chore(deps): Bump the python-dependencies group across 1 directory with 21 updates by dependabot[bot] · Pull Request #128 · astra-ssj/The-Cortex

dependabot · 2026-09-25T18:17:31Z

Bumps the python-dependencies group with 21 updates in the / directory:

Package	From	To
uvicorn	`0.52.4`	`0.53.0`
sqlalchemy	`2.0.52`	`2.0.54`
pypdf	`6.18.0`	`6.19.0`
pyjwt	`2.13.0`	`2.14.0`
filelock	`3.32.5`	`4.0.1`
idna	`3.19`	`3.20`
anthropic	`1.4.0`	`1.8.0`
psycopg2-binary	`2.9.12`	`2.9.13`
ruff	`0.16.6`	`0.16.8`
ast-serialize	`0.11.0`	`0.11.2`
boto3	`1.43.89`	`1.43.99`
botocore	`1.43.89`	`1.43.99`
coverage	`7.16.0`	`7.16.1`
greenlet	`3.5.5`	`3.5.6`
httpcore2	`2.12.0`	`2.13.0`
httpx2	`2.12.0`	`2.13.0`
jiter	`0.16.0`	`0.17.0`
pydantic-core	`2.46.5`	`2.49.0`
urllib3	`2.7.0`	`2.8.0`
watchfiles	`1.2.0`	`1.3.0`
wrapt	`2.4.0`	`2.4.1`

Updates uvicorn from 0.52.4 to 0.53.0

Release notes

Sourced from uvicorn's releases.

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.
uv add uvicorn==0.53.0
Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.

HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.

Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.

Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

Add experimental HTTP/2 support through zttp (#2982, #3101)

Add support for zuvloop (#3104)

Fixed

Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)

Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)

Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

Commits

421708f Version 0.53.0 (#3136)
f1a1bff Unset the keep-alive timer when upgrading to WebSocket (#3107)
63971ed Document HTTP/2 support (#3130)
7d1a005 Remove race from multiprocess health check test (#3128)
5ac6265 Add ::1 to FORWARDED_ALLOW_IPS (#3119)
098b206 Remove timing race from SIGHUP supervisor test (#3127)
968f15e chore(deps): bump the github-actions group with 4 updates (#3113)
7d4c08c chore(deps): bump the python-packages group across 1 directory with 11 update...
fe528a4 Require explicit opt-in for zttp HTTP/2 (#3101)
fa324a4 chore(deps-dev): bump httpx2 from 2.10.0 to 2.12.0 (#3121)
Additional commits viewable in compare view

Updates sqlalchemy from 2.0.52 to 2.0.54

Release notes

Sourced from sqlalchemy's releases.

2.0.54

Released: September 15, 2026

platform

[platform] [change] Binary wheels are no longer built for Python 3.7. PyPI now rejects wheel files whose filename does not begin with the normalized project name, and the packaging tools that can be installed on Python 3.7 do not produce such a filename. As a result, SQLAlchemy 2.0.44 was the last release to publish Python 3.7 wheels to PyPI, and releases 2.0.45 and later have been available on Python 3.7 only as a source distribution; the wheel builds for Python 3.7 are now removed. Python 3.7 remains supported by the 2.0 series.

[platform] [bug] Fixed issue where the Cython extensions were compiled without the freethreading_compatible directive, so that they did not declare themselves as safe to run without the GIL. On a free-threaded Python interpreter such as Python 3.13t or 3.14t, importing SQLAlchemy would cause the interpreter to re-enable the GIL, emitting a RuntimeWarning. The directive is now set when building for Python 3.13 and above, and a test has been added which confirms that importing SQLAlchemy on a free-threaded build does not enable the GIL.

References: #13592

2.0.53

Released: September 14, 2026

orm

[orm] [bug] Fixed issue where an expression passed to _orm.with_expression() that embedded a _sql.select(), such as a correlated _sql.exists(), would fail to populate the attribute correctly on the second and subsequent executions of an otherwise identical statement, when the _orm.query_expression() attribute was loaded by a relationship loader that emits a second query, i.e. _orm.selectinload(), _orm.lazyload() or _orm.immediateload().

References: #13560

[orm] [bug] Fixed memory issue where mapped classes, along with their Table and _orm.Mapper objects, would not be garbage collected after the _orm.registry in which they were mapped had been disposed and dereferenced. The issue would occur for mappings that made use of _orm.relationship() together with constructs such as an

... (truncated)

Commits

See full diff in compare view

Updates pypdf from 6.18.0 to 6.19.0

Release notes

Sourced from pypdf's releases.

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

Limit size of alphabetical page labels (#4096) by @stefan6419846

Deprecations (DEP)

Replace PdfWriter method add_js (#3979) by @j-t-1

Performance Improvements (PI)

Move static value out of loop body for appearance stream data (#4087) by @stefan6419846

Reduce number of full data lookups for attachment mapping API (#4081) by @stefan6419846

Bug Fixes (BUG)

Do not copy unrelated pages when appending pages with non-terminal fields (#4078) by @anandghegde

Use page reference for existing internal link targets (#4076) by @r-kamei

Arabic-Indic digits are reversed during text extraction (#4077) by @Syamjith-NK

Parse a string rect for add_uri into a rectangle (#4074) by @RavSinghChandan

Full Changelog

Version 6.18.1, 2026-09-11

What's new

Security (SEC)

Further restrict FlateDecode recovery (#4073) by @stefan6419846

Limit entry count for TrueType and Type1 font /Widths (#4072) by @stefan6419846

Limit allowed length of tokens in parse_bfchar (#4071) by @stefan6419846

Bug Fixes (BUG)

Use current text matrix for visitor_text (#4062) by @r-kamei

Repeat the letter for /S /A and /S /a page labels past Z (#4065) by @youdie006

Use font color for FreeText default appearance (#4051) by @Yuki9814

Robustness (ROB)

Fix compatibility with fonttools < 4.58.0 (#4050, #4059) by @MeggyCal and @stefan6419846

Documentation (DOC)

Use combined matrix in visitor examples (#4066) by @r-kamei

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.19.0, 2026-09-16

Security (SEC)

Limit size of alphabetical page labels (#4096)

Deprecations (DEP)

Replace PdfWriter method add_js (#3979)

Performance Improvements (PI)

Move static value out of loop body for appearance stream data (#4087)

Reduce number of full data lookups for attachment mapping API (#4081)

Bug Fixes (BUG)

Do not copy unrelated pages when appending pages with non-terminal fields (#4078)

Use page reference for existing internal link targets (#4076)

Arabic-Indic digits are reversed during text extraction (#4077)

Parse a string rect for add_uri into a rectangle (#4074)

Full Changelog

Version 6.18.1, 2026-09-11

Security (SEC)

Further restrict FlateDecode recovery (#4073)

Limit entry count for TrueType and Type1 font /Widths (#4072)

Limit allowed length of tokens in parse_bfchar (#4071)

Bug Fixes (BUG)

Use current text matrix for visitor_text (#4062)

Repeat the letter for /S /A and /S /a page labels past Z (#4065)

Use font color for FreeText default appearance (#4051)

Robustness (ROB)

Fix compatibility with fonttools < 4.58.0 (#4050, #4059)

Documentation (DOC)

Use combined matrix in visitor examples (#4066)

Full Changelog

Commits

d62cb58 REL: 6.19.0
0d8b5a8 SEC: Limit size of alphabetical page labels (#4096)
959467a PI: Move static value out of loop body for appearance stream data (#4087)
20822b2 DEV: Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#4093)
25f2301 DEP: Replace PdfWriter method add_js (#3979)
a924438 BUG: Do not copy unrelated pages when appending pages with non-terminal field...
cf5cec2 BUG: Use page reference for existing internal link targets (#4076)
96d81f0 BUG: Arabic-Indic digits are reversed during text extraction (#4077)
2d21901 DEV: Fix Color class for latest mypy (#4082)
893a010 MAINT: Split PdfDocCommon._flatten (#4070)
Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt's releases.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

`v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__

Security


- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.
Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
</code></pre>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c6fe464b356ff4b1ebc9ba62172d331a40aa27df&quot;&gt;&lt;code&gt;c6fe464&lt;/code&gt;&lt;/a> release: prepare v2.14.0</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f5413029ae7a2e31b1367b5303ea86a2f54ccf42&quot;&gt;&lt;code&gt;f541302&lt;/code&gt;&lt;/a> style: apply Ruff formatting</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95&quot;&gt;&lt;code&gt;801cd12&lt;/code&gt;&lt;/a> fix: reject public JWK container HMAC keys</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb&quot;&gt;&lt;code&gt;af8181c&lt;/code&gt;&lt;/a> fix: reject empty HMAC keys from JWKs</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1&quot;&gt;&lt;code&gt;ba4853a&lt;/code&gt;&lt;/a> Throttle repeated PyJWKClient refreshes</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499&quot;&gt;&lt;code&gt;2798504&lt;/code&gt;&lt;/a> fix: reject DER public keys as HMAC secrets</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07&quot;&gt;&lt;code&gt;8b4e233&lt;/code&gt;&lt;/a> fix: reject loader-accepted PEM variants</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1f8180a211256dfe5cf32294b6753f554a5a4258&quot;&gt;&lt;code&gt;1f8180a&lt;/code&gt;&lt;/a> fix: format JWS tests</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/cff1ac55fe5f1096fd05295b269fce053ee290ab&quot;&gt;&lt;code&gt;cff1ac5&lt;/code&gt;&lt;/a> Fix redirect handler return annotation</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56&quot;&gt;&lt;code&gt;0a795b8&lt;/code&gt;&lt;/a> Reject redirects in PyJWKClient fetches</li>

<li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />

Updates filelock from 3.32.5 to 4.0.1

Release notes
Sourced from filelock's releases.

4.0.1

What's Changed

fix: reject invalid poll_interval before sleep by @Pitchfork-and-Torch in tox-dev/filelock#739

New Contributors

@Pitchfork-and-Torch made their first contribution in tox-dev/filelock#739

Full Changelog: https://github.com/tox-dev/filelock/compare/4.0.0...4.0.1
4.0.0

What's Changed

🐛 fix(soft-rw): replace the state mutex with a generation log by @gaborbernat in tox-dev/filelock#738

Full Changelog: https://github.com/tox-dev/filelock/compare/3.32.7...4.0.0
3.32.7

What's Changed

Fix final symlink test on musl by @lprnmns in tox-dev/filelock#737
📝 docs: say acquire() falls back to the lock's blocking attribute by @hxperl in tox-dev/filelock#733

New Contributors

@hxperl made their first contribution in tox-dev/filelock#733

Full Changelog: https://github.com/tox-dev/filelock/compare/3.32.6...3.32.7
3.32.6

What's Changed

🐛 fix(lease): reject a duration no marker can carry by @lprnmns in tox-dev/filelock#723
🐛 fix(soft-rw): reject non-finite timing options by @lprnmns in tox-dev/filelock#724
fix: preserve exception notes when copying and pickling by @jackwalkerlabs in tox-dev/filelock#729
test(soft-rw): reuse existing test module by @gaborbernat in tox-dev/filelock#730
fix: respect ACL write access when the owner write bit is absent by @jackwalkerlabs in tox-dev/filelock#728
Fix SoftReadWriteLock state lock timeout by @Sohel2309 in tox-dev/filelock#726

New Contributors

@jackwalkerlabs made their first contribution in tox-dev/filelock#729
@Sohel2309 made their first contribution in tox-dev/filelock#726

Full Changelog: https://github.com/tox-dev/filelock/compare/3.32.5...3.32.6



Changelog
Sourced from filelock's changelog.

###########
Changelog
###########
.. towncrier-draft-entries:: Unreleased
.. towncrier release notes start

4.0.3 (2026-09-23)


Importing filelock on CPython 3.10 or 3.11 no longer makes new threads fail with RuntimeError: Cannot install a trace function while another trace function is being installed under coverage or a debugger. filelock skips its fork-safety
audit hook there, so forking from inside a thread's own lock-state transition no longer raises immediately on those
versions. :pr:747


4.0.2 (2026-09-23)


Concurrent acquire() and release() on a thread_local=False lock no longer leak the OS lock, close a
descriptor twice, drop a lease token, or leave a false deadlock after a cross-thread release (:issue:744). :pr:745
:class:~filelock.AsyncReadWriteLock and :class:~filelock.AsyncSoftReadWriteLock now give each asyncio task its
own hold, so tasks sharing one instance no longer enter the write lock together. :pr:746
Correct the async cache example to create its data directory and clarify automatic creation of lock-file parent directories. :pr:740
Exclude sphinx-llm 1.1.0 from documentation dependencies because its Markdown builder emits unknown-node warnings. :pr:742


4.0.1 (2026-09-19)


poll_interval is now validated at construction, on the setter, and on acquire(): a negative, non-finite, or
non-numeric value raises :class:ValueError/:class:TypeError immediately instead of failing inside time.sleep. :pr:739


4.0.0 (2026-09-17)


The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process
running an earlier release does not see it: an old and a new participant on one lock path do not exclude each
other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state,
.write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as
it must for :class:~filelock.StrictSoftFileLock, so a runtime without os.link raises
:class:~filelock.SoftFileLockProtocolError on acquire. Constructing a singleton again with a different
on_compromise, or with poll_interval at or above stale_threshold, now raises :class:ValueError. :pr:735
:class:~filelock.SoftReadWriteLock exposes :attr:~filelock.SoftReadWriteLock.generation as a fencing token for
the protected resource and reports a lost hold through on_compromise and
:attr:~filelock.SoftReadWriteLock.compromise. :pr:735
:class:~filelock.SoftReadWriteLock no longer deadlocks when a holder dies on another host mid-transition, and



... (truncated)


Commits

b5016c4 Release 4.0.1
6ee6db6 fix: reject invalid poll_interval before sleep (#739)
7e57436 Release 4.0.0
f974328 🐛 fix(soft-rw): replace the state mutex with a generation log (#738)
20929f7 Release 3.32.7
35f07c4 [pre-commit.ci] pre-commit autoupdate (#736)
e860d39 📝 docs: say acquire() falls back to the lock's blocking attribute (#733)
c530efe Fix final symlink test on musl (#737)
4efd93e Release 3.32.6
7b7b7a8 Fix SoftReadWriteLock state lock timeout (#726)
Additional commits viewable in compare view




Updates idna from 3.19 to 3.20

Release notes
Sourced from idna's releases.

v3.20

Update to Unicode 18.0.0.
Better enforcement of the domain length limit in the incremental
codec.
Add support for Python 3.15.




Changelog
Sourced from idna's changelog.

3.20 (2026-09-17)

Update to Unicode 18.0.0.
Better enforcement of the domain length limit in the incremental
codec.
Add support for Python 3.15.




Commits

d55e65e Release 3.20
0c0824a Pre-release 3.20rc0
bd7c316 Note Python 3.15 support in the 3.20 changelog
b6cce85 Merge pull request #276 from kjd/unicode-18
9a4bc59 Update to Unicode 18.0.0
dfab5a0 Merge branch 'python-3.15'
417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
cd17392 Merge pull request #274 from kjd/fix-decode-length-check
c5796d7 Skip the decode round-trip check for domains past encode's length limit
d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
Additional commits viewable in compare view




Updates anthropic from 1.4.0 to 1.8.0

Release notes
Sourced from anthropic's releases.

v1.8.0
1.8.0 (2026-09-22)
Full Changelog: v1.7.0...v1.8.0
Features

api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (b5cc700)

Bug Fixes

api: share one evaluated_permission enum across Managed Agents events (f4f51c8)
streaming: avoid a Python 3.13 crash at exit when a stream is left open (af029bd)
tools: add_tools() takes effect straight away (#874) (06d0a6b)
tools: leave reply-only params off the tool runner's compaction request (#871) (4687310)

Chores

docs: add descriptions to the Dreams API reference (5574c63)
docs: add descriptions to the User Profiles API reference (5574c63)
docs: add memory store descriptions to the Managed Agents API reference (5574c63)
docs: improve descriptions in the Dreams API reference (1f5e477)
docs: simplify the session thread agent type description (a45b7ec)
docs: update diagnostics field descriptions on beta messages (367750c)
internal: fix tests (70c8cbd)
internal: remove mypy (be01ed6)
tests: update fixtures (77f6df8)

Documentation

add path and header parameter descriptions (f429a30)

Refactors

client: remove the request param transform in favour of the JSON encoder (539422c)

v1.7.0
1.7.0 (2026-09-18)
Full Changelog: v1.6.0...v1.7.0
Features

api: add group with display_name to rate limits, deprecate group_type (28f0a83)
tools: add compact_before_next_turn() to the tool runner (#641) (8b23fb3)



... (truncated)


Changelog
Sourced from anthropic's changelog.

1.8.0 (2026-09-22)
Full Changelog: v1.7.0...v1.8.0
Features

api: add support for claude-opus-5-5, inline tool definitions and MCP tool-list pinning (beta) (b5cc700)

Bug Fixes

api: share one evaluated_permission enum across Managed Agents events (f4f51c8)
streaming: avoid a Python 3.13 crash at exit when a stream is left open (af029bd)
tools: add_tools() takes effect straight away (#874) (06d0a6b)
tools: leave reply-only params off the tool runner's compaction request (#871) (4687310)

Chores

docs: add descriptions to the Dreams API reference (5574c63)
docs: add descriptions to the User Profiles API reference (5574c63)
docs: add memory store descriptions to the Managed Agents API reference (5574c63)
docs: improve descriptions in the Dreams API reference (1f5e477)
docs: simplify the session thread agent type description (a45b7ec)
docs: update diagnostics field descriptions on beta messages (367750c)
internal: fix tests (70c8cbd)
internal: remove mypy (be01ed6)
tests: update fixtures (77f6df8)

Documentation

add path and header parameter descriptions (f429a30)

Refactors

client: remove the request param transform in favour of the JSON encoder (539422c)

1.7.0 (2026-09-18)
Full Changelog: v1.6.0...v1.7.0
Features

api: add group with display_name to rate limits, deprecate group_type (28f0a83)
tools: add compact_before_next_turn() to the tool runner (#641) (8b23fb3)

Bug Fixes


... (truncated)


Commits

4421d56 Merge pull request #1946 from anthropics/release-please--branches--main--chan...
d0247c2 release: 1.8.0
be01ed6 chore(internal): remove mypy
06d0a6b fix(tools): add_tools() takes effect straight away (#874)
af029bd fix(streaming): avoid a Python 3.13 crash at exit when a stream is left open
4687310 fix(tools): leave reply-only params off the tool runner's compaction request ...
b5cc700 feat(api): add support for claude-opus-5-5, inline tool definitions and MCP t...
70c8cbd chore(internal): fix tests
539422c refactor(client): remove the request param transform in favour of the JSON en...
10a4c07 codegen metadata
Additional commits viewable in compare view




Updates psycopg2-binary from 2.9.12 to 2.9.13

Changelog
Sourced from psycopg2-binary's changelog.

Current release
What's new in psycopg 2.9.13
^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
Fix parsing of malformed bytea input.
Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
Add a pyproject.toml file to declare a PEP 517 build backend
(:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
Drop support for Python 3.9.

What's new in psycopg 2.9.12
^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11
^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Add support for Python 3.14.
Avoid a segfault passing more arguments than placeholders if Python is built
with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
~psycopg2.errorcodes map and ~psycopg2.errors classes updated to
PostgreSQL 18.
Drop support for Python 3.8.

What's new in psycopg 2.9.10
^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Add support for Python 3.13.
Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
~psycopg2.errorcodes map and ~psycopg2.errors classes updated to
PostgreSQL 17.
Drop support for Python 3.7.

What's new in psycopg 2.9.9
^^^^^^^^^^^^^^^^^^^^^^^^^^^

Add support for Python 3.12.
Drop support for Python 3.6.

What's new in psycopg 2.9.8


... (truncated)


Commits

f650e7a chore: bump to release 2.9.13
368c8a1 chore!: drop support for Python 3.9
9b39e65 chore: drop scaleway build support
2ca7041 fix: fix handling of PostgreSQL 18 exceptions
5385c02 Build CPython 3.15 wheels
1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
8fb80bc fix: fix parsing of malformed int64 input in arrays
f98014a fix: fix parsing of malformed bytea input
822b79c chore: bump dependencies in binary package
Additional commits viewable in compare view




Updates ruff from 0.16.6 to 0.16.8

Release notes
Sourced from ruff's releases.

0.16.8
Release Notes
Released on 2026-09-16.
Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)
[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
[flake8-simplify] Preserve operand order in SIM109 fix (#27824)
[pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
[pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

Add support for __lazy_modules__ (#28459)
Recognize PEP-728 TypedDict class keywords (#28533)
Recognize quoted types in typing.TypeForm (#28507)
Support conditional assignment to __lazy_modules__ (#28491)
[flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
[pyupgrade] Make the fix for UP040 always unsafe (#28526)
[pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
[ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
[ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

[flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

@VedantMadane
@alzeph
@charliermarsh
@fredrikblau
@ntBre
@zsol
@Aniket-a14
@r-b-1

Install ruff 0.16.8
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh
</tr></table> 


... (truncated)


Changelog
Sourced from ruff's changelog.

0.16.8
Released on 2026-09-16.
Bug fixes

Visit functional TypedDict keyword arguments correctly (#28584)
[flake8-simplify] Detect nested async with under sync parent (SIM117) (#27821)
[flake8-simplify] Preserve operand order in SIM109 fix (#27824)
[pyupgrade] Preserve required parentheses in multiline UP040 fixes (#28164)
[pyupgrade] Skip TypeVarTuple and ParamSpec conversions with bounds or constraints (UP040, UP046, UP047) (#28505)

Rule changes

Add support for __lazy_modules__ (#28459)
Recognize PEP-728 TypedDict class keywords (#28533)
Recognize quoted types in typing.TypeForm (#28507)
Support conditional assignment to __lazy_modules__ (#28491)
[flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on Python 3.15 and later (TC001, TC002, TC003) (#28541)
[pyupgrade] Make the fix for UP040 always unsafe (#28526)
[pyupgrade] Stop recommending deprecated ByteString aliases (UP035) (#28498)
[ruff, flake8-use-pathlib] Recognize the parent_mode argument (RUF064, PTH103) (#28528)
[ruff] Detect \Z in pytest.raises() match patterns (RUF043) (#28598)

CLI

Use rule name and code in formatter incompatibility warnings (#28571)

Configuration

[flake8-tidy-imports] Add extend-banned-api (#28644)

Contributors

@VedantMadane
@alzeph
@charliermarsh
@fredrikblau
@ntBre
@zsol
@Aniket-a14
@r-b-1

0.16.7
Released on 2026-09-10.
Preview features

[ruff] Add rule for default values on method receivers (RUF077) (#26700)



... (truncated)


Commits

62914c4 Bump version to 0.16.8 (#28648)
c47e0cd [ty] Bound aliased intersection expansion during inference (#28546)
ff4747b renovate: update uv hashes correctly with setup-uv (#28621)
94efeaa [ty] Compact reachable binding and declaration histories (#28349)
50020fb [ty] Avoid storing constraint nodes twice (#28375)
446bb68 [ty] Compare bound-method receivers before signatures (#28384)
304ab86 [flake8-type-checking] Prefer lazy imports over TYPE_CHECKING on 3.15+ (`...
d940b24 [ty] Watch script dependencies in CLI watch mode (#28125)
fe9f065<...
Description has been truncated

…th 21 updates Bumps the python-dependencies group with 21 updates in the / directory: | Package | From | To | | --- | --- | --- | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.4` | `0.53.0` | | [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.52` | `2.0.54` | | [pypdf](https://github.com/py-pdf/pypdf) | `6.18.0` | `6.19.0` | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.14.0` | | [filelock](https://github.com/tox-dev/py-filelock) | `3.32.5` | `4.0.1` | | [idna](https://github.com/kjd/idna) | `3.19` | `3.20` | | [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `1.4.0` | `1.8.0` | | [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.12` | `2.9.13` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.6` | `0.16.8` | | [ast-serialize](https://github.com/mypyc/ast_serialize) | `0.11.0` | `0.11.2` | | [boto3](https://github.com/boto/boto3) | `1.43.89` | `1.43.99` | | [botocore](https://github.com/boto/botocore) | `1.43.89` | `1.43.99` | | [coverage](https://github.com/coveragepy/coveragepy) | `7.16.0` | `7.16.1` | | [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.5` | `3.5.6` | | [httpcore2](https://github.com/pydantic/httpx2) | `2.12.0` | `2.13.0` | | [httpx2](https://github.com/pydantic/httpx2) | `2.12.0` | `2.13.0` | | [jiter](https://github.com/pydantic/jiter) | `0.16.0` | `0.17.0` | | [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.5` | `2.49.0` | | [urllib3](https://github.com/urllib3/urllib3) | `2.7.0` | `2.8.0` | | [watchfiles](https://github.com/samuelcolvin/watchfiles) | `1.2.0` | `1.3.0` | | [wrapt](https://github.com/GrahamDumpleton/wrapt) | `2.4.0` | `2.4.1` | Updates `uvicorn` from 0.52.4 to 0.53.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.52.4...0.53.0) Updates `sqlalchemy` from 2.0.52 to 2.0.54 - [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases) - [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst) - [Commits](https://github.com/sqlalchemy/sqlalchemy/commits) Updates `pypdf` from 6.18.0 to 6.19.0 - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.18.0...6.19.0) Updates `pyjwt` from 2.13.0 to 2.14.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.13.0...2.14.0) Updates `filelock` from 3.32.5 to 4.0.1 - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@3.32.5...4.0.1) Updates `idna` from 3.19 to 3.20 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.19...v3.20) Updates `anthropic` from 1.4.0 to 1.8.0 - [Release notes](https://github.com/anthropics/anthropic-sdk-python/releases) - [Changelog](https://github.com/anthropics/anthropic-sdk-python/blob/main/CHANGELOG.md) - [Commits](anthropics/anthropic-sdk-python@v1.4.0...v1.8.0) Updates `psycopg2-binary` from 2.9.12 to 2.9.13 - [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS) - [Commits](psycopg/psycopg2@2.9.12...2.9.13) Updates `ruff` from 0.16.6 to 0.16.8 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.6...0.16.8) Updates `ast-serialize` from 0.11.0 to 0.11.2 - [Commits](mypyc/ast_serialize@v0.11.0...v0.11.2) Updates `boto3` from 1.43.89 to 1.43.99 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.89...1.43.99) Updates `botocore` from 1.43.89 to 1.43.99 - [Commits](boto/botocore@1.43.89...1.43.99) Updates `coverage` from 7.16.0 to 7.16.1 - [Release notes](https://github.com/coveragepy/coveragepy/releases) - [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.16.0...7.16.1) Updates `greenlet` from 3.5.5 to 3.5.6 - [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst) - [Commits](python-greenlet/greenlet@3.5.5...3.5.6) Updates `httpcore2` from 2.12.0 to 2.13.0 - [Release notes](https://github.com/pydantic/httpx2/releases) - [Commits](pydantic/httpx2@v2.12.0...v2.13.0) Updates `httpx2` from 2.12.0 to 2.13.0 - [Release notes](https://github.com/pydantic/httpx2/releases) - [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md) - [Commits](pydantic/httpx2@v2.12.0...v2.13.0) Updates `jiter` from 0.16.0 to 0.17.0 - [Release notes](https://github.com/pydantic/jiter/releases) - [Commits](pydantic/jiter@v0.16.0...v0.17.0) Updates `pydantic-core` from 2.46.5 to 2.49.0 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](https://github.com/pydantic/pydantic/commits) Updates `urllib3` from 2.7.0 to 2.8.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.7.0...2.8.0) Updates `watchfiles` from 1.2.0 to 1.3.0 - [Release notes](https://github.com/samuelcolvin/watchfiles/releases) - [Commits](samuelcolvin/watchfiles@v1.2.0...v1.3.0) Updates `wrapt` from 2.4.0 to 2.4.1 - [Release notes](https://github.com/GrahamDumpleton/wrapt/releases) - [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst) - [Commits](GrahamDumpleton/wrapt@2.4.0...2.4.1) --- updated-dependencies: - dependency-name: uvicorn dependency-version: 0.53.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: sqlalchemy dependency-version: 2.0.54 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: pypdf dependency-version: 6.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: pyjwt dependency-version: 2.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: filelock dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: python-dependencies - dependency-name: idna dependency-version: '3.20' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: anthropic dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: psycopg2-binary dependency-version: 2.9.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: ruff dependency-version: 0.16.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: ast-serialize dependency-version: 0.11.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: boto3 dependency-version: 1.43.99 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: botocore dependency-version: 1.43.99 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: coverage dependency-version: 7.16.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: greenlet dependency-version: 3.5.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: httpcore2 dependency-version: 2.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: httpx2 dependency-version: 2.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: jiter dependency-version: 0.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: pydantic-core dependency-version: 2.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: urllib3 dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: watchfiles dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: wrapt dependency-version: 2.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-02T18:16:39Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 25, 2026

dependabot Bot closed this Oct 2, 2026

dependabot Bot deleted the dependabot/pip/python-dependencies-5b2128da06 branch October 2, 2026 18:16

Conversation

dependabot Bot commented on behalf of github Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Version 0.53.0

🌐 Opt-in HTTP/2 support

⚙️ More event loop choice

🛡️ More reliable connections and proxies

0.53.0 (September 14, 2026)

Added

Fixed

2.0.54

platform

2.0.53

orm

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

Deprecations (DEP)

Performance Improvements (PI)

Bug Fixes (BUG)

Version 6.18.1, 2026-09-11

What's new

Security (SEC)

Bug Fixes (BUG)

Robustness (ROB)

Documentation (DOC)

Version 6.19.0, 2026-09-16

Security (SEC)

Deprecations (DEP)

Performance Improvements (PI)

Bug Fixes (BUG)

Version 6.18.1, 2026-09-11

Security (SEC)

Bug Fixes (BUG)

Robustness (ROB)

Documentation (DOC)

2.14.0

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

4.0.1

What's Changed

New Contributors

4.0.0

What's Changed

3.32.7

What's Changed

New Contributors

3.32.6

What's Changed

New Contributors

v3.20

3.20 (2026-09-17)

v1.8.0

1.8.0 (2026-09-22)

Features

Bug Fixes

Chores

Documentation

Refactors

v1.7.0

1.7.0 (2026-09-18)

Features

1.8.0 (2026-09-22)

Features

Bug Fixes

Chores

Documentation

Refactors

1.7.0 (2026-09-18)

Features

Bug Fixes

Current release

0.16.8

Release Notes

Bug fixes

Rule changes

CLI

Configuration

Contributors

Install ruff 0.16.8

Install prebuilt binaries via shell script

dependabot Bot commented on behalf of github Sep 25, 2026 •

edited

Loading

`v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__