build(deps): bump the python-minor-and-patch group across 1 directory with 26 updates by dependabot[bot] · Pull Request #218 · scaleapi/agentenv-framework

dependabot · 2026-10-15T01:59:00Z

Bumps the python-minor-and-patch group with 26 updates in the / directory:

Package	From	To
certifi	`2026.6.17`	`2026.7.22`
cryptography	`50.0.1`	`50.0.2`
litellm	`1.96.0`	`1.105.0`
mcp	`1.28.1`	`1.30.0`
packaging	`26.2`	`26.3`
pydantic	`2.12.5`	`2.14.1`
pymongo	`4.17.0`	`4.18.3`
starlette	`1.3.1`	`1.7.0`
uvicorn	`0.49.0`	`0.54.0`
e2b	`2.46.4`	`2.55.1`
boto3	`1.43.38`	`1.43.111`
botocore	`1.43.38`	`1.43.114`
fastapi	`0.141.1`	`0.143.0`
google-api-core	`2.31.0`	`2.42.0`
google-auth	`2.55.1`	`2.61.0`
google-cloud-secret-manager	`2.30.0`	`2.31.0`
google-cloud-storage	`3.15.0`	`3.17.0`
sail	`0.12.8`	`0.13.0`
anyio	`4.14.2`	`4.15.1`
vercel-sandbox	`0.7.0`	`0.9.0`
griffelib	`2.3.0`	`2.3.2`
moto	`5.2.2`	`5.2.4`
psycopg2-binary	`2.9.12`	`2.9.13`
pytest-socket	`0.8.0`	`0.8.1`
ruff	`0.16.10`	`0.17.0`
regex	`2026.6.28`	`2026.9.29`

Updates certifi from 2026.6.17 to 2026.7.22

Commits

f4bc676 2026.07.22 (#428)
4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427)
01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426)
eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425)
474e6fc Include tests in the source distribution (#424)
a31ef39 Bump actions/setup-python from 6.2.0 to 6.3.0 (#420)
98eb2c7 Bump actions/checkout from 6.0.3 to 7.0.0 (#419)
See full diff in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3. * Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later. * Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and MSYS2.

.. _v50-0-1:

Commits

4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
See full diff in compare view

Updates litellm from 1.96.0 to 1.105.0

Release notes

Sourced from litellm's releases.

v1.105.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.105.0
Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:
cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.105.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.105.0
Expected output:
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key
What's Changed

feat(mcp): share compatibility-aware result conversion across tool surfaces by @devin-ai-integration[bot] in BerriAI/litellm#43089

fix(caching): propagate auth cache invalidation over Redis Cluster via a node-level pub/sub client by @devin-ai-integration[bot] in BerriAI/litellm#43110

feat(model-catalog): add Rust registry validation by @devin-ai-integration[bot] in BerriAI/litellm#43136

test(rust): reorganize core crate tests and split cache and OCR suites by @devin-ai-integration[bot] in BerriAI/litellm#43177

fix(proxy): give SpendLogToolIndex its own share of the cleanup budget and log a per-run summary by @devin-ai-integration[bot] in BerriAI/litellm#41768

feat(rust): hand upstream response headers to the native Messages stream by @devin-ai-integration[bot] in BerriAI/litellm#43178

feat(testkit): agent clients for Claude Code, Codex and opencode by @devin-ai-integration[bot] in BerriAI/litellm#43181

ci: run migrated unit selections on every event in legacy GHA shards by @yuneng-berri in BerriAI/litellm#43182

test: move tests/test_litellm root and small trees into tests/unit by @yuneng-berri in BerriAI/litellm#43186

fix(sso): gate /sso/debug routes behind ENABLE_SSO_DEBUG, off by default by @ojensen-berri in BerriAI/litellm#43150

refactor(framer): replace Framer trait with tokio-util codecs by @devin-ai-integration[bot] in BerriAI/litellm#43193

fix(anthropic): surface Responses bridge stream failures as Anthropic error events by @devin-ai-integration[bot] in BerriAI/litellm#43126

test: move tests/test_litellm/llms into tests/unit/llms by @yuneng-berri in BerriAI/litellm#43191

test: move tests/test_litellm integrations and secret_managers into tests/unit by @yuneng-berri in BerriAI/litellm#43194

feat(mcp): configure protocol versions and capability discovery by @joshua-berri in BerriAI/litellm#43169

... (truncated)

Commits

80b9556 Merge pull request #45927 from BerriAI/litellm_ui_bundle_rc_1_105_0
919f027 chore: update Next.js build artifacts (2026-10-11 06:00 UTC, node v24.19.0)
f15af9b feat(ui): backport decision auto-router setup to 1.105 (#45915)
2616b1a Merge pull request #45905 from BerriAI/litellm_backport_decisions_rc_1_105_0
fcbb022 chore(backport): merge rc/1.105.0 and move supported_decisions_providers to l...
23fec69 test(unit): flush queued logging tasks after each test so systemone callback ...
212b42e chore(backport): regenerate dashboard API types and adapt the picks to rc/1.1...
f26cff4 feat(sdk): add litellm.systemone and trim litellm.decisions to the OpenAI sha...
4032305 test(decisions): bill the OpenAI-format openrouter case from provider-reporte...
8f262b2 docs(proxy): describe /v1/decisions and /v1/systemone in Swagger UI (#45838)
Additional commits viewable in compare view

Updates mcp from 1.28.1 to 1.30.0

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).

A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.

The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.

OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.

Clients that keep the GET stream open (the SDK's client does) are not affected.

A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.

To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.

Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.

If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.

AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.

Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).

issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).

session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

[v1.x] Resolve tool output-schema references within the schema document only by @maxisbey in modelcontextprotocol/python-sdk#3396

[v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent sessions by @maxisbey in modelcontextprotocol/python-sdk#3426

[v1.x] Validate the authorization server metadata issuer on every discovery path by @maxisbey in modelcontextprotocol/python-sdk#3431

[v1.x] Follow redirects only within the MCP endpoint's origin by @maxisbey in modelcontextprotocol/python-sdk#3448

[v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource by @maxisbey in modelcontextprotocol/python-sdk#3451

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

[v1.x] Complete the FastMCP Settings model at import time by @maxisbey in modelcontextprotocol/python-sdk#3352

[v1.x] Apply the request body limit to the SSE and OAuth endpoints by @maxisbey in modelcontextprotocol/python-sdk#3344

... (truncated)

Commits

8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
98b7159 [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line (#3177)
c0c5a9d [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh (#3082)
Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)

PEP 808: accept Metadata-Version: 2.6. (#1194)

Add a limit argument to parse_tag() for compressed tag sets. (#1220)

Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)

Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)

Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)

Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)

Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)

Fix an AttributeError when hashing internally trimmed versions. (#1242)

Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)

Normalize requested extra names before comparing or hashing requirements. (#644)

Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)

Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)

Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)

Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)

Keep the parentheses of a nested group when serializing markers. (#1316)

Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)

Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)

Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)

Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)

Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)

Accept the UTF-8 charset case-insensitively in email payloads. (#1330)

Reject malformed Description-Content-Type values. (#1329)

Don't rewrite user values that contain {field} placeholders in error messages. (#1327)

Route multipart email payloads to unparsed instead of asserting. (#1247)

Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)

Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() &lt;packaging.specifiers.SpecifierSet.to_range&gt;,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() &lt;packaging.specifiers.SpecifierSet.is_subset&gt;, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

929fd4b Bump for release
f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
413d006 docs: changelog for 26.3 (#1343)
4eb0753 docs(metadata): explain selective field validation (#1342)
77e9ed4 feat(tags): add pure Python tag generator (#1346)
7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
Additional commits viewable in compare view

Updates pydantic from 2.12.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

Avoid Python tuple allocation during model fields validation by @Viicos in #13955

Avoid unnecessary extra dict allocation in model validation by @Viicos in #13956

Fixes

Fix arguments-v3 schema with variadic keywords by @Viicos in #13954

Fix TypeError on ForwardRef on Python 3.10.0 by @Viicos in #13964

Support closed and extra_items via inheritance in TypedDict by @Viicos in #13967

Enforce the max_digits whole-digits limit in the Python Decimal validator by @Viicos in #13972

Reject out-of-range int inputs for timedelta by @Viicos in #13973

Support named tuples in Sequence validation by @Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

Add support for multiple_of constraint in fraction and timedelta core schemas by @Viicos in #13873

Add __namespace__ parameter to create_model() by @Viicos in #13895

Changes

Add an ordered-dict core schema by @Viicos in #13796

Add a counter core schema by @Viicos in #13824

Do not mutate model_config attribute by @Viicos in #13825

Reject newlines in NameEmail validation by @Viicos in #13897

Fixes

Call enum constructors in both validation modes by @Viicos in #13792

Fix documentation examples not raising and remove unused string_sub_type unused error code by @Viicos in #13821

Catch OverflowError during ByteSize validation by @Viicos in #13850

Require multiple_of constraints to be positive by @Viicos in #13862

Always pop field name and model type stacks during schema generation by @saquibjawedbit in #13859

Handle TypeError gracefully during docstring extraction by @Viicos in #13874

Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @Viicos in #13891

Don't apply ser_json_timedelta to all datetime types in serialization inference by @Viicos in #13892

Encode JSON Schema defaults with a consistent configuration by @Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

Add support for multiple_of constraint in fraction and timedelta core schemas by @Viicos in #13873

Add __namespace__ parameter to create_model() by @Viicos in #13895

Changes

Add an ordered-dict core schema by @Viicos in #13796

Add a counter core schema by @Viicos in #13824

Do not mutate model_config attribute by @Viicos in #13825

Reject newlines in NameEmail validation by @Viicos in #13897

Fixes

Call enum constructors in both validation modes by @Viicos in #13792

Fix documentation examples not raising and remove unused string_sub_type unused error code by @Viicos in #13821

Catch OverflowError during ByteSize validation by @Viicos in #13850

Require multiple_of constraints to be positive by @Viicos in #13862

Always pop field name and model type stacks during schema generation by @saquibjawedbit in #13859

Handle TypeError gracefully during docstring extraction by @Viicos in #13874

Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @Viicos in #13891

Don't apply ser_json_timedelta to all datetime types in serialization inference by @Viicos in #13892

Encode JSON Schema defaults with a consistent configuration by @Viicos in #13893

Propagate init and kw_only=False from Field() to stdlib dataclass fields by @Viicos in #13898

Respect propagated extra config in the JSON Schema of stdlib dataclasses by @Viicos in #13899

Handle OS errors during ZoneInfo validation by @Viicos in #13912

Handle exceptions during Decimal validation by @Viicos in #13940

Rebuild incomplete types during serialization inference by @Viicos in #13922

Reject large exponents in Fraction validation by @Viicos in #13944

Avoid validating URL prefix multiple times in multi host URLs by @Viicos in #13945

New Contributors

@saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

b2212c7 Prepare release v2.14.1
968fb2b Fix docs conversion table
6adc8b3 Support named tuples in Sequence validation
7637fbc Reject out-of-range int inputs for timedelta
dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
e2456d3 Support closed and extra_items via inheritance in TypedDict
317655d Harden CI security
3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
43681ab Bump samuelcolvin/check-python-version action to v5.1
d6bc53a Avoid unnecessary extra dict allocation in model validation
Additional commits viewable in compare view

Updates pymongo from 4.17.0 to 4.18.3

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.3

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-3-released/344145

CVE-2026-106435

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.3 (2026/10/08)

Version 4.18.3 is a bug fix release.

Hardened BSON regex decoding against malformed documents (PYTHON-6110_).

.. _PYTHON-6110: https://jira.mongodb.org/browse/PYTHON-6110

Issues Resolved ...............

See the PyMongo 4.18.3 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.3 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52955

Changes in Version 4.18.2 (2026/09/24)

Version 4.18.2 is a bug fix release.

Hardened the bson buffer size guard against signed integer overflow. (CVE-2026-96749_).

Fixed connection string parsing to percent-decode each host individually. (CVE-2026-96748_).

Client-side field level encryption now rejects a KMS endpoint ending in .sock. (CVE-2026-96747_).

.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749 .. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748 .. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747

Issues Resolved ...............

See the PyMongo 4.18.2 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52896

Changes in Version 4.18.1 (2026/09/10)

Version 4.18.1 is a bug fix release.

Use an exact match for the file ID in GridFS delete methods (CVE-2026-88029_).

.. _CVE-2026-88029: https://www.cve.org/CVERecord?id=CVE-2026-88029

Changes in Version 4.18.0 (2026/09/03)

... (truncated)

Commits

5479af6 PYTHON-6155 Prep 4.18.3 release (#3108)
bb8d4e1 PYTHON-6110 Bound Regex element scans to the remaining document bytes (#3109)
98f444b PYTHON-6140 [v4.18] [Build Failure] TestBSON.test_encode_size_limit MemoryErr...
7376a3e PYTHON-6104 [v4.18] Remove mod_wsgi testing from Evergreen (#3091)
dac0e76 PYTHON-6083 [v4.18] Latest server binary downloads require private S3 (#3080)
9ee37df Update changelog to include CVEs (#3067)
eda87d6 BUMP 4.18.3.dev0
640dd23 Prep 4.18.2 release (#3066)
6a0ec65 Update changelog for CVE-2026-88029 reference (#3049)
44be553 BUMP 4.18.2.dev0
Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.7.0

Release notes

Sourced from starlette's releases.

Version 1.7.0

This release adds experimental OpenTelemetry tracing, HTTP QUERY support, and response trailers in TestClient. Starlette now requires AnyIO 4.

[!WARNING] OpenTelemetryMiddleware is experimental. Its API and emitted telemetry may change in minor releases without a deprecation period.

Added

Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.

Expose the matched route through scope["route"] #3438.

Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.

Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.

Support partitioned cookies in SessionMiddleware #3510.

Add partitioned to Response.delete_cookie() on Python 3.14 and later #3376.

Support IPv6 hosts in TrustedHostMiddleware and TestClient #3471.

Support Python 3.15 #3508.

Changed

Require anyio>=4.0.0,<5, dropping support for AnyIO 3 #3512.

Raise WebSocketDisconnected, a RuntimeError subclass, for disconnected WebSocket operations #2767.

Accept Collection[str] in CORSMiddleware configuration annotations, including sets and frozensets #3518.

Fixed

Run background tasks only after the response is sent when using BaseHTTPMiddleware #3476.

Return 400 for invalid multipart parser input #3492.

Include Vary: Origin on all normal CORS responses and vary preflight responses by all request headers that affect them #3516 and #3517.

Handle malformed Host headers and IPv6 authorities consistently across URL construction, host routing, and redirect middleware #3472.

Ignore Range headers when FileResponse has a status other than 200, preserving its status and full body #3568.

Handle standalone If-None-Match: * in StaticFiles #3201.

Reject WebSocket requests to StaticFiles without raising an assertion error #3532.

Persist session mutations made with popitem() and |= #3436.

Handle empty and absent payloads in WebSocketEndpoint.decode() #3372.

Implement identity on SimpleUser and UnauthenticatedUser #3271.

Allow HTTPException to use non-standard status codes without an explicit detail #3545.

Avoid deprecated AnyIO imports in TestClient and add explicit imports in WSGIMiddleware for AnyIO 4.15 compatibility #3498 and #3501.

Offload debug traceback rendering to a worker thread in ServerErrorMiddleware #2858.

Full changelog: 1.6.0...1.7.0

Version 1.6.0

What's Changed

Add max_body_size to Starlette and route classes by @Kludex in Kludex/starlette#3431

Expose http.response.debug info via response extensions by @y2kbugger in Kludex/starlette#3130

New Contributors

@y2kbugger made their first contribution in Kludex/starlette#3130

Full Changelog: Kludex/starlette@1.5.1...1.6.0

... (truncated)

Changelog

Sourced from starlette's changelog.

1.7.0 (September 23, 2026)

This release adds experimental OpenTelemetry tracing and requires AnyIO 4.

!!! warning "OpenTelemetryMiddleware is experimental" Its API and emitted telemetry may change in minor releases without a deprecation period #3574.

Added
Add experimental OpenTelemetryMiddleware for HTTP server spans, with URL exclusions and custom tracer providers #3438, #3463, and #3520.

Expose the matched route through scope["route"] #3438.

Support the QUERY HTTP method in HTTPEndpoint, CORS, and OpenAPI 3.2 schema generation #3489.

Capture HTTP response trailers in TestClient and expose them through response.extensions["http.response.trailers"] #3563.
Support partitioned cookies in SessionMiddleware Confidence Score: 4/5
Restore the uvicorn minimum before merging so allowed installations can start the local grant server.

Findings

Older uvicorn breaks local grants ▶
Fix with agent prompt
### Issue 1
pyproject.toml:46
If a user already has `uvicorn` below 0.47 installed, the new `>=0.29` requirement lets pip keep it. But `GrantServer._start()` always passes `ssl_context_factory` to `uvicorn.Config`, and that keyword requires 0.47, as the comment notes. Issuing a local storage grant then fails instead of starting the HTTPS server.

Restore the `>=0.47` floor. The newer version in `uv.lock` does not protect installs made without that lock.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
Summary

Updates the Python dependency lock and widens several SDK ranges.

Dependency installs now allow the refreshed Python package releases.

_{Reviews (1) · Last reviewed commit: "build(deps): bump the python-minor-and-p..." · Reviewed by Greptile}

… with 26 updates Bumps the python-minor-and-patch group with 26 updates in the / directory: | Package | From | To | | --- | --- | --- | | [certifi](https://github.com/certifi/python-certifi) | `2026.6.17` | `2026.7.22` | | [cryptography](https://github.com/pyca/cryptography) | `50.0.1` | `50.0.2` | | [litellm](https://github.com/BerriAI/litellm) | `1.96.0` | `1.105.0` | | [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.28.1` | `1.30.0` | | [packaging](https://github.com/pypa/packaging) | `26.2` | `26.3` | | [pydantic](https://github.com/pydantic/pydantic) | `2.12.5` | `2.14.1` | | [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.17.0` | `4.18.3` | | [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.7.0` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.49.0` | `0.54.0` | | [e2b](https://github.com/e2b-dev/e2b) | `2.46.4` | `2.55.1` | | [boto3](https://github.com/boto/boto3) | `1.43.38` | `1.43.111` | | [botocore](https://github.com/boto/botocore) | `1.43.38` | `1.43.114` | | [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.143.0` | | [google-api-core](https://github.com/googleapis/google-cloud-python) | `2.31.0` | `2.42.0` | | [google-auth](https://github.com/googleapis/google-cloud-python) | `2.55.1` | `2.61.0` | | [google-cloud-secret-manager](https://github.com/googleapis/google-cloud-python) | `2.30.0` | `2.31.0` | | [google-cloud-storage](https://github.com/googleapis/google-cloud-python) | `3.15.0` | `3.17.0` | | [sail](https://github.com/sailresearchco/sail) | `0.12.8` | `0.13.0` | | [anyio](https://github.com/agronholm/anyio) | `4.14.2` | `4.15.1` | | vercel-sandbox | `0.7.0` | `0.9.0` | | griffelib | `2.3.0` | `2.3.2` | | [moto](https://github.com/getmoto/moto) | `5.2.2` | `5.2.4` | | [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.12` | `2.9.13` | | [pytest-socket](https://github.com/miketheman/pytest-socket) | `0.8.0` | `0.8.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.10` | `0.17.0` | | [regex](https://github.com/mrabarnett/mrab-regex) | `2026.6.28` | `2026.9.29` | Updates `certifi` from 2026.6.17 to 2026.7.22 - [Commits](certifi/python-certifi@2026.06.17...2026.07.22) Updates `cryptography` from 50.0.1 to 50.0.2 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@50.0.1...50.0.2) Updates `litellm` from 1.96.0 to 1.105.0 - [Release notes](https://github.com/BerriAI/litellm/releases) - [Commits](BerriAI/litellm@v1.96.0...v1.105.0) Updates `mcp` from 1.28.1 to 1.30.0 - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.28.1...v1.30.0) Updates `packaging` from 26.2 to 26.3 - [Release notes](https://github.com/pypa/packaging/releases) - [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst) - [Commits](pypa/packaging@26.2...26.3) Updates `pydantic` from 2.12.5 to 2.14.1 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.12.5...v2.14.1) Updates `pymongo` from 4.17.0 to 4.18.3 - [Release notes](https://github.com/mongodb/mongo-python-driver/releases) - [Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.3/doc/changelog.rst) - [Commits](mongodb/mongo-python-driver@4.17.0...4.18.3) Updates `starlette` from 1.3.1 to 1.7.0 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@1.3.1...1.7.0) Updates `uvicorn` from 0.49.0 to 0.54.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.49.0...0.54.0) Updates `e2b` from 2.46.4 to 2.55.1 - [Release notes](https://github.com/e2b-dev/e2b/releases) - [Commits](https://github.com/e2b-dev/e2b/compare/@e2b/python-sdk@2.46.4...@e2b/python-sdk@2.55.1) Updates `boto3` from 1.43.38 to 1.43.111 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.38...1.43.111) Updates `botocore` from 1.43.38 to 1.43.114 - [Commits](boto/botocore@1.43.38...1.43.114) Updates `fastapi` from 0.141.1 to 0.143.0 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.141.1...0.143.0) Updates `google-api-core` from 2.31.0 to 2.42.0 - [Release notes](https://github.com/googleapis/google-cloud-python/releases) - [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/CHANGELOG.md) - [Commits](googleapis/google-cloud-python@google-api-core-v2.31.0...google-api-core-v2.42.0) Updates `google-auth` from 2.55.1 to 2.61.0 - [Release notes](https://github.com/googleapis/google-cloud-python/releases) - [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md) - [Commits](googleapis/google-cloud-python@google-auth-v2.55.1...google-auth-v2.61.0) Updates `google-cloud-secret-manager` from 2.30.0 to 2.31.0 - [Release notes](https://github.com/googleapis/google-cloud-python/releases) - [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md) - [Commits](googleapis/google-cloud-python@google-cloud-secret-manager-v2.30.0...google-cloud-secret-manager-v2.31.0) Updates `google-cloud-storage` from 3.15.0 to 3.17.0 - [Release notes](https://github.com/googleapis/google-cloud-python/releases) - [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md) - [Commits](googleapis/google-cloud-python@google-cloud-storage-v3.15.0...google-cloud-storage-v3.17.0) Updates `sail` from 0.12.8 to 0.13.0 - [Commits](https://github.com/sailresearchco/sail/commits) Updates `anyio` from 4.14.2 to 4.15.1 - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](agronholm/anyio@4.14.2...4.15.1) Updates `vercel-sandbox` from 0.7.0 to 0.9.0 Updates `griffelib` from 2.3.0 to 2.3.2 Updates `moto` from 5.2.2 to 5.2.4 - [Release notes](https://github.com/getmoto/moto/releases) - [Changelog](https://github.com/getmoto/moto/blob/master/CHANGELOG.md) - [Commits](getmoto/moto@5.2.2...5.2.4) Updates `psycopg2-binary` from 2.9.12 to 2.9.13 - [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS) - [Commits](psycopg/psycopg2@2.9.12...2.9.13) Updates `pytest-socket` from 0.8.0 to 0.8.1 - [Release notes](https://github.com/miketheman/pytest-socket/releases) - [Changelog](https://github.com/miketheman/pytest-socket/blob/main/CHANGELOG.md) - [Commits](miketheman/pytest-socket@0.8.0...0.8.1) Updates `ruff` from 0.16.10 to 0.17.0 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.10...0.17.0) Updates `regex` from 2026.6.28 to 2026.9.29 - [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt) - [Commits](mrabarnett/mrab-regex@2026.6.28...2026.9.29) --- updated-dependencies: - dependency-name: certifi dependency-version: 2026.7.22 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: cryptography dependency-version: 50.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: litellm dependency-version: 1.105.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: mcp dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: packaging dependency-version: '26.3' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: pydantic dependency-version: 2.14.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: pymongo dependency-version: 4.18.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: starlette dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: uvicorn dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: e2b dependency-version: 2.55.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: boto3 dependency-version: 1.43.111 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: botocore dependency-version: 1.43.114 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: fastapi dependency-version: 0.143.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: google-api-core dependency-version: 2.42.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: google-auth dependency-version: 2.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: google-cloud-secret-manager dependency-version: 2.31.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: google-cloud-storage dependency-version: 3.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: sail dependency-version: 0.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: anyio dependency-version: 4.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: vercel-sandbox dependency-version: 0.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: griffelib dependency-version: 2.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: moto dependency-version: 5.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: psycopg2-binary dependency-version: 2.9.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: pytest-socket dependency-version: 0.8.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-minor-and-patch - dependency-name: ruff dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch - dependency-name: regex dependency-version: 2026.9.29 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-10-15T01:59:35Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability
pypi/certifi@2026.6.17 ⏵ 2026.7.22
pypi/botocore@1.43.38 ⏵ 1.43.114
pypi/psycopg2-binary@2.9.12 ⏵ 2.9.13	⁺¹
pypi/e2b@2.46.4 ⏵ 2.55.1
pypi/litellm@1.96.0 ⏵ 1.105.0	⁺¹	⁺²
pypi/moto@5.2.2 ⏵ 5.2.4
pypi/google-auth@2.55.1 ⏵ 2.61.0	⁺¹
pypi/pymongo@4.17.0 ⏵ 4.18.3	⁺¹	⁺²⁴
pypi/google-cloud-storage@3.15.0 ⏵ 3.17.0	⁺¹
pypi/vercel-sandbox@0.7.0 ⏵ 0.9.0
pypi/sail@0.12.8 ⏵ 0.13.0	⁺¹
pypi/anyio@4.14.2 ⏵ 4.15.1
pypi/uvicorn@0.49.0 ⏵ 0.54.0	⁺¹
pypi/griffelib@2.3.0 ⏵ 2.3.2
pypi/mcp@1.28.1 ⏵ 1.30.0	⁺¹
pypi/boto3@1.43.38 ⏵ 1.43.111
pypi/packaging@26.2 ⏵ 26.3	⁺¹
pypi/google-api-core@2.31.0 ⏵ 2.42.0
pypi/google-cloud-secret-manager@2.30.0 ⏵ 2.31.0
pypi/pydantic@2.12.5 ⏵ 2.14.1	⁺¹
pypi/cryptography@50.0.1 ⏵ 50.0.2
pypi/starlette@1.3.1 ⏵ 1.7.0	⁺¹
pypi/ruff@0.16.10 ⏵ 0.17.0
pypi/regex@2026.6.28 ⏵ 2026.9.29
pypi/fastapi@0.141.1 ⏵ 0.143.0	⁺¹
pypi/pytest-socket@0.8.0 ⏵ 0.8.1	⁺¹

View full report

greptile-apps · 2026-10-15T02:02:36Z

    "pyyaml>=6.0",
    "starlette>=0.40",  # the local grant server
-    "uvicorn>=0.47",  # 0.47 adds ssl_context_factory, how the local grant server gets its TLS context
+    "uvicorn>=0.29",  # 0.47 adds ssl_context_factory, how the local grant server gets its TLS context


Older uvicorn breaks local grants

If a user already has uvicorn below 0.47 installed, the new >=0.29 requirement lets pip keep it. But GrantServer._start() always passes ssl_context_factory to uvicorn.Config, and that keyword requires 0.47, as the comment notes. Issuing a local storage grant then fails instead of starting the HTTPS server.

Restore the >=0.47 floor. The newer version in uv.lock does not protect installs made without that lock.

Prompt To Fix With AI

This is a comment left during a code review. Path: pyproject.toml Line: 46 Comment: **Older uvicorn breaks local grants** If a user already has `uvicorn` below 0.47 installed, the new `>=0.29` requirement lets pip keep it. But `GrantServer._start()` always passes `ssl_context_factory` to `uvicorn.Config`, and that keyword requires 0.47, as the comment notes. Issuing a local storage grant then fails instead of starting the HTTPS server. Restore the `>=0.47` floor. The newer version in `uv.lock` does not protect installs made without that lock. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

dependabot Bot requested a review from a team as a code owner October 15, 2026 01:59

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 15, 2026

greptile-apps Bot reviewed Oct 15, 2026

View reviewed changes

Navigation Menu

Repository navigation

build(deps): bump the python-minor-and-patch group across 1 directory with 26 updates - #218

build(deps): bump the python-minor-and-patch group across 1 directory with 26 updates#218
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-88e0117f7b

dependabot Bot commented on behalf of github Oct 15, 2026 •

edited by greptile-apps Bot

Loading

Findings

Summary

Uh oh!

socket-security Bot commented Oct 15, 2026

Uh oh!

greptile-apps Bot Oct 15, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 15, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.105.0

Verify Docker Image Signature

What's Changed

v1.30.0

Behaviour changes

New

What's Changed

v1.29.1

What's Changed

26.3

What's Changed

Features

Behavior adaptations

Fixes for versions and specifiers

Fixes for requirements and markers

Fixes for metadata and licenses

v2.14.1 2026-10-11

What's Changed

Performance

Fixes

v2.14.0 2026-10-08

What's Changed

New Features

Changes

Fixes

v2.14.0 (2026-10-08)

What's Changed

New Features

Changes

Fixes

New Contributors

PyMongo 4.18.3

PyMongo 4.18.2

PyMongo 4.18.1

PyMongo 4.18.0

Changes in Version 4.18.3 (2026/10/08)

Changes in Version 4.18.2 (2026/09/24)

Changes in Version 4.18.1 (2026/09/10)

Changes in Version 4.18.0 (2026/09/03)

Version 1.7.0

Added

Changed

Fixed

Version 1.6.0

What's Changed

New Contributors

1.7.0 (September 23, 2026)

Added

Findings

Summary

Uh oh!

socket-security Bot commented Oct 15, 2026

Uh oh!

greptile-apps Bot Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 15, 2026 •

edited by greptile-apps Bot

Loading