Bumps the python group with 7 updates in the / directory:

Package	From	To
numba	0.66.0	0.67.0
numpy	2.4.6	2.5.2
shap	0.49.1	0.52.0
ruff	0.16.2	0.16.4
ty	0.0.69	0.0.73
validate-pyproject	0.25	0.26
nbformat	5.11.0	5.11.1

Updates numba from 0.66.0 to 0.67.0

Release notes

Sourced from numba's releases.

0.67.0

Major Numba release, adding NumPy 2.5 support. Please view the release notes here: https://numba.readthedocs.io/en/0.67.0/release/0.67.0-notes.html

Commits

• 3190b91 Merge pull request #10772 from swap357/release0.67
• f68f603 add current pr on 0.67 pr list
• 86a975c update final release date for 0.67
• c7f14cf Merge pull request #10726 from swap357/pin_deps_0.67
• 123fa28 update test refs and pin dependencies for release0.67
• 0c89330 Merge pull request #10724 from swap357/changelog_0.67
• ffaa017 Merge pull request #10723 from swap357/update_version_support_table_0.67.0rc1
• af0d879 fix wrapping on release notes
• a5e4654 Update docs/source/release/0.67.0-notes.rst
• e85720e Update docs/source/release/0.67.0-notes.rst
• Additional commits viewable in compare view

Updates numpy from 2.4.6 to 2.5.2

Release notes

Sourced from numpy's releases.

v2.5.2 (Aug 9, 2026)

NumPy 2.5.2 Release Notes

The NumPy 2.5.2 is a patch release that fixes bugs discovered after the 2.5.1 release. The big news is that it includes wheels for the newly released Python 3.15.0rc1.

This release supports Python versions 3.12-3.15

C API changes

PyArray_StringDTypeObject is opaque under the abi3t stable ABI

The PyArray_StringDTypeObject was accidentally exposed in NumPy 2.5 when targeting the free-threading-compatible stable ABI (Py_TARGET_ABI3T). PyArray_StringDTypeObject is now an opaque struct: extensions compiled that way cannot access its fields, since the struct layout depends on the size of the object header. Any code that accessed PyArray_StringDTypeObject fields in an abi3t build would have crashed, so we are making this API change in a bugfix release.

The NpyString allocator API remains usable by passing the descriptor object pointer, e.g. NpyString_acquire_allocator((PyArray_StringDTypeObject *)descr).

(gh-31771)

Contributors

A total of 16 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Abhijeetsingh Meena +
• Charalampos Stratakis
• Charles Harris
• Chris Ninham +
• David Woods
• Geonho +
• Gopu Yeshwanth Reddy +
• Iason Krommydas
• Ijtihed Kilani
• Jelle Zijlstra +
• Joren Hammudoglu
• Kumar Aditya
• Mike Boyle
• Nathan Goldbaum
• Raghuveer Devulapalli
• Sebastian Berg

... (truncated)

Commits

• 48fecee REL: Prepare for the NumPy 2.5.2 release (#32226)
• ecf599c Merge pull request #32221 from charris/backport-32151
• 3c7ac97 Merge pull request #32220 from charris/backport-32205
• 23b30f4 BUG: avoid segfaults when legacy copyswap slot is not defined (#32151)
• 4964ca8 TYP: isclose shape-typing fix for 2d array-likes (#32205)
• c37ed94 MAINT: Skip limited_api tests on some platforms. (#32214)
• 5cfd73b Merge pull request #32206 from charris/update-cibuildwheel
• d8262bc MAINT: Update cibuildwheel to v4.2.0
• 988d94d Merge pull request #32158 from charris/backport-32133
• b2e4f97 BUG: avoid possible stack overflow in arraydescr_dealloc (#32133)
• Additional commits viewable in compare view

Updates shap from 0.49.1 to 0.52.0

Release notes

Sourced from shap's releases.

v0.52.0

What's Changed

Highlights

• Native bindings rewritten with nanobind, and the build system migrated from setup.py to scikit-build-core + CMake. The Cython _kernel_lib.pyx and the existing _cext / _cext_gpu modules are now built as nanobind extensions, and MANIFEST.in / setup.py have been removed in favor of a pyproject.toml-driven build. (#4366, by @​CloseChoice and @​daidahao and @​claude)
• Minimum dependency versions raised to follow SPEC 0. (#4310, by @​CloseChoice)

Enhancements

• Log an INFO message when background data is sub-sampled (closes #3461). (#4294, by @​Ebube22)
• Add cross-links between the API Reference and API Examples pages. (#4329, by @​Abhishek9639)
• Drop the unused typing-extensions dependency. (#4629, by @​samudraneel05)

Bug Fixes

• Improve GPU TreeExplainer parity: preserve XGBoost default/missing child routing so NaN values follow the same branch as the source model, preserve vector-valued XGBoost base_score values (fixing multiclass additivity offsets), and tighten categorical handling so sklearn models with enable_categorical=True raise the existing unsupported-categorical error even when the booster does not expose feature_types. (#4997, by @​RAMitchell)
• TreeExplainer no longer crashes with pandas nullable dtypes. (#4298, by @​tudstudent)
• Fix NameError when with_binary=False and with_cuda=True by initializing compile_args. (#4322, by @​mohityadav8)
• Text plot colors render correctly by converting NumPy types to float. (#4332, by @​Saloni-0465)
• Assign the result of np.flipud so it is no longer a no-op in AdditiveForceArrayVisualizer. (#4343, by @​Mahaveerjain-18)
• Use isinstance() instead of is for type checks. (#4373, by @​divyam-jha123)
• Record 'sample' in Explanation.op_history instead of '__getitem__'. (#4376, by @​tarun-227)
• Move the unreachable large-dataset warning into the interventional branch. (#4392, by @​Mahaveerjain-18)
• Fix "structure of inputs doesn't match the expected structure". (#4410, by @​shaivimalik)
• Fix the return value from is_color_map() in plots/_beeswarm.py. (#4421, by @​maniktyagi04)
• Suppress the UserWarning when LGBMRegressor was fitted with feature names. (#4422, by @​shaivimalik)

... (truncated)

Commits

• 8461059 FIX: Improve GPU TreeExplainer parity (#4997)
• 8549e6b fix: use isinstance() instead of type() is tuple checks (#4508)
• 3be7001 remove webpack dependency for sickness scores (#5018)
• 6e9f9b8 build(deps): bump qs and express in /javascript (#5015)
• 9be5435 build(deps): bump idna from 3.11 to 3.15 in /docs (#5007)
• 52dd763 pin torch to <=2.11.0 in pyproject.toml (#5017)
• d8f2e76 build(deps-dev): bump webpack-dev-server in /javascript (#5009)
• ac6e677 build(deps-dev): bump @​babel/plugin-transform-modules-systemjs (#4991)
• 679b2ee FIX: warn when covariance matrix is singular in LinearExplainer (#4471)
• ce4abd7 build(deps): bump mistune from 3.2.0 to 3.2.1 (#4990)
• Additional commits viewable in compare view

Updates ruff from 0.16.2 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

• [flake8-use-pathlib] Add autofix for PTH116 (#26460)
• [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
• [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

• Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
• [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
• [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

• [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
• [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
• [syntax-errors] Detect duplicate keyword arguments (#17804)
• [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

• Offer display-only fixes and mark safe fixes preferred (#27807)
• Support pull diagnostics for notebook cells (#27779)

Documentation

• Add default indicator to rules table (#27724)
• Fix broken link to Python docs (#27757)

Other changes

• Fix s390x stacker assembly in release builds (#27776)
• Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
• Reduce configuration deserialization code size (#27924)
• Check packed AST index bounds (#27849)

Contributors

• @​AbhinavMir
• @​eduardorittner
• @​royb3
• @​MichaReiser
• @​carljm
• @​rosstitmarsh
• @​ntBre
• @​zaniebot

... (truncated)

Commits

• 11c76bf Bump 0.16.4 (#27937)
• d53c8c5 Isolate playground builds from deployment credentials (#27839)
• cab001e Disable uv preview for releases and pre-commit hooks (#27939)
• f8d575f [ty] Clarify writing guidance for human readers (#27912)
• ca45fae Set --preview and --default-index for the uv-lock hook (#27935)
• 4827bf7 Export UV_DEFAULT_INDEX in release.sh (#27934)
• d1087a4 [ty] Handle assignment expressions in string annotations (#27921)
• 680cce4 [ty] Optimize inherited recursive protocol comparisons (#27922)
• 974d3cb Upgrade ecosystem-analyzer and mypy_primer to the latest upstream pins (#27932)
• b169b40 Install cargo tools locked (#27929)
• Additional commits viewable in compare view

Updates ty from 0.0.69 to 0.0.73

Release notes

Sourced from ty's releases.

0.0.73

Release Notes

Released on 2026-08-18.

LSP server

• Do not prefer unsafe fixes in the language server (#27822)
• Fix signature help in trailing whitespace (#27784)

Library support

• Preserve variadic generics in functools.partial (#27774)

Diagnostics

• Add an opt-in rule flagging function decorators that transform a non-dynamic type into a dynamic type (#27829)
• Disambiguate same-named types in several diagnostics (#27814)
• Show error spans for errors originating in script metadata (#26693)

Core type checking

• Avoid bypassing solver during literal promotion (#27763)
• Expand nested union aliases when finding a TypedDict or callable (#27740)
• Implement intersection meta-type projection (#27660)
• Infer generic protocols from class objects (#27812)
• Model exception-suppressing context managers (#27219)
• Preserve TypeAliasType runtime origin (#27813)
• Preserve class objects in lazy protocol checks (#27815)
• Preserve declared types in exception handlers (#27817)
• Preserve explicit globals after conditional rebinding (#27786)
• Preserve property subclass types and accessors (#27833)
• Preserve required stub fields in generated constructors (#27765)
• Preserve static upper bounds of gradual solutions (#27664)
• Prevent unrelated quantified constraints from destabilizing recursive queries (#27737)
• Separate generic constraint accumulation from legacy projection (#27743)
• Simplify generic protocol inference (#27819)
• Specialize inherited members of unspecialized generic classes (#27658)
• Specialize type variables determined by bound receivers (#27732)
• Support unpacking tuple type aliases (#27825)
• Sync vendored typeshed stubs (#27771). Typeshed diff

Performance

• Cache py.typed contents (#27805)
• Deduplicate exception checkpoints across equivalent branches (#27703)

Contributors

• @​charliermarsh

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.73

Released on 2026-08-18.

LSP server

• Do not prefer unsafe fixes in the language server (#27822)
• Fix signature help in trailing whitespace (#27784)

Library support

• Preserve variadic generics in functools.partial (#27774)

Diagnostics

• Add an opt-in rule flagging function decorators that transform a non-dynamic type into a dynamic type (#27829)
• Disambiguate same-named types in several diagnostics (#27814)
• Show error spans for errors originating in script metadata (#26693)

Core type checking

• Avoid bypassing solver during literal promotion (#27763)
• Expand nested union aliases when finding a TypedDict or callable (#27740)
• Implement intersection meta-type projection (#27660)
• Infer generic protocols from class objects (#27812)
• Model exception-suppressing context managers (#27219)
• Preserve TypeAliasType runtime origin (#27813)
• Preserve class objects in lazy protocol checks (#27815)
• Preserve declared types in exception handlers (#27817)
• Preserve explicit globals after conditional rebinding (#27786)
• Preserve property subclass types and accessors (#27833)
• Preserve required stub fields in generated constructors (#27765)
• Preserve static upper bounds of gradual solutions (#27664)
• Prevent unrelated quantified constraints from destabilizing recursive queries (#27737)
• Separate generic constraint accumulation from legacy projection (#27743)
• Simplify generic protocol inference (#27819)
• Specialize inherited members of unspecialized generic classes (#27658)
• Specialize type variables determined by bound receivers (#27732)
• Support unpacking tuple type aliases (#27825)
• Sync vendored typeshed stubs (#27771). Typeshed diff

Performance

• Cache py.typed contents (#27805)
• Deduplicate exception checkpoints across equivalent branches (#27703)

Contributors

• @​charliermarsh
• @​AlexWaygood

... (truncated)

Commits

• 4bd2833 Bump version to 0.0.73 (#4322)
• 93d0d4f Disable known GitHub cache clients in release workflows (#4317)
• ec4806b Harden release workflow permissions and shell inputs (#4319)
• f61c758 Disable cache-aware actions throughout release workflows (#4321)
• b25dd98 Require wheels for Python tooling dependencies (#4313)
• 07cd61a Manage docs build with a dep group (#4315)
• b37f512 Require the release tooling lockfile (#4316)
• 7a1c4e7 Fix vulnerable Python dependencies (#4282)
• 7abd818 Add dependency cooldowns (#4281)
• 62ebbec Bump version to 0.0.72 (#4268)
• Additional commits viewable in compare view

Updates validate-pyproject from 0.25 to 0.26

Release notes

Sourced from validate-pyproject's releases.

0.26

What's Changed

New Features

• Added support for PEP 808 partially dynamic metadata by @​henryiii (#314).

Main Fixes and Improvements

• Allowed multiple schemas describing the same tool when the schema definitions are identical, by @​henryiii (#303).
• Improved SchemaStore compatibility by supporting relative schema URLs, by @​henryiii (#306).
• Fixed filtering of multi_schema entry points before loading, by @​henryiii (#318).
• Added network request timeouts to avoid indefinite blocking, by @​henryiii (#319).

Contributors

Special thanks to @​henryiii, as well as @​DimitriPapadopoulos and all other contributors who helped improve the project.

Full Changelog: abravalheri/validate-pyproject@v0.25...0.26

Changelog

Sourced from validate-pyproject's changelog.

Version 0.26

• Add support for :pep:808 partially dynamic metadata by :user:henryiii (:pr:314)
• Allow multiple schemas describing the same tool when the schema definitions are identical by :user:henryiii (:pr:303)
• Improve SchemaStore compatibility by supporting relative schema URLs by :user:henryiii (:pr:306)
• Apply filtering before loading validate_pyproject.multi_schema entry points by :user:henryiii (:pr:318)
• Add timeouts to network requests to avoid indefinite blocking by :user:henryiii (:pr:319)

Commits

• 17e1277 Update CHANGELOG for version 0.26
• d097f4b chore(deps): bump astral-sh/setup-uv in the actions group (#332)
• 14f4cdc Populate changelog for upcoming version
• c2f3d75 feat: implement PEP 808 (partially dynamic metadata)
• a6441c6 refactor: clarify PEP 808 error message and add fixtures
• 04032da fix: revert URL now that the guidelines are updated
• 7c0b759 style: pre-commit fixes
• a8b20a4 feat: implement PEP 808 — partially dynamic metadata
• 0076413 chore(deps): update pre-commit hooks (#331)
• 92829d8 chore(deps): bump astral-sh/setup-uv in the actions group (#330)
• Additional commits viewable in compare view

Updates nbformat from 5.11.0 to 5.11.1

Release notes

Sourced from nbformat's releases.

v5.11.1

5.11.1

(Full Changelog)

Merged PRs

• Try to skip publishing to NPM to be able to publish a patch version on PYPI #459 (@​Carreau)
• disable pendingdeprecationWarnings for now #458 (@​Carreau)
• Bump github/codeql-action from 4.37.3 to 4.37.5 in the actions group #453 (@​Carreau)
• Clarify normalize guidance in the changelog #451 (@​aryansk, @​Carreau)
• fix steps to skip #450 (@​Carreau)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​aryansk (activity) | @​Carreau (activity)

Changelog

Sourced from nbformat's changelog.

5.11.1

(Full Changelog)

Merged PRs

• Try to skip publishing to NPM to be able to publish a patch version on PYPI #459 (@​Carreau)
• disable pendingdeprecationWarnings for now #458 (@​Carreau)
• Bump github/codeql-action from 4.37.3 to 4.37.5 in the actions group #453 (@​Carreau)
• Clarify normalize guidance in the changelog #451 (@​aryansk, @​Carreau)
• fix steps to skip #450 (@​Carreau)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​aryansk (activity) | @​Carreau (activity)

Commits

• 75f819f Publish 5.11.1
• 4db76de Bump github/codeql-action from 4.37.3 to 4.37.5 in the actions group
• 3eca403 Try to skip publishing to NPM to be able to publish a patch version on
• d2c5d33 disable pendingdeprecationWarnings for now
• 003ea2c fix steps to skip
• 2e1272b style: pre-commit fixes
• 0bd4ebe Clarify normalize guidance in the changelog
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions