Skip to content

Bump the python-minor-patch group across 1 directory with 60 updates - #599

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-35559bc7df
Open

Bump the python-minor-patch group across 1 directory with 60 updates#599
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-patch-35559bc7df

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 60 updates in the / directory:

Package From To
fastapi 0.141.1 0.162.0
slack-sdk 3.43.0 3.45.0
aiohttp 3.14.4 3.14.5
claude-agent-sdk 0.2.161 0.2.174
mcp 2.0.0 2.3.0
websockets 17.0.1 17.3
click 8.4.2 8.5.0
telethon 1.44.0 1.45.0
watchfiles 1.2.0 1.3.0
xmemory-ai 0.15.0 0.23.0
opentelemetry-instrumentation-anthropic 0.62.3 0.62.4
alembic 1.19.1 1.20.1
anyio 4.14.2 4.15.1
boto3 1.43.74 1.43.118
botocore 1.43.74 1.43.123
certifi 2026.10.19 2026.10.23
charset-normalizer 3.5.1 3.5.2
cryptography 50.0.0 50.0.2
googleapis-common-protos 1.75.1 1.76.0
greenlet 3.5.5 3.5.6
httptools 0.8.0 0.9.0
httpx2 2.12.0 2.16.0
idna 3.19 3.20
iniconfig 2.3.0 2.3.1
jiter 0.16.0 0.18.0
jsonpatch 1.33 1.37
jsonpointer 3.1.1 3.6
langchain-core 1.5.6 1.6.10
langchain-protocol 0.0.18 0.0.20
langsmith 0.11.0 0.14.12
mako 1.4.2 1.4.3
markupsafe 3.0.3 3.0.4
mcp-types 2.0.0 2.3.0
numpy 2.5.2 2.5.4
openai 3.3.0 3.37.0
orjson 3.12.0 3.13.0
pendulum 3.2.0 3.3.0
pluggy 1.6.0 1.7.0
propcache 0.5.2 0.5.4
protobuf 7.35.1 7.36.2
pycparser 3.0 3.12
pydantic 2.13.4 2.14.1
pydantic-core 2.46.4 2.50.1
pyjwt 2.15.0 2.15.1
python-dotenv 1.2.3 1.2.4
rpds-py 2026.6.3 2026.9.1
s3transfer 0.19.2 0.19.3
sqlalchemy 2.0.52 2.0.55
sqlmodel 0.0.39 0.0.48
sse-starlette 3.4.8 3.5.1
starlette 1.6.0 1.10.0
tenacity 9.1.4 9.2.1
tqdm 4.70.0 4.70.1
truststore 0.10.4 0.10.5
tzdata 2026.3 2026.5
tzlocal 5.4.4 5.4.5
uvicorn 0.52.4 0.54.0
uvloop 0.22.1 0.23.0
wrapt 2.3.0 2.5.1
xxhash 4.0.1 4.0.2

Updates fastapi from 0.141.1 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

  • 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

0.161.1

Fixes

  • 🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @​tiangolo.

0.161.0

Features

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

  • 🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @​tiangolo.

Internal

0.159.1

Features

0.159.0

Features

  • ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

0.158.1

... (truncated)

Commits

Updates slack-sdk from 3.43.0 to 3.45.0

Release notes

Sourced from slack-sdk's releases.

v3.45.0

What's Changed

🚀 Enhancements

🐛 Bug Fixes

📚 Documentation

📦 Other changes

New Contributors

Full Changelog: slackapi/python-slack-sdk@v3.44.1...v3.45.0 Milestone: https://github.com/slackapi/python-slack-sdk/milestone/122?closed=1

v3.44.1

What's Changed

🐛 Bug Fixes

📦 Other changes

Full Changelog: slackapi/python-slack-sdk@v3.44.0...v3.44.1 Milestone: https://github.com/slackapi/python-slack-sdk/milestone/121?closed=1

v3.44.0

... (truncated)

Commits
  • dd61579 chore(release): version 3.45.0 (#1979)
  • 5697153 chore(deps): bump ruff from 0.16.4 to 0.16.9 (#1975)
  • 1710bda fix(oauth): treat naive datetime values as UTC when converting to timestamps ...
  • 463c8b3 feat(web-api): add agents.conversations.* methods (#1943)
  • 1fe0b8e docs(deps): simplify the managing-dependencies skill (#1972)
  • 2bc474a fix(socket_mode): recreate a closed aiohttp session when reconnecting (#1966)
  • 3dc7e66 ci: use psycopg 3 for the PostgreSQL database tests (#1971)
  • 77d0a1a fix(socket_mode): check the effective log level in debug guards (#1965)
  • b9f4666 feat(models): allow raw_number cells in TableBlock rows (#1964)
  • 0824928 fix(socket_mode): shut down current_session_runner in built-in close() (#1962)
  • Additional commits viewable in compare view

Updates aiohttp from 3.14.4 to 3.14.5
Updates claude-agent-sdk from 0.2.161 to 0.2.174

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.174

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.310

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.174/

pip install claude-agent-sdk==0.2.174

v0.2.173

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.309

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.173/

pip install claude-agent-sdk==0.2.173

v0.2.172

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.308

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.172/

pip install claude-agent-sdk==0.2.172

v0.2.171

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.307

... (truncated)

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.174

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.310

0.2.173

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.309

0.2.172

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.308

0.2.171

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.307

0.2.170

Bug Fixes

  • Fixed parallel tool calls missing from session messages: get_session_messages and get_session_messages_from_store now return every tool call and result from turns that ran tools in parallel. Previously only one branch of the forked transcript was followed, dropping some calls and results (#1422)

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.306
  • CI: release uploads to PyPI now use trusted publishing (GitHub OIDC) instead of a long-lived API token (#1418)

0.2.169

Documentation

  • Clarified that include_hook_events does not suppress SessionStart and Setup hook events, which the CLI emits regardless of the setting (#1336)

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.305
  • CI: hash-pinned the release build tools (build, twine, wheel, hatchling) so a tampered or unexpected download stops the job (#1415)

0.2.168

Internal/Other Changes

... (truncated)

Commits
  • 0e89b29 docs: update changelog for v0.2.174
  • 784e3f7 chore: release v0.2.174
  • 28003b0 chore: bump bundled CLI version to 2.1.310
  • 163f50e docs: update changelog for v0.2.173
  • 4059606 chore: release v0.2.173
  • c12f3e8 chore: bump bundled CLI version to 2.1.309
  • 6b4a557 docs: update changelog for v0.2.172
  • a731da4 chore: release v0.2.172
  • c3f458a chore: bump bundled CLI version to 2.1.308
  • 7b790c7 docs: update changelog for v0.2.171
  • Additional commits viewable in compare view

Updates mcp from 2.0.0 to 2.3.0

Release notes

Sourced from mcp's releases.

v2.3.0

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

Mostly fixes, plus three new options. A few things behave differently, so skim these first:

Behaviour changes

httpx2>=2.10.0 is now required (#3600)

  • It was >=2.5.0. The new max_sse_event_size option needs it.
  • Nothing to do unless you pin httpx2 below 2.10.

A tool with an invalid x-mcp-header annotation fails at registration (#3620)

  • @mcp.tool(), add_tool and Tool.from_function raise InvalidSignature, naming the tool and the problem.
  • Until now the server started, and 2026-07-28 clients silently dropped the tool from their listing.
  • Refused: anything other than a plain str, int or bool parameter (so also str | None, float, lists and enums), a header name that isn't a valid token, and two names that differ only by case.
  • For an optional header parameter, give the schema directly: Annotated[str | None, WithJsonSchema({"type": "string", "x-mcp-header": "Region"})] = None.

Empty _meta and params are no longer sent (#3628)

  • On 2025-11-25 and earlier connections, 2.x sent "_meta": {} on every request. Some servers reject that. It is now left out, as in v1.
  • ping and list requests without a cursor go out with no params member.
  • On the receiving side ctx.meta is None rather than {}, and middleware sees ctx.params as None for a request without params.
  • 2026-07-28 connections are unchanged.

initialize leaves out experimental when none is configured (#3614)

  • It used to send "experimental": {}. server/discover already left it out.
  • Client code reading capabilities.experimental on a legacy connection should handle None.

Mcp-Param-* validation looks the tool up by name (#3630)

  • MCPServer no longer runs tools/list for every tools/call, so middleware no longer sees that extra request.
  • The registered schema is what gets checked. Middleware that filters or rewrites tools/list no longer affects it.

An interactive OAuth login no longer counts against request timeouts (#3635)

  • The timeout pauses while OAuthClientProvider waits on redirect_handler and callback_handler.
  • This fixes Client(mode="auto") settling on 2025-11-25 when the login took longer than 10 seconds.
  • A request timeout no longer ends a login nobody finishes. Put a limit inside callback_handler if you need one.

New

  • max_sse_event_size= on streamable_http_client and StreamableHttpParameters. The default stays 1 MiB per SSE event; raise it, or pass None, for larger tool results (#3600).
  • MCPServer(subscriptions=False) stops serving subscriptions/listen and advertises listChanged and subscribe as false (#3626).
  • Server(get_tool_input_schema=...) lets a low-level server supply a tool's schema for header validation without running its tools/list handler (#3630).
  • Client.call_tool re-lists the tools and retries once after a HeaderMismatch (-32020) rejection (#3627).

Fixes

  • ctx: Context[AppState] works on prompts and resource templates, not only on tools (#3624).
  • An explicit "structuredContent": null is checked against the output schema instead of being treated as missing (#3621).
  • A progress_callback that raises no longer fails the call on an in-process Client(server) (#3623).
  • Client OpenTelemetry spans record JSON-RPC error responses. With mode="auto", connecting to a server without server/discover now shows one ERROR span for the probe (#3629).
  • stdio_client resolves the executable off the event loop on Windows (#3510).

... (truncated)

Commits
  • 2118f14 docs: refresh translations for recent English changes (#3636)
  • ed9b2d6 Stop counting an interactive OAuth login against request timeouts (#3635)
  • d5cebd1 Keep inline-snapshot disabled when pytest runs in a terminal (#3634)
  • c15566c Link What's new to the Header parameters page (#3632)
  • 4d29994 Let a newer Deploy Docs run cancel the one in progress (#3633)
  • 0acea60 Bump urllib3 from 2.7.0 to 2.8.0 (#3607)
  • c54075c Look the tool schema up by name for Mcp-Param-* validation instead of running...
  • 9afccae Retry a tool call once after a HeaderMismatch rejection (#3627)
  • cafa33b Record JSON-RPC error responses on the client OpenTelemetry span (#3629)
  • 0b2fd3e Omit an empty _meta and empty params from outbound requests (#3628)
  • Additional commits viewable in compare view

Updates websockets from 17.0.1 to 17.3

Release notes

Sourced from websockets's releases.

17.3

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

17.2

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

17.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits
  • 86a1ad5 Release version 17.3.
  • 5cc46ca Bump pypa/cibuildwheel from 4.2.1 to 4.3.1
  • f6702a5 Deindent more test assertions.
  • 7fe5d60 Deindent assertions on raised exceptions.
  • 8549c24 Support arbitrary data in basic auth credentials.
  • a8a898b Support UTF-8 passwords in server basic auth.
  • bc17da4 Parse integers strictly in the HTTP protocol.
  • 7f56717 Increase timeout for running tests.
  • 47e2926 Simplify issue template and fix typo.
  • 77875e1 Fix intermittent errors on free-threaded Python.
  • Additional commits viewable in compare view

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

  • Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
  • Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
  • {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
  • confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
  • {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
  • Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](https://github.com/pallets/click/discussions/3527). #3581
  • style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
  • The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
  • Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

  • Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
  • Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
  • {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
  • confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
  • Fix test failures when using pytest >= 9.1. {pr}3656
  • {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
  • Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](https://github.com/pallets/click/discussions/3527). {pr}3581
  • style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
  • The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
  • Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
  • {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
  • The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits
  • 8b19813 Release version 8.5.0
  • 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
  • 131c86a Add FAQ entry about UnicodeEncodeError on Windows
  • e1fd594 Add support of pathlib.Path to edit (#3781)
  • a1d8785 Add support of pathlib.Path to edit
  • 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
  • a6256bf Forwards all user's parameters set in PAGER
  • 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
  • 9835b0f Resolve the pager command once, in _pager_contextmanager
  • f36d58b Refactor pager stream handling (#3767)
  • Additional commits viewable in compare view

Updates telethon from 1.44.0 to 1.45.0

Updates watchfiles from 1.2.0 to 1.3.0

Release notes

Sourced from watchfiles's releases.

v1.3.0 2026-09-21

What's Changed

New Contributors

Full Changelog: samuelcolvin/watchfiles@v1.2.0...v1.3.0

Commits

Updates xmemory-ai from 0.15.0 to 0.23.0

Updates opentelemetry-instrumentation-anthropic from 0.62.3 to 0.62.4

Release notes

Sourced from opentelemetry-instrumentation-anthropic's releases.

0.62.4

v0.62.4 (2026-09-29)

Fix

  • groq: record token usage and duration metrics for streaming responses (#4439)
  • mcp: end the session span when Client.aexit is cancelled (#4517)
  • mcp: honor TRACELOOP_TRACE_CONTENT on the client path (#4466)
  • openai: don't crash tracing responses.with_raw_response.create(stream=True) (#4477)
  • mistralai: record chunked assistant content instead of dropping it (#4478)
  • langchain: keep objects out of association properties (#4467)
  • crewai: stop the dict walk leaking credentials onto spans (#4465)

[main be498301c] bump: version 0.62.3 → 0.62.4 66 files changed, 77 insertions(+), 65 deletions(-)

Changelog

Sourced from opentelemetry-instrumentation-anthropic's changelog.

v0.62.4 (2026-09-29)

Fix

  • groq: record token usage and duration metrics for streaming responses (#4439)
  • mcp: end the session span when Client.aexit is cancelled (#4517)
  • mcp: honor TRACELOOP_TRACE_CONTENT on the client path (#4466)
  • openai: don't crash tracing responses.with_raw_response.create(stream=True) (#4477)
  • mistralai: record chunked assistant content instead of dropping it (#4478)
  • langchain: keep objects out of association properties (#4467)
  • crewai: stop the dict walk leaking credentials onto spans (#4465)
Commits
  • be49830 bump: version 0.62.3 → 0.62.4
  • 32a2aa8 fix(groq): record token usage and duration metrics for streaming responses (#...
  • 6102f9e fix(mcp): end the session span when Client.aexit is cancelled (#4517)
  • d92433b fix(mcp): honor TRACELOOP_TRACE_CONTENT on the client path (#4466)
  • f7082c8 fix(openai): don't crash tracing responses.with_raw_response.create(stream=Tr...
  • d13e721 fix(mistralai): record chunked assistant content instead of dropping it (#4478)
  • dac2534 fix(langchain): keep objects out of association properties (#4467)
  • 0c7520a fix(crewai): stop the dict walk leaking credentials onto spans (#4465)
  • See full diff in compare view

Updates alembic from 1.19.1 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

  • [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

    References: #1085

  • [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

    References: #1360

  • [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

    References: #1462

  • [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

  • [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

Updates anyio from 4.14.2 to 4.15.1

Release notes

Sourced from anyio's releases.

4.15.1

  • Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first (#1311)

4.15.0

  • Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

    • follow_symlinks on exists() (Python 3.12+)
    • follow_symlinks on is_dir() (Python 3.13+)
    • follow_symlinks on is_file() (Python 3.13+)
    • follow_symlinks on owner() (Python 3.13+)
    • follow_symlinks on group() (Python 3.13+)
    • newline on read_text() (Python 3.13+)

    (#1286, #1293; PR by @​jaideeppyne)

  • Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

  • Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

  • Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

  • Added guidance for managing multiple me...

    Description has been truncated

@dependabot
Bump the python-minor-patch group across 1 directory with 60 updates
7f71151 
---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.162.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: slack-sdk
  dependency-version: 3.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: aiohttp
  dependency-version: 3.14.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: claude-agent-sdk
  dependency-version: 0.2.174
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: mcp
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: websockets
  dependency-version: '17.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: telethon
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: watchfiles
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: xmemory-ai
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: opentelemetry-instrumentation-anthropic
  dependency-version: 0.62.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: alembic
  dependency-version: 1.20.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: anyio
  dependency-version: 4.15.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: boto3
  dependency-version: 1.43.118
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: botocore
  dependency-version: 1.43.123
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: certifi
  dependency-version: 2026.10.23
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: charset-normalizer
  dependency-version: 3.5.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: googleapis-common-protos
  dependency-version: 1.76.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: greenlet
  dependency-version: 3.5.6
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: httptools
  dependency-version: 0.9.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: httpx2
  dependency-version: 2.16.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: idna
  dependency-version: '3.20'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: iniconfig
  dependency-version: 2.3.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: jiter
  dependency-version: 0.18.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: jsonpatch
  dependency-version: '1.37'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: jsonpointer
  dependency-version: '3.6'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: langchain-core
  dependency-version: 1.6.10
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: langchain-protocol
  dependency-version: 0.0.20
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: langsmith
  dependency-version: 0.14.12
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: mako
  dependency-version: 1.4.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: markupsafe
  dependency-version: 3.0.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: mcp-types
  dependency-version: 2.3.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: numpy
  dependency-version: 2.5.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: openai
  dependency-version: 3.37.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: orjson
  dependency-version: 3.13.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pendulum
  dependency-version: 3.3.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pluggy
  dependency-version: 1.7.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: propcache
  dependency-version: 0.5.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: protobuf
  dependency-version: 7.36.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pycparser
  dependency-version: '3.12'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pydantic-core
  dependency-version: 2.50.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pyjwt
  dependency-version: 2.15.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: rpds-py
  dependency-version: 2026.9.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: s3transfer
  dependency-version: 0.19.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: sqlalchemy
  dependency-version: 2.0.55
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: sqlmodel
  dependency-version: 0.0.48
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: sse-starlette
  dependency-version: 3.5.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: starlette
  dependency-version: 1.10.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: tenacity
  dependency-version: 9.2.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: tqdm
  dependency-version: 4.70.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: truststore
  dependency-version: 0.10.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: tzdata
  dependency-version: '2026.5'
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: tzlocal
  dependency-version: 5.4.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: uvloop
  dependency-version: 0.23.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: wrapt
  dependency-version: 2.5.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: xxhash
  dependency-version: 4.0.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 1, 2026
@nerveai

nerveai commented Nov 1, 2026

Copy link
Copy Markdown

Nerve PR review · ✅ Ready to merge once Backend tests pass

The security-relevant bump is mcp 2.0.0→2.3.0, which fixes four medium advisories (GHSA-w4fh-qvv9-3v23, GHSA-5h93-6whr-6q8j, GHSA-rwrf-2pqf-9j8j, GHSA-84m7-p3x7-pcfv). That supersedes #525 (mcp 2.2.0) and covers #573's uvicorn 0.54.0. claude-agent-sdk 0.2.174 leaves every private seam Nerve uses unchanged (subprocess_cli, query, message_parser, _errors, _configure_can_use_tool) and bundles CLI 2.1.310. None of FastAPI 0.162's breaking changes hit Nerve's routes. The xmemory, langsmith and uvicorn names Nerve imports or overrides are still there. memu-py is not touched (that is #598, which will conflict on the lockfile).

Completeness: lockfile consistent; integrity verified against PyPI for all 61 packages; no advisory at any new version; frontend jobs pass, Backend tests pending.
Worth considering:

  • mcp 2.3 now closes a stateful session after 30 minutes with nothing in flight (cap: 10 000 sessions), and nerve/mcp_server/http.py:255 takes that default. Codex 0.164 re-initializes on 404, and its sessions are token-bound. A satellite client that reconnects, though, gets a new mcp-session-id and therefore a new external:<client>:<id> session row (http.py:199). Setting session_idle_timeout explicitly would make that Nerve's own choice.

Checked: lock diff vs trial merge into main 9d4263b; upstream diffs claude-agent-sdk v0.2.161…v0.2.174 and mcp v2.0.0…v2.3.0 server modules; no sandbox run (deps-only, sandbox has main's deps) · automated review by nerveai — mention @nerveai to ask a follow-up.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nerveai