build(deps): bump the python-minor-and-patch group across 1 directory with 18 updates

[dependabot]

Bumps the python-minor-and-patch group with 18 updates in the / directory:

Package	From	To
boto3	1.43.38	1.43.107
litellm	1.96.0	1.103.2
packaging	26.2	26.3
pydantic	2.12.5	2.13.5
pymongo	4.17.0	4.18.2
modal	1.5.2.dev12	1.6.1.dev1
e2b	2.46.4	2.52.0
fastapi	0.141.1	0.142.2
uvicorn	0.49.0	0.54.0
google-api-core	2.31.0	2.40.0
google-auth	2.55.1	2.59.1
google-cloud-secret-manager	2.30.0	2.31.0
google-cloud-storage	3.15.0	3.16.0
moto	5.2.2	5.2.3
psycopg2-binary	2.9.12	2.9.13
pytest-socket	0.8.0	0.8.1
starlette	1.3.1	1.7.0
regex	2026.6.28	2026.9.29

Updates boto3 from 1.43.38 to 1.43.107

Commits

• 402e09c Merge branch 'release-1.43.107'
• 4d32164 Bumping version to 1.43.107
• e6738b9 Add changelog entries from botocore
• c2a321b Bump https://github.com/astral-sh/ruff-pre-commit (#4855)
• 88630f8 Merge branch 'release-1.43.106'
• fac0859 Merge branch 'release-1.43.106' into develop
• eefb3fc Bumping version to 1.43.106
• 8878189 Add changelog entries from botocore
• 29c0d66 Merge branch 'release-1.43.105'
• 82c6dbe Merge branch 'release-1.43.105' into develop
• Additional commits viewable in compare view

Updates litellm from 1.96.0 to 1.103.2

Release notes

Sourced from litellm's releases.

v1.103.2

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.103.2

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.103.2/cosign.pub \
  ghcr.io/berriai/litellm:v1.103.2

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

---

What's Changed

• chore(release): sync stable/1.103.x to v1.103.1 by @​yuneng-berri in BerriAI/litellm#43824
• fix(proxy): backport #40541, #43642, and #43656 to stable/1.103.x for v1.103.2 by @​devin-ai-integration[bot] in BerriAI/litellm#43897
• fix(anthropic): backport #42152 and #42288 to stable/1.103.x by @​devin-ai-integration[bot] in BerriAI/litellm#43662
• fix(proxy): backport #43962 to stable/1.103.x by @​yuneng-berri in BerriAI/litellm#43984

Full Changelog: BerriAI/litellm@v1.103.1...v1.103.2

v1.103.1

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

... (truncated)

Commits

• f69b210 Merge pull request #43984 from BerriAI/litellm_backport_lit9020_stable_1_103_x
• 2869a6f fix(proxy): restore pre-config-wins handling of pass-through endpoints (#43962)
• afbda35 Merge pull request #43662 from BerriAI/litellm_backport_safeguards_stable_1_1...
• f146256 Merge pull request #43897 from BerriAI/litellm_backport_usage_attribution_sta...
• fe87252 chore(release): bump litellm-enterprise 0.1.69 -> 0.1.69.post1 for stable/1.1...
• 1bbc9ee test(integration): register the daily activity key metadata contracts on stab...
• 460d51f bump: version 1.103.2
• 97f670a fix(proxy): look up hashed key names with two spend log rows per key (#43656)
• 00b8664 fix(proxy): recover session key owners from daily spend for usage attribution...
• 74952e9 test(integration): add the scratch_database harness helper
• Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

• Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
• PEP 808: accept Metadata-Version: 2.6. (#1194)
• Add a limit argument to parse_tag() for compressed tag sets. (#1220)
• Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
• Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
• Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

• Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
• Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

• Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
• Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
• Fix an AttributeError when hashing internally trimmed versions. (#1242)
• Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

• Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
• Normalize requested extra names before comparing or hashing requirements. (#644)
• Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
• Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
• Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
• Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
• Keep the parentheses of a nested group when serializing markers. (#1316)
• Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
• Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
• Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
• Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
• Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

• Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
• Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
• Reject malformed Description-Content-Type values. (#1329)
• Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
• Route multipart email payloads to unparsed instead of asserting. (#1247)
• Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
• Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03

Features:

Add a public :class:~packaging.ranges.VersionRange API and

:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,

representing the versions a specifier set accepts as an interval set that

supports intersection, union, difference, complement, set relations,

membership tests, and filtering.

:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back

to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.

(:pull:1267, :pull:1270, :pull:1298)
PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
Add a limit argument to parse_tag() for compressed tag sets.

(:issue:1220)
Add a prefer_sdist_predicate argument to Pylock.select() to prefer

source distributions over wheels for selected packages. (:pull:1334)
Add :func:~packaging.tags.pure_python_tags to generate the pure-Python

tags for a Python version without touching the running platform.

(:pull:1346)
Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,

and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the

versions two specifier sets accept. (:pull:1313)

Behavior adaptations:

Drop support for Python 3.8; packaging now requires Python 3.9 or later.

(:pull:1157)
Prefer native linux_* platform tags over manylinux and musllinux

tags on Linux. (:issue:160)

Fixes for versions and specifiers:

Raise InvalidVersion instead of TypeError when Version is given a

non-string. (:pull:1319)
Raise InvalidVersion for non-string pre-release letters passed to

Version.from_parts. (:pull:1241)
Fix an AttributeError when hashing internally trimmed versions.

(:pull:1242)
Fix SpecifierSet.is_unsatisfiable for post-release boundary

intersections. (:pull:1257)

Fixes for requirements and markers:

Make Requirement.__hash__ consistent with __eq__ for

trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and

foo==1.0.0.0), so equal requirements hash equal and deduplicate in

sets and dicts. (:pull:1232)

</tr></table>

... (truncated)

Commits

• 929fd4b Bump for release
• f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
• f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
• b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
• 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
• 413d006 docs: changelog for 26.3 (#1343)
• 4eb0753 docs(metadata): explain selective field validation (#1342)
• 77e9ed4 feat(tags): add pure Python tag generator (#1346)
• 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
• 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
• Additional commits viewable in compare view

Updates pydantic from 2.12.5 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

v2.13.3 2026-04-20

v2.13.3 (2026-04-20)

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #13096

Full Changelog: pydantic/pydantic@v2.13.2...v2.13.3

v2.13.2 2026-04-17

v2.13.2 (2026-04-17)

What's Changed

Fixes

• Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

Full Changelog: pydantic/pydantic@v2.13.1...v2.13.2

v2.13.1 2026-04-15

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

• Allow reuse of validators when plugins are set by @​Viicos in #13535
• Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
• Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
• Count validated model fields once in smart unions by @​tamird in #13731

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #13096

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

• Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

... (truncated)

Commits

• 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
• 558379f Bump twine to v7.0.0
• 2cfd5d3 Do not check for docs build
• a735bee Fix more Clippy lints
• 7eed4a1 Fix Clippy 0.1.95 warnings
• b353bbb Prepare release v2.13.5
• 63d2ccc Count validated model fields once in smart unions
• a53ec2e Speed up PyPy CI tests
• d65e0f9 Workaround circular import error in Mypy
• 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
• Additional commits viewable in compare view

Updates pymongo from 4.17.0 to 4.18.2

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.2 (2026/09/24)

Version 4.18.2 is a bug fix release.

• Hardened the bson buffer size guard against signed integer overflow. (CVE-2026-96749_).
• Fixed connection string parsing to percent-decode each host individually. (CVE-2026-96748_).
• Client-side field level encryption now rejects a KMS endpoint ending in .sock. (CVE-2026-96747_).

.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749 .. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748 .. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747

Issues Resolved ...............

See the PyMongo 4.18.2 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52896

Changes in Version 4.18.1 (2026/09/10)

Version 4.18.1 is a bug fix release.

• Use an exact match for the file ID in GridFS delete methods (CVE-2026-88029_).

.. _CVE-2026-88029: https://www.cve.org/CVERecord?id=CVE-2026-88029

Changes in Version 4.18.0 (2026/09/03)

PyMongo 4.18 brings a number of changes including:

• Added srvAllowedHostsSuffix as a URI option and keyword argument to :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient. When connecting via mongodb+srv://, this option overrides the default requirement that SRV-returned hosts share the same parent domain as the seed hostname, allowing hosts under a different domain suffix to be accepted. The suffix must not be a public suffix (per the Public Suffix List <https://publicsuffix.org/list/>_). See the :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient documentation for security considerations.
• Dropped support for MongoDB 4.2.
• Added support for MongoDB 9.0.
• PyPy support is deprecated and will be removed in a future release.

... (truncated)

Commits

• 640dd23 Prep 4.18.2 release (#3066)
• 6a0ec65 Update changelog for CVE-2026-88029 reference (#3049)
• 44be553 BUMP 4.18.2.dev0
• 127d140 PYTHON-6085 Prep for 4.18.1 release (#3047)
• fa67658 PYTHON-5994 Use exact match for file ID in GridFS delete methods (#3046)
• 1011e57 Prep branch v4.18
• 4dd7303 PYTHON-6076 Request workflows permission in create-release-branch (#3039)
• e66da83 PYTHON-5956 Use shared python/setup action for CI setup (#2990)
• 22a2ec8 PYTHON-6021 Move _write_concern_for_cmd into BaseObject (#3036)
• 2a4a004 PYTHON-5874 Fix test_fork.py failures on Python 3.15 due to fork() Deprecatio...
• Additional commits viewable in compare view

Updates modal from 1.5.2.dev12 to 1.6.1.dev1

Commits

• See full diff in compare view

Updates e2b from 2.46.4 to 2.52.0

Commits

• 970b34d [skip ci] Release new versions
• 2f92cc3 Add http_version / httpVersion connection option ("1.1" | "2", E2B_HTTP_VERSI...
• f713914 refactor(python-sdk): balance envd traffic across growable connection pools (...
• 03887ad fix(sdk): apply .dockerignore patterns Docker-style when copying template fil...
• 97522f8 feat(sdk): retry control-plane requests on 502/503 and connection failures (#...
• c05a642 test: move create-payload tests to their request-boundary owners (#1915)
• 496ef00 chore: remove TASTE.md and its reference in CLAUDE.md (#1916)
• 4975149 chore(sdk): remove dead constant/attribute and de-duplicate Commands handle s...
• 8c7e5cb chore(deps): refresh compatible JS SDK and CLI dependencies (#1906)
• 2de0cc3 Cap sandbox fork count at 20 (#1909)
• Additional commits viewable in compare view

Updates fastapi from 0.141.1 to 0.142.2

Release notes

Sourced from fastapi's releases.

0.142.2

Fixes

• 🐛 Allow startup when automatic OpenTelemetry configuration fails. PR #16418 by @​tiangolo.

0.142.1

Fixes

• 🐛 Fix repeated endpoint wrapping in included routers. PR #16414 by @​tiangolo.

0.142.0

Features

• ✨ Add native OpenTelemetry support. PR #16403 by @​tiangolo.

Refactors

• 📱 Improve mobile responsiveness of conference rail. PR #16196 by @​alejsdev.
• ♻️ Remove conf section and add event banner. PR #16193 by @​alejsdev.

Docs

• 🔥 Remove unused image. PR #16195 by @​alejsdev.
• 🐛 Use buttons for Termynal controls. PR #16132 by @​tiangolo.

Translations

• 🌐 Update translations for hi (update-outdated). PR #16212 by @​pr-submit[bot].
• 🌐 Update translations for ru (update-outdated). PR #16210 by @​pr-submit[bot].
• 🌐 Update translations for zh-hant (update-outdated). PR #16211 by @​pr-submit[bot].
• 🌐 Update translations for uk (update-outdated). PR #16208 by @​pr-submit[bot].
• 🌐 Update translations for de (update-outdated). PR #16209 by @​pr-submit[bot].
• 🌐 Update translations for tr (update-outdated). PR #16207 by @​pr-submit[bot].
• 🌐 Update translations for ja (update-outdated). PR #16206 by @​pr-submit[bot].
• 🌐 Update translations for fr (update-outdated). PR #16205 by @​pr-submit[bot].
• 🌐 Update translations for zh (update-outdated). PR #16204 by @​pr-submit[bot].
• 🌐 Update translations for es (update-outdated). PR #16203 by @​pr-submit[bot].
• 🌐 Update translations for pt (update-outdated). PR #16202 by @​pr-submit[bot].
• 🌐 Update translations for ko (update-outdated). PR #16201 by @​pr-submit[bot].
• 🌐 Update translations for ko (update-outdated). PR #16171 by @​pr-submit[bot].

Internal

• ✅ Fix frontend test timeout with Starlette Git. PR #16408 by @​YuriiMotov.
• 🔧 Update sponsors: remove Permit.io. PR #16406 by @​tiangolo.
• ⬆ Bump anyio from 4.12.1 to 4.14.2. PR #16375 by @​dependabot[bot].
• ⬆ Bump the python-packages group across 1 directory with 15 updates. PR #16285 by @​dependabot[bot].
• ⬆ Bump starlette from 1.3.1 to 1.6.0. PR #16289 by @​dependabot[bot].
• ⬆ Bump annotated-doc from 0.0.4 to 0.0.5. PR #16288 by @​dependabot[bot].
• ⬆ Bump typing-inspection from 0.4.2 to 0.4.4. PR #16286 by @​dependabot[bot].

... (truncated)

Commits

• 78c4324 🔖 Release version 0.142.2 (#16419)
• 2579ed0 📝 Update release notes
• 1d4953d 🐛 Allow startup when automatic OpenTelemetry configuration fails (#16418)
• 3e33a03 🔖 Release version 0.142.1 (#16415)
• 12ea7f5 📝 Update release notes
• ac88f56 🐛 Fix repeated endpoint wrapping in included routers (#16414)
• bd41128 🔖 Release version 0.142.0 (#16411)
• 7aa21e5 📝 Update release notes
• 4b3949c ✨ Add native OpenTelemetry support (#16403)
• c30032a 📝 Update release notes
• Additional commits viewable in compare view

Updates uvicorn from 0.49.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"

• Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
• HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

• Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0

• Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
• HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

• Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

• Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
• Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
• Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Version 0.52.4

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

... (truncated)

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

• Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
• Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

• Add experimental HTTP/2 support through zttp (#2982, #3101)
• Add support for zuvloop (#3104)

Fixed

• Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
• Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
• Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

• Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

• Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

• Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

• Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
• Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
• Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

... (truncated)

Commits

• 3eb9a9a Version 0.54.0 (#3161)
• cd7ef6d Remove races from supervisor tests (#3134)
• a56c7cc Support HTTP/2 response trailers (#3146)
• 9bd4404 chore(deps): bump anyio from 4.13.0 to 4.14.2 (#3145)
• 21f39ef Add HTTP/2 Early Hints support (#3137)
• 421708f Version 0.53.0 (#3136)
• f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
• 63971ed Document HTTP/2 support (#3130)
• 7d1a005 Remove race from multiprocess health check test (#3128)
• 5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
• Additional commits viewable in compare view

Updates google-api-core from 2.31.0 to 2.40.0

Changelog

Sourced from google-api-core's changelog.

Please refer to each API's CHANGELOG.md file under the packages/ directory

Changelogs

• google-ads-admanager==0.10.0
• google-ads-marketingplatform-admin==0.6.0
• google-ai-generativelanguage==0.12.0
• google-analytics-admin==0.30.0
• google-analytics-data==0.23.0
• google-apps-card==0.7.0
• google-apps-chat==0.10.0
• google-apps-events-subscriptions==0.6.0
• google-apps-meet==0.5.0
• google-apps-script-type==0.8.0
• google-area120-tables==0.15.0
• google-cloud-access-approval==1.20.0
• google-cloud-access-context-manager==0.6.0
• google-cloud-advisorynotifications==0.7.0
• google-cloud-alloydb-connectors==0.5.0
• google-cloud-alloydb==0.11.0
• google-cloud-api-gateway==1.16.0
• google-cloud-api-keys==0.9.0
• google-cloud-apigee-connect==1.16.0
• google-cloud-apigee-registry==0.10.0
• google-cloud-apihub==0.7.0
• google-cloud-appengine-admin==1.18.0
• google-cloud-appengine-logging==1.10.0
• google-cloud-apphub==0.5.0
• google-cloud-artifact-registry==1.22.0
• google-cloud-asset==4.4.0
• google-cloud-assured-workloads==2.4.0
• google-cloud-audit-log==0.6.0
• google-cloud-automl==2.20.0
• google-cloud-backupdr==0.10.0
• google-cloud-bare-metal-solution==1.14.0
• google-cloud-batch==0.22.0
• google-cloud-beyondcorp-appconnections==0.8.0
• google-cloud-beyondcorp-appconnectors==0.8.0
• google-cloud-beyondcorp-appgateways==0.8.0
• google-cloud-beyondcorp-clientconnectorservices==0.8.0
• Confidence Score: 4/5

  The PR appears safe to merge, though the shipped dependency notices should be refreshed.

  Findings

  1.  Shipped notices list old versions ▶
  Fix with agent prompt

  ### Issue 1
  uv.lock:1501
  `uv.lock` now selects `litellm` 1.103.2, but `THIRD_PARTY_NOTICES.md` still lists 1.96.0. The notice says it lists the versions resolved in `uv.lock`, so readers get an outdated list. Update the notices for the upgraded packages; `boto3` and `e2b` also still show their old versions.
  
  ---
  
  For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

  Summary

  This PR refreshes the project’s Python dependencies and widens the allowed version ranges for LiteLLM and E2B. It updates the lockfile to pin the refreshed package set and its dependency changes.

  • LiteLLM can now resolve below version 1.104, and E2B below 2.53.0.
  • The lockfile refreshes the 18 listed packages and related dependencies.

  _{Reviews (1) · Last reviewed commit: "build(deps): bump the python-minor-and-p..."}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​psycopg2-binary@​2.9.12 ⏵ 2.9.13	+1
	pypi/​e2b@​2.46.4 ⏵ 2.52.0
	pypi/​litellm@​1.96.0 ⏵ 1.103.2	+1	+2
	pypi/​moto@​5.2.2 ⏵ 5.2.3
	pypi/​modal@​1.5.2.dev12 ⏵ 1.6.1.dev1	+6
	pypi/​google-auth@​2.55.1 ⏵ 2.59.1
	pypi/​pymongo@​4.17.0 ⏵ 4.18.2	+1
	pypi/​google-cloud-storage@​3.15.0 ⏵ 3.16.0	+1
	pypi/​uvicorn@​0.49.0 ⏵ 0.54.0	+1
	pypi/​boto3@​1.43.38 ⏵ 1.43.107
	pypi/​packaging@​26.2 ⏵ 26.3	+1
	pypi/​google-api-core@​2.31.0 ⏵ 2.40.0
	pypi/​google-cloud-secret-manager@​2.30.0 ⏵ 2.31.0
	pypi/​pydantic@​2.12.5 ⏵ 2.13.5	+1
	pypi/​starlette@​1.3.1 ⏵ 1.7.0	+1
	pypi/​regex@​2026.6.28 ⏵ 2026.9.29
	pypi/​fastapi@​0.141.1 ⏵ 0.142.2	+1
	pypi/​pytest-socket@​0.8.0 ⏵ 0.8.1	+1

View full report

[greptile-apps]

Shipped notices list old versions

uv.lock now selects litellm 1.103.2, but THIRD_PARTY_NOTICES.md still lists 1.96.0. The notice says it lists the versions resolved in uv.lock, so readers get an outdated list. Update the notices for the upgraded packages; boto3 and e2b also still show their old versions.

Prompt To Fix With AI

This is a comment left during a code review.
Path: uv.lock
Line: 1501

Comment:
**Shipped notices list old versions**

`uv.lock` now selects `litellm` 1.103.2, but `THIRD_PARTY_NOTICES.md` still lists 1.96.0. The notice says it lists the versions resolved in `uv.lock`, so readers get an outdated list. Update the notices for the upgraded packages; `boto3` and `e2b` also still show their old versions.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.