chore(deps): bump the python-minor-patch group in /python with 4 updates

[dependabot]

Bumps the python-minor-patch group in /python with 4 updates: ruff, pytest-mock, filelock and langchain-core.

Updates ruff from 0.16.9 to 0.16.10

Release notes

Sourced from ruff's releases.

0.16.10

Release Notes

Released on 2026-10-01.

Preview features

• Add a migration guide for categories (#28087)
• [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

• Reduce memory used by diagnostics (#28951)

Server

• Avoid running uv format in untrusted workspaces (#28873)

Documentation

• Fix links to moved changelog sections and renamed mdtests (#28941)
• Add Python 3.15 as a supported version (#28907)
• Add ty as a type checker example (#28906)

Other changes

• Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

• @​ntBre
• @​spaceone
• @​HardMax71
• @​charliermarsh

Install ruff 0.16.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.ps1 | iex"

Download ruff 0.16.10

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.10

Released on 2026-10-01.

Preview features

• Add a migration guide for categories (#28087)
• [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

• Reduce memory used by diagnostics (#28951)

Server

• Avoid running uv format in untrusted workspaces (#28873)

Documentation

• Fix links to moved changelog sections and renamed mdtests (#28941)
• Add Python 3.15 as a supported version (#28907)
• Add ty as a type checker example (#28906)

Other changes

• Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

• @​ntBre
• @​spaceone
• @​HardMax71
• @​charliermarsh

Commits

• 3265ed1 Bump version to 0.16.10 (#29055)
• e786964 Authorize shared PR security-review workflow to publish findings (#29052)
• a81291e [ty] Defer uv workspace discovery until after project configuration (#28525)
• b6a74d2 [ty] Refresh uv project metadata when uv files change (#28529)
• 41d30df Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)
• 317e0a3 [ty] Bound nested callable signature display (#29049)
• 8546752 [ty] Fix member lookup on union-bounded type variables (#29018)
• 56180bc [ty] Specialize instance members once (#29043)
• aa9a1ff [ty] Avoid stale I/O diagnostics when closing deleted files (#28988)
• 2d25346 [ty] Improve unresolved-import documentation (#29039)
• Additional commits viewable in compare view

Updates pytest-mock from 3.15.1 to 3.16.0

Release notes

Sourced from pytest-mock's releases.

v3.16.0

2026-09-27

• #604: Fixed duplicate_iterators=True for async functions spied with mocker.spy.
• #611: Fixed async mock assertion introspection to use awaited arguments instead of the latest call's arguments.
• #606: mocker.resetall(return_value=True, side_effect=True) now also applies to non-callable mocks, such as those returned by mocker.create_autospec(SomeClass, instance=True). Previously both arguments were silently ignored for them.
• #547: Added SpyType for annotating mocker.spy results.
• Dropped support for EOL Python 3.9.
• #147: Removed handling of RuntimeError: stop called on unstarted patcher, which can no longer occur in the supported Python versions.
• Added support for Python 3.15.

Changelog

Sourced from pytest-mock's changelog.

3.16.0

2026-09-27

• [#604](https://github.com/pytest-dev/pytest-mock/issues/604) <https://github.com/pytest-dev/pytest-mock/pull/604>_: Fixed duplicate_iterators=True for async functions spied with mocker.spy.
• [#611](https://github.com/pytest-dev/pytest-mock/issues/611) <https://github.com/pytest-dev/pytest-mock/pull/611>_: Fixed async mock assertion introspection to use awaited arguments instead of the latest call's arguments.
• [#606](https://github.com/pytest-dev/pytest-mock/issues/606) <https://github.com/pytest-dev/pytest-mock/pull/606>_: mocker.resetall(return_value=True, side_effect=True) now also applies to non-callable mocks, such as those returned by mocker.create_autospec(SomeClass, instance=True). Previously both arguments were silently ignored for them.
• [#547](https://github.com/pytest-dev/pytest-mock/issues/547) <https://github.com/pytest-dev/pytest-mock/issues/547>_: Added SpyType for annotating mocker.spy results.
• Dropped support for EOL Python 3.9.
• [#147](https://github.com/pytest-dev/pytest-mock/issues/147) <https://github.com/pytest-dev/pytest-mock/issues/147>_: Removed handling of RuntimeError: stop called on unstarted patcher, which can no longer occur in the supported Python versions.
• Added support for Python 3.15.

Commits

• f3b531f Release 3.16.0
• 71ed673 Fix duplicate_iterators for async spies (#604)
• 0797e3d Fix async assertion argument introspection (#611)
• e24c334 docs: import os in the opening usage example (#612)
• 9e7eb7b [pre-commit.ci] pre-commit autoupdate (#613)
• 445fd4d [pre-commit.ci] pre-commit autoupdate (#610)
• a8bd0b1 Honour resetall() arguments for non-callable mocks (#606)
• 6559fdf [pre-commit.ci] pre-commit autoupdate (#608)
• 466d026 [pre-commit.ci] pre-commit autoupdate (#605)
• 164defe [pre-commit.ci] pre-commit autoupdate (#603)
• Additional commits viewable in compare view

Updates filelock from 4.0.3 to 4.0.9

Release notes

Sourced from filelock's releases.

4.0.9

What's Changed

• 📝 docs(util): correct write and break guarantees by @​pralav-25 in tox-dev/filelock#762
• 🐛 fix(read-write): close db fd after connect by @​gaborbernat in tox-dev/filelock#763

New Contributors

• @​pralav-25 made their first contribution in tox-dev/filelock#762

Full Changelog: tox-dev/filelock@4.0.8...4.0.9

4.0.8

What's Changed

• 🐛 fix(read-write): refuse cross-thread write release by @​feiiiiii5 in tox-dev/filelock#761

Full Changelog: tox-dev/filelock@4.0.7...4.0.8

4.0.7

What's Changed

• 🐛 fix(mode): require owner read and write by @​gaborbernat in tox-dev/filelock#760

Full Changelog: tox-dev/filelock@4.0.6...4.0.7

4.0.6

What's Changed

• fix(read-write): validate reentrant timeouts by @​feiiiiii5 in tox-dev/filelock#756

Full Changelog: tox-dev/filelock@4.0.5...4.0.6

4.0.5

What's Changed

• fix(marker): preserve live owners by @​DawnofGenX in tox-dev/filelock#751
• fix(tests): separate mode and access checks by @​pasmud in tox-dev/filelock#753
• fix(read-write): honor instance defaults by @​DawnofGenX in tox-dev/filelock#752
• fix(async): validate blocking read-write timeouts by @​pasmud in tox-dev/filelock#755
• fix(strict): handle vanished unreadable claims by @​januththedev in tox-dev/filelock#754

New Contributors

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

---

4.0.11 (2026-10-05)

---

• ReadWriteLock and AsyncReadWriteLock use a validated private hard link when /dev/fd has no entry for the database descriptor, supporting NetBSD's static descriptor directory beyond descriptor 63. The temporary location must share a filesystem with the database. The symlink refusal test accepts NetBSD's error wording.

---

4.0.10 (2026-10-03)

---

• Reusing a singleton AsyncFileLock with another loop, executor or run_in_executor, or a singleton SoftFileLease with another lease_duration, heartbeat_interval or on_compromise, now raises ValueError instead of returning the lock with its original options. :pr:765

---

4.0.9 (2026-10-01)

---

• ReadWriteLock and AsyncReadWriteLock close the descriptor that checks the database path once SQLite has connected, so on PyPy a dropped lock leaves no descriptor open until garbage collection runs. :pr:763
• ReadWriteLock and AsyncReadWriteLock refuse a symlink at the database path instead of following it, so a user who can create names in a shared lock directory cannot point the lock at another file (GHSA-j8f7-rjxc-mr56).

---

4.0.8 (2026-10-01)

---

• ReadWriteLock.release() and SoftReadWriteLock.release() from a thread that does not hold the write lock now raise RuntimeError instead of dropping the holder's lock and letting a second writer in. :pr:761

---

4.0.7 (2026-09-29)

---

• File locks now raise ValueError at construction when mode denies the owner read or write, such as mode=0o444, instead of failing on a later acquire and staying broken until someone deletes the lock file. :pr:760

---

4.0.6 (2026-09-28)

---

... (truncated)

Commits

• 7b00bb8 Release 4.0.9
• 4944624 🐛 fix(read-write): close db fd after connect (#763)
• 162060e 📝 docs(util): correct write and break guarantees (#762)
• 4d45e83 Merge commit from fork
• 9376e9b Release 4.0.8
• 34f4657 🐛 fix(read-write): refuse cross-thread write release (#761)
• 9ed62ac Release 4.0.7
• 2f2c4a7 🐛 fix(mode): require owner read and write (#760)
• d4ffe9c build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-acti...
• 61ce360 Release 4.0.6
• Additional commits viewable in compare view

Updates langchain-core from 1.6.5 to 1.6.6

Release notes

Sourced from langchain-core's releases.

langchain-core==1.6.6

Changes since langchain-core==1.6.5

release(core): 1.6.6 (#40906) fix(anthropic): support Claude Sonnet 5.5 compatibility (#40882) docs(core): fix docstring examples that don't run as copied (#40815)

Commits

• 04ac76c chore(model-profiles): refresh model profile data (#40902)
• 08064f4 release(core): 1.6.6 (#40906)
• ce90661 fix(anthropic): support Claude Sonnet 5.5 compatibility (#40882)
• 78a3cbc hotfix(fireworks): replace unavailable integration test model (#40890)
• 316c045 release(fireworks): 1.7.0 (#40889)
• be854a1 release(langchain): 1.4.3 (#40888)
• 2ade674 fix(langchain): sanitize cache settings for fallback models (#40886)
• 88b9727 feat(fireworks): add prompt caching middleware (#38823)
• 60e57f5 fix(fireworks): classify mid-stream read timeouts (#40874)
• 42f04f4 docs: update OpenWiki (#40781)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.