Skip to content

Bump the python-dependencies group across 1 directory with 9 updates #2350

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump the python-dependencies group across 1 directory with 9 updates #2350

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 26, 2026

Bumps the python-dependencies group with 9 updates in the / directory:

Package From To
elasticsearch 7.17.12 7.17.13
pymongo 4.15.5 4.16.0
fastapi 0.127.0 0.128.0
starlette 0.50.0 0.52.1
aiida-core 2.7.2 2.7.3
rich 14.2.0 14.3.1
ase 3.26.0 3.27.0
mkdocstrings[python] 1.0.0 1.0.2
jarvis-tools 2025.5.30 2025.8.30

Updates elasticsearch from 7.17.12 to 7.17.13

Commits

Updates pymongo from 4.15.5 to 4.16.0

Release notes

Sourced from pymongo's releases.

PyMongo 4.16.0

Community notes:

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.16.0 (2026/01/07)

PyMongo 4.16 brings a number of changes including:

  • Removed invalid documents from :class:bson.errors.InvalidDocument error messages as doing so may leak sensitive user data. Instead, invalid documents are stored in :attr:bson.errors.InvalidDocument.document.
  • PyMongo now requires dnspython>=2.6.1, since dnspython 1.0 is no longer maintained. The minimum version is 2.6.1 to account for CVE-2023-29483 <https://www.cve.org/CVERecord?id=CVE-2023-29483>_.
  • Removed support for Eventlet. Eventlet is actively being sunset by its maintainers and has compatibility issues with PyMongo's dnspython dependency.
  • Use Zstandard support from the standard library for Python 3.14+, and use backports.zstd for older versions.
  • Fixed return type annotation for find_one_and_* methods on :class:~pymongo.asynchronous.collection.AsyncCollection and :class:~pymongo.synchronous.collection.Collection to include None.
  • Added support for NumPy 1D-arrays in :class:bson.binary.BinaryVector.
  • Prevented :class:~pymongo.encryption.ClientEncryption from loading the crypt shared library to fix "MongoCryptError: An existing crypt_shared library is loaded by the application" unless the linked library search path is set.
Commits
  • 3290101 Prepare 4.16.0 release (#2672)
  • 1be94d2 PYTHON-5685 Fix unified spec sync metadata for csot and sessions tests (#2669)
  • 6585d9c PYTHON-2442: Refactor: use _asdict() in _options_dict() (#2670)
  • fdb1f7e PYTHON-5677 Prevent ClientEncryption from loading crypt shared library (#2659)
  • 0cd9763 Bump zizmorcore/zizmor-action from cb3d8e846e148d1111d90b03375b9c03deceda37 t...
  • 2f263d4 PYTHON-5680 Fix handling of expectedDocuments in Unified Test Runner (#2665)
  • e9658b2 Add 4.15.5 release date to changelog (#2666)
  • 10dd204 Update coverage[toml] requirement from <=7.10.6,>=5 to >=5,<=7.10.7 (#2662)
  • 1300677 [Spec Resync] 12-22-2025 (#2663)
  • 18c1f14 PYTHON-5529 Introduce optin setting to await for MinPoolSize population (#2664)
  • Additional commits viewable in compare view

Updates fastapi from 0.127.0 to 0.128.0

Release notes

Sourced from fastapi's releases.

0.128.0

Breaking Changes

Internal

0.127.1

Refactors

Docs

Translations

Internal

Commits

Updates starlette from 0.50.0 to 0.52.1

Release notes

Sourced from starlette's releases.

Version 0.52.1

What's Changed

Full Changelog: Kludex/starlette@0.52.0...0.52.1

Version 0.52.0

In this release, State can be accessed using dictionary-style syntax for improved type safety (#3036).

from collections.abc import AsyncIterator
from contextlib import asynccontextmanager
from typing import TypedDict
import httpx
from starlette.applications import Starlette
from starlette.requests import Request
class State(TypedDict):
http_client: httpx.AsyncClient
@​asynccontextmanager
async def lifespan(app: Starlette) -> AsyncIterator[State]:
async with httpx.AsyncClient() as client:
yield {"http_client": client}
async def homepage(request: Request[State]):
client = request.state["http_client"]
# If you run the below line with mypy or pyright, it will reveal the correct type.
reveal_type(client)  # Revealed type is 'httpx.AsyncClient'

See Accessing State for more details.

Full Changelog: Kludex/starlette@0.51.0...0.52.0

Version 0.51.0

Added

  • Add allow_private_network in CORSMiddleware #3065.

Changed

... (truncated)

Changelog

Sourced from starlette's changelog.

0.52.1 (January 18, 2026)

Fixed

  • Only use typing_extensions in older Python versions #3109.

0.52.0 (January 18, 2026)

In this release, State can be accessed using dictionary-style syntax for improved type safety (#3036).

from collections.abc import AsyncIterator
from contextlib import asynccontextmanager
from typing import TypedDict
import httpx
from starlette.applications import Starlette
from starlette.requests import Request
class State(TypedDict):
http_client: httpx.AsyncClient
@​asynccontextmanager
async def lifespan(app: Starlette) -> AsyncIterator[State]:
async with httpx.AsyncClient() as client:
yield {"http_client": client}
async def homepage(request: Request[State]):
client = request.state["http_client"]
# If you run the below line with mypy or pyright, it will reveal the correct type.
reveal_type(client)  # Revealed type is 'httpx.AsyncClient'

See Accessing State for more details.

0.51.0 (January 10, 2026)

Added

  • Add allow_private_network in CORSMiddleware #3065.

Changed

  • Increase warning stacklevel on DeprecationWarning for wsgi module #3082.
Commits

Updates aiida-core from 2.7.2 to 2.7.3

Release notes

Sourced from aiida-core's releases.

AiiDA v2.7.3

See CHANGELOG.md

Changelog

Sourced from aiida-core's changelog.

v2.7.3 - 2026-01-23

Fixes

Transport

  • Improve path escaping in OpenSSH transport for special characters (#7171) [4c89d9624]
  • Fix a critical race condition in TransportQueue (#7144) [b02a233af]
  • Add semaphore control to AsyncSshTransport::exec_command_wait_async to prevent SSH connection overwhelm (#7144) [985d5c809]

Engine

Devops

Commits
  • 67e97fb Release v2.7.3
  • de48e38 Switch from token-based to OIDC trusted publishing
  • 782ba2a Improve path escaping in OpenSSH transport for special characters
  • 60ef336 Fix: Avoid mutating _polling_jobs inside (slurm) scheduler (#7155)
  • e395345 Fixes a critical race condition in TransportQueue.
  • 53ea84d Add semaphore control to AsyncSshTransport::exec_command_wait_async to preven...
  • 29bde8d Fix PyPI index url (#6923)
  • 9d0a86f Merge release/2.7.2 into support/2.7.x (#7132)
  • 2befa6b Release v2.7.2
  • 4005693 CI fixes
  • See full diff in compare view

Updates rich from 14.2.0 to 14.3.1

Release notes

Sourced from rich's releases.

The Nerdy Fix release

Fixed issue with characters outside of unicode range reporting 0 cell size

[14.3.1] - 2026-01-24

Fixed

The more emojis release

Rich now has support for multi-codepoint emojis. There have also been some Markdown improvements, and a number of fixes. See the release notes below for details.

[14.3.0] - 2026-01-24

Fixed

Added

Changed

Changelog

Sourced from rich's changelog.

[14.3.1] - 2026-01-24

Fixed

[14.3.0] - 2026-01-24

Fixed

Added

Changed

Commits

Updates ase from 3.26.0 to 3.27.0

Commits
  • bbddb82 ASE version 3.27.0
  • 9b59235 Merge branch 'fix-1851' into 'master'
  • 211871f Merge branch 'ci-fixes' into 'master'
  • 6658c2b attempt to fix warnings in windows job
  • 1ce3dcf Rename test_bad_restart.py
  • 372583a Convert restart into str in todict
  • d57625f fix test that was platform-specific for some reason
  • 1348389 use exitstack for creation/closing of tempfiles
  • bb6f5c8 use exitstack in a way that requires less indentation
  • 722e8ec ignore warning about binary incompatibility
  • Additional commits viewable in compare view

Updates mkdocstrings[python] from 1.0.0 to 1.0.2

Release notes

Sourced from mkdocstrings[python]'s releases.

1.0.2

1.0.2 - 2026-01-24

Compare with 1.0.1

Code Refactoring

  • Use global instances for handlers and autorefs (9f79141 by Timothée Mazzucotelli).

1.0.1

1.0.1 - 2026-01-19

Compare with 1.0.0

Code Refactoring

  • Support manual cross-references in Zensical too (d37d907 by Timothée Mazzucotelli).
  • Support cross-references in Zensical (f43f1ee by Timothée Mazzucotelli). PR-812
Changelog

Sourced from mkdocstrings[python]'s changelog.

1.0.2 - 2026-01-24

Compare with 1.0.1

Code Refactoring

  • Use global instances for handlers and autorefs (9f79141 by Timothée Mazzucotelli).

1.0.1 - 2026-01-19

Compare with 1.0.0

Code Refactoring

  • Support manual cross-references in Zensical too (d37d907 by Timothée Mazzucotelli).
  • Support cross-references in Zensical (f43f1ee by Timothée Mazzucotelli). PR-812
Commits
  • 4e66617 chore: Prepare release 1.0.2
  • 9f79141 refactor: Use global instances for handlers and autorefs
  • cb8a3c7 chore: Prepare release 1.0.1
  • d37d907 refactor: Support manual cross-references in Zensical too
  • 0edd18a chore: Clean up after v1
  • f43f1ee refactor: Support cross-references in Zensical
  • b6a33e2 chore: Update sponsors section in README
  • afefc0f chore: Fix docs-deploy duty
  • cc54d77 chore: Template upgrade
  • See full diff in compare view

Updates jarvis-tools from 2025.5.30 to 2025.8.30

Commits

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python-dependencies group across 1 directory with 9 updates
3d3edbf 
Bumps the python-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [elasticsearch](https://github.com/elastic/elasticsearch-py) | `7.17.12` | `7.17.13` |
| [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.15.5` | `4.16.0` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.127.0` | `0.128.0` |
| [starlette](https://github.com/Kludex/starlette) | `0.50.0` | `0.52.1` |
| [aiida-core](https://github.com/aiidateam/aiida-core) | `2.7.2` | `2.7.3` |
| [rich](https://github.com/Textualize/rich) | `14.2.0` | `14.3.1` |
| [ase](https://gitlab.com/ase/ase) | `3.26.0` | `3.27.0` |
| [mkdocstrings[python]](https://github.com/mkdocstrings/mkdocstrings) | `1.0.0` | `1.0.2` |
| [jarvis-tools](https://github.com/atomgptlab/jarvis-tools) | `2025.5.30` | `2025.8.30` |



Updates `elasticsearch` from 7.17.12 to 7.17.13
- [Release notes](https://github.com/elastic/elasticsearch-py/releases)
- [Commits](https://github.com/elastic/elasticsearch-py/commits)

Updates `pymongo` from 4.15.5 to 4.16.0
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.15.5...4.16.0)

Updates `fastapi` from 0.127.0 to 0.128.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.127.0...0.128.0)

Updates `starlette` from 0.50.0 to 0.52.1
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@0.50.0...0.52.1)

Updates `aiida-core` from 2.7.2 to 2.7.3
- [Release notes](https://github.com/aiidateam/aiida-core/releases)
- [Changelog](https://github.com/aiidateam/aiida-core/blob/v2.7.3/CHANGELOG.md)
- [Commits](aiidateam/aiida-core@v2.7.2...v2.7.3)

Updates `rich` from 14.2.0 to 14.3.1
- [Release notes](https://github.com/Textualize/rich/releases)
- [Changelog](https://github.com/Textualize/rich/blob/master/CHANGELOG.md)
- [Commits](Textualize/rich@v14.2.0...v14.3.1)

Updates `ase` from 3.26.0 to 3.27.0
- [Changelog](https://gitlab.com/ase/ase/blob/master/CHANGELOG.rst)
- [Commits](https://gitlab.com/ase/ase/compare/3.26.0...3.27.0)

Updates `mkdocstrings[python]` from 1.0.0 to 1.0.2
- [Release notes](https://github.com/mkdocstrings/mkdocstrings/releases)
- [Changelog](https://github.com/mkdocstrings/mkdocstrings/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/mkdocstrings@1.0.0...1.0.2)

Updates `jarvis-tools` from 2025.5.30 to 2025.8.30
- [Release notes](https://github.com/atomgptlab/jarvis-tools/releases)
- [Commits](https://github.com/atomgptlab/jarvis-tools/commits/v2025.8.30)

---
updated-dependencies:
- dependency-name: elasticsearch
  dependency-version: 7.17.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pymongo
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: fastapi
  dependency-version: 0.128.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: starlette
  dependency-version: 0.52.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: aiida-core
  dependency-version: 2.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: rich
  dependency-version: 14.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: ase
  dependency-version: 3.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: mkdocstrings[python]
  dependency-version: 1.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: jarvis-tools
  dependency-version: 2025.8.30
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependency_updates Issues pertaining to updates to our dependencies that are breaking the eager build label Jan 26, 2026
@dependabot dependabot bot requested review from CasperWA and ml-evs as code owners January 26, 2026 06:08
@dependabot dependabot bot added the dependency_updates Issues pertaining to updates to our dependencies that are breaking the eager build label Jan 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@CasperWA CasperWA Awaiting requested review from CasperWA CasperWA is a code owner

@ml-evs ml-evs Awaiting requested review from ml-evs ml-evs is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependency_updates Issues pertaining to updates to our dependencies that are breaking the eager build

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants