Skip to content

chore(deps): bump the python-dependencies group across 6 directories with 4 updates - #570

Merged
jbonofre merged 1 commit into
mainfrom
dependabot/uv/converters/cube/python-dependencies-b8d7c88331
Oct 12, 2026
Merged

chore(deps): bump the python-dependencies group across 6 directories with 4 updates#570
jbonofre merged 1 commit into
mainfrom
dependabot/uv/converters/cube/python-dependencies-b8d7c88331

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 1 update in the /converters/cube directory: hypothesis.
Bumps the python-dependencies group with 1 update in the /converters/omni directory: hypothesis.
Bumps the python-dependencies group with 1 update in the /converters/ontology directory: pydantic.
Bumps the python-dependencies group with 2 updates in the /converters/orionbelt directory: orionbelt-semantic-layer and types-jsonschema.
Bumps the python-dependencies group with 1 update in the /converters/thoughtspot directory: hypothesis.
Bumps the python-dependencies group with 1 update in the /python directory: pydantic.

Updates hypothesis from 6.168.4 to 6.168.5

Commits
  • ca2a4c6 Bump hypothesis version to 6.168.5 and update changelog
  • c1c9957 Merge pull request #4894 from MarcoGorelli/django-from-field-return-type
  • f92f61c Fix the return type of django's from_field
  • See full diff in compare view

Updates hypothesis from 6.168.4 to 6.168.5

Commits
  • ca2a4c6 Bump hypothesis version to 6.168.5 and update changelog
  • c1c9957 Merge pull request #4894 from MarcoGorelli/django-from-field-return-type
  • f92f61c Fix the return type of django's from_field
  • See full diff in compare view

Updates pydantic from 2.13.5 to 2.14.0

Release notes

Sourced from pydantic's releases.

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

Full Changelog: pydantic/pydantic@v2.13.0...v2.14.0

v2.14.0b2 2026-09-09

What's Changed

This pre-release adds full support for Python 3.15 specific features, such as support for frozendict, making use of TypeForm and stabilizing the MISSING sentinel type.

New Features

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

v2.14.0b2 (2026-09-09)

GitHub release

... (truncated)

Commits

Updates orionbelt-semantic-layer from 2.33.1 to 2.34.0

Release notes

Sourced from orionbelt-semantic-layer's releases.

v2.34.0

[2.34.0] - 2026-10-08

Added

  • Cumulative metrics without their time dimension, as of one period. A query that does not select a cumulative metric's timeDimension now evaluates it per group of its other dimensions, with the value that period's row would show with the time dimension selected: Region, YTD Sales gives each region its year-to-date. The new query field asOf names the date, read at the time dimension's grain (a week that began in January is January's). Without it, the period is the latest one with data under the query's filters, so a filter Sales Month < 2025-07-01 evaluates year-to-date as of June, still read from January. A period without data of its own still reads the periods before it; a group without data in the metric's range gets NULL, counts included. The SQL surfaces (OBSQL, Flight SQL, pgwire) pick the period with a time filter's upper bound. Before, such a query failed with CUMULATIVE_TIME_DIMENSION_NOT_IN_SELECT, which now only remains for grouping: rollup / cube and for another dimension over the same date column (#527, #529).
  • NON_ADDITIVE_CUMULATIVE_SUM warning. A cumulative metric aggregates its measure's value per period, so a sum is the measure over the range only when the measure is a sum or a count. Summed monthly distinct customers count a customer once per month. Such a metric now loads with a warning when its measure aggregates with anything else or aggregates distinct values; avg, min and max over the values per period do not warn (#528).
  • ilike / notilike filter operators. Case-insensitive pattern matching in query filters, OBSQL ([NOT] ILIKE, refused before), rule conditions, static model filters and measure filters, rendered per dialect from an executed probe of all eight engines (#522).
  • SELECT * on the model table. Flight SQL and pgwire both read SELECT * FROM <model>.model as one semantic query over every announced column, keeping WHERE, ORDER BY and LIMIT; Flight answered with a metadata listing before, which broke DuckDB's ATTACH ... (TYPE adbc). Both surfaces announce the same columns, synthesized counts included, and COUNT(*) names the count measures (#524).

Fixed

  • Cumulative metrics accumulate per group. With another dimension selected, a running total, rolling window or grain-to-date ran across groups: Sweden's January year-to-date included Mexico's. The query's other dimensions now partition the window (#520).
  • A time filter no longer cuts the cumulative and period-over-period look-back. Filtered to March-April, YTD Sales for March started in March and Sales MoM Change had no February to compare with. A filter on the time dimension's column now picks the periods shown, and the metrics read the history before them; other filters still limit it (#525).
  • Rolling windows count calendar periods, not rows. window: 3 over months with a gap reached back past the gap. Each period now reads the periods at most N-1 of the time dimension's grain before it, on every engine, including BigQuery TIMESTAMP columns and rows without a date (#526).
  • OBSQL NOT LIKE is no longer inverted. NOT LIKE 'M%' returned only the matching rows, and ILIKE matched case-sensitively; BETWEEN, NOT BETWEEN and NOT IN are now translated instead of refused (#521). A plain ORDER BY puts NULLs last, as Postgres does, also through Dremio federation (#514).
  • pgwire works with Apache Superset, SQLAlchemy 2.x, psycopg 3 and pgjdbc. Catalog probes for connect and reflection are answered (#509, #512); parameterised statements are described and binary results honoured for every announced type, so DBeaver no longer fails on a reused prepared statement (#513, #511); binary date, time, numeric and UUID parameters decode, decimal literals stay exact, and temp-table writes answer with Postgres command tags (#516).
  • The DuckDB adbc_scanner recipes use its new ATTACH API, after the community build replaced adbc_connect (#523).
  • UI "Jump to" files rules and examples under their own sections instead of under metrics (#517).
  • The demo calendar runs through 2026-01-31 (#515).

Changed

  • Dependencies: duckdb 1.5.6 (the adbc_scanner tests now close their connections explicitly, which avoided a deadlock), fastapi 0.142.2, sqlglot 30.21.0, snowflake-connector-python 4.8.0, sqlalchemy 2.1.3, cryptography 50.0.2 (#518, #519).

Full Changelog: ralforion/orionbelt-semantic-layer@v2.33.1...v2.34.0

Changelog

Sourced from orionbelt-semantic-layer's changelog.

[2.34.0] - 2026-10-08

Added

  • Cumulative metrics without their time dimension, as of one period. A query that does not select a cumulative metric's timeDimension now evaluates it per group of its other dimensions, with the value that period's row would show with the time dimension selected: Region, YTD Sales gives each region its year-to-date. The new query field asOf names the date, read at the time dimension's grain (a week that began in January is January's). Without it, the period is the latest one with data under the query's filters, so a filter Sales Month < 2025-07-01 evaluates year-to-date as of June, still read from January. A period without data of its own still reads the periods before it; a group without data in the metric's range gets NULL, counts included. The SQL surfaces (OBSQL, Flight SQL, pgwire) pick the period with a time filter's upper bound. Before, such a query failed with CUMULATIVE_TIME_DIMENSION_NOT_IN_SELECT, which now only remains for grouping: rollup / cube and for another dimension over the same date column (#527, #529).
  • NON_ADDITIVE_CUMULATIVE_SUM warning. A cumulative metric aggregates its measure's value per period, so a sum is the measure over the range only when the measure is a sum or a count. Summed monthly distinct customers count a customer once per month. Such a metric now loads with a warning when its measure aggregates with anything else or aggregates distinct values; avg, min and max over the values per period do not warn (#528).
  • ilike / notilike filter operators. Case-insensitive pattern matching in query filters, OBSQL ([NOT] ILIKE, refused before), rule conditions, static model filters and measure filters, rendered per dialect from an executed probe of all eight engines (#522).
  • SELECT * on the model table. Flight SQL and pgwire both read SELECT * FROM <model>.model as one semantic query over every announced column, keeping WHERE, ORDER BY and LIMIT; Flight answered with a metadata listing before, which broke DuckDB's ATTACH ... (TYPE adbc). Both surfaces announce the same columns, synthesized counts included, and COUNT(*) names the count measures (#524).

Fixed

  • Cumulative metrics accumulate per group. With another dimension selected, a running total, rolling window or grain-to-date ran across groups: Sweden's January year-to-date included Mexico's. The query's other dimensions now partition the window (#520).
  • A time filter no longer cuts the cumulative and period-over-period look-back. Filtered to March-April, YTD Sales for March started in March and Sales MoM Change had no February to compare with. A filter on the time dimension's column now picks the periods shown, and the metrics read the history before them; other filters still limit it (#525).
  • Rolling windows count calendar periods, not rows. window: 3 over months with a gap reached back past the gap. Each period now reads the periods at most N-1 of the time dimension's grain before it, on every engine, including BigQuery TIMESTAMP columns and rows without a date (#526).
  • OBSQL NOT LIKE is no longer inverted. NOT LIKE 'M%' returned only the matching rows, and ILIKE matched case-sensitively; BETWEEN, NOT BETWEEN and NOT IN are now translated instead of refused (#521). A plain ORDER BY puts NULLs last, as Postgres does, also through Dremio federation (#514).
  • pgwire works with Apache Superset, SQLAlchemy 2.x, psycopg 3 and pgjdbc. Catalog probes for connect and reflection are answered (#509, #512); parameterised statements are described and binary results honoured for every announced type, so DBeaver no longer fails on a reused prepared statement (#513, #511); binary date, time, numeric and UUID parameters decode, decimal literals stay exact, and temp-table writes answer with Postgres command tags (#516).
  • The DuckDB adbc_scanner recipes use its new ATTACH API, after the community build replaced adbc_connect (#523).
  • UI "Jump to" files rules and examples under their own sections instead of under metrics (#517).
  • The demo calendar runs through 2026-01-31 (#515).

Changed

  • Dependencies: duckdb 1.5.6 (the adbc_scanner tests now close their connections explicitly, which avoided a deadlock), fastapi 0.142.2, sqlglot 30.21.0, snowflake-connector-python 4.8.0, sqlalchemy 2.1.3, cryptography 50.0.2 (#518, #519).
Commits
  • 016ac08 chore(release): 2.34.0 (#530)
  • befd245 test(correctness): as-of examples in 2022; cumulative beside another fact and...
  • 3951fb0 feat(validator): warn when a cumulative sum adds up values that do not add up...
  • ab3651c feat(compiler): cumulative metrics without their time dimension, as of one pe...
  • f35d244 fix(compiler): rolling windows count calendar periods, not rows (#526)
  • db23e58 fix(compiler): a time filter no longer cuts the cumulative and PoP look-back ...
  • 3493a6a feat(wire): SELECT * reads the model table; COUNT(*) names the count measures...
  • 51e243b fix(docs): DuckDB adbc_scanner recipe for the ATTACH API (#523)
  • bdc646e feat(obml): ilike / notilike filter operators, rendered per dialect (#522)
  • 01c6aab fix(obsql): NOT LIKE no longer inverted; add BETWEEN and NOT IN; refuse ILIKE...
  • Additional commits viewable in compare view

Updates types-jsonschema from 4.26.0.20260518 to 4.26.0.20261006

Commits

Updates hypothesis from 6.168.4 to 6.168.5

Commits
  • ca2a4c6 Bump hypothesis version to 6.168.5 and update changelog
  • c1c9957 Merge pull request #4894 from MarcoGorelli/django-from-field-return-type
  • f92f61c Fix the return type of django's from_field
  • See full diff in compare view

Updates pydantic from 2.13.5 to 2.14.0

Release notes

Sourced from pydantic's releases.

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

Full Changelog: pydantic/pydantic@v2.13.0...v2.14.0

v2.14.0b2 2026-09-09

What's Changed

This pre-release adds full support for Python 3.15 specific features, such as support for frozendict, making use of TypeForm and stabilizing the MISSING sentinel type.

New Features

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

v2.14.0b2 (2026-09-09)

GitHub release

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-dependencies group across 6 directories …
62bb180 
…with 4 updates

Bumps the python-dependencies group with 1 update in the /converters/cube directory: [hypothesis](https://github.com/HypothesisWorks/hypothesis).
Bumps the python-dependencies group with 1 update in the /converters/omni directory: [hypothesis](https://github.com/HypothesisWorks/hypothesis).
Bumps the python-dependencies group with 1 update in the /converters/ontology directory: [pydantic](https://github.com/pydantic/pydantic).
Bumps the python-dependencies group with 2 updates in the /converters/orionbelt directory: [orionbelt-semantic-layer](https://github.com/ralforion/orionbelt-semantic-layer) and [types-jsonschema](https://github.com/python/typeshed).
Bumps the python-dependencies group with 1 update in the /converters/thoughtspot directory: [hypothesis](https://github.com/HypothesisWorks/hypothesis).
Bumps the python-dependencies group with 1 update in the /python directory: [pydantic](https://github.com/pydantic/pydantic).


Updates `hypothesis` from 6.168.4 to 6.168.5
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.168.4...v6.168.5)

Updates `hypothesis` from 6.168.4 to 6.168.5
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.168.4...v6.168.5)

Updates `pydantic` from 2.13.5 to 2.14.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.5...v2.14.0)

Updates `orionbelt-semantic-layer` from 2.33.1 to 2.34.0
- [Release notes](https://github.com/ralforion/orionbelt-semantic-layer/releases)
- [Changelog](https://github.com/ralforion/orionbelt-semantic-layer/blob/main/CHANGELOG.md)
- [Commits](ralforion/orionbelt-semantic-layer@v2.33.1...v2.34.0)

Updates `types-jsonschema` from 4.26.0.20260518 to 4.26.0.20261006
- [Commits](https://github.com/python/typeshed/commits)

Updates `hypothesis` from 6.168.4 to 6.168.5
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.168.4...v6.168.5)

Updates `pydantic` from 2.13.5 to 2.14.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.5...v2.14.0)

---
updated-dependencies:
- dependency-name: hypothesis
  dependency-version: 6.168.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: hypothesis
  dependency-version: 6.168.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pydantic
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: orionbelt-semantic-layer
  dependency-version: 2.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: types-jsonschema
  dependency-version: 4.26.0.20261006
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: hypothesis
  dependency-version: 6.168.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pydantic
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 12, 2026
@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
pip/hypothesis 6.168.5 UnknownUnknown
pip/pydantic 2.14.0 UnknownUnknown
pip/pydantic-core 2.50.0 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 3Found 8/23 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
pip/typing-inspection 0.4.4 UnknownUnknown
pip/hypothesis 6.168.5 UnknownUnknown
pip/pydantic 2.14.0 UnknownUnknown
pip/pydantic-core 2.50.0 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 3Found 8/23 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
pip/orionbelt-semantic-layer 2.34.0 UnknownUnknown
pip/types-jsonschema 4.26.0.20261006 UnknownUnknown
pip/pydantic 2.14.0 UnknownUnknown
pip/pydantic-core 2.50.0 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 3Found 8/23 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
pip/typing-inspection 0.4.4 UnknownUnknown
pip/hypothesis 6.168.5 UnknownUnknown
pip/pydantic 2.14.0 UnknownUnknown
pip/pydantic-core 2.50.0 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 3Found 8/23 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
pip/typing-inspection 0.4.4 UnknownUnknown

Scanned Files

  • converters/cube/uv.lock
  • converters/dbt/uv.lock
  • converters/omni/uv.lock
  • converters/ontology/uv.lock
  • converters/orionbelt/uv.lock
  • converters/sigma/uv.lock
  • converters/thoughtspot/uv.lock
  • python/uv.lock

@jbonofre
jbonofre merged commit 7f4e61c into main Oct 12, 2026
52 checks passed
@jbonofre
jbonofre deleted the dependabot/uv/converters/cube/python-dependencies-b8d7c88331 branch October 12, 2026 07:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jbonofre jbonofre jbonofre approved these changes

Assignees

No one assigned

Labels

converter/dbt converter/omni converter/ontology converter/orionbelt converter/sigma converter dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jbonofre