Skip to content

build(deps): bump the python-minor-and-patch group across 1 directory with 43 updates - #604

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-94865260fd
Open

build(deps): bump the python-minor-and-patch group across 1 directory with 43 updates#604
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-94865260fd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 10, 2026 •
edited by greptile-apps Bot
Loading

Copy link
Copy Markdown

Bumps the python-minor-and-patch group with 43 updates in the / directory:

Package From To
click 8.5.0 8.5.1
cryptography 50.0.1 50.0.2
idna 3.18 3.20
jsonschema 4.23.0 4.26.0
litellm 1.106.6 1.108.3
mcp 1.28.1 1.30.0
packaging 26.2 26.3
pydantic 2.14.1 2.14.3
pymongo 4.17.0 4.19.0
python-multipart 0.0.32 0.0.33
starlette 1.3.1 1.10.0
uvicorn 0.49.0 0.54.0
e2b 2.46.4 2.63.0
fastapi 0.141.1 0.162.2
tzdata 2026.5 2026.6
openenv 0.10.0 0.12.0
transformers 5.21.0 5.22.2
omegaconf 2.3.1 2.4.0
boto3 1.43.123 1.43.126
botocore 1.43.123 1.43.127
google-api-core 2.31.0 2.44.0
google-auth 2.55.1 2.62.1
google-cloud-secret-manager 2.30.0 2.32.0
google-cloud-storage 3.15.0 3.17.1
sail 0.12.8 0.17.2
anyio 4.14.2 4.16.0
httpx2 2.13.1 2.16.0
vercel-sandbox 0.7.0 0.11.0
tensorlake 0.5.149 0.5.163
boxd 0.2.17 0.3.0
daytona 0.224.1 0.231.0
cwsandbox 1.19.6 1.27.0
griffelib 2.3.0 2.4.1
hypothesis 6.170.14 6.170.15
moto 5.2.2 5.2.5
psycopg2-binary 2.9.12 2.9.13
regex 2026.6.28 2026.11.7
websockets 17.2 17.4
pytest 9.1.1 9.2.0
pytest-asyncio 1.4.0 1.4.1.post1
pytest-socket 0.8.0 0.8.1
ruff 0.16.10 0.17.4
smolmachines 1.27.3 1.32.4

Updates click from 8.5.0 to 8.5.1

Release notes

Sourced from click's releases.

8.5.1

This is the Click 8.5.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.5.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-1 Milestone: https://github.com/pallets/click/milestone/66

  • Fix copy.deepcopy() and pickle on a Parameter, Option or Command. #3805
  • A KeyboardInterrupt arriving while Command.main() reports an abort or an error, or while it exits, no longer escapes as an unhandled traceback. The command still exits with the intended code; only the message may be lost. #3802
  • Add Option.get_help_spec(), which returns the option's left help column even when the option is hidden. Option.get_help_record() still returns None for hidden options, so help screens are unchanged. #3821
  • The Positional arguments help section lists every argument of the command, not only the documented ones. An argument with no help gets an empty description, the same way an option with no help does. #3860
  • Argument.get_help_record() always returns a tuple. It used to return None for an argument with no help. #3860
  • Document which types are inferred from default, and what an unrecognized type callable does to a command-line value. #3036 #3808
  • path_type narrows the converted value's type for convert and prompt. #3822 #3858
  • Parameter accepts a new help argument, and Option and Argument inherit it. Parameter.to_info_dict() now reports help for every kind of parameter. #3861
  • A command's short help no longer stops at an abbreviation such as vs. or e.g. inside the first sentence. A period ends the sentence only when it closes the text or the next word does not start in lowercase. #3865
  • With show_envvar=True, an option's error message now prints all variables of an envvar sequence instead of the repr of the sequence. #3884
  • An empty envvar, such as [] or "", shows the same help and error message as no envvar when show_envvar=True. The help screen used to show [env var: ]. #3884
  • Align command's deprecated help text to options and arguments: do not translate the command's own help text, only the (DEPRECATED) label. #3901
Changelog

Sourced from click's changelog.

Version 8.5.1

Released 2026-11-09

  • Fix copy.deepcopy() and pickle on a Parameter, Option or Command. {pr}3805
  • A KeyboardInterrupt arriving while Command.main() reports an abort or an error, or while it exits, no longer escapes as an unhandled traceback. The command still exits with the intended code; only the message may be lost. {issue}3802
  • Add {meth}Option.get_help_spec, which returns the option's left help column even when the option is hidden. {meth}Option.get_help_record still returns None for hidden options, so help screens are unchanged. {pr}3821
  • The Positional arguments help section lists every argument of the command, not only the documented ones. An argument with no help gets an empty description, the same way an option with no help does. {pr}3860
  • {meth}Argument.get_help_record always returns a tuple. It used to return None for an argument with no help. {pr}3860
  • Document which types are inferred from default, and what an unrecognized type callable does to a command-line value. {issue}3036 {pr}3808
  • path_type narrows the converted value's type for convert and prompt. {issue}3822 {pr}3858
  • {class}Parameter accepts a new help argument and {class}Option and {class}Argument inherits it. {meth}Parameter.to_info_dict now reports help for every kind of parameter. {pr}3861
  • A command's short help no longer stops at an abbreviation such as vs. or e.g. inside the first sentence. A period ends the sentence only when it closes the text or the next word does not start in lowercase. {pr}3865
  • With show_envvar=True, an option's error message now prints all variables of an envvar sequence instead of the repr of the sequence. {pr}3884
  • An empty envvar, such as [] or "", shows the same help and error message as no envvar when show_envvar=True. The help screen used to show [env var: ]. {pr}3884
  • Align command's deprecated help text to options and arguments: do not translate the command's own help text, only the (DEPRECATED) label. {pr}3901
Commits
  • cf19179 Release version 8.5.1
  • 1ff766d Remove documentation changelog entry.
  • 16da191 Add a standalone application guide for Nuitka (#3897)
  • 473f652 Remove issue and PR references outside the changelog (#3905)
  • df7fe0b Remove issue and PR references outside the changelog
  • 4fd4206 Bump pypa/gh-action-pypi-publish to v1.14.3 (#3906)
  • 9048ab0 Bump pypa/gh-action-pypi-publish to v1.14.3
  • ff0c369 Add a standalone application guide for Nuitka
  • 5125851 Stop passing a deprecated command's help text through gettext (#3901)
  • 6d34602 Additional round-trip tests for unstyle() (#3899)
  • Additional commits viewable in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.

.. _v50-0-1:

Commits

Updates idna from 3.18 to 3.20

Release notes

Sourced from idna's releases.

v3.20

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.

v3.19

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.

3.19 (2026-08-18)

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits
  • d55e65e Release 3.20
  • 0c0824a Pre-release 3.20rc0
  • bd7c316 Note Python 3.15 support in the 3.20 changelog
  • b6cce85 Merge pull request #276 from kjd/unicode-18
  • 9a4bc59 Update to Unicode 18.0.0
  • dfab5a0 Merge branch 'python-3.15'
  • 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
  • cd17392 Merge pull request #274 from kjd/fix-decode-length-check
  • c5796d7 Skip the decode round-trip check for domains past encode's length limit
  • d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
  • Additional commits viewable in compare view

Updates jsonschema from 4.23.0 to 4.26.0

Release notes

Sourced from jsonschema's releases.

v4.26.0

What's Changed

New Contributors

Full Changelog: python-jsonschema/jsonschema@v4.25.1...v4.26.0

v4.25.1

What's Changed

... (truncated)

Changelog

Sourced from jsonschema's changelog.

v4.26.0

  • Decrease import time by delaying importing of urllib.request (#1416).

v4.25.1

  • Fix an incorrect required argument in the Validator protocol's type annotations (#1396).

v4.25.0

  • Add support for the iri and iri-reference formats to the format-nongpl extra via the MIT-licensed rfc3987-syntax. They were alread supported by the format extra. (#1388).

v4.24.1

  • Properly escape segments in ValidationError.json_path (#139).

v4.24.0

  • Fix improper handling of unevaluatedProperties in the presence of additionalProperties (#1351).
  • Support for Python 3.8 has been dropped, as it is end-of-life.
Commits
  • a727743 Add a changelog entry for 4.26.
  • 6d28c13 Update the lockfile.
  • 739499e Update pre-commit hooks.
  • cb2d779 Merge pull request #1443 from python-jsonschema/pre-commit-ci-update-config
  • e6bbbb7 [pre-commit.ci] pre-commit autoupdate
  • d56037a Merge pull request #1442 from python-jsonschema/dependabot/github_actions/ast...
  • e54ce13 Bump astral-sh/setup-uv from 7.1.4 to 7.1.6
  • 1f7c9fb Partially update docs requirements.
  • 241aec9 Merge pull request #1441 from python-jsonschema/pre-commit-ci-update-config
  • 2818efb Apache-2.0 -> nongpl
  • Additional commits viewable in compare view

Updates litellm from 1.106.6 to 1.108.3

Release notes

Sourced from litellm's releases.

1.108.3 (LTS)

[!TIP] The lts image tag always points to the latest LTS release. Pull ghcr.io/berriai/litellm:lts to stay on the newest LTS patch

Verify this release

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.108.3

Same command for litellm-database, litellm-non_root and the docker.io/litellm/* images

What's new in 1.108.3 (LTS)

11 PRs. 3 fixed. No action needed to upgrade

Changes

  • AWS Bedrock: Fixed every request failing on a Bedrock deployment with api_base: "", which answered 500 or 400 (#50449)
  • MCP: Fixed tool results over 1 MiB failing with SSE stream ended without a response, broken since v1.103.0 (#47034)
  • Guardrails: Fixed model-level post_call guardrails checking each response twice and calling the moderation provider twice (#50463)

Backport #50484 · Backport #50487 · Full changelog

1.108.2 (LTS)

[!TIP] The lts image tag always points to the latest LTS release. Pull ghcr.io/berriai/litellm:lts to stay on the newest LTS patch

Verify this release

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.108.2

Same command for litellm-database, litellm-non_root and the docker.io/litellm/* images

What's new in 1.108.2 (LTS)

12 PRs. 11 fixed, 1 changed. No action needed to upgrade

Changes

  • OpenAI: Fixed openai/ deployments with an empty api_key sending OPENAI_ADMIN_KEY as the bearer token (#50218)
  • AWS Bedrock: Fixed Converse service_tier so unsupported tiers answer 400 and reserved, auto and standard_only are honored (#50360)

... (truncated)

Commits
  • b7d579f Merge pull request #50545 from BerriAI/litellm_chore_23d634
  • 3eda243 chore: bump litellm 1.108.2 -> 1.108.3
  • 7e95523 Merge pull request #50487 from BerriAI/backport_49984_lts_1108
  • 03d9254 Merge pull request #50484 from BerriAI/litellm_backport_mcp_sse_lts_1_108_x
  • a323682 ci: remove workflows whose secrets are dead (#49722)
  • fea2ca5 ci: cut the weekly rc branch on Monday 3am PT instead of Friday (#49472)
  • b6c3c59 ci: run the dashboard API types and Terraform endpoint checks on every change...
  • 8473801 ci: remove the Together AI and weekly cost map sync workflows (#48473)
  • 48bb30b test(mcp): replace the live Linear MCP OAuth e2e tests with integration cover...
  • 26852a4 Merge pull request #50463 from BerriAI/litellm_backport_50300_lts_1_108_x
  • Additional commits viewable in compare view

Updates mcp from 1.28.1 to 1.30.0

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

  • streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
  • A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
  • The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
  • OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

  • A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
  • Clients that keep the GET stream open (the SDK's client does) are not affected.
  • A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
  • To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

  • Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
  • Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
  • If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

  • ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
  • AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
  • Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

  • AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
  • issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
  • session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

... (truncated)

Commits
  • 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
  • 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
  • 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
  • 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
  • 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
  • b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
  • 4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
  • ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
  • 98b7159 [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line (#3177)
  • c0c5a9d [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh (#3082)
  • Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

    

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
    • 

  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
    • 

  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
    • 

  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
    • 

  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
    • 

  • Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
    • 



Behavior adaptations:


    

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
    • 

  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
    • 



Fixes for versions and specifiers:


    

  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
    • 

  • Raise InvalidVersion for non-string pre-release letters passed to
    
Version.from_parts. (:pull:1241)
    • 

  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
    • 

  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
    • 



Fixes for requirements and markers:


    

  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    
foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates pydantic from 2.14.1 to 2.14.3

Release notes

Sourced from pydantic's releases.

v2.14.3 2026-11-04

v2.14.3 (2026-11-04)

What's Changed

Packaging

  • Build wheels for GraalPy 3.13 by @​msimacek in #14136.

    The previous v2.14.2 release published GraalPy 3.11 wheels, which were not working due to a PyO3 version bump. A CI workflow issue made it so that the wheel wasn't tested before publishing. This is now fixed: starting in v2.14.3, we no longer publish GraalPy 3.11 wheels, and GraalPy 3.13 wheels are now published together with the existing 3.12 one.

Performance

  • Improve schema generation for fixed type handlers by @​alexmojaki in #14130
  • Skip general schema dispatch for builtin scalars by @​alexmojaki in #14141
  • Skip annotation handler setup when annotations are empty by @​alexmojaki in #14149
  • Fix quadratic serialization time with per-index include/exclude on sequences by @​Viicos in #14160
  • Avoid type lookups when checking for None during serialization by @​Viicos in #14167
  • Improve performance of model serialization by @​Viicos in #14171
  • Improve performance of dict serialization by @​Viicos in #14172
  • Improve performance of type inference during serialization by @​Viicos in #14173
  • Avoid cloning the field name when using the default value during validation by @​Viicos in #14175
  • Do not evaluate model_config annotations by @​Viicos in #14195
  • Avoid slow runtime Protocol check when expanding GroupedMetad...

    Description has been truncated

    RetriggerView in GreptileConfidence Score: 5/5

    No confirmed blocking issue was found in this dependency update.

    Summary

    Updates Python dependencies in pyproject.toml and uv.lock.

    • The framework allows newer LiteLLM and E2B releases.
    • Optional sandbox providers allow newer SDK releases.
    • Development installs use newer pinned lint and plugin-check tools.

    Reviews (6) · Last reviewed commit: "build(deps): bump the python-minor-and-p..." · Reviewed by Greptile

@dependabot
dependabot Bot requested a review from a team as a code owner November 10, 2026 21:58
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 10, 2026
@socket-security

socket-security Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​botocore@​1.43.123 ⏵ 1.43.12798 +110010010070
Updatedpypi/​hypothesis@​6.170.14 ⏵ 6.170.1598 +110010010070
Updatedpypi/​smolmachines@​1.27.3 ⏵ 1.32.49710010010070 -30
Updatedpypi/​e2b@​2.46.4 ⏵ 2.63.073 +1100100100100
Updatedpypi/​openenv@​0.10.0 ⏵ 0.12.073 +1100100100100
Updatedpypi/​litellm@​1.106.6 ⏵ 1.108.374 +1100100100100
Updatedpypi/​moto@​5.2.2 ⏵ 5.2.575100100100100
Updatedpypi/​transformers@​5.21.0 ⏵ 5.22.277 +1100100100100
Updatedpypi/​pytest@​9.1.1 ⏵ 9.2.087 +1100100100100
Updatedpypi/​google-auth@​2.55.1 ⏵ 2.62.189 +1100100100100
Updatedpypi/​pymongo@​4.17.0 ⏵ 4.19.089 -1100 +31100100100
Updatedpypi/​vercel-sandbox@​0.7.0 ⏵ 0.11.091 -3100100100100
Updatedpypi/​google-cloud-storage@​3.15.0 ⏵ 3.17.193 +1100100100100
Updatedpypi/​click@​8.5.0 ⏵ 8.5.196 +1100100100100
Updatedpypi/​daytona@​0.224.1 ⏵ 0.231.096100100100100
Updatedpypi/​sail@​0.12.8 ⏵ 0.17.296 +1100100100100
Updatedpypi/​tensorlake@​0.5.149 ⏵ 0.5.16398 +1100100100100
Updatedpypi/​griffelib@​2.3.0 ⏵ 2.4.199 +1100100100100
Updatedpypi/​omegaconf@​2.3.1 ⏵ 2.4.099 -1100100100100
Updatedpypi/​boto3@​1.43.123 ⏵ 1.43.12699100100100100
Updatedpypi/​google-api-core@​2.31.0 ⏵ 2.44.099100100100100
Updatedpypi/​google-cloud-secret-manager@​2.30.0 ⏵ 2.32.099100100100100
Updatedpypi/​python-multipart@​0.0.32 ⏵ 0.0.33100 +1100100100100
Updatedpypi/​cwsandbox@​1.19.6 ⏵ 1.27.0100 +1100100100100
Updatedpypi/​cryptography@​50.0.1 ⏵ 50.0.2100100100100100
Updatedpypi/​starlette@​1.3.1 ⏵ 1.10.0100 +1100100100100
Updatedpypi/​ruff@​0.16.10 ⏵ 0.17.4100100100100100
Updatedpypi/​boxd@​0.2.17 ⏵ 0.3.0100 +1100100100100
Updatedpypi/​regex@​2026.6.28 ⏵ 2026.11.7100 +1100100100100
Updatedpypi/​httpx2@​2.13.1 ⏵ 2.16.0100100100100100
Updatedpypi/​fastapi@​0.141.1 ⏵ 0.162.2100 +1100100100100
Updatedpypi/​pytest-socket@​0.8.0 ⏵ 0.8.1100 +1100100100100
See 1 more rows in the dashboard

View full report

@socket-security

socket-security Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
High priority
High CVE: Hydra: hydra.utils.instantiate with untrusted config can lead to code execution in pypi hydra-core

CVE: GHSA-2cp2-2r3c-7p7r Hydra: hydra.utils.instantiate with untrusted config can lead to code execution (HIGH)

Affected versions: < 1.3.4

Patched version: 1.3.4

From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
High priority
High CVE: Hydra logging configuration permits unsafe callable resolution in pypi hydra-core

CVE: GHSA-c3wx-c55w-pxjq Hydra logging configuration permits unsafe callable resolution (HIGH)

Affected versions: < 1.3.6; >= 1.4.0.dev0 < 1.4.0.dev9

Patched version: 1.3.6

From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Potential vulnerability: pypi hydra-core with risk level "medium"

Location: Package overview

From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0

ℹ Read more on: This package | This alert | Navigating potential vulnerabilities

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Potential vulnerability: pypi hydra-core with risk level "medium"

Location: Package overview

From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0

ℹ Read more on: This package | This alert | Navigating potential vulnerabilities

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

@dependabot dependabot Bot changed the title build(deps): Bump the python-minor-and-patch group across 1 directory with 43 updates build(deps): bump the python-minor-and-patch group across 1 directory with 43 updates Nov 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-94865260fd branch 4 times, most recently from 341961f to c7234db Compare November 11, 2026 04:49
@dependabot
build(deps): bump the python-minor-and-patch group across 1 directory…
ab8008b 
… with 43 updates

Bumps the python-minor-and-patch group with 43 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [click](https://github.com/pallets/click) | `8.5.0` | `8.5.1` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.1` | `50.0.2` |
| [idna](https://github.com/kjd/idna) | `3.18` | `3.20` |
| [jsonschema](https://github.com/python-jsonschema/jsonschema) | `4.23.0` | `4.26.0` |
| [litellm](https://github.com/BerriAI/litellm) | `1.106.6` | `1.108.3` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.28.1` | `1.30.0` |
| [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.14.1` | `2.14.3` |
| [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.17.0` | `4.19.0` |
| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.32` | `0.0.33` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.10.0` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.49.0` | `0.54.0` |
| [e2b](https://github.com/e2b-dev/e2b) | `2.46.4` | `2.63.0` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.162.2` |
| [tzdata](https://github.com/python/tzdata) | `2026.5` | `2026.6` |
| [openenv](https://github.com/openenv/OpenEnv) | `0.10.0` | `0.12.0` |
| [transformers](https://github.com/huggingface/transformers) | `5.21.0` | `5.22.2` |
| [omegaconf](https://github.com/hydra-ecosystem/omegaconf) | `2.3.1` | `2.4.0` |
| [boto3](https://github.com/boto/boto3) | `1.43.123` | `1.43.126` |
| [botocore](https://github.com/boto/botocore) | `1.43.123` | `1.43.127` |
| [google-api-core](https://github.com/googleapis/google-cloud-python) | `2.31.0` | `2.44.0` |
| [google-auth](https://github.com/googleapis/google-cloud-python) | `2.55.1` | `2.62.1` |
| [google-cloud-secret-manager](https://github.com/googleapis/google-cloud-python) | `2.30.0` | `2.32.0` |
| [google-cloud-storage](https://github.com/googleapis/google-cloud-python) | `3.15.0` | `3.17.1` |
| [sail](https://github.com/sailresearchco/sail) | `0.12.8` | `0.17.2` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.16.0` |
| [httpx2](https://github.com/pydantic/httpx2) | `2.13.1` | `2.16.0` |
| vercel-sandbox | `0.7.0` | `0.11.0` |
| [tensorlake](https://github.com/tensorlakeai/tensorlake) | `0.5.149` | `0.5.163` |
| [boxd](https://github.com/boxd-sh/sdk) | `0.2.17` | `0.3.0` |
| daytona | `0.224.1` | `0.231.0` |
| [cwsandbox](https://github.com/coreweave/cwsandbox-client) | `1.19.6` | `1.27.0` |
| [griffelib](https://github.com/mkdocstrings/griffe) | `2.3.0` | `2.4.1` |
| [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.170.14` | `6.170.15` |
| [moto](https://github.com/getmoto/moto) | `5.2.2` | `5.2.5` |
| [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.12` | `2.9.13` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.6.28` | `2026.11.7` |
| [websockets](https://github.com/python-websockets/websockets) | `17.2` | `17.4` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` |
| [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) | `1.4.0` | `1.4.1.post1` |
| [pytest-socket](https://github.com/miketheman/pytest-socket) | `0.8.0` | `0.8.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.10` | `0.17.4` |
| [smolmachines](https://github.com/smol-machines/smol) | `1.27.3` | `1.32.4` |



Updates `click` from 8.5.0 to 8.5.1
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.5.0...8.5.1)

Updates `cryptography` from 50.0.1 to 50.0.2
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.1...50.0.2)

Updates `idna` from 3.18 to 3.20
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.20)

Updates `jsonschema` from 4.23.0 to 4.26.0
- [Release notes](https://github.com/python-jsonschema/jsonschema/releases)
- [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst)
- [Commits](python-jsonschema/jsonschema@v4.23.0...v4.26.0)

Updates `litellm` from 1.106.6 to 1.108.3
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.106.6...v1.108.3)

Updates `mcp` from 1.28.1 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.28.1...v1.30.0)

Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.2...26.3)

Updates `pydantic` from 2.14.1 to 2.14.3
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.14.1...v2.14.3)

Updates `pymongo` from 4.17.0 to 4.19.0
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/main/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.17.0...4.19.0)

Updates `python-multipart` from 0.0.32 to 0.0.33
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md)
- [Commits](Kludex/python-multipart@0.0.32...0.0.33)

Updates `starlette` from 1.3.1 to 1.10.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.10.0)

Updates `uvicorn` from 0.49.0 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.49.0...0.54.0)

Updates `e2b` from 2.46.4 to 2.63.0
- [Release notes](https://github.com/e2b-dev/e2b/releases)
- [Commits](https://github.com/e2b-dev/e2b/compare/@e2b/python-sdk@2.46.4...e2b@2.63.0)

Updates `fastapi` from 0.141.1 to 0.162.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.162.2)

Updates `tzdata` from 2026.5 to 2026.6
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.5...2026.6)

Updates `openenv` from 0.10.0 to 0.12.0
- [Release notes](https://github.com/openenv/OpenEnv/releases)
- [Commits](openenv/OpenEnv@v0.10.0...v0.12.0)

Updates `transformers` from 5.21.0 to 5.22.2
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.21...v5.22.2)

Updates `omegaconf` from 2.3.1 to 2.4.0
- [Release notes](https://github.com/hydra-ecosystem/omegaconf/releases)
- [Changelog](https://github.com/hydra-ecosystem/omegaconf/blob/main/NEWS.md)
- [Commits](hydra-ecosystem/omegaconf@v2.3.1...v2.4.0)

Updates `boto3` from 1.43.123 to 1.43.126
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.123...1.43.126)

Updates `botocore` from 1.43.123 to 1.43.127
- [Commits](boto/botocore@1.43.123...1.43.127)

Updates `google-api-core` from 2.31.0 to 2.44.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-api-core-v2.31.0...google-api-core-v2.44.0)

Updates `google-auth` from 2.55.1 to 2.62.1
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-auth-v2.55.1...google-auth-v2.62.1)

Updates `google-cloud-secret-manager` from 2.30.0 to 2.32.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-secret-manager-v2.30.0...google-cloud-secret-manager-v2.32.0)

Updates `google-cloud-storage` from 3.15.0 to 3.17.1
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-storage-v3.15.0...google-cloud-storage-v3.17.1)

Updates `sail` from 0.12.8 to 0.17.2
- [Commits](https://github.com/sailresearchco/sail/commits)

Updates `anyio` from 4.14.2 to 4.16.0
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.2...4.16.0)

Updates `httpx2` from 2.13.1 to 2.16.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.13.1...v2.16.0)

Updates `vercel-sandbox` from 0.7.0 to 0.11.0

Updates `tensorlake` from 0.5.149 to 0.5.163
- [Release notes](https://github.com/tensorlakeai/tensorlake/releases)
- [Commits](tensorlakeai/tensorlake@cli-v0.5.149...cli-v0.5.163)

Updates `boxd` from 0.2.17 to 0.3.0
- [Commits](https://github.com/boxd-sh/sdk/commits/v0.3.0)

Updates `daytona` from 0.224.1 to 0.231.0

Updates `cwsandbox` from 1.19.6 to 1.27.0

Updates `griffelib` from 2.3.0 to 2.4.1
- [Release notes](https://github.com/mkdocstrings/griffe/releases)
- [Changelog](https://github.com/mkdocstrings/griffe/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/griffe@2.3.0...2.4.1)

Updates `hypothesis` from 6.170.14 to 6.170.15
- [Release notes](https://github.com/HypothesisWorks/hypothesis/releases)
- [Commits](HypothesisWorks/hypothesis@v6.170.14...v6.170.15)

Updates `moto` from 5.2.2 to 5.2.5
- [Release notes](https://github.com/getmoto/moto/releases)
- [Changelog](https://github.com/getmoto/moto/blob/master/CHANGELOG.md)
- [Commits](getmoto/moto@5.2.2...5.2.5)

Updates `psycopg2-binary` from 2.9.12 to 2.9.13
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.12...2.9.13)

Updates `regex` from 2026.6.28 to 2026.11.7
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.6.28...2026.11.7)

Updates `websockets` from 17.2 to 17.4
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@17.2...17.4)

Updates `pytest` from 9.1.1 to 9.2.0
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.1.1...9.2.0)

Updates `pytest-asyncio` from 1.4.0 to 1.4.1.post1
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases)
- [Commits](pytest-dev/pytest-asyncio@v1.4.0...v1.4.1.post1)

Updates `pytest-socket` from 0.8.0 to 0.8.1
- [Release notes](https://github.com/miketheman/pytest-socket/releases)
- [Changelog](https://github.com/miketheman/pytest-socket/blob/main/CHANGELOG.md)
- [Commits](miketheman/pytest-socket@0.8.0...0.8.1)

Updates `ruff` from 0.16.10 to 0.17.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.10...0.17.4)

Updates `smolmachines` from 1.27.3 to 1.32.4
- [Release notes](https://github.com/smol-machines/smol/releases)
- [Commits](smol-machines/smol@v1.27.3...v1.32.4)

---
updated-dependencies:
- dependency-name: anyio
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: boto3
  dependency-version: 1.43.126
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: botocore
  dependency-version: 1.43.127
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: boxd
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: click
  dependency-version: 8.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: cwsandbox
  dependency-version: 1.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: daytona
  dependency-version: 0.231.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: e2b
  dependency-version: 2.63.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: fastapi
  dependency-version: 0.162.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-api-core
  dependency-version: 2.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-auth
  dependency-version: 2.62.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-cloud-secret-manager
  dependency-version: 2.32.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-cloud-storage
  dependency-version: 3.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: griffelib
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: httpx2
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: hypothesis
  dependency-version: 6.170.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: idna
  dependency-version: '3.20'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: jsonschema
  dependency-version: 4.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: litellm
  dependency-version: 1.108.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: mcp
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: moto
  dependency-version: 5.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: omegaconf
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: openenv
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pydantic
  dependency-version: 2.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pymongo
  dependency-version: 4.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pytest-asyncio
  dependency-version: 1.4.1.post1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pytest-socket
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: python-multipart
  dependency-version: 0.0.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: regex
  dependency-version: 2026.11.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.17.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: sail
  dependency-version: 0.17.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: smolmachines
  dependency-version: 1.32.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: starlette
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: tensorlake
  dependency-version: 0.5.163
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: transformers
  dependency-version: 5.22.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: tzdata
  dependency-version: '2026.6'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: vercel-sandbox
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: websockets
  dependency-version: '17.4'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-94865260fd branch from c7234db to ab8008b Compare November 11, 2026 05:41

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants