by @​hroncok)
• Fixed SyntaxWarning on Python 3.14 about return in finally (#​816)
• Fixed RunVar name conflicts. RunVar instances with the same name should not share storage (#​880; PR by @​vimfu)
• Renamed the BrokenWorkerIntepreter exception to BrokenWorkerInterpreter. The old name is available as a deprecated alias. (#​938; PR by @​ayussh-verma)
• Fixed an edge case in CapacityLimiter on asyncio where a task, waiting to acquire a limiter gets cancelled and is subsequently granted a token from the limiter, but before the cancellation is delivered, and then fails to notify the next waiting task (#​947)

kislyuk/argcomplete (argcomplete)

v3.6.3

Compare Source

===============================

• Make RE PCRE compatible. Fixes #​539

• Only execute Python interpreters (#​536)

• fish: set variable scope to local to avoid clobbering global or
  universal variables (#​534)

• Documentation and help improvements

pylint-dev/astroid (astroid)

v3.3.11

Compare Source

=============================
Release date: 2025-07-13

• Fix a crash when parsing an empty arbitrary expression with extract_node (extract_node("__()")).

  Closes #​2734

• Fix a crash when parsing a slice called in a decorator on a function that is also decorated with
  a known six decorator.

  Closes #​2721

facelessuser/backrefs (backrefs)

v5.9

Compare Source

5.9

• NEW: Add support for Python 3.14.
• ENHANCE: Switch to deploying with PyPI's "Trusted Publisher".

PyCQA/bandit (bandit)

v1.8.6

Compare Source

What's Changed

• Bump sigstore/cosign-installer from 3.8.2 to 3.9.0 by @​dependabot in #​1279
• Bump docker/setup-buildx-action from 3.10.0 to 3.11.1 by @​dependabot in #​1278
• added hint to FreeBSD package in doc/source/integrations.rst by @​daniel-mohr in #​1282
• Bump sigstore/cosign-installer from 3.9.0 to 3.9.1 by @​dependabot in #​1284
• Huggingface revision pinning by @​lukehinds in #​1281

New Contributors

• @​daniel-mohr made their first contribution in #​1282

Full Changelog: PyCQA/bandit@1.8.5...1.8.6

v1.8.5

Compare Source

What's Changed

• Fix the rendering of the CI/CD doc by @​ericwb in #​1274
• Fix for publish to PyPI failure by @​ericwb in #​1273

Full Changelog: PyCQA/bandit@1.8.4...1.8.5

psf/black (black)

v25.11.0

Compare Source

Highlights

• Enable base 3.14 support (#​4804)
• Add support for the new Python 3.14 t-string syntax introduced by PEP 750 (#​4805)

Stable style

• Fix bug where comments between # fmt: off and # fmt: on were reformatted (#​4811)
• Comments containing fmt directives now preserve their exact formatting instead of
  being normalized (#​4811)

Preview style

• Move multiline_string_handling from --unstable to --preview (#​4760)
• Fix bug where module docstrings would be treated as normal strings if preceded by
  comments (#​4764)
• Fix bug where python 3.12 generics syntax split line happens weirdly (#​4777)
• Standardize type comments to form # type: <value> (#​4645)
• Fix fix_fmt_skip_in_one_liners preview feature to respect # fmt: skip for compound
  statements with semicolon-separated bodies (#​4800)

Configuration

• Add no_cache option to control caching behavior. (#​4803)

Packaging

• Releases now include arm64 Linux binaries (#​4773)

Output

• Write unchanged content to stdout when excluding formatting from stdin using pipes
  (#​4610)

Blackd

• Implemented BlackDClient. This simple python client allows to easily send formatting
  requests to blackd (#​4774)

Integrations

• Enable 3.14 base CI (#​4804)
• Enhance GitHub Action psf/black to support the required-version major-version-only
  "stability" format when using pyproject.toml (#​4770)
• Improve error message for vim plugin users. It now handles independently vim version
• Vim: Warn on unsupported Vim and Python versions independently (#​4772)
• Vim: Print the import paths when importing black fails (#​4675)
• Vim: Fix handling of virtualenvs that have a different Python version (#​4675)

v25.9.0

Compare Source

Highlights

• Remove support for pre-python 3.7 await/async as soft keywords/variable names
  (#​4676)

Stable style

• Fix crash while formatting a long del statement containing tuples (#​4628)
• Fix crash while formatting expressions using the walrus operator in complex with
  statements (#​4630)
• Handle # fmt: skip followed by a comment at the end of file (#​4635)
• Fix crash when a tuple appears in the as clause of a with statement (#​4634)
• Fix crash when tuple is used as a context manager inside a with statement (#​4646)
• Fix crash when formatting a \ followed by a \r followed by a comment (#​4663)
• Fix crash on a \\r\n (#​4673)
• Fix crash on await ... (where ... is a literal Ellipsis) (#​4676)
• Fix crash on parenthesized expression inside a type parameter bound (#​4684)
• Fix crash when using line ranges excluding indented single line decorated items
  (#​4670)

Preview style

• Fix a bug where one-liner functions/conditionals marked with # fmt: skip would still
  be formatted (#​4552)
• Improve multiline_string_handling with ternaries and dictionaries (#​4657)
• Fix a bug where string_processing would not split f-strings directly after
  expressions (#​4680)
• Wrap the in clause of comprehensions across lines if necessary (#​4699)
• Remove parentheses around multiple exception types in except and except* without
  as. (#​4720)
• Add \r style newlines to the potential newlines to normalize file newlines both from
  and to (#​4710)

Parser

• Rewrite tokenizer to improve performance and compliance (#​4536)
• Fix bug where certain unusual expressions (e.g., lambdas) were not accepted in type
  parameter bounds and defaults. (#​4602)

Performance

• Avoid using an extra process when running with only one worker (#​4734)

Integrations

• Fix the version check in the vim file to reject Python 3.8 (#​4567)
• Enhance GitHub Action psf/black to read Black version from an additional section in
  pyproject.toml: [project.dependency-groups] (#​4606)
• Build gallery docker image with python3-slim and reduce image size (#​4686)

Documentation

• Add FAQ entry for windows emoji not displaying (#​4714)

boto/boto3 (boto3)

v1.40.74

Compare Source

=======

• api-change:datazone: [botocore] Adds support for granting read and write access to Amazon S3 general purpose buckets using CreateSubscriptionRequest and AcceptSubscriptionRequest APIs. Also adds search filters for SSOUser and SSOGroup to ListSubscriptions APIs and deprecates "sortBy" parameter for ListSubscriptions APIs.
• api-change:ec2: [botocore] This release adds AvailabilityZoneId support for CreateInstanceConnectEndpoint, DescribeInstanceConnectEndpoints, and DeleteInstanceConnectEndpoint APIs.
• api-change:imagebuilder: [botocore] EC2 Image Builder now supports invoking Lambda functions and executing Step Functions state machine through image workflows.
• api-change:medialive: [botocore] Removed all the value constraint (min/max) for the shape definitions (e.g. integerMin0Max3600) on the C2j models to get rid of the need to request an exemption from the SDK team whenever a shape definition (e.g. integerMin0Max3600) is changed.
• enhancement:AWSCRT: [botocore] Update awscrt version to 0.28.4

v1.40.73

Compare Source

=======

• api-change:cloudformation: [botocore] CloudFormation now supports GetHookResult API with annotations to retrieve structured compliance check results and remediation guidance for each evaluated resource, replacing the previous single-message limitation with detailed validation outcomes.
• api-change:controlcatalog: [botocore] Added support for related control mappings with new RELATED_CONTROL mapping type in ListControlMappings API.
• api-change:ec2: [botocore] Added support for new accelerator types ("media") and accelerator names ("L4", "L40s", "GAUDI_HL_205", "INFERENTIA2", "TRAINIUM", "TRAINIUM2", "U30") in Attributes Based Instance Type Selection for launched instance types.
• api-change:ecr: [botocore] Add Amazon ECR FIPS PrivateLink endpoint support
• api-change:elbv2: [botocore] QUIC and TCP_QUIC protocol support for Network Load Balancer (NLB). This capability enables customers to forward QUIC traffic to their targets with ultra-low latency while maintaining session stickiness using QUIC Connection IDs.
• api-change:endpoint-rules: [botocore] Update endpoint-rules client to latest version
• api-change:iotwireless: [botocore] Integration of Device Location with Amazon Sidewalk network for Amazon Sidewalk enabled devices
• api-change:mediaconvert: [botocore] Lowers minimum duration for black video generator. Adds support for embedding and signing C2PA content credentials in DASH and CMAF HLS outputs.
• api-change:rds: [botocore] Updated endpoint and service metadata
• api-change:sagemaker: [botocore] Added support for minor version upgrades and AWS Identity Center integration for SageMaker Hadron Partner Apps, enabling automated version management and IdC group-based access control.
• api-change:workspaces-web: [botocore] Support for managing web content filtering for defining, tracking and regulating type of content accessed with WorkSpaces Secure Browser as part of browser settings.

v1.40.72

Compare Source

=======

• api-change:amp: [botocore] Add VPC source configuration support enabling Amazon Managed Service for Prometheus Collector to collect metrics from MSK clusters.
• api-change:connect: [botocore] Updated Authentication Profile APIs to add support for automatic logout on user inactivity
• api-change:dms: [botocore] Added support of SQL statements creation, metadata model discovery and selection rules transformation.
• api-change:ec2: [botocore] Adds complete AMI ancestry tracing from immediate parent through each preceding generation back to the root AMI
• api-change:elbv2: [botocore] This release expands ALB Authentication to support JWT verification and adds support for a new JWT validation action in listener rule.
• api-change:redshift: [botocore] Added GetIdentityCenterAuthToken API to retrieve encrypted authentication tokens for Identity Center integrated applications. This API enables programmatic access to secure Identity Center tokens with proper error handling and parameter validation across supported SDK languages.
• api-change:s3tables: [botocore] Adds support for request metrics metrics APIs for S3 Tables
• api-change:sagemaker: [botocore] Add support for trn2.3xlarge instance type for SageMaker Hyperpod

v1.40.71

Compare Source

=======

• api-change:batch: [botocore] Documentation-only update: update API and doc descriptions per EKS ImageType default value switch from AL2 to AL2023.
• api-change:bedrock-data-automation: [botocore] Added support for Language Expansion feature for BDA Audio modality.
• api-change:ec2: [botocore] AWS Site-to-Site VPN now supports VPN connections with up to 5 Gbps bandwidth per tunnel, a 4x improvement from existing limit of 1.25 Gbps.
• api-change:endpoint-rules: [botocore] Update endpoint-rules client to latest version
• api-change:medical-imaging: [botocore] Added new fields in existing APIs.
• api-change:rtbfabric: [botocore] Added LogSettings and LinkAttribute fields to external links
• api-change:security-ir: [botocore] Added support for configuring communication preferences as well as clearly displaying case comment author identities.

v1.40.70

Compare Source

=======

• api-change:acm-pca: [botocore] Private Certificate Authority service now supports ML-DSA key algorithms.
• api-change:appstream: [botocore] AWS Appstream support for IPv6
• api-change:backup: [botocore] AWS Backup supports backups of Amazon EKS clusters, including Kubernetes cluster state and persistent storage attached to the EKS cluster via a persistent volume claim (EBS volumes, EFS file systems, and S3 buckets).
• api-change:braket: [botocore] Adds ExperimentalCapabilities field to CreateQuantumTask request and GetQuantumTask response objects. Enables use of experimental software capabilities when creating quantum tasks.
• api-change:datazone: [botocore] Remove trackingServerName from DataZone Connection MLflowProperties
• api-change:dsql: [botocore] Cluster endpoint added to CreateCluster and GetCluster API responses
• api-change:ec2: [botocore] Amazon EC2 Fleet customers can now filter instance types based on encryption-in-transit support using Attribute-Based Instance Type Selection (ABIS), eliminating the manual effort of identifying and selecting compatible instance types for security-sensitive workloads.
• api-change:guardduty: [botocore] Include tags filed in CreatePublishingDestinationRequest and DescribePublishingDestinationResponse.
• api-change:iam: [botocore] Added CreateDelegationRequest API, which is not available for general use at this time.
• api-change:invoicing: [botocore] Added new invoicing get-invoice-pdf API Operation
• api-change:kafka: [botocore] Amazon MSK now supports intelligent rebalancing for MSK Express brokers.
• api-change:sts: [botocore] Added GetDelegatedAccessToken API, which is not available for general use at this time.
• api-change:verifiedpermissions: [botocore] Amazon Verified Permissions / Features : Adds support for entity Cedar tags.
• api-change:wafv2: [botocore] AWS WAF now supports CLOUDWATCH_TELEMETRY_RULE_MANAGED as a LogScope option, enabling automated logging configuration through Amazon CloudWatch Logs for telemetry data collection and analysis.

v1.40.69

Compare Source

=======

• api-change:controltower: [botocore] Added Parent Identifier support to ListEnabledControls and GetEnabledControl API. Implemented RemediationType support for Landing Zone operations: CreateLandingZone, UpdateLandingZone and GetLandingZone APIs
• api-change:ec2: [botocore] Adds PrivateDnsPreference and PrivateDnsSpecifiedDomains to control private DNS resolution for resource and service network VPC en