Skip to content

deps: bump the python-dependencies group across 1 directory with 5 updates - #65

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/pip/python-dependencies-cb73585a6e
Open

deps: bump the python-dependencies group across 1 directory with 5 updates#65
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/pip/python-dependencies-cb73585a6e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on alpaca-py, ccxt, databento, hatchling and vcs-versioning to permit the latest version.
Updates alpaca-py from 0.43.5 to 0.44.0

Release notes

Sourced from alpaca-py's releases.

v0.44.0

What's Changed

New Contributors

Full Changelog: alpacahq/alpaca-py@v0.43.5...v0.44.0

Commits
  • cc4cb3b fix: trust /github/workspace for Docker PyPI publish (#766)
  • afada1d fix: quote Python 3.10 in PyPI publish workflow matrix (#765)
  • 8b46639 Fix streaming reconnect reliability (#740) (#744)
  • 7346967 feat: add opt-in live paper/sandbox probe tests (#761)
  • 95ae23d deps: bump urllib3 from 2.2.2 to 2.7.0 (#760)
  • 593e9d3 deps: bump msgpack from 1.0.8 to 1.2.1 (#712)
  • d92293f fix: Corrected Market Data Api links (#759)
  • 4b83ca9 feat: standardize User-Agent across REST and websocket clients (#747)
  • ec53d72 deps: bump pytest from 8.4.2 to 9.1.1 (#756)
  • 3f34f36 deps: bump pytest-asyncio from 0.23.8 to 1.4.0 (#751)
  • Additional commits viewable in compare view

Updates ccxt to 4.5.74

Release notes

Sourced from ccxt's releases.

v4.5.74

What's Changed

... (truncated)

Commits

Updates databento from 0.83.0 to 0.84.0

Release notes

Sourced from databento's releases.

databento 0.84.0

Release notes

Enhancements

  • Added support for listing_id, issuer_id, and security_id as stype_in values for the security master and corporate actions reference data endpoints, and security_id for the adjustment factors endpoint
  • Added a dataset parameter to MetadataHttpAPI.list_fields(). If not provided, the returned fields are for the latest DBN encoding version, which may not match a specific dataset's schema
  • Upgraded databento-dbn to 0.67.0:
    • Improved performance of record field accessors that convert a raw value to an enum, such as side(), action() and rtype(), by no longer copying the description when constructing the conversion error
Changelog

Sourced from databento's changelog.

0.84.0 - 2026-08-18

Enhancements

  • Added support for listing_id, issuer_id, and security_id as stype_in values for the security master and corporate actions reference data endpoints, and security_id for the adjustment factors endpoint
  • Added a dataset parameter to MetadataHttpAPI.list_fields(). If not provided, the returned fields are for the latest DBN encoding version, which may not match a specific dataset's schema
  • Upgraded databento-dbn to 0.67.0:
    • Improved performance of record field accessors that convert a raw value to an enum, such as side(), action() and rtype(), by no longer copying the description when constructing the conversion error
Commits
  • c8f90e6 VER: Release 0.84.0
  • 2641cb3 VER: Release 0.84.0
  • ec26207 MOD: Upgrade databento-dbn to 0.67.0
  • 7fab55f ADD: Optional dataset to metadata.list_fields
  • 0a84db3 ADD: Add new stypes for reference data API
  • 7beec1f FIX: Fix authentication error reporting in C++
  • See full diff in compare view

Updates hatchling from 1.31.0 to 1.32.0

Release notes

Sourced from hatchling's releases.

Hatchling v1.32.0

Changed:

  • Bump default core metadata version to 2.5

  • Add tomlkit as a runtime dependency, which is required to rewrite pyproject.toml when setting a static version

Added:

  • The version command can now set a version that is statically defined by the project.version field, updating pyproject.toml in place. Pass --force to allow an explicit downgrade

Fixed:

  • Allow the ; private annotation on project.import-names and project.import-namespaces entries rather than rejecting them as invalid import names.

  • Reject project.readme paths that are absolute or resolve outside of the project directory.

Commits
  • 558061c Fix ci (#2377)
  • bc6d1bc release Hatch v1.18.0 (#2376)
  • 8429e5d release Hatchling v1.32.0 (#2375)
  • 413b3a8 Prepare for release (#2374)
  • 4ccc9ea Bug Fix - fix CTRL-C behavior to correctly handle signals (#2369)
  • a885803 Add sources to enable other types of local dependencies (#2313)
  • ab3e000 Add --all flag to hatch build for building all workspace members (#2352)
  • bb90277 fix: Allow the ; private annotation in import-names/import-namespaces p...
  • 3a9d853 fix: prevent backward relative paths in readme (#2354)
  • c4dc4f8 test: Fix test expectations for metadata generated by flit-core (#2365)
  • Additional commits viewable in compare view

Updates vcs-versioning from 2.2.4 to 2.3.1

Release notes

Sourced from vcs-versioning's releases.

vcs-versioning v2.3.1

Fixed

  • Fix a FileNotFoundError crash in the git file finder when a submodule is tracked in the index but its working tree directory does not exist - such gitlinks are now skipped like not checked out submodules. (#1500)

vcs-versioning v2.3.0

Added

Fixed

  • Make the tag.strict and scm.git.describe_command diagnostics actionable and non-conflicting.

    The tag.strict future-default notice is now reported by the git backend rather than at configuration time, and only when the future default would actually select a different tag for the repository -- the message names both the current and the future version string. Projects the change cannot affect are silent, and setting an explicit describe_command no longer triggers it at all, so the two warnings can no longer contradict each other.

    The describe_command notice is likewise limited to the case where it and an explicit tag.strict really disagree, and no longer claims that tag.prefix has no effect -- prefix stripping applies regardless of how the tag was selected.

    Both are logged at warning level instead of raised as warnings, so SETUPTOOLS_SCM_DEBUG=ERROR silences them. (#1429)

  • Honour export-ignore on directories and submodules again in the git file finder.

    The switch from git archive to git ls-files --recurse-submodules lost two parts of the archive semantics: --recurse-submodules listed every submodule regardless of export-ignore, and the :(exclude,attr:export-ignore) pathspec only matches files, so an export-ignore on a directory no longer excluded the files below it. Projects that kept vendored submodules in an export-ignored directory suddenly shipped them in their sdists.

    The finder now lists a repository without recursion, checks export-ignore for directories via git check-attr (which is what git archive effectively does when it skips a tree), and only then descends into the submodules that survived. Submodule contents are still listed - with their own .gitattributes applied - so export-ignore in the parent repository now controls exactly which submodules get packaged. Submodules that are not checked out are skipped instead of failing the listing. (#1469)

  • Honour tag.strict on Mercurial changesets that carry tags of their own, and report the coming strict default for Mercurial repositories.

    tag.strict was only applied when looking for the latest tag, so a checked-out changeset tagged event-2024 still produced version 2024 even with tag.strict = true, while git rejected the same tag. Strict matching now applies to the tags on the changeset too: a changeset carrying only event-style tags is treated as untagged and versioning continues from the last real version tag, matching git describe --match. When several tags sit on one changeset, the version-shaped one is now selected instead of whichever Mercurial happened to list first.

    The tag.strict divergence diagnostic added in #1429 now covers Mercurial as well, naming the current and future version whenever the coming default would change them. Both backends share the message, and the git-only helpers moved to _backends/_scm_workdir.py.

    Note that the Mercurial backend required a dot in version tags before setuptools-scm 9, so for Mercurial projects the coming strict default restores the historical behavior. (#1495)

Commits
  • ffa8d49 Merge pull request #1502 from pypa/release/main
  • 21a40e6 Prepare release: vcs-versioning v2.3.1
  • 3c9c18d Merge pull request #1501 from RonnyPfannschmidt/fix-1500-missing-submodule-wo...
  • f6b41bb fix: skip gitlinks whose working tree is absent in file finding
  • 8ee692f Merge pull request #1493 from pypa/release/main
  • 784eb38 Prepare release: vcs-versioning v2.3.0
  • b815737 Merge pull request #1498 from RonnyPfannschmidt/fix-1469-export-ignore-submod...
  • 217ab54 fix: honour export-ignore for directories and submodules in file discovery (#...
  • 46ff855 Merge pull request #1497 from RonnyPfannschmidt/fix-1495-hg-tag-strict
  • 9be8078 test: cover hg tag selection as pure logic instead of via hg update
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the python-dependencies group across 1 directory with 5 up…
2e3ccb9 
…dates

Updates the requirements on [alpaca-py](https://github.com/alpacahq/alpaca-py), [ccxt](https://github.com/ccxt/ccxt), [databento](https://github.com/databento/databento-python), [hatchling](https://github.com/pypa/hatch) and [vcs-versioning](https://github.com/pypa/setuptools-scm) to permit the latest version.

Updates `alpaca-py` from 0.43.5 to 0.44.0
- [Release notes](https://github.com/alpacahq/alpaca-py/releases)
- [Commits](alpacahq/alpaca-py@v0.43.5...v0.44.0)

Updates `ccxt` to 4.5.74
- [Release notes](https://github.com/ccxt/ccxt/releases)
- [Commits](ccxt/ccxt@v4.5.31...v4.5.74)

Updates `databento` from 0.83.0 to 0.84.0
- [Release notes](https://github.com/databento/databento-python/releases)
- [Changelog](https://github.com/databento/databento-python/blob/main/CHANGELOG.md)
- [Commits](databento/databento-python@v0.83.0...v0.84.0)

Updates `hatchling` from 1.31.0 to 1.32.0
- [Release notes](https://github.com/pypa/hatch/releases)
- [Commits](pypa/hatch@hatchling-v1.31.0...hatchling-v1.32.0)

Updates `vcs-versioning` from 2.2.4 to 2.3.1
- [Release notes](https://github.com/pypa/setuptools-scm/releases)
- [Changelog](https://github.com/pypa/setuptools-scm/blob/main/RELEASE_SYSTEM.md)
- [Commits](pypa/setuptools-scm@vcs-versioning-v2.2.4...vcs-versioning-v2.3.1)

---
updated-dependencies:
- dependency-name: alpaca-py
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: ccxt
  dependency-version: 4.5.74
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: databento
  dependency-version: 0.84.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: hatchling
  dependency-version: 1.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: vcs-versioning
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@stefan-jansen stefan-jansen added compatibility: affected Has Python, platform, dependency, or cross-library compatibility impact ecosystem Tracked by a shared ML4T ecosystem requirement priority: normal Normal planned work status: accepted Accepted for implementation type: maintenance Internal maintenance without user-visible behavior dependencies Dependency updates python Python dependencies labels Aug 26, 2026
@stefan-jansen

stefan-jansen commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Local qualification at head 11a5efa passed from a clean fixed-revision worktree: dependency audit, minimum/locked/maximum dependency profiles, 978 deterministic tests, stress and controlled-fault suites, sustained performance qualification, strict docs, package build and metadata checks, security checks, pre-commit, and installed wheel/sdist verification on Python 3.12 through 3.14. The lockfile, build constraints, and dependency policy now describe the same dependency closure.

stefan-jansen
stefan-jansen approved these changes Aug 26, 2026
View reviewed changes

@stefan-jansen stefan-jansen left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved at head 11a5efa. All 26 required checks passed. Local fixed-revision qualification also passed the dependency profiles, 978-test suite, stress, controlled faults, performance, docs, artifacts, security, and installed-distribution checks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@stefan-jansen stefan-jansen stefan-jansen approved these changes

Assignees

No one assigned

Labels

compatibility: affected Has Python, platform, dependency, or cross-library compatibility impact dependencies Dependency updates ecosystem Tracked by a shared ML4T ecosystem requirement priority: normal Normal planned work python Python dependencies status: accepted Accepted for implementation type: maintenance Internal maintenance without user-visible behavior

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@stefan-jansen