[dependabot]

Bumps the test-data-dependencies group with 4 updates in the /test/e2e/content-workspace directory: fastapi, shiny, shinywidgets and pandas.

Updates fastapi from 0.162.0 to 0.162.4

Release notes

Sourced from fastapi's releases.

0.162.4

FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Fixes

• 🐛 Require AnyIO 4.1.0 or newer at runtime. PR #16730 by @​tiangolo.

0.162.3

FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Upgrades

• ⬆️ Add support for Python 3.15. PR #16727 by @​tiangolo.
• ⬆️ Update locked Pydantic to 2.14.3. PR #16728 by @​tiangolo.
• ⬆️ Upgrade markdown-include-variants to 0.0.10. PR #16705 by @​tiangolo.

Docs

• 📝 Adopt unversioned snippets and _non_an variants. PR #16707 by @​tiangolo.
• 🎨 Use the Zensical modern theme for docs. PR #16701 by @​tiangolo.
• 🐛 Fix AI coding agent notice links in previews. PR #16700 by @​tiangolo.
• 📝 Add an AI coding agent notice to the docs. PR #16699 by @​tiangolo.

Translations

• 🌐 Update Traditional Chinese translations. PR #16719 by @​tiangolo.
• 🌐 Update Chinese translations. PR #16718 by @​tiangolo.
• 🌐 Update Ukrainian translations. PR #16717 by @​tiangolo.
• 🌐 Update Turkish translations. PR #16716 by @​tiangolo.
• 🌐 Update Russian translations. PR #16715 by @​tiangolo.
• 🌐 Update Portuguese translations. PR #16714 by @​tiangolo.
• 🌐 Update Korean translations. PR #16713 by @​tiangolo.
• 🌐 Update Japanese translations. PR #16712 by @​tiangolo.
• 🌐 Update Hindi translations. PR #16711 by @​tiangolo.
• 🌐 Update French translations. PR #16710 by @​tiangolo.
• 🌐 Update Spanish translations. PR #16709 by @​tiangolo.
• 🌐 Update German translations. PR #16708 by @​tiangolo.
• 🌐 Update Korean translations to match the English docs. PR #16706 by @​tiangolo.

Internal

• 🔥 Remove obsolete docs snippet commands. PR #16724 by @​tiangolo.
• 🐛 Preserve snippet variants when cleaning up docs sources. PR #16722 by @​tiangolo.

0.162.2

FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Docs

• 📝 Add FastAPI Cloud guidance to the FastAPI skill. PR #16697 by @​tiangolo.

... (truncated)

Commits

• e10178c 🔖 Release version 0.162.4 (#16731)
• af62806 📝 Update release notes
• 0902e8b 🐛 Require AnyIO 4.1.0 or newer at runtime (#16730)
• 84d5f8e 🔖 Release version 0.162.3 (#16729)
• 6b131a6 📝 Update release notes
• ed6f566 ⬆️ Add support for Python 3.15 (#16727)
• 5e24b32 📝 Update release notes
• 60acfa1 ⬆️ Update locked Pydantic to 2.14.3 (#16728)
• ba5d72b 📝 Update release notes
• e059ace 🔥 Remove obsolete docs snippet commands (#16724)
• Additional commits viewable in compare view

Updates shiny from 1.8.0 to 1.9.0

Release notes

Sourced from shiny's releases.

shiny 1.9.0

Breaking changes

• OpenTelemetry reactive_update spans now follow each session's cycle: one span per session, from when the session turns busy until all of its effects (including async ones) have finished, carrying the session's session.id. The session's calc, effect, and output spans are its children. Previously, there was one span per reactive flush, which can serve several sessions, so with concurrent effects it couldn't carry a single session.id and ended before async effects finished. Effects without a session no longer have a reactive_update parent (#2522).

• Reactive effects now run concurrently. Shiny starts each invalidated effect without waiting for an async effect's awaited part, so a slow async effect, calc, or render function no longer delays other sessions. Within a session, input changes and reactive.invalidate_later() still wait until all of that session's effects have finished, and outputs are sent together once they have. What app authors may notice:

  • async effects interleave at each await instead of running one after another. priority orders when effects start, not when they finish. Runs of the same effect still don't overlap: a re-run waits for the previous run.

  • reactive.lock() is now defunct and no longer locks the reactive graph. Please remove it from your code.

  • await reactive.flush() returns right away, without waiting for dependents, when called from within an effect, a reactive.on_flushed() or session.on_flush()/session.on_flushed() callback, or a task one of these started while it is still running, since waiting there could deadlock. A task that outlives the effect that started it, such as an extended task's body, still waits. The wait covers the whole process, including other sessions' effects and output.

  • reactive.on_flushed() callbacks run after each round of effects has started, without waiting for async effects, and can run several times per reactive.flush(). Previously, they ran once all effects had finished. An error in one of these callbacks is now printed, and the other callbacks still run, instead of closing a session.

  • Message handlers (session.set_message_handler()) run in their own task, so a slow handler no longer holds up other messages from the client.

  • Each session sends its outputs in a task of its own, once all of its effects have finished. A slow client, or a slow session.on_flush() callback, delays only its own session's output, not other sessions' output or other reactive work.

  • Setting a reactive.value now re-runs its dependents automatically, without a call to reactive.flush(). The reactive graph itself still isn't thread-safe, so from another thread use loop.call_soon_threadsafe(value.set, new_value).

  • File uploads and session.dynamic_route() requests no longer mark the session busy.

  • Destroying an effect (effect.destroy()) cancels its in-progress run, raising asyncio.CancelledError at its current await. So ending a session, or session.destroy(id), cancels its in-progress async effects and render functions instead of letting them run on after the session or module is gone.

  (#2508, #2515)

• near_points(add_dist=True), imported from shiny.plotutils, now names its distance column dist_ instead of dist. Code reading df["dist"] from the result must now read df["dist_"] (#2510).

Lifecycle changes

• reactive.lock() is now defunct: it no longer locks the reactive graph and emits a ShinyDeprecationWarning. Please remove it from your code (#2520).

• shiny add test is deprecated and now prints a deprecation warning. It will be removed in a future release. Please use the shiny-for-python Agent Skill with a coding agent to generate tests instead (#2566).

New features

• New session.run_once_when_idle() runs a function once, after the session's effects have finished and its outputs have been sent. Use it to change reactive state from a background task or a custom timer without changing a value that a running effect is still reading (#2546).

• ui.sidebar() gains a role argument ("form", "search", "complementary", or "region"rstudio/bslib#1359"complementary" renders an <aside>, other roles render a <div> with the corresponding role attribute, and landmark roles require an accessible name (from title, aria_label, or aria_labelledby). Note that the default (role=None) now renders a neutral <div> instead of an <aside>. In addition, ui.page_sidebar() now places the whole sidebar layout inside the page's <main> landmark (#2526).

Bug fixes and minor improvements

• On Windows, an output's busy indicator now shows while the output renders. Previously, when a synchronous render function blocked the event loop, the message that turns on the indicator reached the browser together with the output's new value, so most outputs never showed it (#1381).

• UI updates and custom messages sent from outside the reactive graph (e.g. from a background asyncio task that calls ui.update_text()) are now sent to the client right away instead of waiting for the next input change (#21, #1889).

• Jsonifiable now uses Sequence and Mapping for its container arms instead of the invariant List and Dict, so values like dict[str, int] and list[str] type-check as Jsonifiable, including as the return type of a function passed to a Renderer[Jsonifiable]. As a side effect, type checkers also accept other sequences and mappings, such as range, deque, and bytes, even though only list, tuple, and dict serialize. Runtime behavior is unchanged (@​wolfgang-aura, #2511).

• near_points(add_dist=True), imported from shiny.plotutils, now adds the dist_ column its documentation describes, instead of a column named dist. The trailing underscore keeps it from colliding with a dist column in your own data. Code reading df["dist"] from the result must now read df["dist_"] (#2510). near_points() and brushed_points() also now map a non-string categorical column (e.g. one of integers) to its category codes, instead of raising ValueError: to_float: unsupported dtype for x (#2505).

... (truncated)

Changelog

Sourced from shiny's changelog.

[1.9.0] - 2026-10-29

Breaking changes

• OpenTelemetry reactive_update spans now follow each session's cycle: one span per session, from when the session turns busy until all of its effects (including async ones) have finished, carrying the session's session.id. The session's calc, effect, and output spans are its children. Previously, there was one span per reactive flush, which can serve several sessions, so with concurrent effects it couldn't carry a single session.id and ended before async effects finished. Effects without a session no longer have a reactive_update parent (#2522).

• Reactive effects now run concurrently. Shiny starts each invalidated effect without waiting for an async effect's awaited part, so a slow async effect, calc, or render function no longer delays other sessions. Within a session, input changes and reactive.invalidate_later() still wait until all of that session's effects have finished, and outputs are sent together once they have. What app authors may notice:

  • async effects interleave at each await instead of running one after another. priority orders when effects start, not when they finish. Runs of the same effect still don't overlap: a re-run waits for the previous run.

  • reactive.lock() is now defunct and no longer locks the reactive graph. Please remove it from your code.

  • await reactive.flush() returns right away, without waiting for dependents, when called from within an effect, a reactive.on_flushed() or session.on_flush()/session.on_flushed() callback, or a task one of these started while it is still running, since waiting there could deadlock. A task that outlives the effect that started it, such as an extended task's body, still waits. The wait covers the whole process, including other sessions' effects and output.

  • reactive.on_flushed() callbacks run after each round of effects has started, without waiting for async effects, and can run several times per reactive.flush(). Previously, they ran once all effects had finished. An error in one of these callbacks is now printed, and the other callbacks still run, instead of closing a session.

  • Message handlers (session.set_message_handler()) run in their own task, so a slow handler no longer holds up other messages from the client.

  • Each session sends its outputs in a task of its own, once all of its effects have finished. A slow client, or a slow session.on_flush() callback, delays only its own session's output, not other sessions' output or other reactive work.

  • Setting a reactive.value now re-runs its dependents automatically, without a call to reactive.flush(). The reactive graph itself still isn't thread-safe, so from another thread use loop.call_soon_threadsafe(value.set, new_value).

  • File uploads and session.dynamic_route() requests no longer mark the session busy.

  • Destroying an effect (effect.destroy()) cancels its in-progress run, raising asyncio.CancelledError at its current await. So ending a session, or session.destroy(id), cancels its in-progress async effects and render functions instead of letting them run on after the session or module is gone.

  (#2508, #2515)

• near_points(add_dist=True), imported from shiny.plotutils, now names its distance column dist_ instead of dist. Code reading df["dist"] from the result must now read df["dist_"] (#2510).

Lifecycle changes

• reactive.lock() is now defunct: it no longer locks the reactive graph and emits a ShinyDeprecationWarning. Please remove it from your code (#2520).

• shiny add test is deprecated and now prints a deprecation warning. It will be removed in a future release. Please use the shiny-for-python Agent Skill with a coding agent to generate tests instead (#2566).

New features

• New session.run_once_when_idle() runs a function once, after the session's effects have finished and its outputs have been sent. Use it to change reactive state from a background task or a custom timer without changing a value that a running effect is still reading (#2546).

• ui.sidebar() gains a role argument ("form", "search", "complementary", or "region"rstudio/bslib#1359"complementary" renders an <aside>, other roles render a <div> with the corresponding role attribute, and landmark roles require an accessible name (from title, aria_label, or aria_labelledby). Note that the default (role=None) now renders a neutral <div> instead of an <aside>. In addition, ui.page_sidebar() now places the whole sidebar layout inside the page's <main> landmark (#2526).

Bug fixes and minor improvements

• On Windows, an output's busy indicator now shows while the output renders. Previously, when a synchronous render function blocked the event loop, the message that turns on the indicator reached the browser together with the output's new value, so most outputs never showed it (#1381).

• UI updates and custom messages sent from outside the reactive graph (e.g. from a background asyncio task that calls ui.update_text()) are now sent to the client right away instead of waiting for the next input change (#21, #1889).

• Jsonifiable now uses Sequence and Mapping for its container arms instead of the invariant List and Dict, so values like dict[str, int] and list[str] type-check as Jsonifiable, including as the return type of a function passed to a Renderer[Jsonifiable]. As a side effect, type checkers also accept other sequences and mappings, such as range, deque, and bytes, even though only list, tuple, and dict serialize. Runtime behavior is unchanged (@​wolfgang-aura, #2511).

... (truncated)

Commits

• 0812f81 release: v1.9.0 (#2592)
• 2020003 docs: Match update_cell_value and bind_task_button parameter names (#2585)
• 2909747 fix(tests): Install pytest-base-url to avoid pytest 9.2's base_url warning (#...
• 4f066be docs(changelog): Note shiny add test deprecation and polish bug fix bullets (...
• f73b8fe fix(session): Run flush callbacks registered during an output flush (#2587)
• 6a62d2c fix(lint): Catch ModuleNotFoundError before ImportError (#2588)
• 4ad7276 fix(tests): Use a local image in the card test and card_image example (#2584)
• ac81774 test(examples): Skip the airmass example app (#2586)
• 8dfdf40 docs(changelog): Limit the sent-right-away note to background tasks (#2583)
• eac0c6d fix(tests): Allow yfinance pandas 3.1 deprecation warnings (#2582)
• Additional commits viewable in compare view

Updates shinywidgets from 0.8.1 to 0.8.2

Release notes

Sourced from shinywidgets's releases.

shinywidgets 0.8.2

Bug Fixes

• Fixed an issue where Shiny's busy indicator (spinner) did not appear over widget outputs while recalculating, because the output element's inline visibility: hidden also hid the spinner. Recalculating widget outputs now mirror Shiny's own handling of htmlwidgets, keeping the element (and spinner) visible while hiding the stale widget content. (#213)
• Fixed an issue where async @render_widgetposit-dev/py-shiny#2549@render_widget inside a Shiny module are now also closed when the output re-renders. (#241, #242)

Changelog

Sourced from shinywidgets's changelog.

[0.8.2] - 2026-10-15

• Fixed an issue where Shiny's busy indicator (spinner) did not appear over widget outputs while recalculating, because the output element's inline visibility: hidden also hid the spinner. Recalculating widget outputs now mirror Shiny's own handling of htmlwidgets, keeping the element (and spinner) visible while hiding the stale widget content. (#213)
• Fixed an issue where async @render_widgetposit-dev/py-shiny#2549@render_widget inside a Shiny module are now also closed when the output re-renders. (#241, #242)

Commits

• 4ef37a7 release: v0.8.2
• 3d302fa fix: Show Shiny busy indicator over recalculating widget outputs (#243)
• bf85cca fix: Track the rendering output per task, not per session (#242)
• See full diff in compare view

Updates pandas from 3.0.6 to 3.1.1

Release notes

Sourced from pandas's releases.

pandas 3.1.1

We are pleased to announce the release of pandas 3.1.1. This is a patch release in the 3.1.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.1.x series upgrade to this version.

See the full whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas==3.1.*

Or from conda-forge

conda install -c conda-forge pandas=3.1

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.1.0

We are pleased to announce the release of pandas 3.1.0. This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

• New DataFrame.select() and updated DataFrame.filter() method
• Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas

Or from conda-forge

conda install -c conda-forge pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.1.0rc0

We are pleased to announce a release candidate for pandas 3.1.0.

See the whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade --pre pandas==3.1.0rc0

... (truncated)

Commits

• 3dcc6fb RLS: 3.1.1
• 01560e3 Backport PR #71896 on branch 3.1.x (DOC: cleanup 3.1.1 whatsnew) (#71898)
• 49709c4 [backport 3.1.x] BUG: ffill/bfill on Arrow arrays without NA returns a view o...
• 55089f8 Backport PR #71025 on branch 3.1.x (BUG: \s and \S in str regex methods missi...
• eea23d0 Backport PR #71782 on branch 3.1.x (BUG: py.path.local treated as an open buf...
• e427eb5 [backport 3.1.x] DOC: avoid system-ui in default font-family for the docs (re...
• 3120a57 Backport PR #71572 on branch 3.1.x (BLD: don't include moments_simd.hpp in mo...
• 378620e Backport PR #71865 on branch 3.1.x (REGR: ensure map() with datetime-like dty...
• ceca8cb Backport PR #71495 on branch 3.1.x (BUG: support python-dateutil 3.0 tzfile (...
• 68fc76e Backport PR #71661 on branch 3.1.x (CI: Remove install requirement-dev.txt sm...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.