chore(deps): bump the all-dependencies group with 3 updates

[dependabot]

Bumps the all-dependencies group with 3 updates: numpy, pybind11 and mypy.

Updates numpy from 2.4.3 to 2.4.4

Release notes

Sourced from numpy's releases.

2.4.4 (Mar 29, 2026)

NumPy 2.4.4 Release Notes

The NumPy 2.4.4 is a patch release that fixes bugs discovered after the 2.4.3 release. It should finally close issue #30816, the OpenBLAS threading problem on ARM.

This release supports Python versions 3.11-3.14

Contributors

A total of 8 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

• Charles Harris
• Daniel Haag +
• Denis Prokopenko +
• Harshith J +
• Koki Watanabe
• Marten van Kerkwijk
• Matti Picus
• Nathan Goldbaum

Pull requests merged

A total of 7 pull requests were merged for this release.

• #30978: MAINT: Prepare 2.4.x for further development
• #31049: BUG: Add test to reproduce problem described in #30816 (#30818)
• #31052: BUG: fix FNV-1a 64-bit selection by using NPY_SIZEOF_UINTP (#31035)
• #31053: BUG: avoid warning on ufunc with where=True and no output
• #31058: DOC: document caveats of ndarray.resize on 3.14 and newer
• #31079: TST: fix POWER VSX feature mapping (#30801)
• #31084: MAINT: numpy.i: Replace deprecated sprintf with snprintf...

Commits

• be93fe2 Merge pull request #31090 from charris/prepare-2.4.4
• f5245dc REL: Prepare for the NumPy 2.4.4 release
• 02e838b Merge pull request #31084 from charris/backport-31056
• fa74b2d MAINT: numpy.i: Replace deprecated sprintf with snprintf (#31056)
• 533a6db Merge pull request #31079 from charris/backport-20801
• 9e496cb TST: fix POWER VSX feature mapping (#30801)
• 8052c4b Merge pull request #31058 from charris/backport-31021
• 7f13b5a MAINT: Skip test on PyPy.
• 4c5fdd6 MAINT: Remove unused import of tracemalloc.
• a3ca5ed Update numpy/_core/src/multiarray/shape.c
• Additional commits viewable in compare view

Updates pybind11 from 3.0.2 to 3.0.3

Release notes

Sourced from pybind11's releases.

Version 3.0.3

Bug fixes:

• Fixed TSS key exhaustion in implicitly_convertible() when many implicit conversions are registered across large module sets. #6020

• Fixed heap-buffer-overflow in pythonbuf with undersized buffers by enforcing a minimum buffer size. #6019

• Fixed virtual-inheritance pointer offset crashes when dispatching inherited methods through virtual bases. #6017

• Fixed free(): invalid pointer crashes during interpreter shutdown with py::enum_<> by duplicating late-added def_property_static argument strings. #6015

• Fixed function_record heap-type deallocation to call PyObject_Free() and decref the type. #6010

• Hardened PYBIND11_MODULE_PYINIT and get_internals() against module-initialization crashes. #6018

• Fixed static_pointer_cast build failure with virtual inheritance in holder_caster_foreign_helpers.h. #6014

• Fixed ambiguous factory template specialization that caused compilation failures with nvcc + GCC 14. #6011

• Fixed crash in def_readwrite for non-smart-holder properties of smart-holder classes. #6008

• Fixed memory leak for py::dynamic_attr() objects on Python 3.13+ by clearing managed __dict__ contents during deallocation. #5999

• Fixed binding of noexcept and ref-qualified (&, &&) methods inherited from unregistered base classes. #5992

Internal:

• Moved tomlkit dependency to the dev dependency group. #5990

• Switched to newer public CPython APIs (PyType_GetFlags and public vectorcall APIs where available). #6005

Tests:

• Made an async callback test deterministic by replacing fixed sleep with bounded waiting. #5986

CI:

... (truncated)

Changelog

Sourced from pybind11's changelog.

Version 3.0.3 (March 31, 2026)

Bug fixes:

• Fixed TSS key exhaustion in implicitly_convertible() when many implicit conversions are registered across large module sets. #6020

• Fixed heap-buffer-overflow in pythonbuf with undersized buffers by enforcing a minimum buffer size. #6019

• Fixed virtual-inheritance pointer offset crashes when dispatching inherited methods through virtual bases. #6017

• Fixed free(): invalid pointer crashes during interpreter shutdown with py::enum_<> by duplicating late-added def_property_static argument strings. #6015

• Fixed function_record heap-type deallocation to call PyObject_Free() and decref the type. #6010

• Hardened PYBIND11_MODULE_PYINIT and get_internals() against module-initialization crashes. #6018

• Fixed static_pointer_cast build failure with virtual inheritance in holder_caster_foreign_helpers.h. #6014

• Fixed ambiguous factory template specialization that caused compilation failures with nvcc + GCC 14. #6011

• Fixed crash in def_readwrite for non-smart-holder properties of smart-holder classes. #6008

• Fixed memory leak for py::dynamic_attr() objects on Python 3.13+ by clearing managed __dict__ contents during deallocation. #5999

• Fixed binding of noexcept and ref-qualified (&, &&) methods inherited from unregistered base classes. #5992

Internal:

• Moved tomlkit dependency to the dev dependency group. #5990

• Switched to newer public CPython APIs (PyType_GetFlags and public vectorcall APIs where available). #6005

Tests:

• Made an async callback test deterministic by replacing fixed sleep with bounded waiting. #5986

... (truncated)

Commits

• 1b49908 docs: add v3.0.3 and v3.1.0 changelog updates. (#6023)
• c066c76 fix: add missing PYBIND11_ALWAYS_INLINE macro for v3.0.3 backports
• 76efcb3 Bump version from v3.0.2 → v3.0.3
• 0f41635 chore(deps): bump pygments from 2.17.2 to 2.20.0 in /docs (#6024)
• 54a4615 chore(deps): bump requests from 2.32.4 to 2.33.0 in /docs (#6013)
• d12037c chore(deps): update pre-commit hooks (#6002)
• 64eecc4 chore(deps): bump the actions group with 3 updates (#6000)
• c0ea8fc Fix heap-buffer-overflow in pythonbuf with undersized buffers (#6019)
• 8d621d6 fix: detect virtual inheritance in add_base to prevent pointer offset crash (...
• b6a616e fix: strdup "self" arg in def_property_static, partially revert #6010 (gh...
• Additional commits viewable in compare view

Updates mypy from 1.19.1 to 1.20.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 1.20

We’ve just uploaded mypy 1.20.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Planned Changes to Defaults and Flags in Mypy 2.0

As a reminder, we are planning to enable --local-partial-types by default in mypy 2.0, which will likely be the next feature release. This will often require at least minor code changes. This option is implicitly enabled by mypy daemon, so this makes the behavior of daemon and non-daemon modes consistent.

Note that this release improves the compatibility of --local-partial-types significantly to make the switch easier (see below for more).

This can also be configured in a mypy configuration file (use False to disable):

local_partial_types = True

For more information, refer to the documentation.

We will also enable --strict-bytes by default in mypy 2.0. This usually requires at most minor code changes to adopt. For more information, refer to the documentation.

Finally, --allow-redefinition-new will be renamed to --allow-redefinition. If you want to continue using the older --allow-redefinition semantics which are less flexible (e.g. limited support for conditional redefinitions), you can switch to --allow-redefinition-old, which is currently supported as an alias to the legacy --allow-redefinition behavior. To use --allow-redefinition in the upcoming mypy 2.0, you can't use --no-local-partial-types. For more information, refer to the documentation.

Better Type Narrowing

Mypy's implementation of narrowing has been substantially reworked. Mypy will now narrow more aggressively, more consistently, and more correctly. In particular, you are likely to notice new narrowing behavior in equality expressions (==), containment expressions (in),

... (truncated)

Commits

• 770d3ca Remove +dev from version
• 4738ffa Changelog updates for 1.20 (#21109)
• b4f07a7 Use 'native-parser' instead of 'native-parse' for optional dependency (#21115)
• 7bec7b7 [mypyc] Document librt and librt.base64 (#21114)
• c482596 --allow-redefinition-new is no longer experimental (#21110)
• c916ca3 sdist: include misc/{diff-cache,apply-cache-diff}.py for `mypy/test/test_di...
• b137e4e [mypyc] Speed up native-to-native imports within the same group (#21101)
• 978b711 [mypyc] Fix range loop variable off-by-one after loop exit (#21098)
• 67ada30 [stubtest] Check runtime availability of private types not marked `@type_chec...
• bdef6ef librt cache tests: build respecting MYPY_TEST_PREFIX (#21097)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.