[dependabot]

Bumps the python-packages group with 4 updates: copier, pandas, poethepoet and prek.

Updates copier from 9.18.2 to 9.19.1

Release notes

Sourced from copier's releases.

v9.19.1 (2026-10-13)

Fix

• vcs: restore support for Git older than 2.43.1

v9.19.0 (2026-10-12)

Feat

• add support for opt-in questions via the ask setting (#2849)

Fix

• updating: keep symlink targets when a directory containing a symlink is renamed

Security

• vcs: prevent argument injection via git subprocess calls

Changelog

Sourced from copier's changelog.

v9.19.1 (2026-10-13)

Fix

• vcs: restore support for Git older than 2.43.1

v9.19.0 (2026-10-12)

Feat

• add support for opt-in questions via the ask setting (#2849)

Fix

• updating: keep symlink targets when a directory containing a symlink is renamed

Security

• vcs: prevent argument injection via git subprocess calls

Commits

• 5d95bfa bump: version 9.19.0 → 9.19.1
• 920813a fix(vcs): restore support for Git older than 2.43.1
• 10d5140 bump: version 9.18.2 → 9.19.0
• 6ca1e9d fix(vcs): prevent argument injection via git subprocess calls
• 04a8619 build(deps): update dependency platformdirs to v4.12.4
• 8109685 build(deps): update dependency commitizen to v4.19.2
• ba6ef49 build(deps): update dependency inline-snapshot to v0.36.0
• 0dd8d68 chore(docs): fix admonition title syntax
• 2920219 build(deps): lock file maintenance
• b6acf96 build(deps): update dependency platformdirs to v4.12.3
• Additional commits viewable in compare view

Updates pandas from 3.0.6 to 3.1.0

Release notes

Sourced from pandas's releases.

pandas 3.1.0

We are pleased to announce the release of pandas 3.1.0. This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

• New DataFrame.select() and updated DataFrame.filter() method
• Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas

Or from conda-forge

conda install -c conda-forge pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.1.0rc0

We are pleased to announce a release candidate for pandas 3.1.0.

See the whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade --pre pandas==3.1.0rc0

Or from conda-forge

conda install -c conda-forge/label/pandas_rc pandas==3.1.0rc0

Please report any issues with the release candidate on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• c6f4676 RLS: 3.1.0
• dd69475 Backport PR #71468 on branch 3.1.x (DOC: 3.1 whatsnew: add some structure to ...
• 4ccc19a Backport PR #71465 on branch 3.1.x (DOC: update announce (contributor listing...
• 24dae63 [backport 3.1.x] DOC: cleanup 3.1.0 whatsnew (#71408) (#71466)
• 8519ca6 [backport 3.1.x] CI: temporary pin dateutil to <3 (#71461) (#71464)
• 2126193 Backport PR #71387 on branch 3.1.x (BUG: fix string regex operations with $ e...
• 4700f5d Backport PR #71442 on branch 3.1.x (BUG: parallel read_csv raising released m...
• 08efb14 Backport PR #71456 on branch 3.1.x (TST: Fix test_reduce_array until reduct...
• ee8dcb7 Backport PR #71429 on branch 3.1.x (DOC: add dedicated 3.1 whatsnew section f...
• d93e32c Backport PR #71383 on branch 3.1.x (BUG: fix string regex operations with Pyt...
• Additional commits viewable in compare view

Updates poethepoet from 0.48.0 to 0.49.0

Release notes

Sourced from poethepoet's releases.

0.49.0

Enhancements

• Add true_string and false_string options to customize the string values that boolean args are exposed as by @​nat-n in nat-n/poethepoet#419
• Support the .yml file extension for poe_tasks.yml and included config files by @​Ab2nour in nat-n/poethepoet#426
• Remove the pastel dependency, leaving pyyaml (and tomli on older pythons) as the only runtime dependencies by @​nat-n in nat-n/poethepoet#411

Fixes

• Resolve glob patterns in cmd tasks after parameter expansion, so expansions and quotes inside square bracket patterns are respected and unmatched globs are passed on unescaped by @​nat-n in nat-n/poethepoet#425
• Handle absolute glob patterns (e.g. /etc/host*) and ** within a path component in cmd tasks instead of crashing by @​nat-n in nat-n/poethepoet#431
• Propagate errors and exit codes from failed subtasks: errors in a switch case or a ref'd task are no longer swallowed, and poe now exits with the exit code of the first failed subtask instead of 1 by @​nat-n in nat-n/poethepoet#430
• Resolve subtask arg defaults against the env inherited from the parent task by @​nat-n in nat-n/poethepoet#421
• Detect and report cyclic deps/uses instead of silently running nothing or crashing by @​nat-n in nat-n/poethepoet#421
• Report malformed, empty, and non-table config files with clear errors instead of tracebacks by @​nat-n in nat-n/poethepoet#428
• Fix boolean flags forwarded to python tasks being inverted when their default is templated by @​nat-n in nat-n/poethepoet#420

Breaking changes

These changes may affect a small number of existing configurations:

• Consistent sys.argv for Python tasks with declared args. Script tasks that call a function, and expr tasks, now get the same sys.argv as script tasks that run a module: declared args as parsed (with defaults applied), followed by any args given after --. Templates like ${VAR} in args given on the command line are also no longer expanded for these tasks, matching other task types. See the migration guide for an example. (nat-n/poethepoet#420)

• Square bracket glob patterns in cmd tasks are parsed like in bash. Whitespace, backslashes, quotes, and parameter expansions inside [...] are no longer taken literally, so e.g. [ -f foo ] is now four words rather than one pattern. To match a space or backslash, escape or quote it, e.g. [a\ b]. See the migration guide for details. (nat-n/poethepoet#425)

AI Agent Skill 🤖

• Teach the task graph (deps, uses, uses_env) and steer agents towards declarative poe features rather than bash logic by @​nat-n in nat-n/poethepoet#429

Upgrade an installed skill with:

poe _install_skill --upgrade

New Contributors

• @​Ab2nour made their first contribution in nat-n/poethepoet#426

Full Changelog: nat-n/poethepoet@v0.48.0...v0.49.0

Commits

• b8e96a9 Bump version to 0.49.0
• 98da6fe fix(cmd): handle absolute glob patterns and misplaced ** without crashing (...
• 5e67f11 fix: propagate errors and exit codes from failed subtasks (#430)
• 65f2390 fix!: resolve glob patterns in cmd tasks after parameter expansion (#425)
• 0f56a81 docs(skill): teach the task graph and steer bash logic to poe features (#429)
• eec9c33 fix!: consistent sys.argv for Python tasks with declared args (#420)
• ac60c37 fix(config): report malformed and non-table config files cleanly (#428)
• af160fe feat: support both .yaml and .yml file extensions (#426)
• 31b931e fix: resolve subtask arg defaults against the inherited env, and detect cycli...
• ee5b9bc feat: customize boolean argument string values (#419)
• Additional commits viewable in compare view

Updates prek from 0.5.3 to 0.5.7

Release notes

Sourced from prek's releases.

0.5.7

Release Notes

Released on 2026-10-21.

Enhancements

• Support system Rust toolchains without rustup (#2887)

Performance

• Use blocking file checks for CPU-heavy builtin hooks (#2910)

Other changes

• Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)

Contributors

• @​shaanmajid
• @​j178

Install prek 0.5.7

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.7/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.5.7

File	Platform	Checksum
prek-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
prek-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
prek-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
prek-x86_64-pc-windows-msvc.zip	x64 Windows	checksum

... (truncated)

Changelog

Sourced from prek's changelog.

0.5.7

Released on 2026-10-21.

Enhancements

• Support system Rust toolchains without rustup (#2887)

Performance

• Use blocking file checks for CPU-heavy builtin hooks (#2910)

Other changes

• Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)

Contributors

• @​shaanmajid
• @​j178

0.5.6

Released on 2026-10-19.

Enhancements

• Add builtin hook check-commit-trailers (#2885)
• Add builtin hook check-signed-commit (#2725)

Performance

• Enable PGO for native release builds (#2890)
• Reduce hook process launches with balanced batches (#2907)
• Resolve hook commands before batching (#2840)

Bug fixes

• Accept UTF-8 BOM in check-json (#2879)
• Preserve unquoted dotted revisions in prek update (#2853)

Documentation

• Document standalone installer options (#2859)
• Update benchmarks for prek 0.5.5 (#2786)

Other changes

• Enable ICF for release builds (#2891)
• Update uv to 0.13.0 (#2856)

... (truncated)

Commits

• 8569a4a Bump version to 0.5.7 (#2920)
• c290bac Bump certifi from 2026.7.22 to 2026.10.19 (#2921)
• 40287b8 Temporarily skip Aliyun uv download in CI (#2922)
• 062c8a0 Update CA root crates and uv for the eMudhra intermediate CA compromise (#2919)
• 5b66378 Log download and archive extraction stages (#2917)
• c369353 Share tar extraction across compression formats (#2916)
• 1c82a0d Move managed Rust toolchain discovery into the installer (#2914)
• 2bf1958 Support system Rust toolchains without rustup (#2887)
• 812e80f Move shared hook helpers and rename run to concurrency (#2911)
• 615a001 Use blocking file checks for CPU-heavy builtin hooks (#2910)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[d33bs]

Low-risk python-packages group bump: copier, pandas, poethepoet, prek all minor/patch bumps within same major version; lockfile revision bump only. CI green across all jobs.