[dependabot]

Bumps the python group with 5 updates in the /python directory:

Package	From	To
ruff	0.16.7	0.17.3
polars	1.44.2	2.1.0
certifi	2026.10.19	2026.10.23
pydantic	2.13.5	2.14.1
aws-lambda-powertools	3.34.0	3.37.0

Updates ruff from 0.16.7 to 0.17.3

Release notes

Sourced from ruff's releases.

0.17.3

Release Notes

Released on 2026-10-26.

Preview features

• [suspicious] Add shared-clock-mock (#29074)

Bug fixes

• [pyupgrade] Avoid incorrect conversions to f-strings (UP032) (#25485)

Performance

• Buffer stdout in ruff format (#29631)
• Specialize ASCII identifier lexing (#29503)
• Speed up identifier and keyword lexing (#29463)

Documentation

• [flake8-bandit] Describe what the rule actually checks for httpx (S113) (#27936)

Contributors

• @​itsvedantkumar
• @​charliermarsh
• @​anishgirianish

Install ruff 0.17.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.3/ruff-installer.ps1 | iex"

Download ruff 0.17.3

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.3

Released on 2026-10-26.

Preview features

• [suspicious] Add shared-clock-mock (#29074)

Bug fixes

• [pyupgrade] Avoid incorrect conversions to f-strings (UP032) (#25485)

Performance

• Buffer stdout in ruff format (#29631)
• Specialize ASCII identifier lexing (#29503)
• Speed up identifier and keyword lexing (#29463)

Documentation

• [flake8-bandit] Describe what the rule actually checks for httpx (S113) (#27936)

Contributors

• @​itsvedantkumar
• @​charliermarsh
• @​anishgirianish

0.17.2

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

• Avoid intermediate names in lint name resolution (#29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
• Share postfix parsing and reduce expression copies (#29480)

... (truncated)

Commits

• ba65abf Bump version to 0.17.3 (#29745)
• fb2f921 [ty] Fix narrowing of strings and integers compared with enum members (#29743)
• d181287 [ty] Index nominal union alternatives (#29196)
• 07872ad [ty] Preserve string literals in comparisons with LiteralString (#29741)
• 95888b2 [ty] Preserve narrowing after guarded match subject captures (#29558)
• 3c8166b [ty] Fix hang when negating recursive unions of instance types (#29652)
• 3fd20e0 [ty] Preserve generic callback specializations during return refinement (#29667)
• 2f0a29e [ty] Record predicate truthiness alongside expression inference (#29706)
• 60f104a [ty] Honor @​override on overload implementations in stubs (#29470)
• 207ec3a [ty] Add diagnostic baseline support (#27636)
• Additional commits viewable in compare view

Updates polars from 1.44.2 to 2.1.0

Release notes

Sourced from polars's releases.

Python Polars 2.1.0

💥 Breaking changes

• Disallow mixed string <=> numeric arithmetic in eager (#30071)

🚀 Performance improvements

• Limit the memory of buckets sorted ahead in the sort flush (#30297)
• Make file readers wait for spills while over the memory budget (#30296)
• Count unspilled frames in the memory estimate right away (#30295)
• Simplify more boolean expressions and drop redundant null checks (#30293)
• Wait for spills while over the out-of-core memory budget (#30294)
• Lower the default out-of-core prefetch fraction to 0.5 (#30292)
• Aggregate unique and n_unique in the streaming group-by itself (#30281)
• Return freed memory to the OS right away while out-of-core data is spilled (#30280)
• Gather List(Array) and Array columns without per-row slices (#30278)
• Evaluate the streaming window node out of core (#30282)
• Avoid deep copies when building a DataFrame from flat dataclasses (#30275)
• Sort the window partitions by each order key instead of their row encoding (#30277)
• Scan the haystack for a single needle in is_in (#30276)
• Prefer fixed-width columns when only the row count is needed (#30274)
• Native gather for List arrays (#30019)
• Evaluate windows in filter predicates in the streaming window node (#30272)
• Don't busy-wait in RAYON.block_on (#30259)
• Encode nested Parquet levels directly from the level buffers (#30251)
• Reduce memory of CSV scans on wide rows (#30165)
• Avoid quadratic JSON serialization of nested lists and maps (#30203)
• Skip the gather when exploding lists without nulls (#30234)
• Speed up writing nested Parquet columns (#30245)
• Don't keep whole parquet string dictionaries alive for a few selected rows (#30248)
• Set default spill compression level to 1 (#30237)
• Reuse zstd contexts in compression and avoid memcpys (#30233)
• Remove repeated and scalar ordering keys before the sort rewrites (#30231)
• Remove repeated keys from by's (#30095)
• Keep only one guessed unique key per join order leaf (#30191)
• Don't let extra join keys shrink an estimate once one key is unique (#30190)
• Reduce binary size of asof join with by keys (#30192)
• Reduce binary size of SQL visitors and parallel group-by collect (#30171)
• Push as-of join key filters to the right input (#30123)
• Drop null as-of right keys with a parallel filter before the join node (#30125)
• Keep as-of nearest join state small (#30126)
• Explode lists in group_by aggregations without a per-group apply (#30020)
• Streaming OOC group-by with shuffles (#29911)
• Drop scalar ordering keys in the optimizer (#30063)
• Merge union inputs that scan files of the same kind into one multi-file scan (#30056)
• Use the streaming scalar window for std, var and combined reductions in over (#30066)
• Limit the bytes of local CSV and NDJSON files read at once in multi-file scans (#30055)
• Check the matched flag of join keys in the table entry before the bitset (#30067)
• Track matched build rows of all join tables in a bitset (#30050)
• Add dedicated list gather kernels (#30049)

... (truncated)

Commits

• 7f902bd Python Polars 2.1.0 (#30124)
• dfb63c7 fix(rust): Include rolling index columns in expression metadata (#29245)
• a26073c perf: Limit the memory of buckets sorted ahead in the sort flush (#30297)
• 8d11086 test: Fix allocator-dependent failure in masked zero-copy to_numpy test (#3...
• a9a998b perf: Make file readers wait for spills while over the memory budget (#30296)
• 8b57b77 perf: Count unspilled frames in the memory estimate right away (#30295)
• 720d744 refactor: Simplify the out-of-core decay state and tests (#30283)
• f7a3227 perf: Simplify more boolean expressions and drop redundant null checks (#30293)
• 48de7ae perf: Wait for spills while over the out-of-core memory budget (#30294)
• 28cfd43 fix: Compare Array(Struct) rows field by field (#30290)
• Additional commits viewable in compare view

Updates certifi from 2026.10.19 to 2026.10.23

Commits

• b60466c 2026.10.23 (#445)
• See full diff in compare view

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

Two security fixes are fixed by this release: GHSA-gj4f-r7mf-jjxh and GHSA-955g-x97g-8mcp.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Reject large exponents in Fraction validation by @​Viicos in #13944. Addresses GHSA-gj4f-r7mf-jjxh.
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945. Addresses GHSA-955g-x97g-8mcp.
• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• Additional commits viewable in compare view

Updates aws-lambda-powertools from 3.34.0 to 3.37.0

Release notes

Sourced from aws-lambda-powertools's releases.

v3.37.0

Summary

This release adds support for the AppConfig Agent Lambda extension in Parameters and Feature Flags, brings Depends() injection to middlewares in Event Handler, and ships the Lambda layer with precompiled bytecode for faster cold starts. It also fixes bugs across Event Handler, Streaming, Idempotency, Circuit Breaker, Data Classes and Parser.

We are happy to welcome seven new contributors in this release: @​abhinavs1920, @​AtulJoshi1206, @​unknownhackerworld, @​LuisFigueroaG, @​ArfiArfath21, @​vyrnsynx and @​reginaldalfret. Thank you for the reports, the fixes and the patience during reviews. Thanks also to @​LemonCondor, @​xili-ytl, @​chiruu12 and @​exg for coming back with more.

AppConfig Agent Lambda extension

Docs

The AppConfig Agent runs as a Lambda extension next to your function, polls AppConfig for you and serves the configuration over localhost. Reading from it takes a couple of milliseconds instead of a round trip to the service, and your function doesn't need an SDK client for it.

You can now read from the extension with AppConfigExtensionProvider:

from aws_lambda_powertools.utilities.parameters import AppConfigExtensionProvider
provider = AppConfigExtensionProvider(environment="prod", application="orders")
config = provider.get("features", transform="json")

Feature Flags support it too. Pass use_extension=True to AppConfigStore, or use AppConfigExtensionStore:

from aws_lambda_powertools.utilities.feature_flags import AppConfigExtensionStore, FeatureFlags
store = AppConfigExtensionStore(environment="prod", application="orders", name="features")
feature_flags = FeatureFlags(store=store)

The extension is configured through its own environment variables, such as AWS_APPCONFIG_EXTENSION_PREFETCH_LIST and AWS_APPCONFIG_EXTENSION_POLL_INTERVAL_SECONDS, and you attach the AWS-AppConfig-Extension layer to your function. The docs list the variables and the layer ARNs.

Depends() in middlewares

Docs

Function-based middlewares can now declare Depends() parameters, the same way route handlers do. Dependencies are resolved before the middleware runs, share the per-request cache with the route, and honour dependency_overrides in tests.

def user_middleware(
    app: APIGatewayHttpResolver,
    next_middleware: NextMiddleware,
    user_dao: Annotated[UserDao, Depends(get_user_dao)],
):
    sub = app.current_event.request_context.authorizer.jwt_claim.get("sub")
    if sub and (user := user_dao.get(sub)):
        app.append_context(user=user)
    return next_middleware(app)
</tr></table>

... (truncated)

Changelog

Sourced from aws-lambda-powertools's changelog.

[v3.37.0] - 2026-10-22

Bug Fixes

• circuit_breaker: start a fresh probe success streak on each probe election (#8646)
• data-classes: keep CaseInsensitiveDict on copy and merge (#8537)
• data-classes: use user_uid for the Uid in Transfer Family PosixProfile (#8524)
• event_handler: handle exceptions raised in Depends() like route exceptions (#8568)
• event_handler: route VPC Lattice requests that carry a query string (#8572)
• event_handler: match AppSync Events wildcard routes on segment boundaries (#8546)
• event_handler: preserve commas in scalar query and header parameters (#8509)
• event_handler: clear context when route resolution raises (#8539)
• event_handler: resolve Depends() and Request params with a None default on Python 3.10 (#8649)
• idempotency: serialize PydanticSerializer output in JSON mode (#8570)
• parser: support camelCase replyTo in SesMailCommonHeaders (#8542)
• streaming: report S3Object as closed after close() without building the transformed stream (#8566)
• streaming: keep CsvTransform options intact across repeated use (#8565)
• streaming: respect size in S3Object.readline (#8558)

Code Refactoring

• typing: add type hints to middleware-based decorators (#8541)

Features

• event_handler: support Depends() injection in function-based middleware (#8573)
• parameters: add AppConfigExtensionProvider for the AppConfig Agent Lambda extension (#8562)

Maintenance

• version bump
• deps: bump fastjsonschema, isort, ijson, cfn-lint and ruff (#8647)
• deps: bump the github-actions group with 2 updates (#8644)
• docs: migrate docs build from MkDocs to Zensical (#8585)
• lint: enable Python 3.10 pyupgrade rules (#8561)

Performance Improvements

• layer: precompile Python sources in Lambda layers (#8520)
• parser: load event models on demand (#8519)

[v3.36.0] - 2026-10-15

Bug Fixes

• data-classes: handle keyword arguments in CaseInsensitiveDict.update (#8518)
• data-classes: keep the value of large DynamoDB numbers (#8513)
• event_handler: skip compression when the response has no body (#8485)
• event_handler: emit Max-Age=0 for cookies with max_age=0 (#8488)
• feature_flags: warn on comparator evaluation errors (#8470)

... (truncated)

Commits

• 0b9ab28 chore: version bump
• 7a5b1ac fix(event_handler): resolve Depends() and Request params with a None default ...
• 4fe0d6d fix(circuit_breaker): start a fresh probe success streak on each probe electi...
• d82a695 chore(deps): bump fastjsonschema, isort, ijson, cfn-lint and ruff (#8647)
• 31180f0 chore(deps): bump the github-actions group with 2 updates (#8644)
• 0f64f28 feat(event_handler): support Depends() injection in function-based middleware...
• bdd370b chore(docs): migrate docs build from MkDocs to Zensical (#8585)
• 43bab8d fix(event_handler): handle exceptions raised in Depends() like route exceptio...
• 93e577c fix(event_handler): route VPC Lattice requests that carry a query string (#8572)
• f58cd87 fix(idempotency): serialize PydanticSerializer output in JSON mode (#8570)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: auto-approve, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[greptile-apps]

PR author is in the excluded authors list.

[silvexis]

Approving. This Dependabot update changes only python/uv.lock:

• ruff 0.16.7 → 0.17.3 (minor, dev tooling)
• polars 1.44.2 → 2.1.0 (major), with polars-runtime-32 1.44.2 → 2.1.0
• certifi 2026.10.19 → 2026.10.23 (CA bundle refresh; the CVE-2026-111943 floor certifi>=2026.10.19 still holds)
• pydantic 2.13.5 → 2.14.1 (minor), with pydantic-core 2.46.5 → 2.50.1
• aws-lambda-powertools 3.34.0 → 3.37.0 (minor)

Supply-chain checks on dbb6ca9:

• Every package source is still https://pypi.org/simple, and every artifact URL is on files.pythonhosted.org.
• Every locked sha256 matches the files PyPI publishes for that version, and none of the releases are yanked.
• Every new version has been on PyPI for at least 7 days.
• The lock header is unchanged (version = 1, revision = 5, requires-python = ">=3.11"), and the editable project entry is unchanged.

The existing python/pyproject.toml constraints allow all of these versions. The polars 2.x major is allowed by polars>=1.44.0, and the template ships no polars code. All 13 checks pass.

Non-blocking follow-ups for the template:

• Add [tool.uv] exclude-newer = "7 days" to python/pyproject.toml, and set a Dependabot cooldown (default-days: 7) in .github/dependabot.yaml. Projects created from this template would then get a minimum package age by default. This PR resolved ruff 0.17.3 and polars 2.1.0 when they were only 3 to 5 days old.
• Create the auto-approve and dependencies labels that .github/dependabot.yaml references, or remove them from that file. Dependabot reports that they are missing, so dependabot-auto-merge.yml never enables auto-merge.