[dependabot]

Bumps the minor-and-patch group with 3 updates in the / directory: anyio, pyarrow and cachetools.

Updates anyio from 4.15.1 to 4.16.0

Release notes

Sourced from anyio's releases.

4.16.0

New features

• Added BlockingPortal.call_async() for asynchronously calling into an event loop with optional abandonment on cancellation (#1342; PR by @​davidbrochart)
• Added SOCK_SEQPACKET support to connect_unix() and create_unix_listener() (#1349; PR by @​theunkn0wn1)

Other changes

• Changed UDP sockets on the asyncio backend to make send() wait until the datagram has been passed to the operating system (#1294; PR by @​graingert)

Bug fixes

• Fixed documentation implying that use_uvloop=True falls back to the standard event loop when uvloop (winloop on Windows) is not installed, and showed how to skip the corresponding pytest backend variant when the dependency is missing (#645; PR by @​GruffElixir)
• Fixed get_current_task() on the asyncio backend raising an opaque TypeError: cannot create weak reference to 'NoneType' object instead of a clear error when called from a callback scheduled via loop.call_soon_threadsafe() (e.g. from within from_thread.run_sync()), where asyncio.current_task() is legitimately None (#773; PR by @​AmirF194)
• Fixed CancelScope on the asyncio backend swallowing a native Task.cancel() that was delivered in the same event loop iteration as the scope's own cancellation (such as a move_on_after() deadline expiring), which left the host task with a pending cancellation request that never raised CancelledError (#1214)
• Fixed UDP socket closing hanging if a datagram send was still in flight (#1237; PR by @​graingert)
• Fixed concurrent aclose_forcefully() calls on asyncio socket streams returning before the underlying socket was closed (#1273; PR by @​graingert)
• Fixed aclose() on sockets not checkpointing, and thus failing to raise a cancellation exception when called inside a cancelled scope (affected UNIX socket streams and UNIX datagram sockets on asyncio, and all sockets on Trio) (#1288; PR by @​graingert)
• Fixed aclose() on asyncio TCP socket listeners not checkpointing, and leaking the listening socket if cancelled while another task was waiting in accept() (#1289; PR by @​graingert)
• Fixed accept() on asyncio UNIX socket listeners hanging forever, and leaving the listening socket registered with the event loop, when the listener was closed by another task (#1289; PR by @​graingert)
• Fixed send() on asyncio TCP and UDP sockets returning normally, despite the data being discarded, when the socket was closed by another task (or, for TCP, the connection was lost) while send() was waiting for the operating system to accept the data (#1289; PR by @​graingert)
• Fixed SocketStream.send() on the asyncio backend handing its data to a paused transport after a previous send() was cancelled (#1299; PR by @​graingert)
• Fixed sleep() treating a negative delay (including -inf) inconsistently across backends (asyncio returned immediately; Trio raised ValueError) by raising ValueError on all backends (#1306; PR by @​BetterAndBetterII)
• Fixed create_tcp_listener() occasionally failing with a message like Could not create 2 listeners with a consistent port when an ephemeral port is requested and IPv6 is enabled and the dual-stack path is not available or a specific local host name was given (#1313)
• Fixed AsyncFile not shielding against cancellation while closing (#1314)
• Fixed TemporaryDirectory.cleanup() reacting to cancellation prematurely when the host task was already cancelled, causing the actual cleanup operation to be skipped (#1316; PR by @​Yasser-Ameur)
• Fixed a NaN deadline being accepted on asyncio while Trio raised ValueError, which silently disabled the timeout (fail_after(math.nan) returned instead of raising TimeoutError); CancelScope now rejects it on both backends (#1317; PR by @​dylanpulver)
• Fixed FileReadStream and FileWriteStream leaving files open when cancelled during context manager exit, including unflushed writes (#1318; PR by @​Kuang-xianxin)
• Fixed Condition.notify() and Condition.notify_all() failing when the underlying lock was acquired directly rather than through the condition (#1319; PR by @​GruffElixir)
• Fixed importing AnyIO with loaders that do not provide __file__, such as PyOxidizer, raising TypeError instead of falling back to eager imports (#1322; PR by @​skulitom)
• Fixed text receive streams silently discarding incomplete characters at end-of-file instead of applying the configured decoding error handler (#1339; PR by @​Aurelucien)
• Fixed Semaphore(fast_acquire=True) losing its fast-acquire behavior when instantiated outside a running event loop (#1348; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider permanently failing with an AttributeError on every subsequent use if the first attempt to start its blocking portal failed (#1350; PR by @​Yasser-Ameur)
• Fixed create_udp_socket() silently ignoring the local_port argument when local_host was omitted, making the socket bind to a random ephemeral port instead of the requested one (#1351; PR by @​januththedev)
• Fixed worker threads on the asyncio backend never returning to the idle pool (and thus never being reused or pruned) when a to_thread.run_sync() call was cancelled after it had been queued for the worker but before the worker thread had picked it up (#1352; PR by @​Zac-HD)
• Fixed pytest plugin running Hypothesis async tests only on the first parametrized backend instead of each backend (#1353; PR by @​DYNOSuprovo)
• Fixed TypeError when subclassing an existing TypedAttributeSet subclass, and this subclass contains type annotations (#1358; PR by @​pasmud)
• Fixed Lock.locked() (and Condition.locked()) raising NoEventLoopError when the lock was created outside a running event loop (#1362; PR by @​00200200)
• Fixed connect_tcp() leaking a connected socket when an enclosing cancel scope was cancelled before the connection attempt task group exited (#1364; PR by @​charan-rathore)
• Fixed create_connected_udp_socket() silently ignoring local_port when local_host was not given: the local address was left unset, so the OS picked an ephemeral port instead of the requested one (#1365; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider not passing the exception raised in its with block on to the start_blocking_portal() context manager it wraps (#1366; PR by @​feiiiiii5)
• Fixed anyio.itertools.islice() not consuming the first start items when stop <= start (#1372; PR by @​Rodrigo-Palma)
• Fixed BufferedByteReceiveStream.receive_exactly() and receive_until() returning buffered data after explicit closure instead of raising ClosedResourceError (#1378; PR by @​kokotatan)
• Fixed a TLS stream sending records the peer could no longer decrypt after a cancelled send() lost an already-encrypted record; the stream now raises BrokenResourceError on further use instead (#1385; PR by @​Kayvan-Zahiri)
• Fixed close() on memory object streams not waking up tasks blocked in send() or receive() on the same stream (#1391)
• Fixed anyio.itertools.product() acquiring and consuming unused input iterables when repeat=0 (#1394; PR by @​sricharanreddycheruku)
• Fixed SpooledTemporaryFile rolling over to disk on writes when max_size is zero (the default) (#1397; PR by @​fhgffy)
• Fixed Trio UDP sockets remaining open when initialization failed or was cancelled (#1400; PR by @​adenzhou1350)
• Fixed SpooledTemporaryFile.rollover() moving the current file position to the end of the file (#1401; PR by @​fhgffy)
• Fixed cancellation during temporary directory creation leaving the directory behind while its context manager is retained (#1403; PR by @​adenzhou1350)

... (truncated)

Commits

• 0ddd02d Released version 4.16.0
• 576892e Fixed certain pending tasks not woken up by the closing of memory object stre...
• 02ff4f8 Added BlockingPortal.call_async() (#1343)
• 1af29a4 Moved documentation code snippets into separate, checked files (#1445)
• f01c041 [pre-commit.ci] pre-commit autoupdate (#1448)
• 95a0143 Test with blockbuster and uvloop on Python 3.15 too
• 4d51154 Modernized the memory object stream tests
• 1e4b448 Fixed the as_connectable() example in the networking docs (#1442)
• cd21b36 Fixed TypedAttributeSet not collecting annotations from superclasses (#1358)
• b7f8c68 [pre-commit.ci] pre-commit autoupdate (#1431)
• Additional commits viewable in compare view

Updates pyarrow from 26.0.0 to 26.0.1

Release notes

Sourced from pyarrow's releases.

Apache Arrow 26.0.1

Release Notes URL: https://arrow.apache.org/release/26.0.1.html

Apache Arrow 26.0.1 RC1

Release Notes: Release Candidate: 26.0.1 RC1

Commits

• 9e5d697 MINOR: [Release] Update versions for 26.0.1
• 905f17c MINOR: [Release] Update .deb/.rpm changelogs for 26.0.1
• 2c3234c MINOR: [Release] Update CHANGELOG.md for 26.0.1
• 8d3388b GH-55316: [CI][FlightRPC][ODBC] Apply ports.patch in Windows build (#55317)
• 3ec2cf1 GH-54936: [C++] Ensure reading an invalid map array from IPC doesn't crash (#...
• f942ba3 GH-51684: [C++][Parquet][FOLLOWUP] Speed up content-defined chunking with a l...
• 700a983 GH-52161: [C++][Parquet] Add support for string/binary view to content define...
• ba754c4 GH-51669: [C++][Parquet] Preserve cipher in plaintext footer metadata (#54884)
• 16f1823 GH-50544: [C++][Gandiva] Fix out-of-bounds read in round with most negative p...
• ae357c6 GH-53518: [Parquet] Reject unsupported compression codecs (#53522)
• Additional commits viewable in compare view

Updates cachetools from 7.2.7 to 7.2.8

Changelog

Sourced from cachetools's changelog.

v7.2.8 (2026-10-31)

• Fix type stubs for TTLCache and TLRUCache with default timer.

• Minor documentation and unit test improvements.

Commits

• 340c474 Release v7.2.8.
• c8b4ee2 Make "self" positional-only in @​cachedmethod decorators and keys.
• f806754 Improve typed key tests.
• 6a89b7c Improve docs and tests for decorators' lock/condition dependencies.
• 304167f Fix type stubs for TTLCache and TLRUCache with default timer.
• 505aece Update copilot instructions and review.
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T15:01:49.430524Z	b638de5	PR opened
🔒 Security Review	✅ Completed 2026-11-07T15:03:26.229669Z	b638de5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.