Skip to content

chore(deps): bump the python-minor-and-patch group across 1 directory with 30 updates - #340

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-9990df997b
Closed

chore(deps): bump the python-minor-and-patch group across 1 directory with 30 updates#340
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-9990df997b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the python-minor-and-patch group with 30 updates in the / directory:

Package From To
certifi 2026.6.17 2026.10.23
cryptography 50.0.1 50.0.2
litellm 1.96.0 1.106.2
mcp 1.28.1 1.30.0
packaging 26.2 26.3
pymongo 4.17.0 4.19.0
starlette 1.3.1 1.9.0
uvicorn 0.49.0 0.54.0
modal 1.6.2.dev1 1.6.3.dev9
e2b 2.46.4 2.59.0
boto3 1.43.38 1.43.118
botocore 1.43.38 1.43.119
google-api-core 2.31.0 2.43.0
google-auth 2.55.1 2.62.0
google-cloud-secret-manager 2.30.0 2.31.0
google-cloud-storage 3.15.0 3.17.1
sail 0.12.8 0.16.0
anyio 4.14.2 4.15.1
httpx2 2.13.1 2.16.0
vercel-sandbox 0.7.0 0.10.0
tensorlake 0.5.149 0.5.158
boxd 0.2.17 0.2.19
daytona 0.224.1 0.226.1
griffelib 2.3.0 2.4.1
moto 5.2.2 5.2.4
psycopg2-binary 2.9.12 2.9.13
pytest-socket 0.8.0 0.8.1
ruff 0.16.10 0.17.2
smolmachines 1.27.3 1.31.5
regex 2026.6.28 2026.9.29

Updates certifi from 2026.6.17 to 2026.10.23

Commits

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.

.. _v50-0-1:

Commits

Updates litellm from 1.96.0 to 1.106.2

Release notes

Sourced from litellm's releases.

v1.106.2

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.2

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.106.2/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.2

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

Full Changelog: BerriAI/litellm@v1.106.1...v1.106.2

v1.106.1

Verify this release

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.1

... (truncated)

Commits
  • 49943cd Merge pull request #47695 from BerriAI/litellm_backport_lit145_batch_stable_1...
  • 43ae32c Merge branch 'stable/1.106.x' into litellm_backport_lit145_batch_stable_1_106_x
  • 500e19d Merge pull request #47736 from BerriAI/litellm_backport_p0_batch_translation_...
  • 4a6deef Merge branch 'stable/1.106.x' into litellm_backport_p0_batch_translation_cost...
  • 25c3121 Merge pull request #47742 from BerriAI/litellm_backport_46430_stable_1_106_x
  • 0aefd1b fix(anthropic): carry main's dangerous-tool-use beta map entries; skip worker...
  • 65c4fcd fix(count_tokens): fall back to Mantle on Bedrock 404 (Bedrock part of #46430)
  • dae6a2d bump: version 1.106.2
  • f44d4a7 chore(cost-map): accept the mirrored map's search_free_requests and token_cou...
  • ebf92c9 test: retarget tests that pinned prices the mirrored cost map now carries
  • Additional commits viewable in compare view

Updates mcp from 1.28.1 to 1.30.0

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

  • streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
  • A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
  • The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
  • OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

  • A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
  • Clients that keep the GET stream open (the SDK's client does) are not affected.
  • A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
  • To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

  • Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
  • Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
  • If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

  • ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
  • AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
  • Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

  • AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
  • issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
  • session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

... (truncated)

Commits
  • 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
  • 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
  • 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
  • 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
  • 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
  • b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
  • 4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
  • ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
  • 98b7159 [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line (#3177)
  • c0c5a9d [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh (#3082)
  • Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

    

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
    • 

  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
    • 

  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
    • 

  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
    • 

  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
    • 

  • Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
    • 



Behavior adaptations:


    

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
    • 

  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
    • 



Fixes for versions and specifiers:


    

  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
    • 

  • Raise InvalidVersion for non-string pre-release letters passed to
    
Version.from_parts. (:pull:1241)
    • 

  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
    • 

  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
    • 



Fixes for requirements and markers:


    

  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    
foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates pymongo from 4.17.0 to 4.19.0

Release notes

Sourced from pymongo's releases.

PyMongo 4.19.0

Release notes: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52147

PyMongo 4.18.3

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-3-released/344145

CVE-2026-106435

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.19.0 (2026/10/14)

PyMongo 4.19 brings a number of changes including:

.. warning:: PyMongo 4.19 drops support for Python 3.9 and 3.10 and removes PyPy support: Python 3.11+ is now required.

  • Added support for Python 3.15.
  • Dropped support for Python 3.9 and 3.10.
  • Removed support for PyPy.
  • Removed the deprecated Algorithm.RANGEPREVIEW and QueryType.RANGEPREVIEW members (PYTHON-6009_).
  • Added support for running the synchronous and asynchronous clients in subinterpreters, including inside concurrent.futures.InterpreterPoolExecutor (Python 3.14+). Only in subinterpreters, which do not allow daemon threads, the synchronous client's monitor threads now start as non-daemon threads and are stopped and joined when the interpreter is torn down. Monitor threads in the main interpreter remain daemon threads and shutdown behavior is unchanged. Note that because these threads are non-daemon, a subinterpreter may block on teardown until any in-flight monitor work completes.
  • Added support for routing Key Management Service (KMS) requests for Client-Side Field Level Encryption and Queryable Encryption through an HTTP proxy, using the new kms_connect_callback option on :class:~pymongo.encryption_options.AutoEncryptionOpts, :class:~pymongo.encryption.ClientEncryption, and :class:~pymongo.asynchronous.encryption.AsyncClientEncryption. The callback opens the connection and the driver performs the KMS TLS handshake over it, so verification still targets the KMS host rather than the proxy. For an ordinary HTTP proxy, pass :class:~pymongo.encryption_options.HTTPProxyKMSConnect or :class:~pymongo.encryption_options.AsyncHTTPProxyKMSConnect instead of writing a callback. Both helpers accept custom CONNECT headers, e.g. Proxy-Authorization for proxies that require authentication.
  • Added the srv_host_validator keyword argument to :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient, an alternative to srvAllowedHostsSuffix for deployments whose acceptable SRV hosts cannot be expressed as a single suffix. The callback is invoked once per SRV-returned host and must return a boolean: True to accept the host and False to reject it. During initial DNS discovery a non-boolean return raises an error; during SRV polling it is treated as a rejection. It is mutually exclusive with srvAllowedHostsSuffix and, because it takes a callable, cannot be set in a connection string. See the :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient documentation for security considerations.
  • srvAllowedHostsSuffix may now be set to a single label reserved for private or special use, such as localhost, test, or internal.

... (truncated)

Commits
  • a58b4f4 Prep 4.19 Release (#3122)
  • 3242611 PYTHON-6147 Add CSFLE HTTP proxy KMS connect helpers (#3101)
  • b5a7f26 PYTHON-6009 Remove deprecated Algorithm.RANGEPREVIEW and QueryType.RANGEPREVI...
  • f3f19df PYTHON-6170 [BF] AWS ECS test container cannot install uv (#3120)
  • a740cdf PYTHON-6063 Remove PyPy support (#3119)
  • ed74401 PYTHON-6138 followup -- Drop Python 3.9 and 3.10 Support (#3118)
  • e0b11bf PYTHON-6163 Pure-Python decode_all silently accepts 1-byte invalid BSON (#3117)
  • b5a36cc PYTHON-6111 C extension accepts BSON documents where element data overlaps th...
  • 1f64ecd PYTHON-6158 Clean up version-gated code paths (#3112)
  • 0cc64d6 PYTHON-6161 Fix mod_wsgi CI: run apt-get update before install (#3115)
  • Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.9.0

Release notes

Sourced from starlette's releases.

Version 1.9.0

This release streams TestClient response bodies, so client.stream() returns before the application finishes. It also escapes path delimiters when building URLs, matches host names case-insensitively, and keeps every existing Vary header.

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

Full changelog: 1.8.0...1.9.0

Version 1.8.0

This release adds HTTP 103 Early Hints, preserves response trailers through GZipMiddleware, and stops FileResponse transfers when clients disconnect. Starlette now requires Python 3.11.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
  • Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
  • Add Vary: Cookie when Session.pop() removes an existing key #3186.
  • Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
  • Bracket IPv6 hostnames in URL.replace() #3617.

Full changelog: 1.7.0...1.8.0

Version 1.7.0

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

[!WARNING] OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

... (truncated)

Changelog

Sourced from starlette's changelog.

1.9.0 (October 18, 2026)

Changed

  • Stream TestClient response bodies, so client.stream() returns before the application finishes. Closing an unfinished streamed response now cancels the application #3491.

Fixed

  • Percent-encode ?, #, \ and a leading // in the request path when building request.url, and \ and a leading // in url_path_for #3671.
  • Use the byte length for Content-Length when the response body is a typed or multidimensional memoryview #3622.
  • Include HEAD in the Allow header of HTTPEndpoint 405 responses when GET is defined #3585.
  • Match host names case-insensitively in Host routing and TrustedHostMiddleware #3542.
  • Preserve every existing Vary header in MutableHeaders.add_vary_header(), used by GZipMiddleware and SessionMiddleware #3675.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
  • Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
  • Add Vary: Cookie when Session.pop() removes an existing key #3186.
  • Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
  • Bracket IPv6 hostnames in URL.replace() #3617.

1.7.0 (September 23, 2026)

This release adds experimental OpenTelemetry tracing and requires AnyIO 4.

!!! warning "OpenTelemetryMiddleware is experimental" Its API and emitted telemetry may change in minor releases without a deprecation period #3574.

Added

... (truncated)

Commits
  • 1840c9d Version 1.9.0 (#3676)
  • 750dc33 Preserve all Vary headers in MutableHeaders.add_vary_header (#3675)
  • 414af4f Remove unmaintained packages from the third-party packages page (#3674)
  • d4df01a Add adminsite to the third-party packages (#3654)
  • 1766228 Match host names case-insensitively in Host routing and `TrustedHostMiddlew...
  • a579222 Include HEAD in the Allow header of HTTPEndpoint 405 responses (#3585)
  • 6b11cd7 Honor streaming responses in TestClient (#3491)
  • b7901fb Use byte length for typed memoryview response bodies (#3622)
  • 3214cd0 Escape path delimiters and leading // when building URLs (#3671)
  • 7b2948f Version 1.8.0 (#3660)
  • Additional commits viewable in compare view

Updates uvicorn from 0.49.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0
  • Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
  • HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

  • Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

  • Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
  • Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
  • Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

... (truncated)

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

... (truncated)

Commits
  • 3eb9a9a Version 0.54.0 (#3161)
  • cd7ef6d Remove races from supervisor tests (#3134)
  • a56c7cc Support HTTP/2 response trailers (#3146)
  • 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
  • 21f39ef Add HTTP/2 Early Hints support (#3137)
  • 421708f Version 0.53.0 (#3136)
  • f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
  • 63971ed Document HTTP/2 support (#...

    Description has been truncated

    RetriggerView in GreptileConfidence Score: 4/5

    The PR should not merge until the existing AWS-extra test failure is fixed.

    Fix All in CursorFindings

    1. P1 AWS extra tests fail ▶
    Fix with agent prompt 
    ### Issue 1
uv.lock:undefined-2408
`litellm` now installs `boto3`, which also installs `botocore`. Those are the only packages declared by the `aws` extra, so `_only_in("aws")` now returns an empty list. `test_core_and_every_store_module_import_without_the_extra` fails its `assert blocked` check, blocking unit CI. The tests that simulate missing AWS packages also stop blocking those imports.

Update the optional-extra checks for this dependency graph, or keep a compatible `litellm` version until those checks are adjusted.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

    Summary

    Updates 30 Python dependencies and refreshes uv.lock.

    • The framework installs newer Python packages across its runtime and optional providers.

    Reviews (3) · Last reviewed commit: "chore(deps): bump the python-minor-and-p..." · Reviewed by Greptile

@dependabot
dependabot Bot requested a review from a team as a code owner October 27, 2026 00:26
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 27, 2026
@socket-security

socket-security Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​certifi@​2026.6.17 ⏵ 2026.10.23100100 +7510010070
Updatedpypi/​botocore@​1.43.38 ⏵ 1.43.1199810010010070
Updatedpypi/​psycopg2-binary@​2.9.12 ⏵ 2.9.13100 +110010010070
Updatedpypi/​smolmachines@​1.27.3 ⏵ 1.31.59710010010070 -30
Updatedpypi/​e2b@​2.46.4 ⏵ 2.59.073 +1100100100100
Updatedpypi/​litellm@​1.96.0 ⏵ 1.106.274 +1100 +2100100100
Updatedpypi/​moto@​5.2.2 ⏵ 5.2.475100100100100
Updatedpypi/​modal@​1.6.2.dev1 ⏵ 1.6.3.dev980 +1100100100100
Updatedpypi/​google-auth@​2.55.1 ⏵ 2.62.089 +1100100100100
Updatedpypi/​pymongo@​4.17.0 ⏵ 4.19.089 -1100 +24100100100
Updatedpypi/​vercel-sandbox@​0.7.0 ⏵ 0.10.090 -3100100100100
Updatedpypi/​google-cloud-storage@​3.15.0 ⏵ 3.17.193 +1100100100100
Updatedpypi/​daytona@​0.224.1 ⏵ 0.226.196 +1100100100100
Updatedpypi/​sail@​0.12.8 ⏵ 0.16.096 +1100100100100
Updatedpypi/​anyio@​4.14.2 ⏵ 4.15.197100100100100
Updatedpypi/​uvicorn@​0.49.0 ⏵ 0.54.098 +1100100100100
Updatedpypi/​tensorlake@​0.5.149 ⏵ 0.5.15898 +1100100100100
Updatedpypi/​griffelib@​2.3.0 ⏵ 2.4.199 +1100100100100
Updatedpypi/​mcp@​1.28.1 ⏵ 1.30.099 +1100 +2100100100
Updatedpypi/​boto3@​1.43.38 ⏵ 1.43.11899100100100100
Updatedpypi/​packaging@​26.2 ⏵ 26.399 +1100100100100
Updatedpypi/​google-api-core@​2.31.0 ⏵ 2.43.099100100100100
Updatedpypi/​google-cloud-secret-manager@​2.30.0 ⏵ 2.31.099100100100100
Updatedpypi/​cryptography@​50.0.1 ⏵ 50.0.2100100100100100
Updatedpypi/​starlette@​1.3.1 ⏵ 1.9.0100 +1100100100100
Updatedpypi/​ruff@​0.16.10 ⏵ 0.17.2100100100100100
Updatedpypi/​boxd@​0.2.17 ⏵ 0.2.19100 +1100100100100
Updatedpypi/​regex@​2026.6.28 ⏵ 2026.9.29100100100100100
Updatedpypi/​httpx2@​2.13.1 ⏵ 2.16.0100100100100100
Updatedpypi/​pytest-socket@​0.8.0 ⏵ 0.8.1100 +1100100100100

View full report

@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-9990df997b branch from 3b76add to e8630e5 Compare October 27, 2026 02:57
greptile-apps[bot]
greptile-apps Bot reviewed Oct 27, 2026
View reviewed changes
Comment thread uv.lock
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "aiohttp" },
{ name = "boto3" },

@greptile-apps greptile-apps Bot Oct 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 AWS extra tests fail

litellm now installs boto3, which also installs botocore. Those are the only packages declared by the aws extra, so _only_in("aws") now returns an empty list. test_core_and_every_store_module_import_without_the_extra fails its assert blocked check, blocking unit CI. The tests that simulate missing AWS packages also stop blocking those imports.

Update the optional-extra checks for this dependency graph, or keep a compatible litellm version until those checks are adjusted.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: uv.lock
Line: 2408

Comment:
**AWS extra tests fail**

`litellm` now installs `boto3`, which also installs `botocore`. Those are the only packages declared by the `aws` extra, so `_only_in("aws")` now returns an empty list. `test_core_and_every_store_module_import_without_the_extra` fails its `assert blocked` check, blocking unit CI. The tests that simulate missing AWS packages also stop blocking those imports.

Update the optional-extra checks for this dependency graph, or keep a compatible `litellm` version until those checks are adjusted.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Cursor Fix in Claude Code Fix in Codex

@dependabot
chore(deps): bump the python-minor-and-patch group across 1 directory…
ac4920b 
… with 30 updates

Bumps the python-minor-and-patch group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [certifi](https://github.com/certifi/python-certifi) | `2026.6.17` | `2026.10.23` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.1` | `50.0.2` |
| [litellm](https://github.com/BerriAI/litellm) | `1.96.0` | `1.106.2` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.28.1` | `1.30.0` |
| [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` |
| [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.17.0` | `4.19.0` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.9.0` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.49.0` | `0.54.0` |
| [modal](https://github.com/modal-labs/modal-client) | `1.6.2.dev1` | `1.6.3.dev9` |
| [e2b](https://github.com/e2b-dev/e2b) | `2.46.4` | `2.59.0` |
| [boto3](https://github.com/boto/boto3) | `1.43.38` | `1.43.118` |
| [botocore](https://github.com/boto/botocore) | `1.43.38` | `1.43.119` |
| [google-api-core](https://github.com/googleapis/google-cloud-python) | `2.31.0` | `2.43.0` |
| [google-auth](https://github.com/googleapis/google-cloud-python) | `2.55.1` | `2.62.0` |
| [google-cloud-secret-manager](https://github.com/googleapis/google-cloud-python) | `2.30.0` | `2.31.0` |
| [google-cloud-storage](https://github.com/googleapis/google-cloud-python) | `3.15.0` | `3.17.1` |
| [sail](https://github.com/sailresearchco/sail) | `0.12.8` | `0.16.0` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` |
| [httpx2](https://github.com/pydantic/httpx2) | `2.13.1` | `2.16.0` |
| vercel-sandbox | `0.7.0` | `0.10.0` |
| [tensorlake](https://github.com/tensorlakeai/tensorlake) | `0.5.149` | `0.5.158` |
| [boxd](https://github.com/azin-tech/boxd-sdk-python) | `0.2.17` | `0.2.19` |
| daytona | `0.224.1` | `0.226.1` |
| [griffelib](https://github.com/mkdocstrings/griffe) | `2.3.0` | `2.4.1` |
| [moto](https://github.com/getmoto/moto) | `5.2.2` | `5.2.4` |
| [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.12` | `2.9.13` |
| [pytest-socket](https://github.com/miketheman/pytest-socket) | `0.8.0` | `0.8.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.10` | `0.17.2` |
| [smolmachines](https://github.com/smol-machines/smol) | `1.27.3` | `1.31.5` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.6.28` | `2026.9.29` |



Updates `certifi` from 2026.6.17 to 2026.10.23
- [Commits](certifi/python-certifi@2026.06.17...2026.10.23)

Updates `cryptography` from 50.0.1 to 50.0.2
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.1...50.0.2)

Updates `litellm` from 1.96.0 to 1.106.2
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.96.0...v1.106.2)

Updates `mcp` from 1.28.1 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.28.1...v1.30.0)

Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.2...26.3)

Updates `pymongo` from 4.17.0 to 4.19.0
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/main/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.17.0...4.19.0)

Updates `starlette` from 1.3.1 to 1.9.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.9.0)

Updates `uvicorn` from 0.49.0 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.49.0...0.54.0)

Updates `modal` from 1.6.2.dev1 to 1.6.3.dev9
- [Changelog](https://github.com/modal-labs/modal-client/blob/main/CHANGELOG_DEV.md)
- [Commits](https://github.com/modal-labs/modal-client/commits)

Updates `e2b` from 2.46.4 to 2.59.0
- [Release notes](https://github.com/e2b-dev/e2b/releases)
- [Commits](https://github.com/e2b-dev/e2b/compare/@e2b/python-sdk@2.46.4...e2b@2.59.0)

Updates `boto3` from 1.43.38 to 1.43.118
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.38...1.43.118)

Updates `botocore` from 1.43.38 to 1.43.119
- [Commits](boto/botocore@1.43.38...1.43.119)

Updates `google-api-core` from 2.31.0 to 2.43.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-api-core-v2.31.0...google-api-core-v2.43.0)

Updates `google-auth` from 2.55.1 to 2.62.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-auth-v2.55.1...google-auth-v2.62.0)

Updates `google-cloud-secret-manager` from 2.30.0 to 2.31.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-secret-manager-v2.30.0...google-cloud-secret-manager-v2.31.0)

Updates `google-cloud-storage` from 3.15.0 to 3.17.1
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-storage-v3.15.0...google-cloud-storage-v3.17.1)

Updates `sail` from 0.12.8 to 0.16.0
- [Commits](https://github.com/sailresearchco/sail/commits)

Updates `anyio` from 4.14.2 to 4.15.1
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.2...4.15.1)

Updates `httpx2` from 2.13.1 to 2.16.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.13.1...v2.16.0)

Updates `vercel-sandbox` from 0.7.0 to 0.10.0

Updates `tensorlake` from 0.5.149 to 0.5.158
- [Release notes](https://github.com/tensorlakeai/tensorlake/releases)
- [Commits](tensorlakeai/tensorlake@cli-v0.5.149...cli-v0.5.158)

Updates `boxd` from 0.2.17 to 0.2.19
- [Commits](https://github.com/azin-tech/boxd-sdk-python/commits/v0.2.19)

Updates `daytona` from 0.224.1 to 0.226.1

Updates `griffelib` from 2.3.0 to 2.4.1
- [Release notes](https://github.com/mkdocstrings/griffe/releases)
- [Changelog](https://github.com/mkdocstrings/griffe/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/griffe@2.3.0...2.4.1)

Updates `moto` from 5.2.2 to 5.2.4
- [Release notes](https://github.com/getmoto/moto/releases)
- [Changelog](https://github.com/getmoto/moto/blob/master/CHANGELOG.md)
- [Commits](getmoto/moto@5.2.2...5.2.4)

Updates `psycopg2-binary` from 2.9.12 to 2.9.13
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.12...2.9.13)

Updates `pytest-socket` from 0.8.0 to 0.8.1
- [Release notes](https://github.com/miketheman/pytest-socket/releases)
- [Changelog](https://github.com/miketheman/pytest-socket/blob/main/CHANGELOG.md)
- [Commits](miketheman/pytest-socket@0.8.0...0.8.1)

Updates `ruff` from 0.16.10 to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.10...0.17.2)

Updates `smolmachines` from 1.27.3 to 1.31.5
- [Release notes](https://github.com/smol-machines/smol/releases)
- [Commits](smol-machines/smol@v1.27.3...v1.31.5)

Updates `regex` from 2026.6.28 to 2026.9.29
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.6.28...2026.9.29)

---
updated-dependencies:
- dependency-name: anyio
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: boto3
  dependency-version: 1.43.118
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: botocore
  dependency-version: 1.43.119
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: boxd
  dependency-version: 0.2.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: certifi
  dependency-version: 2026.10.23
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: daytona
  dependency-version: 0.226.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: e2b
  dependency-version: 2.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-api-core
  dependency-version: 2.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-auth
  dependency-version: 2.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-cloud-secret-manager
  dependency-version: 2.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-cloud-storage
  dependency-version: 3.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: griffelib
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: httpx2
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: litellm
  dependency-version: 1.106.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: mcp
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: modal
  dependency-version: 1.6.3.dev8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: moto
  dependency-version: 5.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pymongo
  dependency-version: 4.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pytest-socket
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: regex
  dependency-version: 2026.9.29
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.17.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: sail
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: smolmachines
  dependency-version: 1.31.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: starlette
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: tensorlake
  dependency-version: 0.5.158
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: vercel-sandbox
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-9990df997b branch from e8630e5 to ac4920b Compare October 27, 2026 03:31
@dependabot @github

dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 27, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python-minor-and-patch-9990df997b branch October 27, 2026 05:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants