[dependabot]

Bumps the python group with 4 updates in the /python directory: ruff, polars, pydantic and aws-lambda-powertools.

Updates ruff from 0.16.7 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

• Update the default and latest Python versions for 3.15 (#28792)

  Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15

... (truncated)

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (#29384)
• 355b42a [ty] Avoid writable override contracts from object (#29373)
• e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
• Additional commits viewable in compare view

Updates polars from 1.44.2 to 2.0.0

Release notes

Sourced from polars's releases.

Python Polars 2.0.0

💥 Breaking changes

• Run SQL window functions over grouped rows on the aggregated rows, and evaluate QUALIFY before the projection (#29746)
• Type exact SQL numeric literals as Decimal and truncate SQL %/DIV (#29536)
• Allow deterministic expression plugins to opt into CSE/CSPE (#29428)
• Read Parquet ENUM type as pl.String (#29331)
• More map operations (#29296)
• Deprecate cut/qcut (#29329)

🚀 Performance improvements

• Fix phases ending too soon due to join sampling (#29752)
• Group record batch fetches of remote IPC scans (#29750)
• Mark group-by node as memory intensive pipeline blocker (#29749)
• Don't inline slow OOC memory drift path (#29745)
• Only prefetch on unspill when there is memory headroom (#29701)
• Pushdown filters to scan_lance (#29538)
• Do not materialize equal ScalarColumns in Column::append/extend (#28989)
• Evaluate scalar windows in the streaming window node (#29698)
• Don't materialize scalar columns in DataFrame::estimated_size (#29711)
• Defer cached pread from prefetch to decode for Parquet (#29702)
• Decode IPC scans out of order when order is not observed (#29675)
• IPC metadata suffix fetch (#29692)
• Speed up null tracking in streaming group-by sum, min and max (#29691)
• Cache Iceberg manifest files across scans (#29623)
• Improve pushdown support for fallible Hive predicates (#29594)
• Streamline BytecodeParser method rewriting (#29632)
• Stream from_dicts records straight into column buffers (#29656)
• Read correlated SQL aggregates from the outer join when the subquery repeats it (#29685)
• Emit files unordered for remote IPC files when order not observed (#29678)
• Don't keep input order for order-insensitive windows in all engines (#29680)
• Fix parallelization in top-k reducer (#29684)
• Share one bloom filter between the build threads of a runtime filter (#29677)
• Add streaming (out-of-core) sort (#29657)
• Insert keys that start a run of equal keys into the hot group-by table right away (#29673)
• Prefetch key-row hash table lookups in blocks (#29663)
• Lower count-guarded sums to a sum that is null on empty input (#29668)
• Use single PUT for small cloud uploads (#29603)
• Don't cache plain scans in the streaming engine (#29654)
• Change single-key group-by hash table layout and add prefetching (#29661)
• Use the integer ranges of sampled parquet row groups in filter estimates (#29655)
• Raise HTTP rate-limiter read init default (#29584)
• Change join hash table layout and add prefetching (#29653)
• Add a fast-path for as_list with only a single input (#29592)
• Use one runtime filter builder per thread for a finished sample (#29646)
• Compute decimal addition, subtraction and multiplication in i64 when values fit (#29638)
• Spread decimal sums and means over lanes and check the sum's 38 digits once (#29637)
• Compute decimal addition, subtraction and multiplication without per-row validity (#29634)
• Skip or reuse UDF disassembly in BytecodeParser (#29625)

... (truncated)

Commits

• 22a147d perf: Fix phases ending too soon due to join sampling (#29752)
• e319cca Python Polars 2.0 (#29723)
• d1d6ba4 fix: Find SQL aggregates by their function name, and raise on nested aggregat...
• 5c6a473 perf: Group record batch fetches of remote IPC scans (#29750)
• c630040 perf: Mark group-by node as memory intensive pipeline blocker (#29749)
• e1fbe49 fix: Run SQL window functions over grouped rows on the aggregated rows, and e...
• 3de661d feat: Enable OOC by default with 80% of available RAM as threshold (#29741)
• 0159b45 refactor: Hold the category mapping in the categorical is_in lookup (#29747)
• 29995b3 perf: Don't inline slow OOC memory drift path (#29745)
• 8399cf6 fix: Match categories added after is_in prepares a string haystack (#29744)
• Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• Additional commits viewable in compare view

Updates aws-lambda-powertools from 3.34.0 to 3.36.0

Release notes

Sourced from aws-lambda-powertools's releases.

v3.36.0

Summary

This release ships a new Auth utility in alpha, with two pieces: a JWT verifier to protect your APIs and an OAuth2 client to call APIs protected by someone else. It also fixes a handful of bugs across Data Classes, Streaming, Idempotency, Event Handler, Metrics and Feature Flags.

A special thank you to @​bfreiberg for the outstanding work on both Auth utilities. They helped and implemented them, wrote the docs and tested it.

Welcome also to our other new contributors @​Om-singhaI, @​Shubham-Padkonde, @​chancesong10 and @​chiruu12. Thank you for the reports, the fixes and the patience during reviews.

JWT verification (alpha)

Docs

You can now verify access tokens with JWTVerifier. It fetches and caches the issuer's JWKS, selects the signing key, and checks signature, issuer, audience, expiration and any claim you require. Only asymmetric algorithms are accepted, and errors never include token material.

from aws_lambda_powertools.event_handler import APIGatewayHttpResolver
from aws_lambda_powertools.utilities.auth_alpha import JWTVerifier
app = APIGatewayHttpResolver()
verifier = JWTVerifier(
issuer="https://idp.example.com",
audience="https://orders.example.com",
algorithms=["RS256"],
required_claims=["sub"],
)
@​app.get("/orders", middlewares=[verifier.require(scopes=["orders:read"])])
def list_orders():
return {"subject": app.context["claims"]["sub"]}

The middleware returns 401 for missing or invalid tokens and 403 for missing scopes. You can also call verifier.verify(token) directly, use verifier.authorize(event) inside an API Gateway Lambda authorizer, or start from JWTVerifier.cognito() for Amazon Cognito access tokens.

Install it with pip install "aws-lambda-powertools[jwt]". Thank you @​bfreiberg for building this with us.

OAuth2 client credentials (alpha)

Docs

You can now call downstream APIs protected by OAuth2 with OAuth2Client. It exchanges your client credentials for a bearer token, caches it, and refreshes it before it expires. Pass the client secret as a callable and it is loaded on every exchange, so it can come straight from Secrets Manager.

from aws_lambda_powertools.utilities.auth_alpha import OAuth2Client
inventory_api = OAuth2Client(
token_url="https://idp.example.com/token",
client_id="orders-service",
client_secret=load_secret,
</tr></table>

... (truncated)

Changelog

Sourced from aws-lambda-powertools's changelog.

[v3.36.0] - 2026-10-15

Bug Fixes

• data-classes: handle keyword arguments in CaseInsensitiveDict.update (#8518)
• data-classes: keep the value of large DynamoDB numbers (#8513)
• event_handler: skip compression when the response has no body (#8485)
• event_handler: emit Max-Age=0 for cookies with max_age=0 (#8488)
• feature_flags: warn on comparator evaluation errors (#8470)
• idempotency: apply jmespath_options to payload_validation_jmespath (#8474)
• idempotency: serialize UUID and datetime fields in dataclass payloads (#8501)
• layer: remove urllib3 from the Lambda layer again (#8556)
• metrics: preserve string default dimensions across instances (#8404)
• streaming: return empty bytes when reading at the end of an S3 object (#8511)

Features

• auth: add OAuth2 client credentials support (alpha) (#8486)
• auth: add JWT verification and API Gateway authorization (#8469)
• event_handler: add opt-in ALB response size validation (#8490)

Maintenance

• version bump
• deps: bump datadog-lambda from 8.122.0 to 8.128.0 (#8503)
• deps: bump soupsieve from 2.8.4 to 2.9 in /docs (#8471)
• deps: bump the github-actions group with 8 updates (#8549)
• deps: bump typing-extensions from 4.15.0 to 4.16.0 (#8482)
• deps: bump anyio from 4.12.1 to 4.14.2 (#8475)
• deps: bump release-drafter/release-drafter from 7.7.0 to 7.9.0 in the github-actions group (#8521)
• deps: bump the github-actions group with 5 updates (#8481)
• deps: bump pydantic from 2.13.4 to 2.13.5 (#8479)
• deps: bump the github-actions group with 2 updates (#8497)
• deps: bump pyjwt from 2.14.0 to 2.15.0 (#8506)
• deps: bump urllib3 from 2.7.0 to 2.8.0 in /docs (#8533)
• deps: bump pyjwt from 2.15.0 to 2.15.1 (#8530)
• deps: bump gitpython from 3.1.59 to 3.1.62 (#8531)
• deps: bump cryptography from 50.0.1 to 50.0.2 (#8527)
• deps: bump mkdocs-llmstxt from 0.2.0 to 0.5.0 (#8507)
• deps: bump pydantic-settings from 2.14.2 to 2.15.0 (#8504)
• deps-dev: bump types-requests from 2.33.0.20260712 to 2.33.0.20260906 (#8505)
• deps-dev: bump aws-cdk from 2.1143.0 to 2.1145.0 in the aws-cdk group (#8547)
• deps-dev: bump urllib3 from 2.7.0 to 2.8.0 in /layer_v3 (#8532)
• deps-dev: bump protobuf from 7.35.1 to 7.36.2 (#8528)
• deps-dev: bump aws-cdk from 2.1142.0 to 2.1143.0 in the aws-cdk group (#8491)
• deps-dev: bump ty from 0.0.49 to 0.0.84 (#8498)
• deps-dev: bump types-protobuf from 7.34.1.20260518 to 7.35.1.20260906 (#8495)
• deps-dev: bump ruff from 0.16.8 to 0.16.9 in the dev-dependencies group across 1 directory (#8493)
• deps-dev: bump sentry-sdk from 2.63.0 to 2.70.0 (#8496)
• deps-dev: bump filelock from 3.29.7 to 4.0.3 (#8494)
• deps-dev: bump the dev-dependencies group across 1 directory with 2 updates (#8478)

... (truncated)

Commits

• 5099d2e chore: version bump
• dc47557 fix(layer): remove urllib3 from the Lambda layer again (#8556)
• ce161fd chore(deps-dev): bump types-requests from 2.33.0.20260906 to 2.33.0.20261006 ...
• 5317765 chore(deps-dev): bump aws-cdk from 2.1143.0 to 2.1145.0 in the aws-cdk group ...
• a74600c chore(deps-dev): bump nox from 2026.4.10 to 2026.8.17 (#8551)
• 623fe84 chore(deps-dev): bump aws-cdk-aws-lambda-python-alpha from 2.272.0a0 to 2.273...
• ad8a3ac chore(deps): bump the github-actions group with 8 updates (#8549)
• d743540 chore(deps-dev): bump ruff from 0.16.10 to 0.17.0 in the dev-dependencies gro...
• 56c2134 chore(deps-dev): bump sentry-sdk from 2.70.0 to 2.71.0 (#8554)
• 5b74209 chore(deps): bump release-drafter/release-drafter from 7.7.0 to 7.9.0 in the ...
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: auto-approve, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[greptile-apps]

PR author is in the excluded authors list.

[silvexis]

Approving. Lockfile ages are all past the 7-day window and CI is green on b0c21dc. Non-blocking follow-up: land [tool.uv] exclude-newer = "7 days" on main (and ideally a 7-day uv cooldown in Dependabot) so the next lock can’t open under-age again; also worth noting the polars 1→2 major for template consumers since CI only syncs the dev extra.