build(deps): bump the python-minor-and-patch group across 1 directory with 44 updates by dependabot[bot] · Pull Request #651 · scaleapi/agentenv-framework

dependabot · 2026-11-12T22:23:26Z

Bumps the python-minor-and-patch group with 44 updates in the / directory:

Package	From	To
click	`8.5.0`	`8.5.1`
cryptography	`50.0.1`	`50.0.2`
idna	`3.18`	`3.20`
jsonschema	`4.23.0`	`4.26.0`
litellm	`1.106.6`	`1.109.0`
mcp	`1.28.1`	`1.30.0`
packaging	`26.2`	`26.3`
pydantic	`2.14.1`	`2.14.3`
pymongo	`4.17.0`	`4.19.0`
python-multipart	`0.0.32`	`0.0.33`
starlette	`1.3.1`	`1.10.0`
uvicorn	`0.49.0`	`0.54.0`
e2b	`2.46.4`	`2.63.0`
fastapi	`0.141.1`	`0.162.5`
tzdata	`2026.5`	`2026.6`
openenv	`0.10.0`	`0.12.0`
datasets	`5.1.0`	`5.2.0`
transformers	`5.21.0`	`5.22.2`
omegaconf	`2.3.1`	`2.4.0`
boto3	`1.43.123`	`1.44.1`
botocore	`1.43.123`	`1.44.3`
google-api-core	`2.31.0`	`2.44.0`
google-auth	`2.55.1`	`2.62.2`
google-cloud-secret-manager	`2.30.0`	`2.32.0`
google-cloud-storage	`3.15.0`	`3.17.1`
sail	`0.12.8`	`0.18.1`
anyio	`4.14.2`	`4.16.0`
httpx2	`2.13.1`	`2.16.0`
vercel-sandbox	`0.7.0`	`0.11.0`
tensorlake	`0.5.149`	`0.5.163`
boxd	`0.2.17`	`0.3.1`
daytona	`0.224.1`	`0.231.1`
cwsandbox	`1.19.6`	`1.28.0`
griffelib	`2.3.0`	`2.4.1`
hypothesis	`6.170.14`	`6.170.15`
moto	`5.2.2`	`5.2.5`
psycopg2-binary	`2.9.12`	`2.9.13`
regex	`2026.6.28`	`2026.11.9`
websockets	`17.2`	`17.4`
pytest	`9.1.1`	`9.2.0`
pytest-asyncio	`1.4.0`	`1.4.1.post1`
pytest-socket	`0.8.0`	`0.8.1`
ruff	`0.16.10`	`0.17.4`
smolmachines	`1.27.3`	`1.32.4`

Updates click from 8.5.0 to 8.5.1

Release notes

Sourced from click's releases.

8.5.1

This is the Click 8.5.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.5.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-1 Milestone: https://github.com/pallets/click/milestone/66

Fix copy.deepcopy() and pickle on a Parameter, Option or Command. #3805

A KeyboardInterrupt arriving while Command.main() reports an abort or an error, or while it exits, no longer escapes as an unhandled traceback. The command still exits with the intended code; only the message may be lost. #3802

Add Option.get_help_spec(), which returns the option's left help column even when the option is hidden. Option.get_help_record() still returns None for hidden options, so help screens are unchanged. #3821

The Positional arguments help section lists every argument of the command, not only the documented ones. An argument with no help gets an empty description, the same way an option with no help does. #3860

Argument.get_help_record() always returns a tuple. It used to return None for an argument with no help. #3860

Document which types are inferred from default, and what an unrecognized type callable does to a command-line value. #3036 #3808

path_type narrows the converted value's type for convert and prompt. #3822 #3858

Parameter accepts a new help argument, and Option and Argument inherit it. Parameter.to_info_dict() now reports help for every kind of parameter. #3861

A command's short help no longer stops at an abbreviation such as vs. or e.g. inside the first sentence. A period ends the sentence only when it closes the text or the next word does not start in lowercase. #3865

With show_envvar=True, an option's error message now prints all variables of an envvar sequence instead of the repr of the sequence. #3884

An empty envvar, such as [] or "", shows the same help and error message as no envvar when show_envvar=True. The help screen used to show [env var: ]. #3884

Align command's deprecated help text to options and arguments: do not translate the command's own help text, only the (DEPRECATED) label. #3901

Changelog

Sourced from click's changelog.

Version 8.5.1

Released 2026-11-09

Fix copy.deepcopy() and pickle on a Parameter, Option or Command. {pr}3805

A KeyboardInterrupt arriving while Command.main() reports an abort or an error, or while it exits, no longer escapes as an unhandled traceback. The command still exits with the intended code; only the message may be lost. {issue}3802

Add {meth}Option.get_help_spec, which returns the option's left help column even when the option is hidden. {meth}Option.get_help_record still returns None for hidden options, so help screens are unchanged. {pr}3821

The Positional arguments help section lists every argument of the command, not only the documented ones. An argument with no help gets an empty description, the same way an option with no help does. {pr}3860

{meth}Argument.get_help_record always returns a tuple. It used to return None for an argument with no help. {pr}3860

Document which types are inferred from default, and what an unrecognized type callable does to a command-line value. {issue}3036 {pr}3808

path_type narrows the converted value's type for convert and prompt. {issue}3822 {pr}3858

{class}Parameter accepts a new help argument and {class}Option and {class}Argument inherits it. {meth}Parameter.to_info_dict now reports help for every kind of parameter. {pr}3861

A command's short help no longer stops at an abbreviation such as vs. or e.g. inside the first sentence. A period ends the sentence only when it closes the text or the next word does not start in lowercase. {pr}3865

With show_envvar=True, an option's error message now prints all variables of an envvar sequence instead of the repr of the sequence. {pr}3884

An empty envvar, such as [] or "", shows the same help and error message as no envvar when show_envvar=True. The help screen used to show [env var: ]. {pr}3884

Align command's deprecated help text to options and arguments: do not translate the command's own help text, only the (DEPRECATED) label. {pr}3901

Commits

cf19179 Release version 8.5.1
1ff766d Remove documentation changelog entry.
16da191 Add a standalone application guide for Nuitka (#3897)
473f652 Remove issue and PR references outside the changelog (#3905)
df7fe0b Remove issue and PR references outside the changelog
4fd4206 Bump pypa/gh-action-pypi-publish to v1.14.3 (#3906)
9048ab0 Bump pypa/gh-action-pypi-publish to v1.14.3
ff0c369 Add a standalone application guide for Nuitka
5125851 Stop passing a deprecated command's help text through gettext (#3901)
6d34602 Additional round-trip tests for unstyle() (#3899)
Additional commits viewable in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3. * Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later. * Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and MSYS2.

.. _v50-0-1:

Commits

4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
See full diff in compare view

Updates idna from 3.18 to 3.20

Release notes

Sourced from idna's releases.

v3.20

Update to Unicode 18.0.0.

Better enforcement of the domain length limit in the incremental codec.

Add support for Python 3.15.

v3.19

Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.

Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.

Test on free-threaded CPython with the GIL disabled and document thread safety.

Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.

Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.

The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.

Reject A-labels that are not the canonical Punycode encoding of their U-label.

Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.

Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.

Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.

Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

Update to Unicode 18.0.0.

Better enforcement of the domain length limit in the incremental codec.

Add support for Python 3.15.

3.19 (2026-08-18)

Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.

Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.

Test on free-threaded CPython with the GIL disabled and document thread safety.

Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.

Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.

The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.

Reject A-labels that are not the canonical Punycode encoding of their U-label.

Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.

Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.

Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.

Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits

d55e65e Release 3.20
0c0824a Pre-release 3.20rc0
bd7c316 Note Python 3.15 support in the 3.20 changelog
b6cce85 Merge pull request #276 from kjd/unicode-18
9a4bc59 Update to Unicode 18.0.0
dfab5a0 Merge branch 'python-3.15'
417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
cd17392 Merge pull request #274 from kjd/fix-decode-length-check
c5796d7 Skip the decode round-trip check for domains past encode's length limit
d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
Additional commits viewable in compare view

Updates jsonschema from 4.23.0 to 4.26.0

Release notes

Sourced from jsonschema's releases.

v4.26.0

What's Changed

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1400

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1405

Bump astral-sh/setup-uv from 6.5.0 to 6.6.0 by @dependabot[bot] in python-jsonschema/jsonschema#1406

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1407

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1413

Bump astral-sh/setup-uv from 6.6.0 to 6.6.1 by @dependabot[bot] in python-jsonschema/jsonschema#1412

Bump pypa/gh-action-pypi-publish from 1.12.4 to 1.13.0 by @dependabot[bot] in python-jsonschema/jsonschema#1410

Bump softprops/action-gh-release from 2.3.2 to 2.3.3 by @dependabot[bot] in python-jsonschema/jsonschema#1409

Bump actions/setup-python from 5 to 6 by @dependabot[bot] in python-jsonschema/jsonschema#1411

validators: avoid urllib.request at import-time by @gudnimg in python-jsonschema/jsonschema#1416

Bump astral-sh/setup-uv from 6.6.1 to 6.8.0 by @dependabot[bot] in python-jsonschema/jsonschema#1417

Bump softprops/action-gh-release from 2.3.3 to 2.3.4 by @dependabot[bot] in python-jsonschema/jsonschema#1418

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1415

Bump softprops/action-gh-release from 2.3.4 to 2.4.1 by @dependabot[bot] in python-jsonschema/jsonschema#1419

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in python-jsonschema/jsonschema#1420

Bump astral-sh/setup-uv from 6.8.0 to 7.1.0 by @dependabot[bot] in python-jsonschema/jsonschema#1421

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1424

Bump astral-sh/setup-uv from 7.1.0 to 7.1.1 by @dependabot[bot] in python-jsonschema/jsonschema#1423

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1425

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1429

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1431

Bump softprops/action-gh-release from 2.4.1 to 2.4.2 by @dependabot[bot] in python-jsonschema/jsonschema#1432

Bump astral-sh/setup-uv from 7.1.1 to 7.1.2 by @dependabot[bot] in python-jsonschema/jsonschema#1430

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1434

Bump astral-sh/setup-uv from 7.1.2 to 7.1.4 by @dependabot[bot] in python-jsonschema/jsonschema#1435

Bump actions/checkout from 5 to 6 by @dependabot[bot] in python-jsonschema/jsonschema#1436

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1437

Bump softprops/action-gh-release from 2.4.2 to 2.5.0 by @dependabot[bot] in python-jsonschema/jsonschema#1438

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1439

Document uuid format by @sim642 in python-jsonschema/jsonschema#1440

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1441

Bump astral-sh/setup-uv from 7.1.4 to 7.1.6 by @dependabot[bot] in python-jsonschema/jsonschema#1442

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in python-jsonschema/jsonschema#1443

New Contributors

@gudnimg made their first contribution in python-jsonschema/jsonschema#1416

@sim642 made their first contribution in python-jsonschema/jsonschema#1440

Full Changelog: python-jsonschema/jsonschema@v4.25.1...v4.26.0

v4.25.1

What's Changed

Fix Validator protocol init to match runtime by @sirosen in python-jsonschema/jsonschema#1396

... (truncated)

Changelog

Sourced from jsonschema's changelog.

v4.26.0

Decrease import time by delaying importing of urllib.request (#1416).

v4.25.1

Fix an incorrect required argument in the Validator protocol's type annotations (#1396).

v4.25.0

Add support for the iri and iri-reference formats to the format-nongpl extra via the MIT-licensed rfc3987-syntax. They were alread supported by the format extra. (#1388).

v4.24.1

Properly escape segments in ValidationError.json_path (#139).

v4.24.0

Fix improper handling of unevaluatedProperties in the presence of additionalProperties (#1351).

Support for Python 3.8 has been dropped, as it is end-of-life.

Commits

a727743 Add a changelog entry for 4.26.
6d28c13 Update the lockfile.
739499e Update pre-commit hooks.
cb2d779 Merge pull request #1443 from python-jsonschema/pre-commit-ci-update-config
e6bbbb7 [pre-commit.ci] pre-commit autoupdate
d56037a Merge pull request #1442 from python-jsonschema/dependabot/github_actions/ast...
e54ce13 Bump astral-sh/setup-uv from 7.1.4 to 7.1.6
1f7c9fb Partially update docs requirements.
241aec9 Merge pull request #1441 from python-jsonschema/pre-commit-ci-update-config
2818efb Apache-2.0 -> nongpl
Additional commits viewable in compare view

Updates litellm from 1.106.6 to 1.109.0

Release notes

Sourced from litellm's releases.

v1.109.0

Verify this release
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.109.0
Same command for litellm-database, litellm-non_root and the docker.io/litellm/* images

What's new in 1.109.0

982 PRs. 144 added, 424 fixed, 60 changed, 17 improved, 9 removed. 5 need action

Action required

Routing and fallbacks: Change string fallback targets to lists of model names (#48943)

Caching: Switch cache_params.type from disk to local or redis, since the disk cache backend (diskcache) has been removed (#48114)

Routing and fallbacks: Add optional_pre_call_checks: ["enforce_model_rate_limits"] to keep a hard rpm cap on deployments (#48873)

Vertex AI and Gemini: Set drop_params: true or stop sending temperature, top_p and top_k to Gemini 3.6 Flash, 3.5 Flash-Lite and newer (#47645)

Deployment: Deploy Lens from its own chart and set lens.* in your values (#49169)

Highlights

Admin UI: Added a Chat UI with a model hub, image generation and usage metrics (#48108)

Routing and fallbacks: Added mid-stream fallback continuation so a streaming chat cut off mid-answer continues on the configured fallback (#41127)

Deployment: Added LITELLM_OFFLINE_MODE to turn off every fetch LiteLLM makes on its own with one switch (#48096)

Cost tracking and pricing: Added model_info.pricing_provider to price a deployment from another provider's catalog rates instead of $0 (#47620)

Vertex AI and Gemini: Added Gemini 3.1 Flash TTS support, including multi-speaker voices and mp3, opus, alaw and mulaw output (#31915)

SDK: Fixed tool calls on completion() and responses() failing with No module named 'mcp' on base SDK installs (#45961) Also in 1.108.4

All changes

Added per-deployment workload identity on non-chat routes, realtime and the moderation guardrail (#39966)

Added the 12-hour cache write rate for gpt-5.6-cyber (#48246)

Added OpenAI gpt-6.1-terra with pricing (#48429)

Added Batch and Ultrafast 12-hour cache write rates for OpenAI models (#48433)

Added gpt-6-rosalind to the model cost map with its published prices (#49268)

Added gpt-6-astra-law with pricing from the OpenAI pricing page (#49444)

Fixed 400 errors and $0 spend logs on gpt-transcribe calls without response_format (#44021)

Fixed nonstreaming aiohttp_openai responses dropping service_tier (#47263)

Fixed prompt_cache_retention such as 24h being silently dropped instead of sent upstream (#47480)

Fixed /health marking OpenAI and Azure audio chat models unhealthy (#47730)

Fixed OpenAI context_length_exceeded errors raising BadRequestError instead of ContextWindowExceededError (#47954)

Fixed 12-hour prompt cache writes on openai/gpt-5.6 and newer billing at the 30-minute rate (#48088)

Fixed uncatalogued ChatGPT models hitting an unsupported Chat Completions endpoint (#48244)

Fixed the whole reasoning_effort dict not being sent when chat is bridged to Responses (#48807)

... (truncated)

Commits

55c9c6a Merge pull request #50849 from BerriAI/litellm_rc109_beta_header_test_bundled...
e4f7454 test(integration): cap the OAuth metadata lookup in the mixed capabilities su...
d993377 test(integration): give each kill-burst its own prompts so cached control rep...
f8eeb05 test(integration): empty the shared client cache before the tier pin batch test
9eedf60 test(vertex_ai): read the bundled beta header config in the prompt caching sc...
d55668e Merge pull request #50795 from BerriAI/litellm_rc109_drop_gemini_empty_n
3389850 test(integration): drop the empty-string n case from the Gemini long decode test
efebe3a Merge pull request #50757 from BerriAI/litellm_rc109_together_repin
5d0935b test(e2e): repin the Together reasoning replay backend to MiniMax-M3.1-Flash ...
7f88a33 Merge pull request #49978 from BerriAI/litellm_chore_9d4b6e
Additional commits viewable in compare view

Updates mcp from 1.28.1 to 1.30.0

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).

A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.

The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.

OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.

Clients that keep the GET stream open (the SDK's client does) are not affected.

A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.

To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.

Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.

If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.

AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.

Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).

issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).

session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

[v1.x] Resolve tool output-schema references within the schema document only by @maxisbey in modelcontextprotocol/python-sdk#3396

[v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @maxisbey in modelcontextprotocol/python-sdk#3426

[v1.x] Validate the authorization server metadata issuer on every discovery path by @maxisbey in modelcontextprotocol/python-sdk#3431

[v1.x] Follow redirects only within the MCP endpoint's origin by @maxisbey in modelcontextprotocol/python-sdk#3448

[v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource by @maxisbey in modelcontextprotocol/python-sdk#3451

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

[v1.x] Complete the FastMCP Settings model at import time by @maxisbey in modelcontextprotocol/python-sdk#3352

[v1.x] Apply the request body limit to the SSE and OAuth endpoints by @maxisbey in modelcontextprotocol/python-sdk#3344

... (truncated)

Commits

8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
98b7159 [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line (#3177)
c0c5a9d [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh (#3082)
Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)

PEP 808: accept Metadata-Version: 2.6. (#1194)

Add a limit argument to parse_tag() for compressed tag sets. (#1220)

Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)

Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)

Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)

Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)

Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)

Fix an AttributeError when hashing internally trimmed versions. (#1242)

Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)

Normalize requested extra names before comparing or hashing requirements. (#644)

Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)

Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)

Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)

Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)

Keep the parentheses of a nested group when serializing markers. (#1316)

Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)

Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)

Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)

Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)

Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)

Accept the UTF-8 charset case-insensitively in email payloads. (#1330)

Reject malformed Description-Content-Type values. (#1329)

Don't rewrite user values that contain {field} placeholders in error messages. (#1327)

Route multipart email payloads to unparsed instead of asserting. (#1247)

Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)

Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() &lt;packaging.specifiers.SpecifierSet.to_range&gt;,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() &lt;packaging.specifiers.SpecifierSet.is_subset&gt;, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

929fd4b Bump for release
f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
413d006 docs: changelog for 26.3 (#1343)
4eb0753 docs(metadata): explain selective field validation (#1342)
77e9ed4 feat(tags): add pure Python tag generator (#1346)
7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
Additional commits viewable in compare view

Updates pydantic from 2.14.1 to 2.14.3

Release notes

Sourced from pydantic's releasesDescription has been truncated

Confidence Score: 5/5
The PR appears safe to merge, with the existing non-blocking dependency-notices issue still open.
Findings

Dependency notices miss a package ▶

Fix with agent prompt

### Issue 1 uv.lock:1833-1834 `uv.lock` adds `e2b-dockerfile-utils` and removes `dockerfile-parse`, but the shipped `THIRD_PARTY_NOTICES.md` still lists the removed package and omits the new one. It also lists old versions of several updated runtime dependencies. Refresh the notices from the new lockfile so users receive an accurate dependency and license list. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Widens dependency ranges for LiteLLM and five sandbox SDKs, and updates the pinned development tools.

Framework installs now resolve updated Python packages across core and optional features.

_{Reviews (12) · Last reviewed commit: "build(deps): bump the python-minor-and-p..." · Reviewed by Greptile}

socket-security · 2026-11-12T22:24:41Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	License
	pypi/botocore@1.43.123 ⏵ 1.44.3	⁺¹
	pypi/hypothesis@6.170.14 ⏵ 6.170.15	⁺¹
	pypi/smolmachines@1.27.3 ⏵ 1.32.4			^-30
	pypi/e2b@2.46.4 ⏵ 2.63.0	⁺¹
	pypi/openenv@0.10.0 ⏵ 0.12.0	⁺¹
	pypi/litellm@1.106.6 ⏵ 1.109.0
	pypi/moto@5.2.2 ⏵ 5.2.5
	pypi/transformers@5.21.0 ⏵ 5.22.2	⁺¹
	pypi/pytest@9.1.1 ⏵ 9.2.0	⁺¹
	pypi/google-auth@2.55.1 ⏵ 2.62.2	⁺¹
	pypi/pymongo@4.17.0 ⏵ 4.19.0	^-1	⁺³¹
	pypi/vercel-sandbox@0.7.0 ⏵ 0.11.0	^-3
	pypi/datasets@5.1.0 ⏵ 5.2.0	⁺¹
	pypi/google-cloud-storage@3.15.0 ⏵ 3.17.1	⁺¹
	pypi/click@8.5.0 ⏵ 8.5.1	⁺¹
	pypi/daytona@0.224.1 ⏵ 0.231.1
	pypi/sail@0.12.8 ⏵ 0.18.1	⁺¹
	pypi/tensorlake@0.5.149 ⏵ 0.5.163	⁺¹
	pypi/griffelib@2.3.0 ⏵ 2.4.1	⁺¹
	pypi/omegaconf@2.3.1 ⏵ 2.4.0	^-1
	pypi/boto3@1.43.123 ⏵ 1.44.1	⁺¹
	pypi/google-api-core@2.31.0 ⏵ 2.44.0
	pypi/google-cloud-secret-manager@2.30.0 ⏵ 2.32.0
	pypi/python-multipart@0.0.32 ⏵ 0.0.33	⁺¹
	pypi/cwsandbox@1.19.6 ⏵ 1.28.0	⁺¹
	pypi/cryptography@50.0.1 ⏵ 50.0.2
	pypi/starlette@1.3.1 ⏵ 1.10.0	⁺¹
	pypi/ruff@0.16.10 ⏵ 0.17.4
	pypi/boxd@0.2.17 ⏵ 0.3.1	⁺¹
	pypi/httpx2@2.13.1 ⏵ 2.16.0
	pypi/fastapi@0.141.1 ⏵ 0.162.5	⁺¹
	pypi/pytest-socket@0.8.0 ⏵ 0.8.1	⁺¹
See 1 more rows in the dashboard

View full report

socket-security · 2026-11-12T22:24:43Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	High CVE: Hydra logging configuration permits unsafe callable resolution in pypi `hydra-core` CVE: GHSA-c3wx-c55w-pxjq Hydra logging configuration permits unsafe callable resolution (HIGH) Affected versions: < 1.3.6; >= 1.4.0.dev0 < 1.4.0.dev9 Patched version: 1.3.6 From: uv.lock → `pypi/nemo-gym@0.7.0` → `pypi/hydra-core@1.3.0` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/hydra-core@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	High CVE: Hydra: hydra.utils.instantiate with untrusted config can lead to code execution in pypi `hydra-core` CVE: GHSA-2cp2-2r3c-7p7r Hydra: hydra.utils.instantiate with untrusted config can lead to code execution (HIGH) Affected versions: < 1.3.4 Patched version: 1.3.4 From: uv.lock → `pypi/nemo-gym@0.7.0` → `pypi/hydra-core@1.3.0` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/hydra-core@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi `hydra-core` with risk level "medium" Location: Package overview From: uv.lock → `pypi/nemo-gym@0.7.0` → `pypi/hydra-core@1.3.0` ℹ Read more on: This package \| This alert \| Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/hydra-core@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi `hydra-core` with risk level "medium" Location: Package overview From: uv.lock → `pypi/nemo-gym@0.7.0` → `pypi/hydra-core@1.3.0` ℹ Read more on: This package \| This alert \| Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/hydra-core@1.3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

greptile-apps · 2026-11-12T22:27:55Z

+name = "e2b-dockerfile-utils"
+version = "0.1.1"


Dependency notices miss a package

uv.lock adds e2b-dockerfile-utils and removes dockerfile-parse, but the shipped THIRD_PARTY_NOTICES.md still lists the removed package and omits the new one. It also lists old versions of several updated runtime dependencies. Refresh the notices from the new lockfile so users receive an accurate dependency and license list.

Prompt To Fix With AI

This is a comment left during a code review. Path: uv.lock Line: 1833-1834 Comment: **Dependency notices miss a package** `uv.lock` adds `e2b-dockerfile-utils` and removes `dockerfile-parse`, but the shipped `THIRD_PARTY_NOTICES.md` still lists the removed package and omits the new one. It also lists old versions of several updated runtime dependencies. Refresh the notices from the new lockfile so users receive an accurate dependency and license list. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

… with 44 updates Bumps the python-minor-and-patch group with 44 updates in the / directory: | Package | From | To | | --- | --- | --- | | [click](https://github.com/pallets/click) | `8.5.0` | `8.5.1` | | [cryptography](https://github.com/pyca/cryptography) | `50.0.1` | `50.0.2` | | [idna](https://github.com/kjd/idna) | `3.18` | `3.20` | | [jsonschema](https://github.com/python-jsonschema/jsonschema) | `4.23.0` | `4.26.0` | | [litellm](https://github.com/BerriAI/litellm) | `1.106.6` | `1.109.0` | | [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.28.1` | `1.30.0` | | [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` | | [pydantic](https://github.com/pydantic/pydantic) | `2.14.1` | `2.14.3` | | [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.17.0` | `4.19.0` | | [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.32` | `0.0.33` | | [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.10.0` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.49.0` | `0.54.0` | | [e2b](https://github.com/e2b-dev/e2b) | `2.46.4` | `2.63.0` | | [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.162.5` | | [tzdata](https://github.com/python/tzdata) | `2026.5` | `2026.6` | | [openenv](https://github.com/openenv/OpenEnv) | `0.10.0` | `0.12.0` | | [datasets](https://github.com/huggingface/datasets) | `5.1.0` | `5.2.0` | | [transformers](https://github.com/huggingface/transformers) | `5.21.0` | `5.22.2` | | [omegaconf](https://github.com/hydra-ecosystem/omegaconf) | `2.3.1` | `2.4.0` | | [boto3](https://github.com/boto/boto3) | `1.43.123` | `1.44.1` | | [botocore](https://github.com/boto/botocore) | `1.43.123` | `1.44.3` | | [google-api-core](https://github.com/googleapis/google-cloud-python) | `2.31.0` | `2.44.0` | | [google-auth](https://github.com/googleapis/google-cloud-python) | `2.55.1` | `2.62.2` | | [google-cloud-secret-manager](https://github.com/googleapis/google-cloud-python) | `2.30.0` | `2.32.0` | | [google-cloud-storage](https://github.com/googleapis/google-cloud-python) | `3.15.0` | `3.17.1` | | [sail](https://github.com/sailresearchco/sail) | `0.12.8` | `0.18.1` | | [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.16.0` | | [httpx2](https://github.com/pydantic/httpx2) | `2.13.1` | `2.16.0` | | vercel-sandbox | `0.7.0` | `0.11.0` | | [tensorlake](https://github.com/tensorlakeai/tensorlake) | `0.5.149` | `0.5.163` | | [boxd](https://github.com/boxd-sh/sdk) | `0.2.17` | `0.3.1` | | daytona | `0.224.1` | `0.231.1` | | [cwsandbox](https://github.com/coreweave/cwsandbox-client) | `1.19.6` | `1.28.0` | | [griffelib](https://github.com/mkdocstrings/griffe) | `2.3.0` | `2.4.1` | | [hypothesis](https://github.com/HypothesisWorks/hypothesis) | `6.170.14` | `6.170.15` | | [moto](https://github.com/getmoto/moto) | `5.2.2` | `5.2.5` | | [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.12` | `2.9.13` | | [regex](https://github.com/mrabarnett/mrab-regex) | `2026.6.28` | `2026.11.9` | | [websockets](https://github.com/python-websockets/websockets) | `17.2` | `17.4` | | [pytest](https://github.com/pytest-dev/pytest) | `9.1.1` | `9.2.0` | | [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) | `1.4.0` | `1.4.1.post1` | | [pytest-socket](https://github.com/miketheman/pytest-socket) | `0.8.0` | `0.8.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.10` | `0.17.4` | | [smolmachines](https://github.com/smol-machines/smol) | `1.27.3` | `1.32.4` | Updates `click` from 8.5.0 to 8.5.1 - [Release notes](https://github.com/pallets/click/releases) - [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md) - [Commits](pallets/click@8.5.0...8.5.1) Updates `cryptography` from 50.0.1 to 50.0.2 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@50.0.1...50.0.2) Updates `idna` from 3.18 to 3.20 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.18...v3.20) Updates `jsonschema` from 4.23.0 to 4.26.0 - [Release notes](https://github.com/python-jsonschema/jsonschema/releases) - [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst) - [Commits](python-jsonschema/jsonschema@v4.23.0...v4.26.0) Updates `litellm` from 1.106.6 to 1.109.0 - [Release notes](https://github.com/BerriAI/litellm/releases) - [Commits](BerriAI/litellm@v1.106.6...v1.109.0) Updates `mcp` from 1.28.1 to 1.30.0 - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.28.1...v1.30.0) Updates `packaging` from 26.2 to 26.3 - [Release notes](https://github.com/pypa/packaging/releases) - [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst) - [Commits](pypa/packaging@26.2...26.3) Updates `pydantic` from 2.14.1 to 2.14.3 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.14.1...v2.14.3) Updates `pymongo` from 4.17.0 to 4.19.0 - [Release notes](https://github.com/mongodb/mongo-python-driver/releases) - [Changelog](https://github.com/mongodb/mongo-python-driver/blob/main/doc/changelog.rst) - [Commits](mongodb/mongo-python-driver@4.17.0...4.19.0) Updates `python-multipart` from 0.0.32 to 0.0.33 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.32...0.0.33) Updates `starlette` from 1.3.1 to 1.10.0 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.3.1...1.10.0) Updates `uvicorn` from 0.49.0 to 0.54.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.49.0...0.54.0) Updates `e2b` from 2.46.4 to 2.63.0 - [Release notes](https://github.com/e2b-dev/e2b/releases) - [Commits](https://github.com/e2b-dev/e2b/compare/@e2b/python-sdk@2.46.4...e2b@2.63.0) Updates `fastapi` from 0.141.1 to 0.162.5 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.141.1...0.162.5) Updates `tzdata` from 2026.5 to 2026.6 - [Release notes](https://github.com/python/tzdata/releases) - [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md) - [Commits](python/tzdata@2026.5...2026.6) Updates `openenv` from 0.10.0 to 0.12.0 - [Release notes](https://github.com/openenv/OpenEnv/releases) - [Commits](openenv/OpenEnv@v0.10.0...v0.12.0) Updates `datasets` from 5.1.0 to 5.2.0 - [Release notes](https://github.com/huggingface/datasets/releases) - [Commits](huggingface/datasets@5.1.0...5.2.0) Updates `transformers` from 5.21.0 to 5.22.2 - [Release notes](https://github.com/huggingface/transformers/releases) - [Commits](huggingface/transformers@v5.21...v5.22.2) Updates `omegaconf` from 2.3.1 to 2.4.0 - [Release notes](https://github.com/hydra-ecosystem/omegaconf/releases) - [Changelog](https://github.com/hydra-ecosystem/omegaconf/blob/main/NEWS.md) - [Commits](hydra-ecosystem/omegaconf@v2.3.1...v2.4.0) Updates `boto3` from 1.43.123 to 1.44.1 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.123...1.44.1) Updates `botocore` from 1.43.123 to 1.44.3 - [Commits](boto/botocore@1.43.123...1.44.3) Updates `google-api-core` from 2.31.0 to 2.44.0 - [Release notes](https://github.com/googleapis/google-cloud-python/releases) - [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/CHANGELOG.md) - [Commits](googleapis/google-cloud-python@google-api-core-v2.31.0...google-api-core-v2.44.0) Updates `google-auth` from 2.55.1 to 2.62.2 - [Release notes](https://github.com/googleapis/google-cloud-python/releases) - [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md) - [Commits](googleapis/google-cloud-python@google-auth-v2.55.1...google-auth-v2.62.2) Updates `google-cloud-secret-manager` from 2.30.0 to 2.32.0 - [Release notes](https://github.com/googleapis/google-cloud-python/releases) - [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md) - [Commits](googleapis/google-cloud-python@google-cloud-secret-manager-v2.30.0...google-cloud-secret-manager-v2.32.0) Updates `google-cloud-storage` from 3.15.0 to 3.17.1 - [Release notes](https://github.com/googleapis/google-cloud-python/releases) - [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md) - [Commits](googleapis/google-cloud-python@google-cloud-storage-v3.15.0...google-cloud-storage-v3.17.1) Updates `sail` from 0.12.8 to 0.18.1 - [Commits](https://github.com/sailresearchco/sail/commits) Updates `anyio` from 4.14.2 to 4.16.0 - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](agronholm/anyio@4.14.2...4.16.0) Updates `httpx2` from 2.13.1 to 2.16.0 - [Release notes](https://github.com/pydantic/httpx2/releases) - [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md) - [Commits](pydantic/httpx2@v2.13.1...v2.16.0) Updates `vercel-sandbox` from 0.7.0 to 0.11.0 Updates `tensorlake` from 0.5.149 to 0.5.163 - [Release notes](https://github.com/tensorlakeai/tensorlake/releases) - [Commits](tensorlakeai/tensorlake@cli-v0.5.149...cli-v0.5.163) Updates `boxd` from 0.2.17 to 0.3.1 - [Commits](https://github.com/boxd-sh/sdk/commits/v0.3.1) Updates `daytona` from 0.224.1 to 0.231.1 Updates `cwsandbox` from 1.19.6 to 1.28.0 Updates `griffelib` from 2.3.0 to 2.4.1 - [Release notes](https://github.com/mkdocstrings/griffe/releases) - [Changelog](https://github.com/mkdocstrings/griffe/blob/main/CHANGELOG.md) - [Commits](mkdocstrings/griffe@2.3.0...2.4.1) Updates `hypothesis` from 6.170.14 to 6.170.15 - [Release notes](https://github.com/HypothesisWorks/hypothesis/releases) - [Commits](HypothesisWorks/hypothesis@v6.170.14...v6.170.15) Updates `moto` from 5.2.2 to 5.2.5 - [Release notes](https://github.com/getmoto/moto/releases) - [Changelog](https://github.com/getmoto/moto/blob/master/CHANGELOG.md) - [Commits](getmoto/moto@5.2.2...5.2.5) Updates `psycopg2-binary` from 2.9.12 to 2.9.13 - [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS) - [Commits](psycopg/psycopg2@2.9.12...2.9.13) Updates `regex` from 2026.6.28 to 2026.11.9 - [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt) - [Commits](mrabarnett/mrab-regex@2026.6.28...2026.11.9) Updates `websockets` from 17.2 to 17.4 - [Release notes](https://github.com/python-websockets/websockets/releases) - [Commits](python-websockets/websockets@17.2...17.4) Updates `pytest` from 9.1.1 to 9.2.0 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.1.1...9.2.0) Updates `pytest-asyncio` from 1.4.0 to 1.4.1.post1 - [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases) - [Commits](pytest-dev/pytest-asyncio@v1.4.0...v1.4.1.post1) Updates `pytest-socket` from 0.8.0 to 0.8.1 - [Release notes](https://github.com/miketheman/pytest-socket/releases) - [Changelog](https://github.com/miketheman/pytest-socket/blob/main/CHANGELOG.md) - [Commits](miketheman/pytest-socket@0.8.0...0.8.1) Updates `ruff` from 0.16.10 to 0.17.4 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.10...0.17.4) Updates `smolmachines` from 1.27.3 to 1.32.4 - [Release notes](https://github.com/smol-machines/smol/releases) - [Commits](smol-machines/smol@v1.27.3...v1.32.4) --- updated-dependencies: - dependency-name: anyio dependency-version: 4.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: boto3 dependency-version: 1.43.127 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: botocore dependency-version: 1.43.127 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: boxd dependency-version: 0.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: click dependency-version: 8.5.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: cryptography dependency-version: 50.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: cwsandbox dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: datasets dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: daytona dependency-version: 0.231.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: e2b dependency-version: 2.63.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: fastapi dependency-version: 0.162.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: google-api-core dependency-version: 2.44.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: google-auth dependency-version: 2.62.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: google-cloud-secret-manager dependency-version: 2.32.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: google-cloud-storage dependency-version: 3.17.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: griffelib dependency-version: 2.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: httpx2 dependency-version: 2.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: hypothesis dependency-version: 6.170.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: idna dependency-version: '3.20' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: jsonschema dependency-version: 4.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: litellm dependency-version: 1.108.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: mcp dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: moto dependency-version: 5.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: omegaconf dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: openenv dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: packaging dependency-version: '26.3' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: psycopg2-binary dependency-version: 2.9.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: pydantic dependency-version: 2.14.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: pymongo dependency-version: 4.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: pytest dependency-version: 9.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: pytest-asyncio dependency-version: 1.4.1.post1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: pytest-socket dependency-version: 0.8.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: python-multipart dependency-version: 0.0.33 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: regex dependency-version: 2026.11.9 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: ruff dependency-version: 0.17.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: sail dependency-version: 0.18.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: smolmachines dependency-version: 1.32.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: starlette dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: tensorlake dependency-version: 0.5.163 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: transformers dependency-version: 5.22.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: tzdata dependency-version: '2026.6' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: uvicorn dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: vercel-sandbox dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: websockets dependency-version: '17.4' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from a team as a code owner November 12, 2026 22:23

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 12, 2026

greptile-apps Bot reviewed Nov 12, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-e0b3f558ea branch 10 times, most recently from 1d01554 to 489d59e Compare November 14, 2026 00:24

dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-e0b3f558ea branch from 489d59e to 459a2f8 Compare November 15, 2026 00:15

Navigation Menu

Repository navigation

build(deps): bump the python-minor-and-patch group across 1 directory with 44 updates - #651

build(deps): bump the python-minor-and-patch group across 1 directory with 44 updates#651
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-e0b3f558ea

dependabot Bot commented on behalf of github Nov 12, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

socket-security Bot commented Nov 12, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Nov 12, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot Nov 12, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 12, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

8.5.1

Version 8.5.1

v3.20

v3.19

3.20 (2026-09-17)

3.19 (2026-08-18)

v4.26.0

What's Changed

New Contributors

v4.25.1

What's Changed

v4.26.0

v4.25.1

v4.25.0

v4.24.1

v4.24.0

v1.109.0

Verify this release

What's new in 1.109.0

Action required

Highlights

All changes

v1.30.0

Behaviour changes

New

What's Changed

v1.29.1

What's Changed

26.3

What's Changed

Features

Behavior adaptations

Fixes for versions and specifiers

Fixes for requirements and markers

Fixes for metadata and licenses

Confidence Score: 5/5

Findings

Summary

Uh oh!

socket-security Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot Nov 12, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Nov 12, 2026 •

edited by greptile-apps Bot

Loading

socket-security Bot commented Nov 12, 2026 •

edited

Loading

socket-security Bot commented Nov 12, 2026 •

edited

Loading