[dependabot]

Bumps the python group with 3 updates in the /python directory: ruff, polars and aws-lambda-powertools.

Updates ruff from 0.16.7 to 0.16.10

Release notes

Sourced from ruff's releases.

0.16.10

Release Notes

Released on 2026-10-01.

Preview features

• Add a migration guide for categories (#28087)
• [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

• Reduce memory used by diagnostics (#28951)

Server

• Avoid running uv format in untrusted workspaces (#28873)

Documentation

• Fix links to moved changelog sections and renamed mdtests (#28941)
• Add Python 3.15 as a supported version (#28907)
• Add ty as a type checker example (#28906)

Other changes

• Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

• @​ntBre
• @​spaceone
• @​HardMax71
• @​charliermarsh

Install ruff 0.16.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.ps1 | iex"

Download ruff 0.16.10

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.10

Released on 2026-10-01.

Preview features

• Add a migration guide for categories (#28087)
• [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

• Reduce memory used by diagnostics (#28951)

Server

• Avoid running uv format in untrusted workspaces (#28873)

Documentation

• Fix links to moved changelog sections and renamed mdtests (#28941)
• Add Python 3.15 as a supported version (#28907)
• Add ty as a type checker example (#28906)

Other changes

• Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

• @​ntBre
• @​spaceone
• @​HardMax71
• @​charliermarsh

0.16.9

Released on 2026-09-24.

Preview features

• [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

• [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
• [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

• Update LibCST-based fixes for Python 3.15 (#28616)

... (truncated)

Commits

• 3265ed1 Bump version to 0.16.10 (#29055)
• e786964 Authorize shared PR security-review workflow to publish findings (#29052)
• a81291e [ty] Defer uv workspace discovery until after project configuration (#28525)
• b6a74d2 [ty] Refresh uv project metadata when uv files change (#28529)
• 41d30df Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)
• 317e0a3 [ty] Bound nested callable signature display (#29049)
• 8546752 [ty] Fix member lookup on union-bounded type variables (#29018)
• 56180bc [ty] Specialize instance members once (#29043)
• aa9a1ff [ty] Avoid stale I/O diagnostics when closing deleted files (#28988)
• 2d25346 [ty] Improve unresolved-import documentation (#29039)
• Additional commits viewable in compare view

Updates polars from 1.44.2 to 2.0.0

Release notes

Sourced from polars's releases.

Python Polars 2.0.0

💥 Breaking changes

• Run SQL window functions over grouped rows on the aggregated rows, and evaluate QUALIFY before the projection (#29746)
• Type exact SQL numeric literals as Decimal and truncate SQL %/DIV (#29536)
• Allow deterministic expression plugins to opt into CSE/CSPE (#29428)
• Read Parquet ENUM type as pl.String (#29331)
• More map operations (#29296)
• Deprecate cut/qcut (#29329)

🚀 Performance improvements

• Fix phases ending too soon due to join sampling (#29752)
• Group record batch fetches of remote IPC scans (#29750)
• Mark group-by node as memory intensive pipeline blocker (#29749)
• Don't inline slow OOC memory drift path (#29745)
• Only prefetch on unspill when there is memory headroom (#29701)
• Pushdown filters to scan_lance (#29538)
• Do not materialize equal ScalarColumns in Column::append/extend (#28989)
• Evaluate scalar windows in the streaming window node (#29698)
• Don't materialize scalar columns in DataFrame::estimated_size (#29711)
• Defer cached pread from prefetch to decode for Parquet (#29702)
• Decode IPC scans out of order when order is not observed (#29675)
• IPC metadata suffix fetch (#29692)
• Speed up null tracking in streaming group-by sum, min and max (#29691)
• Cache Iceberg manifest files across scans (#29623)
• Improve pushdown support for fallible Hive predicates (#29594)
• Streamline BytecodeParser method rewriting (#29632)
• Stream from_dicts records straight into column buffers (#29656)
• Read correlated SQL aggregates from the outer join when the subquery repeats it (#29685)
• Emit files unordered for remote IPC files when order not observed (#29678)
• Don't keep input order for order-insensitive windows in all engines (#29680)
• Fix parallelization in top-k reducer (#29684)
• Share one bloom filter between the build threads of a runtime filter (#29677)
• Add streaming (out-of-core) sort (#29657)
• Insert keys that start a run of equal keys into the hot group-by table right away (#29673)
• Prefetch key-row hash table lookups in blocks (#29663)
• Lower count-guarded sums to a sum that is null on empty input (#29668)
• Use single PUT for small cloud uploads (#29603)
• Don't cache plain scans in the streaming engine (#29654)
• Change single-key group-by hash table layout and add prefetching (#29661)
• Use the integer ranges of sampled parquet row groups in filter estimates (#29655)
• Raise HTTP rate-limiter read init default (#29584)
• Change join hash table layout and add prefetching (#29653)
• Add a fast-path for as_list with only a single input (#29592)
• Use one runtime filter builder per thread for a finished sample (#29646)
• Compute decimal addition, subtraction and multiplication in i64 when values fit (#29638)
• Spread decimal sums and means over lanes and check the sum's 38 digits once (#29637)
• Compute decimal addition, subtraction and multiplication without per-row validity (#29634)
• Skip or reuse UDF disassembly in BytecodeParser (#29625)

... (truncated)

Commits

• 22a147d perf: Fix phases ending too soon due to join sampling (#29752)
• e319cca Python Polars 2.0 (#29723)
• d1d6ba4 fix: Find SQL aggregates by their function name, and raise on nested aggregat...
• 5c6a473 perf: Group record batch fetches of remote IPC scans (#29750)
• c630040 perf: Mark group-by node as memory intensive pipeline blocker (#29749)
• e1fbe49 fix: Run SQL window functions over grouped rows on the aggregated rows, and e...
• 3de661d feat: Enable OOC by default with 80% of available RAM as threshold (#29741)
• 0159b45 refactor: Hold the category mapping in the categorical is_in lookup (#29747)
• 29995b3 perf: Don't inline slow OOC memory drift path (#29745)
• 8399cf6 fix: Match categories added after is_in prepares a string haystack (#29744)
• Additional commits viewable in compare view

Updates aws-lambda-powertools from 3.34.0 to 3.35.0

Release notes

Sourced from aws-lambda-powertools's releases.

v3.35.0

Summary

This release includes an important security improvement for Data Masking and a significant cold start optimization for Parser.

We are happy to welcome six new contributors in this release: @​Adityaj0, @​manshahH, @​ErezMizrahi, @​wuodar, @​MohammedAlkindi, and @​TanbirRamim. Thank you for taking the time to report problems, work through reviews, and improve the prokject.

Data Masking now fails closed

Previously, an error while applying a masking rule could emit a warning and return the original value unchanged. Since callers received a normal return value, they could continue logging or storing data believing that masking had succeeded.

Data Masking now raises DataMaskingError when a masking provider fails, a masking path is invalid, or a regular expression cannot be compiled. Existing Data Masking exceptions now inherit from this common base exception.

from aws_lambda_powertools.utilities.data_masking import DataMasking
from aws_lambda_powertools.utilities.data_masking.exceptions import DataMaskingError
data_masker = DataMasking()
try:
masked = data_masker.erase(
{"customer": {"email": "customer@example.com"}},
masking_rules={"customer.email": {"regex_pattern": "[", "mask_format": "*"}},
)
except DataMaskingError:
# Stop processing the payload when masking cannot be completed.
raise

Missing fields continue to follow the existing raise_on_missing_field setting. With its default value, a missing field raises DataMaskingFieldNotFoundError; when explicitly disabled, Data Masking emits a warning and continues.

See #8446 for the complete change.

Faster Parser imports

Importing parse or event_parser previously loaded all 16 Parser envelope modules, even when the application did not use an envelope.

Envelopes and BaseEnvelope are now loaded only when first accessed. Existing public imports continue to work, so no application changes are required.

In the Lambda benchmark contributed in #8405, this reduced INIT_DURATION by approximately 900ms on arm64 with Python 3.13 and 1024MB of memory. The exact improvement depends on the function and packaging configuration.

Thank you @​ErezMizrahi for finding this and working through the compatibility details with us.

Changes

• fix(metrics): stop spurious overwrite warnings from set_default_dimensions (#8403) by @​vishwakt
• chore(feature_flags): warn on empty schema and empty rules (#8430) by @​dreamorosi
• fix(event_handler): match generic alias response models in OpenAPI schema (#8453) by @​TanbirRamim
• fix(feature_flags): handle same-hour midnight rollover and reject malformed HH:MM (#8428) by @​dreamorosi
• test(shared): compare abs_lambda_path against a normalised path (#8457) by @​MohammedAlkindi

... (truncated)

Changelog

Sourced from aws-lambda-powertools's changelog.

[v3.35.0] - 2026-09-15

Maintenance

• version bump
• deps: bump valkey-glide from 2.5.1 to 2.5.2 (#8459)

Commits

• 4770746 chore: version bump
• d7d5168 chore(deps): bump valkey-glide from 2.5.1 to 2.5.2 (#8459)
• 440e3ec chore(deps-dev): bump cdklabs-generative-ai-cdk-constructs from 0.1.318 to 0....
• 226f384 chore(deps-dev): bump types-python-dateutil from 2.9.0.20260518 to 2.9.0.2026...
• b712d3c chore(deps): bump aws-encryption-sdk from 4.0.6 to 4.0.7 (#8460)
• a5b8045 chore(deps): bump avro from 1.12.1 to 1.12.2 (#8462)
• 94b9d5e fix(metrics): stop spurious overwrite warnings from set_default_dimensions (#...
• 14af77f chore(feature_flags): warn on empty schema and empty rules (#8430)
• 362a797 fix(event_handler): match generic alias response models in OpenAPI schema (#8...
• 237f4db fix(feature_flags): missing context key never satisfies a condition (#8429)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: auto-approve, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[greptile-apps]

PR author is in the excluded authors list.

[silvexis]

Lockfile-only group bump. The polars 1.x -> 2.0 major is the one to watch, but the full 13-check matrix is green and every release is now past our 7-day window. Approving. Template users inherit polars 2.x, so worth a line in the next release notes.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.