chore(deps-dev): Bump vws-python-mock from 2026.9.6 to 2026.9.8.1

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps vws-python-mock from 2026.9.6 to 2026.9.8.1.

Release notes

Sourced from vws-python-mock's releases.

Release 2026.09.08.1

2026.09.08.1

• The URL of a reco counts report now has the shape of the presigned cloud storage URL which real Vuforia returns. The report file is named {date}-{hour}.csv for the current month and {month}.csv for the previous month, so two requests for the same month in the same hour name the same file and serve the report which the first request generated. The URL carries the query parameters of a presigned URL, and the mock honors X-Amz-Date and X-Amz-Expires as real Vuforia's storage does, so a URL which is out of date or which has no query parameters gives the 403 XML error document which Amazon S3 gives. A report which is not yet generated gives the 404 NoSuchKey XML error document which Amazon S3 gives, as real Vuforia has now been observed to do, rather than an empty body.

Release 2026.09.08

2026.09.08

• The response delay and client timeout simulation is now provided by the mock-response-delay package.

• The mock now returns NGINX's 400 Request Header Or Cookie Too Large response for any request header line longer than 8190 bytes, as real Vuforia does.

• Match real Vuforia's request rate limiting, which was checked against it on 2026-09-08. DOCUMENTED_REQUEST_RATE_LIMITS now allows two GET /targets requests per minute rather than one, a rate-limited request gets Envoy's empty-bodied 429 response rather than a JSON TooManyRequests body, and the limits are applied before the request's signature is checked.

Changelog

Sourced from vws-python-mock's changelog.

Changelog

.. towncrier release notes start

2026.09.12

• Validate decoded Model Target request values before processing them.

• Type target-manager request defaults as database dictionaries instead of arbitrary mappings.

• Type parsed Target Manager request bodies using recursive JSON values.

• Accept integer response_delay_seconds values when mocking requests calls.

2026.09.08.1

• The URL of a reco counts report now has the shape of the presigned cloud storage URL which real Vuforia returns. The report file is named {date}-{hour}.csv for the current month and {month}.csv for the previous month, so two requests for the same month in the same hour name the same file and serve the report which the first request generated. The URL carries the query parameters of a presigned URL, and the mock honors X-Amz-Date and X-Amz-Expires as real Vuforia's storage does, so a URL which is out of date or which has no query parameters gives the 403 XML error document which Amazon S3 gives. A report which is not yet generated gives the 404 NoSuchKey XML error document which Amazon S3 gives, as real Vuforia has now been observed to do, rather than an empty body.

2026.09.08

• The response delay and client timeout simulation is now provided by the mock-response-delay package.

• The mock now returns NGINX's 400 Request Header Or Cookie Too Large response for any request header line longer than 8190 bytes, as real Vuforia does.

• Match real Vuforia's request rate limiting, which was checked against it on 2026-09-08. DOCUMENTED_REQUEST_RATE_LIMITS now allows two GET /targets requests per minute rather than one, a rate-limited request gets Envoy's empty-bodied 429 response rather than a JSON TooManyRequests body, and the limits are applied before the request's signature is checked.

2026.09.06

• Add MockVWS.set_target_recognition_counts and a matching target manager endpoint for the Flask and Docker mock, for setting the recognition counts which the target summary report and the reco counts report show for a target. A reco counts report now has a row for each target with recognitions in the requested month, and the recognition counts and recognition threshold of a cloud database are kept when the database is created in the Flask and Docker mock.

• Order Query API and GET /duplicates/{target_id} results by match score, with the best match first, as the real Query API does. Matches with equal scores keep the existing upload date and then target ID order.

  Image matchers now return a score, or None for no match, rather than a bool. StructuralSimilarityMatcher returns the images' SSIM score, and ExactMatcher gives every match the same score. A custom query_match_checker or duplicate_match_checker which returns a bool now raises a TypeError; return a score, such as 1.0, for a match and None for no match instead. The mock's ranking is its matcher's opinion, not Vuforia's proprietary one, so the mock's order still need not agree with the real Query API's order.

• Respond, rather than failing to respond, to a request body which is not UTF-8 and to a query request whose multipart/form-data body ends before its closing boundary.

... (truncated)

Commits

• 7ec1f62 Bump CHANGELOG
• cb5b468 Match real Vuforia's reco counts report URL, expiry and not-ready response (#...
• f68ca20 Bump CHANGELOG
• 6175163 Verify the VWS request rate limits against real Vuforia (#3579)
• dcce0e4 Merge pull request #3580 from VWS-Python/strictest-ty-config
• ff4b336 Use Ty's strictest recommended configuration
• aab4a17 Merge pull request #3578 from VWS-Python/issue-3573
• 23f6a5d Merge pull request #3577 from VWS-Python/pyrefly-all
• 9f13ce8 Use documented call results
• 862f6b6 Preserve runtime normalization under Pyrefly all
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)