Skip to content

build(deps): bump the python-minor-and-patch group across 1 directory with 26 updates - #218

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-88e0117f7b
Open

build(deps): bump the python-minor-and-patch group across 1 directory with 26 updates#218
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-88e0117f7b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026 •
edited by greptile-apps Bot
Loading

Copy link
Copy Markdown

Bumps the python-minor-and-patch group with 26 updates in the / directory:

Package From To
certifi 2026.6.17 2026.7.22
cryptography 50.0.1 50.0.2
litellm 1.96.0 1.105.0
mcp 1.28.1 1.30.0
packaging 26.2 26.3
pydantic 2.12.5 2.14.1
pymongo 4.17.0 4.18.3
starlette 1.3.1 1.8.0
uvicorn 0.49.0 0.54.0
e2b 2.46.4 2.56.0
boto3 1.43.38 1.43.112
botocore 1.43.38 1.43.114
fastapi 0.141.1 0.143.0
google-api-core 2.31.0 2.42.0
google-auth 2.55.1 2.62.0
google-cloud-secret-manager 2.30.0 2.31.0
google-cloud-storage 3.15.0 3.17.0
sail 0.12.8 0.13.0
anyio 4.14.2 4.15.1
vercel-sandbox 0.7.0 0.9.0
griffelib 2.3.0 2.3.2
moto 5.2.2 5.2.4
psycopg2-binary 2.9.12 2.9.13
pytest-socket 0.8.0 0.8.1
ruff 0.16.10 0.17.0
regex 2026.6.28 2026.9.29

Updates certifi from 2026.6.17 to 2026.7.22

Commits

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.

.. _v50-0-1:

Commits

Updates litellm from 1.96.0 to 1.105.0

Release notes

Sourced from litellm's releases.

v1.105.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.105.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.105.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.105.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • 80b9556 Merge pull request #45927 from BerriAI/litellm_ui_bundle_rc_1_105_0
  • 919f027 chore: update Next.js build artifacts (2026-10-11 06:00 UTC, node v24.19.0)
  • f15af9b feat(ui): backport decision auto-router setup to 1.105 (#45915)
  • 2616b1a Merge pull request #45905 from BerriAI/litellm_backport_decisions_rc_1_105_0
  • fcbb022 chore(backport): merge rc/1.105.0 and move supported_decisions_providers to l...
  • 23fec69 test(unit): flush queued logging tasks after each test so systemone callback ...
  • 212b42e chore(backport): regenerate dashboard API types and adapt the picks to rc/1.1...
  • f26cff4 feat(sdk): add litellm.systemone and trim litellm.decisions to the OpenAI sha...
  • 4032305 test(decisions): bill the OpenAI-format openrouter case from provider-reporte...
  • 8f262b2 docs(proxy): describe /v1/decisions and /v1/systemone in Swagger UI (#45838)
  • Additional commits viewable in compare view

Updates mcp from 1.28.1 to 1.30.0

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

  • streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
  • A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
  • The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
  • OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

  • A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
  • Clients that keep the GET stream open (the SDK's client does) are not affected.
  • A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
  • To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

  • Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
  • Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
  • If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

  • ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
  • AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
  • Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

  • AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
  • issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
  • session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

... (truncated)

Commits
  • 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
  • 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
  • 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
  • 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
  • 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
  • b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
  • 4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
  • ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
  • 98b7159 [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line (#3177)
  • c0c5a9d [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh (#3082)
  • Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

    

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
    • 

  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
    • 

  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
    • 

  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
    • 

  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
    • 

  • Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
    • 



Behavior adaptations:


    

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
    • 

  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
    • 



Fixes for versions and specifiers:


    

  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
    • 

  • Raise InvalidVersion for non-string pre-release letters passed to
    
Version.from_parts. (:pull:1241)
    • 

  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
    • 

  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
    • 



Fixes for requirements and markers:


    

  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    
foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates pydantic from 2.12.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

  • Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
  • Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

  • Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
  • Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

Fixes

  • Call enum constructors in both validation modes by @​Viicos in #13792
  • Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
  • Catch OverflowError during ByteSize validation by @​Viicos in #13850
  • Require multiple_of constraints to be positive by @​Viicos in #13862
  • Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
  • Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
  • Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
  • Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
  • Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
  • Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
  • Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
  • Handle OS errors during ZoneInfo validation by @​Viicos in #13912
  • Handle exceptions during Decimal validation by @​Viicos in #13940
  • Rebuild incomplete types during serialization inference by @​Viicos in #13922
  • Reject large exponents in Fraction validation by @​Viicos in #13944
  • Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

... (truncated)

Commits
  • b2212c7 Prepare release v2.14.1
  • 968fb2b Fix docs conversion table
  • 6adc8b3 Support named tuples in Sequence validation
  • 7637fbc Reject out-of-range int inputs for timedelta
  • dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
  • e2456d3 Support closed and extra_items via inheritance in TypedDict
  • 317655d Harden CI security
  • 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
  • 43681ab Bump samuelcolvin/check-python-version action to v5.1
  • d6bc53a Avoid unnecessary extra dict allocation in model validation
  • Additional commits viewable in compare view

Updates pymongo from 4.17.0 to 4.18.3

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.3

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-3-released/344145

CVE-2026-106435

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.3 (2026/10/08)

Version 4.18.3 is a bug fix release.

  • Hardened BSON regex decoding against malformed documents (PYTHON-6110_).

.. _PYTHON-6110: https://jira.mongodb.org/browse/PYTHON-6110

Issues Resolved ...............

See the PyMongo 4.18.3 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.3 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52955

Changes in Version 4.18.2 (2026/09/24)

Version 4.18.2 is a bug fix release.

  • Hardened the bson buffer size guard against signed integer overflow. (CVE-2026-96749_).
  • Fixed connection string parsing to percent-decode each host individually. (CVE-2026-96748_).
  • Client-side field level encryption now rejects a KMS endpoint ending in .sock. (CVE-2026-96747_).

.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749 .. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748 .. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747

Issues Resolved ...............

See the PyMongo 4.18.2 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52896

Changes in Version 4.18.1 (2026/09/10)

Version 4.18.1 is a bug fix release.

  • Use an exact match for the file ID in GridFS delete methods (CVE-2026-88029_).

.. _CVE-2026-88029: https://www.cve.org/CVERecord?id=CVE-2026-88029

Changes in Version 4.18.0 (2026/09/03)

... (truncated)

Commits

Updates starlette from 1.3.1 to 1.8.0

Release notes

Sourced from starlette's releases.

Version 1.8.0

This release adds HTTP 103 Early Hints, preserves response trailers through GZipMiddleware, and stops FileResponse transfers when clients disconnect. Starlette now requires Python 3.11.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles 405 responses #3640.
  • Close Request.stream() generators deterministically, avoiding "Exception ignored" errors with stacked BaseHTTPMiddleware #3628.
  • Add Vary: Cookie when Session.pop() removes an existing key #3186.
  • Emit Max-Age=0 on the session cookie when SessionMiddleware uses max_age=0 #3651.
  • Bracket IPv6 hostnames in URL.replace() #3617.

Full changelog: 1.7.0...1.8.0

Version 1.7.0

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

[!WARNING] OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

Added

  • Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.
  • Expose the matched route through scope["route"] #3438.
  • Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.
  • Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
  • Support partitioned cookies in SessionMiddleware #3510.
  • Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.
  • Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.
  • Support Python 3.15 #3508.

Changed

  • Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.
  • Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.
  • Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

... (truncated)

Changelog

Sourced from starlette's changelog.

1.8.0 (October 13, 2026)

This release drops Python 3.10 support and adds HTTP 103 Early Hints.

Added

  • Add Request.send_early_hints() for HTTP 103 Early Hints through the ASGI http.response.early_hint extension #3435.

Changed

  • Require Python 3.11 or later, dropping support for Python 3.10 #3592.
  • Exclude native gRPC media types (application/grpc and application/grpc+...) from GZipMiddleware compression by default #3565.
  • Send http.response.start immediately in GZipMiddleware for responses with an existing Content-Encoding, status 206, or an excluded content type, instead of waiting for the first body chunk #3631.
  • Resolve the multipart charset once per request instead of once per field #3618.

Fixed

  • Preserve response trailers through GZipMiddleware #3565.
  • Stop FileResponse transfers when the client disconnects #3523.
  • Stop multipart range responses when the file ends before a range is complete, instead of looping forever #3583.
  • Ignore Range when If-Range contains a weak ETag #3567.
  • Include Allow: GET, HEAD in StaticFiles...

    Description has been truncated

    RetriggerView in GreptileConfidence Score: 3/5

    The PR still needs fixes for the previously reported local-grant failure and AWS tests before merging.

    Fix All in CursorFindings

    1. P1 Older uvicorn breaks local grants ▶
    2. P1 AWS extra tests fail ▶
    Fix with agent prompt 
    ### Issue 1
pyproject.toml:undefined-46
If a user already has `uvicorn` below 0.47 installed, the new `>=0.29` requirement lets pip keep it. But `GrantServer._start()` always passes `ssl_context_factory` to `uvicorn.Config`, and that keyword requires 0.47, as the comment notes. Issuing a local storage grant then fails instead of starting the HTTPS server.

Restore the `>=0.47` floor. The newer version in `uv.lock` does not protect installs made without that lock.

### Issue 2
uv.lock:undefined-1930
`litellm` 1.105.0 now requires `boto3`, which also installs `botocore`. These are the only packages in the `aws` extra, so core now installs both. `_only_in("aws")` therefore returns an empty list, and `test_core_and_every_store_module_import_without_the_extra` fails its `assert blocked` check. The AWS missing-extra tests also stop blocking AWS modules and no longer get the expected install hint.

Update those tests to block AWS modules explicitly, or keep a `litellm` version that leaves AWS dependencies optional.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

    Summary

    Updates Python dependencies and refreshes uv.lock.

    • Installs resolve to newer Python packages within updated version bounds.

    Reviews (4) · Last reviewed commit: "build(deps): bump the python-minor-and-p..." · Reviewed by Greptile

@dependabot
dependabot Bot requested a review from a team as a code owner October 15, 2026 01:59
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 15, 2026
@socket-security

socket-security Bot commented Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​certifi@​2026.6.17 ⏵ 2026.7.2210010010010070
Updatedpypi/​botocore@​1.43.38 ⏵ 1.43.1149810010010070
Updatedpypi/​psycopg2-binary@​2.9.12 ⏵ 2.9.13100 +110010010070
Updatedpypi/​e2b@​2.46.4 ⏵ 2.56.073100100100100
Updatedpypi/​litellm@​1.96.0 ⏵ 1.105.074 +1100 +2100100100
Updatedpypi/​moto@​5.2.2 ⏵ 5.2.475100100100100
Updatedpypi/​google-auth@​2.55.1 ⏵ 2.62.089 +1100100100100
Updatedpypi/​pymongo@​4.17.0 ⏵ 4.18.391 +1100 +24100100100
Updatedpypi/​google-cloud-storage@​3.15.0 ⏵ 3.17.093 +1100100100100
Updatedpypi/​vercel-sandbox@​0.7.0 ⏵ 0.9.093100100100100
Updatedpypi/​sail@​0.12.8 ⏵ 0.13.096 +1100100100100
Updatedpypi/​anyio@​4.14.2 ⏵ 4.15.197100100100100
Updatedpypi/​uvicorn@​0.49.0 ⏵ 0.54.098 +1100100100100
Updatedpypi/​griffelib@​2.3.0 ⏵ 2.3.299100100100100
Updatedpypi/​mcp@​1.28.1 ⏵ 1.30.099 +1100 +2100100100
Updatedpypi/​boto3@​1.43.38 ⏵ 1.43.11299100100100100
Updatedpypi/​packaging@​26.2 ⏵ 26.399 +1100100100100
Updatedpypi/​google-api-core@​2.31.0 ⏵ 2.42.099100100100100
Updatedpypi/​google-cloud-secret-manager@​2.30.0 ⏵ 2.31.099100100100100
Updatedpypi/​pydantic@​2.12.5 ⏵ 2.14.1100 +1100100100100
Updatedpypi/​cryptography@​50.0.1 ⏵ 50.0.2100100100100100
Updatedpypi/​starlette@​1.3.1 ⏵ 1.8.0100 +1100100100100
Updatedpypi/​ruff@​0.16.10 ⏵ 0.17.0100100100100100
Updatedpypi/​regex@​2026.6.28 ⏵ 2026.9.29100100100100100
Updatedpypi/​fastapi@​0.141.1 ⏵ 0.143.0100 +1100100100100
Updatedpypi/​pytest-socket@​0.8.0 ⏵ 0.8.1100 +1100100100100

View full report

greptile-apps[bot]
greptile-apps Bot reviewed Oct 15, 2026
View reviewed changes
Comment thread pyproject.toml
"pyyaml>=6.0",
"starlette>=0.40", # the local grant server
"uvicorn>=0.47", # 0.47 adds ssl_context_factory, how the local grant server gets its TLS context
"uvicorn>=0.29", # 0.47 adds ssl_context_factory, how the local grant server gets its TLS context

@greptile-apps greptile-apps Bot Oct 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Older uvicorn breaks local grants

If a user already has uvicorn below 0.47 installed, the new >=0.29 requirement lets pip keep it. But GrantServer._start() always passes ssl_context_factory to uvicorn.Config, and that keyword requires 0.47, as the comment notes. Issuing a local storage grant then fails instead of starting the HTTPS server.

Restore the >=0.47 floor. The newer version in uv.lock does not protect installs made without that lock.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: pyproject.toml
Line: 46

Comment:
**Older uvicorn breaks local grants**

If a user already has `uvicorn` below 0.47 installed, the new `>=0.29` requirement lets pip keep it. But `GrantServer._start()` always passes `ssl_context_factory` to `uvicorn.Config`, and that keyword requires 0.47, as the comment notes. Issuing a local storage grant then fails instead of starting the HTTPS server.

Restore the `>=0.47` floor. The newer version in `uv.lock` does not protect installs made without that lock.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Cursor Fix in Claude Code Fix in Codex

@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-88e0117f7b branch from 8193066 to bc8f7ea Compare October 15, 2026 20:30
greptile-apps[bot]
greptile-apps Bot reviewed Oct 15, 2026
View reviewed changes
Comment thread uv.lock
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "aiohttp" },
{ name = "boto3" },

@greptile-apps greptile-apps Bot Oct 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 AWS extra tests fail

litellm 1.105.0 now requires boto3, which also installs botocore. These are the only packages in the aws extra, so core now installs both. _only_in("aws") therefore returns an empty list, and test_core_and_every_store_module_import_without_the_extra fails its assert blocked check. The AWS missing-extra tests also stop blocking AWS modules and no longer get the expected install hint.

Update those tests to block AWS modules explicitly, or keep a litellm version that leaves AWS dependencies optional.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: uv.lock
Line: 1930

Comment:
**AWS extra tests fail**

`litellm` 1.105.0 now requires `boto3`, which also installs `botocore`. These are the only packages in the `aws` extra, so core now installs both. `_only_in("aws")` therefore returns an empty list, and `test_core_and_every_store_module_import_without_the_extra` fails its `assert blocked` check. The AWS missing-extra tests also stop blocking AWS modules and no longer get the expected install hint.

Update those tests to block AWS modules explicitly, or keep a `litellm` version that leaves AWS dependencies optional.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Cursor Fix in Claude Code Fix in Codex

@AlexS-scale AlexS-scale mentioned this pull request Oct 15, 2026
Closed
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-88e0117f7b branch from bc8f7ea to a0705c1 Compare October 16, 2026 05:41
@dependabot
build(deps): bump the python-minor-and-patch group across 1 directory…
68575ce 
… with 26 updates

Bumps the python-minor-and-patch group with 26 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [certifi](https://github.com/certifi/python-certifi) | `2026.6.17` | `2026.7.22` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.1` | `50.0.2` |
| [litellm](https://github.com/BerriAI/litellm) | `1.96.0` | `1.105.0` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.28.1` | `1.30.0` |
| [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.12.5` | `2.14.1` |
| [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.17.0` | `4.18.3` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.8.0` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.49.0` | `0.54.0` |
| [e2b](https://github.com/e2b-dev/e2b) | `2.46.4` | `2.56.0` |
| [boto3](https://github.com/boto/boto3) | `1.43.38` | `1.43.112` |
| [botocore](https://github.com/boto/botocore) | `1.43.38` | `1.43.114` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.143.0` |
| [google-api-core](https://github.com/googleapis/google-cloud-python) | `2.31.0` | `2.42.0` |
| [google-auth](https://github.com/googleapis/google-cloud-python) | `2.55.1` | `2.62.0` |
| [google-cloud-secret-manager](https://github.com/googleapis/google-cloud-python) | `2.30.0` | `2.31.0` |
| [google-cloud-storage](https://github.com/googleapis/google-cloud-python) | `3.15.0` | `3.17.0` |
| [sail](https://github.com/sailresearchco/sail) | `0.12.8` | `0.13.0` |
| [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` |
| vercel-sandbox | `0.7.0` | `0.9.0` |
| griffelib | `2.3.0` | `2.3.2` |
| [moto](https://github.com/getmoto/moto) | `5.2.2` | `5.2.4` |
| [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.12` | `2.9.13` |
| [pytest-socket](https://github.com/miketheman/pytest-socket) | `0.8.0` | `0.8.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.10` | `0.17.0` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.6.28` | `2026.9.29` |



Updates `certifi` from 2026.6.17 to 2026.7.22
- [Commits](certifi/python-certifi@2026.06.17...2026.07.22)

Updates `cryptography` from 50.0.1 to 50.0.2
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.1...50.0.2)

Updates `litellm` from 1.96.0 to 1.105.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.96.0...v1.105.0)

Updates `mcp` from 1.28.1 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.28.1...v1.30.0)

Updates `packaging` from 26.2 to 26.3
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@26.2...26.3)

Updates `pydantic` from 2.12.5 to 2.14.1
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.12.5...v2.14.1)

Updates `pymongo` from 4.17.0 to 4.18.3
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.3/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.17.0...4.18.3)

Updates `starlette` from 1.3.1 to 1.8.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.8.0)

Updates `uvicorn` from 0.49.0 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.49.0...0.54.0)

Updates `e2b` from 2.46.4 to 2.56.0
- [Release notes](https://github.com/e2b-dev/e2b/releases)
- [Commits](https://github.com/e2b-dev/e2b/compare/@e2b/python-sdk@2.46.4...e2b@2.56.0)

Updates `boto3` from 1.43.38 to 1.43.112
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.38...1.43.112)

Updates `botocore` from 1.43.38 to 1.43.114
- [Commits](boto/botocore@1.43.38...1.43.114)

Updates `fastapi` from 0.141.1 to 0.143.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.143.0)

Updates `google-api-core` from 2.31.0 to 2.42.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-api-core-v2.31.0...google-api-core-v2.42.0)

Updates `google-auth` from 2.55.1 to 2.62.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-auth-v2.55.1...google-auth-v2.62.0)

Updates `google-cloud-secret-manager` from 2.30.0 to 2.31.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-secret-manager-v2.30.0...google-cloud-secret-manager-v2.31.0)

Updates `google-cloud-storage` from 3.15.0 to 3.17.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-storage-v3.15.0...google-cloud-storage-v3.17.0)

Updates `sail` from 0.12.8 to 0.13.0
- [Commits](https://github.com/sailresearchco/sail/commits)

Updates `anyio` from 4.14.2 to 4.15.1
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.14.2...4.15.1)

Updates `vercel-sandbox` from 0.7.0 to 0.9.0

Updates `griffelib` from 2.3.0 to 2.3.2

Updates `moto` from 5.2.2 to 5.2.4
- [Release notes](https://github.com/getmoto/moto/releases)
- [Changelog](https://github.com/getmoto/moto/blob/master/CHANGELOG.md)
- [Commits](getmoto/moto@5.2.2...5.2.4)

Updates `psycopg2-binary` from 2.9.12 to 2.9.13
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.12...2.9.13)

Updates `pytest-socket` from 0.8.0 to 0.8.1
- [Release notes](https://github.com/miketheman/pytest-socket/releases)
- [Changelog](https://github.com/miketheman/pytest-socket/blob/main/CHANGELOG.md)
- [Commits](miketheman/pytest-socket@0.8.0...0.8.1)

Updates `ruff` from 0.16.10 to 0.17.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.10...0.17.0)

Updates `regex` from 2026.6.28 to 2026.9.29
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.6.28...2026.9.29)

---
updated-dependencies:
- dependency-name: anyio
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: boto3
  dependency-version: 1.43.111
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: botocore
  dependency-version: 1.43.114
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: e2b
  dependency-version: 2.55.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: fastapi
  dependency-version: 0.143.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-api-core
  dependency-version: 2.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-auth
  dependency-version: 2.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-cloud-secret-manager
  dependency-version: 2.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-cloud-storage
  dependency-version: 3.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: griffelib
  dependency-version: 2.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: litellm
  dependency-version: 1.105.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: mcp
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: moto
  dependency-version: 5.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pymongo
  dependency-version: 4.18.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pytest-socket
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: regex
  dependency-version: 2026.9.29
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: sail
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: starlette
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: vercel-sandbox
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-88e0117f7b branch from a0705c1 to 68575ce Compare October 16, 2026 15:29

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants