chore(deps-dev): bump the uv group with 4 updates

[dependabot]

Bumps the uv group with 4 updates: prek, ty, ddtrace and fastapi.

Updates prek from 0.4.11 to 0.5.0

Release notes

Sourced from prek's releases.

0.5.0

Release Notes

Released on 2026-08-27.

Highlights

Choose where hook toolchains come from

language_version now accepts a source preference alongside the version request, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use managed (the default) or system to choose which source prek tries first while still allowing fallback and downloads. Use only-managed or only-system to require one source.

For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek:

repos:
  - repo: local
    hooks:
      - id: ruff
        name: ruff
        language: python
        entry: ruff check
        additional_dependencies: [ruff]
        language_version:
          request: "3.12"
          preference: only-managed

With only-managed, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from PATH, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment.

Existing scalar values such as language_version: "3.12" continue to work. See toolchain management and language_version for the full source-selection behavior. (#2613)

Breaking changes

The breaking changes in this release are mostly small cleanups, and most users should not be affected.

• Group names can no longer start with @. This prefix is now reserved for special group selectors such as the new @ungrouped selector. (#2617)
• PREK_MAX_CONCURRENCY has been removed. Use PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES to control hook and per-hook batch concurrency separately. (#2620)
• The top-level prek init-template-dir command has been removed. Use prek util init-template-dir, or prek init-templatedir for drop-in compatibility with pre-commit. (#2623)
• prek auto-update has been removed. Use prek update, or prek autoupdate for drop-in compatibility with pre-commit. (#2619)

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.0

Released on 2026-08-27.

Highlights

Choose where hook toolchains come from

language_version now accepts a source preference alongside the version request, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use managed (the default) or system to choose which source prek tries first while still allowing fallback and downloads. Use only-managed or only-system to require one source.

For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek:

repos:
  - repo: local
    hooks:
      - id: ruff
        name: ruff
        language: python
        entry: ruff check
        additional_dependencies: [ruff]
        language_version:
          request: "3.12"
          preference: only-managed

With only-managed, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from PATH, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment.

Existing scalar values such as language_version: "3.12" continue to work. See toolchain management and language_version for the full source-selection behavior. (#2613)

Breaking changes

The breaking changes in this release are mostly small cleanups, and most users should not be affected.

• Group names can no longer start with @. This prefix is now reserved for special group selectors such as the new @ungrouped selector. (#2617)
• PREK_MAX_CONCURRENCY has been removed. Use PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES to control hook and per-hook batch concurrency separately. (#2620)
• The top-level prek init-template-dir command has been removed. Use prek util init-template-dir, or prek init-templatedir for drop-in compatibility with pre-commit. (#2623)
• prek auto-update has been removed. Use prek update, or prek autoupdate for drop-in compatibility with pre-commit. (#2619)

Enhancements

... (truncated)

Commits

• 67f8535 Bump version to 0.5.0 (#2631)
• 4546bef Remove legacy init-template-dir command (#2623)
• e63bd4b Remove hook marker schema 0 (#2622)
• 8c433ae Remove config-tracking cache bootstrap (#2621)
• 62ca460 Remove PREK_MAX_CONCURRENCY (#2620)
• e2468ea Remove legacy update aliases (#2619)
• 795c3a4 Group run options in CLI help (#2629)
• b27eb6e Document prek run architecture (#2630)
• 7dd9aa9 Avoid persisting docs workflow credentials (#2627)
• 23815bd Remove the @builtin group selector (#2628)
• Additional commits viewable in compare view

Updates ty from 0.0.64 to 0.0.75

Release notes

Sourced from ty's releases.

0.0.75

Release Notes

Released on 2026-08-26.

Preview features

• Initialize PEP 723 script environments in the CLI (#27544)
• Refresh PEP 723 script environments in watch mode (#27617)
• Run PEP 723 script synchronization on bounded workers (#27615)

Bug fixes

• Specialize Self bounds of inherited methods (#27990)

LSP server

• Add "Go to Definition" support for pytest fixtures (#27444)

Documentation

• Fix documented Python package build command (#4384)
• Link untyped-call tracking issue in migration guide (#4382)

Library support

• Resolve imported pytest fixture exposures (#27539)
• Resolve installed core pytest fixture providers (#27770)
• Resolve pytest fixtures through conftest (#27540)

Diagnostics

• Add more autofixes (#28029)
• Add a dedicated missing-slot diagnostic (#28039)
• Explain missing storage for declared slotted attributes (#27969)
• Improve diagnostic spans for unpacked variable assignments (#28041)

Core type checking

• Account for known subclasses in equality inference (#28005)
• Expand ParamSpec signatures inferred from bound receivers (#28020)
• Fix Self binding in ParamSpec protocols (#28016)
• Fix TypedDict variance inference (#28052)
• Fix unsound narrowing through branch-assigned conditions (#28006)
• Ignore inconsistent binding decorators on overloads (#28036)
• Infer yield from send/return types from the iterator returned by __iter__ (#27987)
• Infer tuple type parameters from union arguments (#28062)
• Infer variance through nonrecursive protocol references (#28065)
• Preserve bounds of non-literal metaclasses (#28046)
• Preserve correlated generic-call inference (#28043)

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.75

Released on 2026-08-26.

Preview features

• Initialize PEP 723 script environments in the CLI (#27544)
• Refresh PEP 723 script environments in watch mode (#27617)
• Run PEP 723 script synchronization on bounded workers (#27615)

Bug fixes

• Specialize Self bounds of inherited methods (#27990)

LSP server

• Add "Go to Definition" support for pytest fixtures (#27444)

Documentation

• Fix documented Python package build command (#4384)
• Link untyped-call tracking issue in migration guide (#4382)

Library support

• Resolve imported pytest fixture exposures (#27539)
• Resolve installed core pytest fixture providers (#27770)
• Resolve pytest fixtures through conftest (#27540)

Diagnostics

• Add more autofixes (#28029)
• Add a dedicated missing-slot diagnostic (#28039)
• Explain missing storage for declared slotted attributes (#27969)
• Improve diagnostic spans for unpacked variable assignments (#28041)

Core type checking

• Account for known subclasses in equality inference (#28005)
• Expand ParamSpec signatures inferred from bound receivers (#28020)
• Fix Self binding in ParamSpec protocols (#28016)
• Fix TypedDict variance inference (#28052)
• Fix unsound narrowing through branch-assigned conditions (#28006)
• Ignore inconsistent binding decorators on overloads (#28036)
• Infer yield from send/return types from the iterator returned by __iter__ (#27987)
• Infer tuple type parameters from union arguments (#28062)
• Infer variance through nonrecursive protocol references (#28065)
• Preserve bounds of non-literal metaclasses (#28046)
• Preserve correlated generic-call inference (#28043)
• Preserve invariant materialization constraints (#28047)

... (truncated)

Commits

• a553dcc Bump version to 0.0.75 (#4396)
• 26b1b50 Update prek dependencies (#4392)
• 73d226e Fix documented Python package build command (#4384)
• 5e264da Link untyped-call tracking issue in migration guide (#4382)
• 00199f0 Bump version to 0.0.74 (#4351)
• 5769062 Update mypy/pyright comparison table (#4165)
• 4fcb060 Remove Zulip from the PGO training (#4336)
• a7a7064 Use the versions bot's ruleset bypass when merging (#4333)
• 01b0fab Update prek dependencies (#4325)
• deef42f Update dependency python to 3.14 (#4326)
• Additional commits viewable in compare view

Updates ddtrace from 4.12.0 to 4.14.0

Release notes

Sourced from ddtrace's releases.

4.14.0

Estimated end-of-life date, accurate to within three months: 05-2027

See the support level definitions for more information.

New Features

• AI Guard:

  • Adds a redaction feature that can be enabled in the UI. For more information, see the AI Guard SDK setup documentation.

• CI Visibility:

  • Adds a new ci.pipeline.display_name tag for the Buildkite provider, populated from the BUILDKITE_PIPELINE_NAME environment variable.

• Data Streams Monitoring:

  • Adds an optional tags argument to ddtrace.data_streams.set_produce_checkpoint and ddtrace.data_streams.set_consume_checkpoint. Pass a list of "key:value" strings to attach additional edge tags to a manual checkpoint alongside the automatically set type, topic, and direction tags. For example: set_produce_checkpoint("eventbridge", detail_type, carrier_set, tags=["exchange:my-bus"]). Existing calls that do not pass tags are unaffected.

• LLM Observability:

  • Adds LLMObs.list_experiments() to query experiments by logical name and metadata containment, such as {"tags": ["git.commit.sha:abc123"]}. It returns run status and aggregate data—including evaluations, token costs, and error rates—so CI/CD workflows can compare a run against a baseline commit and gate on the result.
  • Adds support for manually versioning agents. Pass version when starting an agent span, either with LLMObs.agent(name="my-agent", version="v3") or with the @agent(version="v3") decorator. For agents created by an auto-instrumented framework, use LLMObs.annotation_context(agent={"version": "v3"}). This sets the agent_version tag on agent spans. The agent argument accepts a plain dictionary or the new ddtrace.llmobs.Agent TypedDict class.
  • Adds LLMObs.submit_feedback() for submitting end-user feedback associated with a span, trace, session, or customer-defined feedback join key.

• OpenFeature:

  • Adds agentless delivery for the Feature Flagging and Experimentation (FFE) OpenFeature provider, loading Universal Flag Configuration directly from Datadog over HTTPS without requiring a Datadog Agent. Agentless delivery is now the default and requires DD_API_KEY. Set DD_FEATURE_FLAGS_CONFIGURATION_SOURCE=remote_config to continue loading configuration through the Datadog Agent's Remote Configuration.

• OpenTelemetry:

  • OTLP trace export now supports the http/protobuf protocol—the default—and http/json, selected through the OTEL_EXPORTER_OTLP_TRACES_PROTOCOL environment variable.

• Tracing:

  • Adds Span.remove_tag(key) and Span.remove_metric(key) for removing a previously set tag or metric from a span. Both methods are no-ops if the key is not set.

Bug Fixes

• AAP:

  • Fixes incorrect request fingerprints when a web application is wrapped by same-service tracing middleware.

• Botocore:

  • Fixes an issue where LLM Observability spans for Bedrock invoke_model_with_response_stream calls reported all token usage metrics as 0. Token counts are now extracted from the streamed response and set on the span.

• CI Visibility:

... (truncated)

Commits

• ef86511 upgrade pyproject.toml version
• 500e6bc chore: increase the package version (#19769)
• 5c04ddd fix: exit only entered wrapping context [backport 4.14] (#19764)
• 6a51eb5 chore: increase the package version (#19746)
• 101a1a7 chore(tracing): avoid reentrant SpanData borrow panic [backport 4.14] (#19742)
• cf5270c bump pyproject to 4.14.0rc2 (#19692)
• ebb8a61 ci: update one-pipeline to 1.3.1 (#19676)
• 922434c fix(profiling): avoid invalid thread ID dereference [backport 4.14] (#19664)
• c7fa551 ci: update ci-utils image [backport 4.14] (#19650)
• e9228c8 fix(snowflake): snowflake cursor now supports command keyword [backport 4.14]...
• Additional commits viewable in compare view

Updates fastapi from 0.140.13 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

• 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

• 📝 Document FASTAPI_ENV in FastAPI CLI guide. PR #16104 by @​tiangolo.

0.141.0

Features

• ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

Commits

• 95f8322 🔖 Release version 0.141.1 (#16106)
• f137944 📝 Update release notes
• d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
• 1d211b9 📝 Update release notes
• 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
• c7e7b65 🔖 Release version 0.141.0 (#16103)
• 6bceb84 📝 Update release notes
• 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions