Conversation
It's often helpful to commit this file
Bumps the uv group with 4 updates in the / directory: [cryptography](https://github.com/pyca/cryptography), [langchain-core](https://github.com/langchain-ai/langchain), [pillow](https://github.com/python-pillow/Pillow) and [protobuf](https://github.com/protocolbuffers/protobuf). Updates `cryptography` from 46.0.3 to 46.0.5 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.3...46.0.5) Updates `langchain-core` from 1.2.7 to 1.2.11 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-core==1.2.7...langchain-core==1.2.11) Updates `pillow` from 12.1.0 to 12.1.1 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.0...12.1.1) Updates `protobuf` from 6.33.4 to 6.33.5 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) --- updated-dependencies: - dependency-name: cryptography dependency-version: 46.0.5 dependency-type: indirect dependency-group: uv - dependency-name: langchain-core dependency-version: 1.2.11 dependency-type: indirect dependency-group: uv - dependency-name: pillow dependency-version: 12.1.1 dependency-type: indirect dependency-group: uv - dependency-name: protobuf dependency-version: 6.33.5 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the uv group with 4 updates in the / directory: [cryptography](https://github.com/pyca/cryptography), [langchain-core](https://github.com/langchain-ai/langchain), [pillow](https://github.com/python-pillow/Pillow) and [protobuf](https://github.com/protocolbuffers/protobuf). Updates `cryptography` from 46.0.3 to 46.0.5 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p> <blockquote> <p>46.0.5 - 2026-02-10</p> <pre><code> * An attacker could create a malicious public key that reveals portions of your private key when using certain uncommon elliptic curves (binary curves). This version now includes additional security checks to prevent this attack. This issue only affects binary elliptic curves, which are rarely used in real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine** for reporting the issue. **CVE-2026-26007** * Support for ``SECT*`` binary elliptic curves is deprecated and will be removed in the next release. <p>.. v46-0-4:</p> <p>46.0.4 - 2026-01-27<br /> </code></pre></p> <ul> <li><code>Dropped support for win_arm64 wheels</code>_.</li> <li>Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.</li> </ul> <p>.. _v46-0-3:</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/06e120e682cb200e3f7050c02f0bcdac90c4c6ad"><code>06e120e</code></a> bump version for 46.0.5 release (<a href="https://redirect.github.com/pyca/cryptography/issues/14289">#14289</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c"><code>0eebb9d</code></a> EC check key on cofactor > 1 (<a href="https://redirect.github.com/pyca/cryptography/issues/14287">#14287</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/bedf6e186b814f69a3f54f51252c23a71d44ed2e"><code>bedf6e1</code></a> fix openssl version on 46 branch (<a href="https://redirect.github.com/pyca/cryptography/issues/14220">#14220</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/e6f44fc8e6391f05d719fb9d369692325b87a471"><code>e6f44fc</code></a> bump for 46.0.4 and drop win arm64 due to CI issues (<a href="https://redirect.github.com/pyca/cryptography/issues/14217">#14217</a>)</li> <li>See full diff in <a href="https://github.com/pyca/cryptography/compare/46.0.3...46.0.5">compare view</a></li> </ul> </details> <br /> Updates `langchain-core` from 1.2.7 to 1.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-core's releases</a>.</em></p> <blockquote> <h2>langchain-core==1.2.11</h2> <p>Changes since langchain-core==1.2.10</p> <p>release(core): 1.2.11 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35144">#35144</a>) fix(openai): sanitize urls when counting tokens in images (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35143">#35143</a>) chore(core): clean up docstring mismatch and redundant logic in langchain-core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35064">#35064</a>) fix(core): replace bare except with Exception in tracer (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35138">#35138</a>)</p> <h2>langchain-core==1.2.10</h2> <p>Changes since langchain-core==1.2.9</p> <p>release(core): 1.2.10 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35136">#35136</a>) chore(deps): bump the langchain-deps group across 3 directories with 40 updates (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35129">#35129</a>) chore(deps): bump the langchain-deps group across 3 directories with 11 updates (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35121">#35121</a>) feat(core): add ContextOverflowError, raise in anthropic and openai (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35099">#35099</a>) feat(model-profiles): add <code>text_inputs</code> and <code>text_outputs</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35084">#35084</a>) feat(core): count tokens from tool schemas in <code>count_tokens_approximately</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35098">#35098</a>) docs(core): add missing <code>name</code> docstring for <code>RunnableSerializable</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35088">#35088</a>)</p> <h2>langchain-core==1.2.9</h2> <p>Changes since langchain-core==1.2.8</p> <p>release(core): 1.2.9 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35025">#35025</a>) fix(core): adjust cap when scaling approximate token counts (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35017">#35017</a>) revert: precompile hex color regex pattern at module level (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35016">#35016</a>) chore: add <code>make type</code> target (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35015">#35015</a>) revert: "chore: add typing target in <code>Makefile</code>" (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35013">#35013</a>) chore: add typing target in <code>Makefile</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35012">#35012</a>) fix(core): apply cap when scaling approximate token counts (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35005">#35005</a>) feat(core): allow scaling by reported usage when counting tokens approximately (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34996">#34996</a>) test(core): increase <code>delta_time</code> for flaky test (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34982">#34982</a>) chore: enrich <code>pyproject.toml</code> files (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34980">#34980</a>)</p> <h2>langchain-core==1.2.8</h2> <p>Changes since langchain-core==1.2.7</p> <p>release(core): 1.2.8 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34975">#34975</a>) docs(core): add examples for <code>pretty_repr</code>, <code>pretty_print</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34968">#34968</a>) docs(core): use proper admonition for <code>get_buffer_string</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34967">#34967</a>) docs: add usage examples to core classes (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34841">#34841</a>) chore(core): fix docstring format (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34966">#34966</a>) chore(deps): bump the uv group across 20 directories with 3 updates (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34941">#34941</a>) docs: add example to create_message function docstring (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34851">#34851</a>) docs(core): clarify <a href="https://github.com/tool"><code>@tool</code></a> decorator argument and return type requirements (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34860">#34860</a>) fix(core): fix nested mustache variable extraction and update docs (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34872">#34872</a>) fix(core): allow base model annotations for empty model (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34932">#34932</a>) chore: upgrade urllib3 to 2.6.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34940">#34940</a>) fix(core): prevent crash in ParrotFakeChatModel when messages list is empty (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34943">#34943</a>) fix(core): google docstring parsing with no arguments/reserved arguments (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34861">#34861</a>) test(core): add tests for approximate token counting with multimodal messages (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34898">#34898</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/524e1dab5e7c8229bd78be3c13ab38ac93a6216b"><code>524e1da</code></a> release(core): 1.2.11 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35144">#35144</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/2b4b1dc29a833d4053deba4c2b77a3848c834565"><code>2b4b1dc</code></a> fix(openai): sanitize urls when counting tokens in images (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35143">#35143</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/0493b276e0be31d4f48d9d0ba5fcbce7fdded38f"><code>0493b27</code></a> fix(anthropic): support effort="max" and remove beta headers (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35141">#35141</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/a5f22e7cb18a05ed057028797a7d0d79cd509b0d"><code>a5f22e7</code></a> chore(core): clean up docstring mismatch and redundant logic in langchain-cor...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/97ee14c179f703473a6ec6ee24179ea756a5698f"><code>97ee14c</code></a> fix(core): replace bare except with Exception in tracer (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35138">#35138</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/990e8076e1d61a0c8ced4d83607685bd71e23687"><code>990e807</code></a> release(standard-tests): release 1.1.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35139">#35139</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/74dffca3d89effdb62da567d1ff6d160c9ad5354"><code>74dffca</code></a> release(langchain): 1.2.10 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35137">#35137</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/f41e0493336698e9a3e25e6e238786dfc8af91ba"><code>f41e049</code></a> release(core): 1.2.10 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35136">#35136</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/de05838fca46eb6c2f67064da3a59f5e84818e9a"><code>de05838</code></a> chore(deps): bump the langchain-deps group across 3 directories with 40 updat...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/d6e86aa748ae173857732ee1f7114a06ff8f4231"><code>d6e86aa</code></a> chore(deps): bump the other-deps group across 3 directories with 12 updates (...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.2.7...langchain-core==1.2.11">compare view</a></li> </ul> </details> <br /> Updates `pillow` from 12.1.0 to 12.1.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>12.1.1</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html</a></p> <h2>Dependencies</h2> <ul> <li>Patch libavif for svt-av1 4.0 compatibility <a href="https://redirect.github.com/python-pillow/Pillow/issues/9413">#9413</a> [<a href="https://github.com/hugovk"><code>@hugovk</code></a>]</li> </ul> <h2>Other changes</h2> <ul> <li>Fix OOB Write with invalid tile extents <a href="https://redirect.github.com/python-pillow/Pillow/issues/9427">#9427</a> [<a href="https://github.com/radarhere"><code>@radarhere</code></a>]</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/5158d98c807e719c5938aa3886913ef0ea6814e9"><code>5158d98</code></a> 12.1.1 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa"><code>9000313</code></a> Fix OOB Write with invalid tile extents (<a href="https://redirect.github.com/python-pillow/Pillow/issues/9427">#9427</a>)</li> <li><a href="https://github.com/python-pillow/Pillow/commit/cd0111849fb32c40860e3ee3d57b9b1cee4260cf"><code>cd01118</code></a> Patch libavif for svt-av1 4.0 compatibility</li> <li>See full diff in <a href="https://github.com/python-pillow/Pillow/compare/12.1.0...12.1.1">compare view</a></li> </ul> </details> <br /> Updates `protobuf` from 6.33.4 to 6.33.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/protocolbuffers/protobuf/releases">protobuf's releases</a>.</em></p> <blockquote> <h2>Protocol Buffers v34.0-rc1</h2> <h1>Announcements</h1> <ul> <li><strong>This version includes breaking changes to: C++, Objective-C, PHP, Python.</strong></li> <li>[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (<a href="https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb">https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb</a>)</li> <li>[C++] Make generator headers private (<a href="https://github.com/protocolbuffers/protobuf/commit/3a2af3510f0d454dbe3e4dc281674b61c4d20b9e">https://github.com/protocolbuffers/protobuf/commit/3a2af3510f0d454dbe3e4dc281674b61c4d20b9e</a>)</li> <li>[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (<a href="https://github.com/protocolbuffers/protobuf/commit/7a7589823d2cfaaf7994b050e98d5d553bc9b1c1">https://github.com/protocolbuffers/protobuf/commit/7a7589823d2cfaaf7994b050e98d5d553bc9b1c1</a>)</li> <li>[C++] Add [[nodiscard]] to many APIs. (<a href="https://github.com/protocolbuffers/protobuf/commit/a70115f33f9af2c4b2202c800b84837e7fe0d738">https://github.com/protocolbuffers/protobuf/commit/a70115f33f9af2c4b2202c800b84837e7fe0d738</a>)</li> <li>[C++] Make the arena-enabled constructors of <code>RepeatedField</code>, <code>RepeatedPtrField</code>, and <code>Map</code> private. (<a href="https://github.com/protocolbuffers/protobuf/commit/ef890c3d0c79398c70e047fe5dd893f460ba2336">https://github.com/protocolbuffers/protobuf/commit/ef890c3d0c79398c70e047fe5dd893f460ba2336</a>)</li> <li>[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (<a href="https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292">https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292</a>)</li> <li>[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (<a href="https://github.com/protocolbuffers/protobuf/commit/b115358c64127896fed88b8b5ef5d91d86d8cbae">https://github.com/protocolbuffers/protobuf/commit/b115358c64127896fed88b8b5ef5d91d86d8cbae</a>)</li> <li>[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (<a href="https://github.com/protocolbuffers/protobuf/commit/68346ec9348e932664e58c3ecdcd1478f95233a8">https://github.com/protocolbuffers/protobuf/commit/68346ec9348e932664e58c3ecdcd1478f95233a8</a>)</li> <li>[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (<a href="https://github.com/protocolbuffers/protobuf/commit/837a2cd1d6c75402b2503ffe7cd8aeaf25868536">https://github.com/protocolbuffers/protobuf/commit/837a2cd1d6c75402b2503ffe7cd8aeaf25868536</a>)</li> <li>[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() && !is_repeated()) instead (<a href="https://github.com/protocolbuffers/protobuf/commit/9dbc5d479a8e453921485d8d3de47fb3c005f1af">https://github.com/protocolbuffers/protobuf/commit/9dbc5d479a8e453921485d8d3de47fb3c005f1af</a>)</li> <li>[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (<a href="https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00">https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00</a>)</li> <li>[C++] All entity names have length limit (2afb0dc)</li> <li>[ObjC] Remove <code>generate_minimal_imports</code> generation option warning (<a href="https://github.com/protocolbuffers/protobuf/commit/45b1297fdaad5a9436d0e207422168c38dc45ac4">https://github.com/protocolbuffers/protobuf/commit/45b1297fdaad5a9436d0e207422168c38dc45ac4</a>)</li> <li>[ObjC] Fix nullability annotations on some <code>GPB*Dictionary</code> types. (<a href="https://github.com/protocolbuffers/protobuf/commit/ea67d6d26a48478a567c404679e3bb99cf230d50">https://github.com/protocolbuffers/protobuf/commit/ea67d6d26a48478a567c404679e3bb99cf230d50</a>)</li> <li>[ObjC] Remove <code>-[GPBFieldDescriptor optional]</code> (<a href="https://github.com/protocolbuffers/protobuf/commit/3414dc151eb4dcbdb2ca952e2589993bf7af75c4">https://github.com/protocolbuffers/protobuf/commit/3414dc151eb4dcbdb2ca952e2589993bf7af75c4</a>)</li> <li>[Other] Remove deprecated flag for enabling MSVC support (<a href="https://github.com/protocolbuffers/protobuf/commit/97c979be6e0907e1051bee62584dac4594e73fa7">https://github.com/protocolbuffers/protobuf/commit/97c979be6e0907e1051bee62584dac4594e73fa7</a>)</li> <li>[PHP] Remove deprecated PHP APIs (<a href="https://github.com/protocolbuffers/protobuf/commit/9c45014099a4f7004fab6dd1278de2f4f2a393c5">https://github.com/protocolbuffers/protobuf/commit/9c45014099a4f7004fab6dd1278de2f4f2a393c5</a>)</li> <li>[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (<a href="https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345">https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345</a>, <a href="https://github.com/protocolbuffers/protobuf/commit/cd76e675b14d00dda5623b30835d2bc7105fccc6">https://github.com/protocolbuffers/protobuf/commit/cd76e675b14d00dda5623b30835d2bc7105fccc6</a>, <a href="https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345">https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345</a>)</li> <li>[PHP] Add PHP typehints for setters and remove redundant GPBUtil checks (<a href="https://redirect.github.com/protocolbuffers/protobuf/pull/25296">protocolbuffers/protobuf#25296</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/aee03b78929c02461a5f9d8e136a2a016359b0cd">https://github.com/protocolbuffers/protobuf/commit/aee03b78929c02461a5f9d8e136a2a016359b0cd</a>)</li> <li>[PHP] support default values for editions/proto2 (<a href="https://redirect.github.com/protocolbuffers/protobuf/pull/25161">protocolbuffers/protobuf#25161</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/b01099d56350551bae3da88b97bf3027274c9f17">https://github.com/protocolbuffers/protobuf/commit/b01099d56350551bae3da88b97bf3027274c9f17</a>)</li> <li>[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (<a href="https://github.com/protocolbuffers/protobuf/commit/5b116fe2f14f49dd0cc3b76089983717f211025c">https://github.com/protocolbuffers/protobuf/commit/5b116fe2f14f49dd0cc3b76089983717f211025c</a>)</li> <li>[Python] Remove float_format/double_format from python proto text_format (<a href="https://github.com/protocolbuffers/protobuf/commit/e4854a186e0bfa867d5bfa5cd850608a948fd488">https://github.com/protocolbuffers/protobuf/commit/e4854a186e0bfa867d5bfa5cd850608a948fd488</a>)</li> <li>[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (<a href="https://github.com/protocolbuffers/protobuf/commit/00aaca1b4d98954bc2933d7c8a5379ba6088124c">https://github.com/protocolbuffers/protobuf/commit/00aaca1b4d98954bc2933d7c8a5379ba6088124c</a>)</li> <li>[Python] Remove float_precision from python proto json_format (<a href="https://github.com/protocolbuffers/protobuf/commit/f027f1fcd52b9d080b7ee79f4024f53cf54e0dc5">https://github.com/protocolbuffers/protobuf/commit/f027f1fcd52b9d080b7ee79f4024f53cf54e0dc5</a>)</li> <li>[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (<a href="https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292">https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292</a>)</li> <li>[Python] Remove deprecated FieldDescriptor.label (<a href="https://github.com/protocolbuffers/protobuf/commit/0a8ff55518ea5874478ad5b26515b31d186045a9">https://github.com/protocolbuffers/protobuf/commit/0a8ff55518ea5874478ad5b26515b31d186045a9</a>)</li> <li>[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (<a href="https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00">https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00</a>)</li> <li><a href="https://protobuf.dev/news/">Protobuf News</a> may include additional announcements or pre-announcements for upcoming changes.</li> <li><a href="https://protobuf.dev/support/migration/">Migration Guide</a> may include additional guidance for breaking changes.</li> </ul> <h1>Bazel</h1> <ul> <li>Fix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/25168">#25168</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/8c857c3a1c6a106b0a096f1c9fa504bfaca035a9">https://github.com/protocolbuffers/protobuf/commit/8c857c3a1c6a106b0a096f1c9fa504bfaca035a9</a>)</li> <li>Breaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (<a href="https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb">https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb</a>)</li> <li>Feat(bazel): wire up prebuilt protoc toolchain (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/24115">#24115</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/cc23698b486e690ea2eb873cc7596a87c74a3ba6">https://github.com/protocolbuffers/protobuf/commit/cc23698b486e690ea2eb873cc7596a87c74a3ba6</a>)</li> <li>Migrate <code>proto_descriptor_set</code> (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/23369">#23369</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/8d4dfdd39a7a242a9ed631a6ab2192c57dd9b9c8">https://github.com/protocolbuffers/protobuf/commit/8d4dfdd39a7a242a9ed631a6ab2192c57dd9b9c8</a>)</li> </ul> <h1>Compiler</h1> <ul> <li>Ruby codegen: support generation of rbs files (<a href="https://redirect.github.com/protocolbuffers/protobuf/issues/15633">#15633</a>) (<a href="https://github.com/protocolbuffers/protobuf/commit/6ebdf851ba78728f0aa145d38454ed9a316fb08d">https://github.com/protocolbuffers/protobuf/commit/6ebdf851ba78728f0aa145d38454ed9a316fb08d</a>)</li> <li>Avoid collision name problems between a message named <code>Xyz</code> and a direct sibling enum named <code>XyzView</code> (<a href="https://github.com/protocolbuffers/protobuf/commit/eba53e8f172b273d679759a72ce4250131ee3df1">https://github.com/protocolbuffers/protobuf/commit/eba53e8f172b273d679759a72ce4250131ee3df1</a>)</li> <li>Generalizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (<a href="https://github.com/protocolbuffers/protobuf/commit/ed3c57114d8e2b47cca7697ddaa50c1b3762a6b0">https://github.com/protocolbuffers/protobuf/commit/ed3c57114d8e2b47cca7697ddaa50c1b3762a6b0</a>)</li> <li>Fix a bug with custom features outside of the <code>pb</code> package. (<a href="https://github.com/protocolbuffers/protobuf/commit/872d3ce7a4da00d7dcec33ced20cfe45235935e8">https://github.com/protocolbuffers/protobuf/commit/872d3ce7a4da00d7dcec33ced20cfe45235935e8</a>)</li> <li>Fix import option handling when include_imports isn't set. (<a href="https://github.com/protocolbuffers/protobuf/commit/9ef9e80afd9bc8379d578fe67e5ab0738728c04e">https://github.com/protocolbuffers/protobuf/commit/9ef9e80afd9bc8379d578fe67e5ab0738728c04e</a>)</li> <li>Fix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (<a href="https://github.com/protocolbuffers/protobuf/commit/1229d4adba24c0952ab85ce96bc7b7f8a1fe6d0f">https://github.com/protocolbuffers/protobuf/commit/1229d4adba24c0952ab85ce96bc7b7f8a1fe6d0f</a>)</li> <li>Prevent accidental stripping of <code>debug_redact</code> options via import option. (<a href="https://github.com/protocolbuffers/protobuf/commit/f58b098bffa7ca4045ef7773b09151a6af5d0c28">https://github.com/protocolbuffers/protobuf/commit/f58b098bffa7ca4045ef7773b09151a6af5d0c28</a>)</li> </ul> <h1>C++</h1> <ul> <li>Add EnumerateEnumValues function. (<a href="https://github.com/protocolbuffers/protobuf/commit/397d5d99db274b379d1384814074bf7df39d32f7">https://github.com/protocolbuffers/protobuf/commit/397d5d99db274b379d1384814074bf7df39d32f7</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/protocolbuffers/protobuf/commits">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/react-agent/network/alerts). </details>
Bumps the uv group with 2 updates in the / directory: [langgraph](https://github.com/langchain-ai/langgraph) and [orjson](https://github.com/ijl/orjson). Updates `langgraph` from 1.0.6 to 1.0.10rc1 - [Release notes](https://github.com/langchain-ai/langgraph/releases) - [Commits](langchain-ai/langgraph@1.0.6...1.0.10rc1) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) --- updated-dependencies: - dependency-name: langgraph dependency-version: 1.0.10rc1 dependency-type: direct:production dependency-group: uv - dependency-name: orjson dependency-version: 3.11.6 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the uv group with 2 updates in the / directory: [langgraph](https://github.com/langchain-ai/langgraph) and [orjson](https://github.com/ijl/orjson). Updates `langgraph` from 1.0.6 to 1.0.10rc1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langgraph/releases">langgraph's releases</a>.</em></p> <blockquote> <h2>langgraph==1.0.10rc1</h2> <p>Changes since 1.0.9</p> <ul> <li>release: Candidate (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6947">#6947</a>)</li> <li>Merge commit from fork</li> <li>chore: add tests to confirm expected subgraph persistence behavior (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6943">#6943</a>)</li> <li>fix(langgraph): correct ParentCommand bubbling when checkpoint_ns includes numeric task segments (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6864">#6864</a>)</li> <li>chore: add <code>make type</code> target for type checking (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6748">#6748</a>)</li> </ul> <h2>langgraph==1.0.9</h2> <p>Changes since 1.0.8</p> <ul> <li>release: langgraph + prebuilt (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6875">#6875</a>)</li> <li>fix: sequential interrupt handling w/ functional API (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6863">#6863</a>)</li> <li>chore: state_updated_at sort by (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6857">#6857</a>)</li> <li>chore: bump orjson (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6852">#6852</a>)</li> <li>chore: conformance testing (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6842">#6842</a>)</li> <li>chore(deps): bump the all-dependencies group in /libs/langgraph with 6 updates (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6815">#6815</a>)</li> <li>chore(deps): bump protobuf from 6.33.4 to 6.33.5 in /libs/langgraph (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6833">#6833</a>)</li> <li>chore(deps): bump cryptography from 46.0.3 to 46.0.5 in /libs/langgraph (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6837">#6837</a>)</li> <li>chore(deps): bump nbconvert from 7.16.6 to 7.17.0 in /libs/langgraph (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6832">#6832</a>)</li> <li>chore: server runtime type (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6774">#6774</a>)</li> <li>refactor: replace bare except with BaseException in AsyncQueue (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6765">#6765</a>)</li> </ul> <h2>langgraph==1.0.8</h2> <p>Changes since 1.0.7</p> <ul> <li>release(langgraph): 1.0.8 (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6757">#6757</a>)</li> <li>chore: shallow copy futures (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6755">#6755</a>)</li> <li>fix: pydantic messages double streaming (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6753">#6753</a>)</li> <li>chore(deps-dev): bump ruff from 0.14.7 to 0.14.11 in /libs/sdk-py (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6673">#6673</a>)</li> <li>chore: Omit lock when using connection pool (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6734">#6734</a>)</li> <li>docs: enhance <code>Runtime</code> and <code>ToolRuntime</code> class descriptions for clarity (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6689">#6689</a>)</li> <li>docs: add clarity to use of <code>thread_id</code> (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6515">#6515</a>)</li> <li>docs: add docstrings to <code>add_node</code> overloads (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6514">#6514</a>)</li> <li>docs: update notebook links and add archival notices for examples (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6720">#6720</a>)</li> <li>release(cli): 0.4.12 (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6716">#6716</a>)</li> </ul> <h2>langgraph-prebuilt==1.0.8</h2> <p>Changes since prebuilt==1.0.7</p> <ul> <li>release: langgraph + prebuilt (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6875">#6875</a>)</li> <li>fix: inject ToolRuntime for dynamically registered tools (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6874">#6874</a>)</li> <li>chore: bump orjson (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6852">#6852</a>)</li> <li>chore(deps): bump langchain-core from 1.2.12 to 1.2.13 in /libs/prebuilt in the all-dependencies group (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6849">#6849</a>)</li> <li>chore: conformance testing (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6842">#6842</a>)</li> <li>chore(deps): bump the all-dependencies group in /libs/prebuilt with 3 updates (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6810">#6810</a>)</li> <li>chore: server runtime type (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6774">#6774</a>)</li> <li>docs(prebuilt): update warning for <code>create_react_agent</code> (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6760">#6760</a>)</li> <li>release(langgraph): 1.0.8 (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6757">#6757</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langgraph/commit/a04ec5d6f00fa6583b2d98dfe789da741204b767"><code>a04ec5d</code></a> release: Candidate (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6947">#6947</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/50df7d423abebcb5a192f0a59c2952c68cb0df8c"><code>50df7d4</code></a> Merge commit from fork</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/c4a4a4647343d802d0ab909439806076bae15bd6"><code>c4a4a46</code></a> chore: add tests to confirm expected subgraph persistence behavior (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6943">#6943</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/f178eb821e52906e1705c9cc02533bb88854b409"><code>f178eb8</code></a> fix(langgraph): correct ParentCommand bubbling when checkpoint_ns includes nu...</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/48167d7fec9c25228426c92ba83d8650b77de0f3"><code>48167d7</code></a> chore(deps): bump the all-dependencies group in /libs/cli with 2 updates (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6920">#6920</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/806878a421458e99f9882e666ff35a41ad1bb561"><code>806878a</code></a> chore(deps): bump the all-dependencies group in /libs/checkpoint-postgres wit...</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/8087e6a42c62c2049a5fb3f99372a8c601d07e08"><code>8087e6a</code></a> docs(sdk-py): update auth docstrings to default-deny pattern (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6933">#6933</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/8fbdb144876ec9ca75943c7addb452a2bb634304"><code>8fbdb14</code></a> release(sdk-py): 0.3.9 (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6932">#6932</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/5093802f319119be674c02269f9874df04558419"><code>5093802</code></a> chore(deps): bump the all-dependencies group in /libs/checkpoint with 2 updat...</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/b89ef60b91e019c3cb4422af1e3cc216804ccb20"><code>b89ef60</code></a> feat(sdk-py): add extract parameter to threads.search() (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/6880">#6880</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langgraph/compare/1.0.6...1.0.10rc1">compare view</a></li> </ul> </details> <br /> Updates `orjson` from 3.11.5 to 3.11.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ijl/orjson/releases">orjson's releases</a>.</em></p> <blockquote> <h2>3.11.6</h2> <h3>Changed</h3> <ul> <li>orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).</li> <li>Drop support for Python 3.9.</li> <li>ABI compatibility with CPython 3.15 alpha 5.</li> <li>Build now depends on Rust 1.89 or later instead of 1.85.</li> </ul> <h3>Fixed</h3> <ul> <li>Fix sporadic crash serializing deeply nested <code>list</code> of <code>dict</code>.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ijl/orjson/blob/master/CHANGELOG.md">orjson's changelog</a>.</em></p> <blockquote> <h2>3.11.6 - 2026-01-29</h2> <h3>Changed</h3> <ul> <li>orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).</li> <li>Drop support for Python 3.9.</li> <li>ABI compatibility with CPython 3.15 alpha 5.</li> <li>Build now depends on Rust 1.89 or later instead of 1.85.</li> </ul> <h3>Fixed</h3> <ul> <li>Fix sporadic crash serializing deeply nested <code>list</code> of <code>dict</code>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ijl/orjson/commit/ec02024c3837255064f248c0d2d331319b75e9ad"><code>ec02024</code></a> 3.11.6</li> <li><a href="https://github.com/ijl/orjson/commit/d58168733189f82b3fd0c058dff73e05d09202e6"><code>d581687</code></a> build, clippy misc</li> <li><a href="https://github.com/ijl/orjson/commit/4105b29b2275f200f6fae01349bef02ccf1bc2e2"><code>4105b29</code></a> writer::num</li> <li><a href="https://github.com/ijl/orjson/commit/62bb185b70785ded49c79c26f8c9781f1e6fe370"><code>62bb185</code></a> Fix sporadic crash on serializing object close</li> <li><a href="https://github.com/ijl/orjson/commit/d860078a973f44401265c5c4ad12a7dbe4f839ad"><code>d860078</code></a> PyRef idiom refactors</li> <li><a href="https://github.com/ijl/orjson/commit/343ae2f148197918aba9f8562db42c364620e4b8"><code>343ae2f</code></a> Deserializer, Utf8Buffer</li> <li><a href="https://github.com/ijl/orjson/commit/7835f58d1c56947d1cf7a18acdfc07a2bca9b0f2"><code>7835f58</code></a> PyBytesRef and other input refactor</li> <li><a href="https://github.com/ijl/orjson/commit/71e0516424ce1e11613eb1780f18e8cde83989fd"><code>71e0516</code></a> PyStrRef</li> <li><a href="https://github.com/ijl/orjson/commit/1096df42dc585fde837ed0c930a346f5ef7dbb94"><code>1096df4</code></a> MSRV 1.89</li> <li><a href="https://github.com/ijl/orjson/commit/b718e75b8ba18a707c2b44b6de14d52547573771"><code>b718e75</code></a> Drop support for python3.9</li> <li>Additional commits viewable in <a href="https://github.com/ijl/orjson/compare/3.11.5...3.11.6">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/react-agent/network/alerts). </details>
Bumps the uv group with 1 update in the / directory: [requests](https://github.com/psf/requests). Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) --- updated-dependencies: - dependency-name: requests dependency-version: 2.33.0 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>
#37) Bumps the uv group with 1 update in the / directory: [requests](https://github.com/psf/requests). Updates `requests` from 2.32.5 to 2.33.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>.</em></p> <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> <p><strong>Announcements</strong></p> <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> <p><strong>Security</strong></p> <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> <p><strong>Improvements</strong></p> <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> <p><strong>Bugfixes</strong></p> <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> <p><strong>Deprecations</strong></p> <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> <p><strong>Documentation</strong></p> <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>.</em></p> <blockquote> <h2>2.33.0 (2026-03-25)</h2> <p><strong>Announcements</strong></p> <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> <p><strong>Security</strong></p> <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> <p><strong>Improvements</strong></p> <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> <p><strong>Bugfixes</strong></p> <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> <p><strong>Deprecations</strong></p> <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> <p><strong>Documentation</strong></p> <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/react-agent/network/alerts). </details>
- Add top-level `permissions: contents: read` to integration-tests.yml and unit-tests.yml - SHA-pin codespell-project/actions-codespell@v2 → 406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary - Add top-level `permissions: contents: read` to `integration-tests.yml` and `unit-tests.yml` (Rule 1 compliance) - SHA-pin `codespell-project/actions-codespell@v2` → `406322ec52dd7b488e48c1c4b82e2a8b3a1bf630` in both usages in `unit-tests.yml` (Rule 6 compliance) ## Test plan - [ ] CI passes on this branch - [x] Code scanning alerts for missing permissions are resolved after merge
Bumps the uv group with 1 update in the / directory: [langchain-core](https://github.com/langchain-ai/langchain). Updates `langchain-core` from 1.2.11 to 1.2.22 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](langchain-ai/langchain@langchain-core==1.2.11...langchain-core==1.2.22) --- updated-dependencies: - dependency-name: langchain-core dependency-version: 1.2.22 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>
…rectory (#39) Bumps the uv group with 1 update in the / directory: [langchain-core](https://github.com/langchain-ai/langchain). Updates `langchain-core` from 1.2.11 to 1.2.22 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-core's releases</a>.</em></p> <blockquote> <h2>langchain-core==1.2.22</h2> <p>Changes since langchain-core==1.2.21</p> <p>release(core): 1.2.22 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36201">#36201</a>) fix(core): validate paths in <code>prompt.save</code> and <code>load_prompt</code>, deprecate methods (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36200">#36200</a>)</p> <h2>langchain-core==1.2.21</h2> <p>Changes since langchain-core==1.2.20</p> <p>release(core): 1.2.21 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36179">#36179</a>) fix(core,model-profiles): add missing <code>ModelProfile</code> fields, warn on schema drift (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36129">#36129</a>) chore(core): remove stale blockbuster allowlist for deleted context module (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36168">#36168</a>) ci: suppress pytest streaming output in CI (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36092">#36092</a>)</p> <h2>langchain-core==1.2.20</h2> <p>Changes since langchain-core==1.2.19</p> <p>release(core): 1.2.20 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36085">#36085</a>) fix(core): trace invocation params in metadata (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36080">#36080</a>) feat: Add LangSmith integration metadata to create_agent and init_chat_model (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35810">#35810</a>) feat(core): harden anti-ssrf (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35960">#35960</a>) ci: avoid unnecessary dep installs in lint targets (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36046">#36046</a>) docs(core): document <code>base_url</code> in mermaid api (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35961">#35961</a>) chore: bump orjson from 3.11.5 to 3.11.6 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35805">#35805</a>) chore: housekeeping (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35850">#35850</a>)</p> <h2>langchain-core==1.2.19</h2> <p>Changes since langchain-core==1.2.18</p> <p>release(core): 1.2.19 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35832">#35832</a>) chore(core): move BaseCrossEncoder to langchain-core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35809">#35809</a>) chore: bump tornado from 6.5.2 to 6.5.5 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35775">#35775</a>)</p> <h2>langchain-core==1.2.18</h2> <p>Changes since langchain-core==1.2.17</p> <p>release(core): 1.2.18 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35704">#35704</a>) fix(core): fix double backticks in deprecation docstring for alternative_import (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35658">#35658</a>) fix(core): preserve default_factory when generating tool call schema (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35550">#35550</a>) feat(openai): support tool search (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35582">#35582</a>) chore: bump the minor-and-patch group across 3 directories with 7 updates (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35605">#35605</a>)</p> <h2>langchain-core==1.2.17</h2> <p>Changes since langchain-core==1.2.16</p> <p>release(core): 1.2.17 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35527">#35527</a>) fix(core): extract usage metadata from serialized tracer message outputs (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35526">#35526</a>) chore: bump the langchain-deps group across 3 directories with 7 updates (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35513">#35513</a>) chore: bump the langchain-deps group across 3 directories with 14 updates (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35441">#35441</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/d22df94537e4267f72dc1bbfc8e3849baf20d9f7"><code>d22df94</code></a> release(core): 1.2.22 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36201">#36201</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c"><code>27add91</code></a> fix(core): validate paths in <code>prompt.save</code> and <code>load_prompt</code>, deprecate metho...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/7563fceb40ce31165524f3f57ec65e487c02b1a7"><code>7563fce</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36195">#36195</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/3e64c255b84b283b3a65216b19b9838734258c96"><code>3e64c25</code></a> chore: use repo permissions instead of org membership for maintainer override...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/1778b082ecd64a9dedd48674d874ca1bfcbe4c7d"><code>1778b08</code></a> chore(partners): bump <code>langchain-core</code> min to <code>1.2.21</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36183">#36183</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/ad574fce0d52740c249b0db7bde871d779ffb93d"><code>ad574fc</code></a> fix(openai): bump min core version (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36180">#36180</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/19f81cf6f1d73f7adf156491ba0617497a526b8c"><code>19f81cf</code></a> release(core): 1.2.21 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36179">#36179</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/6d07ef28a7023dc7b832fe52862f7a6fc0a187f3"><code>6d07ef2</code></a> release(openai): 1.1.12 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36178">#36178</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/2f64d80cc65091985873c339ca76a59af7baf739"><code>2f64d80</code></a> fix(core,model-profiles): add missing <code>ModelProfile</code> fields, warn on schema d...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/5ffece5c033365baf4a3df52ffed5c6bfbed27ee"><code>5ffece5</code></a> chore(core): remove stale blockbuster allowlist for deleted context module (#...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.2.11...langchain-core==1.2.22">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/react-agent/network/alerts). </details>
Bumps the uv group with 1 update in the / directory: [cryptography](https://github.com/pyca/cryptography). Updates `cryptography` from 46.0.5 to 46.0.6 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.5...46.0.6) --- updated-dependencies: - dependency-name: cryptography dependency-version: 46.0.6 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>
…ctory (#41) Bumps the uv group with 1 update in the / directory: [cryptography](https://github.com/pyca/cryptography). Updates `cryptography` from 46.0.5 to 46.0.6 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p> <blockquote> <p>46.0.6 - 2026-03-25</p> <pre><code> * **SECURITY ISSUE**: Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug, including those used by the Web PKI. Credit to **Oleh Konko (1seal)** for reporting the issue. **CVE-2026-34073** <p>.. _v46-0-5:<br /> </code></pre></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/91d728897bdad30cd5c79a2b23e207f1f050d587"><code>91d7288</code></a> Cherry-pick <a href="https://redirect.github.com/pyca/cryptography/issues/14542">#14542</a> (<a href="https://redirect.github.com/pyca/cryptography/issues/14543">#14543</a>)</li> <li>See full diff in <a href="https://github.com/pyca/cryptography/compare/46.0.5...46.0.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/react-agent/network/alerts). </details>
pyjwt < 2.12.0 accepts unknown `crit` header extensions. Transitive via langgraph-api -> pyjwt (dev-only path). Strategy: constraint-dependencies (C). Remove once langgraph-api requires pyjwt>=2.12.0 upstream.
## Security Alert Patch Resolves 1 Dependabot security alert in the high severity tier. ### Packages Updated | Package | Old Constraint | New Constraint | Strategy | Scope | CVEs Resolved | |---------|---------------|----------------|----------|-------|---------------| | PyJWT | (unconstrained, resolved 2.10.1) | `>=2.12.0` (resolved 2.12.1) | C — constraint | dev-only | CVE-2026-32597 | Strategy C = `[tool.uv.constraint-dependencies]` override — valid because PyJWT is dev-only (transitive via `langgraph-cli[inmem]` → `langgraph-api` → `pyjwt`). ### CVE Details - **[CVE-2026-32597](https://nvd.nist.gov/vuln/detail/CVE-2026-32597)** / [GHSA-752w-5fwx-jx9f](GHSA-752w-5fwx-jx9f): PyJWT accepts unknown `crit` header extensions — versions < 2.12.0 are vulnerable. ### Removal Condition The `constraint-dependencies` entry can be removed once `langgraph-api` releases a version that requires `pyjwt>=2.12.0` upstream. ### Linear Tickets No matching Linear tickets found for the resolved CVEs. ### Verification - [x] Lockfile updated — resolved version is now 2.12.1 - [x] Linters pass (`ruff check`) - [ ] Tests pass (CI) 🤖 Submitted by langster-patch
--- updated-dependencies: - dependency-name: aiohttp dependency-version: 3.13.4 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>
…s 1 directory (#43) [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/react-agent/network/alerts). </details>
…s 1 directory (#55) Bumps the uv group with 1 update in the / directory: [aiohttp](https://github.com/aio-libs/aiohttp). Updates `aiohttp` from 3.14.1 to 3.14.3 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst">aiohttp's changelog</a>.</em></p> <blockquote> <h1>3.14.3 (2026-07-22)</h1> <h2>Bug fixes</h2> <ul> <li> <p>Fixed the client dropping only the first <code>Authorization</code>, <code>Cookie</code> and <code>Proxy-Authorization</code> header when a redirect crossed an origin -- by :user:<code>arshsmith1</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>13180</code>.</p> </li> <li> <p>Fixed error message construction in the C HTTP parser -- by :user:<code>bdraco</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>13222</code>.</p> </li> </ul> <hr /> <h1>3.14.2 (2026-07-20)</h1> <h2>Bug fixes</h2> <ul> <li> <p>Fixed :py:attr:<code>~aiohttp.web.StreamResponse.last_modified</code> rounding a :class:<code>datetime.datetime</code> with a fractional second down.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>5303</code>.</p> </li> <li> <p>Fixed resolving <code>localhost</code> on Windows to fall back without <code>AI_ADDRCONFIG</code> when the first lookup fails, so <code>localhost</code> still works without an active network.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>5357</code>.</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aio-libs/aiohttp/commit/5e392ce0456f5235a4ee6ad46f0e806df2f15873"><code>5e392ce</code></a> Release v3.14.3 (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/13225">#13225</a>)</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d"><code>49f65d5</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13222">#13222</a>/f4866933 backport][3.14] Build C parser error message from bounded...</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/240099e5216a01b32919dcd8dd5c6c0b1bf83671"><code>240099e</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13180">#13180</a>/ee53d655 backport][3.14] drop every copy of credential headers on ...</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/d93f30a302f8b930074fe14a2be7b2088ba28111"><code>d93f30a</code></a> Bump version (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/13202">#13202</a>)</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/c1b9212ad3d93c24b5fc66ad0849597166bc816e"><code>c1b9212</code></a> Release v3.14.2 (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/13201">#13201</a>)</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/380d4b55e8df48dfd62f1addfb530426f6bc4106"><code>380d4b5</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13054">#13054</a>/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/e1e1bee363dfba04a9a75c8801717da2ed5bdcb9"><code>e1e1bee</code></a> Make llhttp method array size dynamic (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/13174">#13174</a>) (<a href="https://redirect.github.com/aio-libs/aiohttp/issues/13196">#13196</a>)</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/aa4cf29b6a5ad6f4d21fa1dd3f69193dc2f5d505"><code>aa4cf29</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13170">#13170</a>/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/71b57b40d85a0723c92b0a5a37ebdf518210d2ea"><code>71b57b4</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13172">#13172</a>/a57747ed backport][3.14] Fix C parser folding fragment into query_...</li> <li><a href="https://github.com/aio-libs/aiohttp/commit/64a03fb620b623e5a5a1b7103c07ae3e536a0d40"><code>64a03fb</code></a> [PR <a href="https://redirect.github.com/aio-libs/aiohttp/issues/13169">#13169</a>/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...</li> <li>Additional commits viewable in <a href="https://github.com/aio-libs/aiohttp/compare/v3.14.1...v3.14.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/react-agent/network/alerts). </details>
Bumps the uv group with 1 update in the / directory: [cryptography](https://github.com/pyca/cryptography). Updates `cryptography` from 48.0.1 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@48.0.1...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>
…across 1 directory (#56) Bumps the uv group with 1 update in the / directory: [cryptography](https://github.com/pyca/cryptography). Updates `cryptography` from 48.0.1 to 50.0.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p> <blockquote> <p>50.0.0 - 2026-07-31</p> <pre><code> * **SECURITY ISSUE**: :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der` and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in :rfc:`3218`. Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247** * Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm. * Added ``xof()`` class methods to :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing algorithm instances configured for use with :class:`~cryptography.hazmat.primitives.hashes.XOFHash`. * The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now considered stable and are subject to our API stability policy. * Added the :doc:`/cobblestone` recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP chunked-encryption specification <https://c2sp.org/chunked-encryption>`_ for streaming authenticated encryption of large messages. * Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them. * Added support for using :class:`~cryptography.x509.Name` as a field type in the :doc:`/hazmat/asn1/index` module. * Loading a public key or an EC private key now rejects DER where the ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero number of unused bits, instead of silently ignoring it. * Parsing a CRL entry's ``InvalidityDate`` extension now rejects a ``GeneralizedTime`` that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field. * :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request or response whose ``version`` field is not ``v1``, the only version defined by RFC 6960, matching the version validation already performed when loading certificates, CSRs and CRLs. * :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported when building against AWS-LC. * HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC. * Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported when building against AWS-LC. </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/dcb7050b807b00392fa9fe2eac7cb362fcf355cc"><code>dcb7050</code></a> Prepare for 50.0.0 release (<a href="https://redirect.github.com/pyca/cryptography/issues/15372">#15372</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f"><code>53fccd9</code></a> Don't leak how PKCS#7 encryptedKey decryption failed (<a href="https://redirect.github.com/pyca/cryptography/issues/15369">#15369</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/d472f978470fbefa521b86d98b2ecccbbb4d1dd8"><code>d472f97</code></a> Add <code>from __future__ import annotations</code> to all src/ Python files (<a href="https://redirect.github.com/pyca/cryptography/issues/15371">#15371</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/908773d53829fb1466c6db364b31321c3cd8eb9a"><code>908773d</code></a> Bump downstream dependencies in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/15368">#15368</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/2cc07cc948948211899bcb0cddd1fddf86e95812"><code>2cc07cc</code></a> Bump BoringSSL, OpenSSL, AWS-LC in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/15367">#15367</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/c94ede9f040fa44942f7139772603419000acf66"><code>c94ede9</code></a> chore(deps): bump ruff from 0.16.0 to 0.16.1 (<a href="https://redirect.github.com/pyca/cryptography/issues/15366">#15366</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/67a8308dc9ea4cce6056e0f1438f903c208c3f35"><code>67a8308</code></a> chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (<a href="https://redirect.github.com/pyca/cryptography/issues/15365">#15365</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/95018ffcdbbc510fd92fc872e3a3e80aa6e58596"><code>95018ff</code></a> Release the GIL in one-shot AEAD encrypt/decrypt (<a href="https://redirect.github.com/pyca/cryptography/issues/15361">#15361</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/6954733eaf55a0074abf88f06f7242dfca3a5d02"><code>6954733</code></a> Release the GIL during DH and DSA parameter generation (<a href="https://redirect.github.com/pyca/cryptography/issues/15364">#15364</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/6893b94c33e948f6240082461424cfb5da2dacc6"><code>6893b94</code></a> Import _serialization instead of serialization in x509/extensions (<a href="https://redirect.github.com/pyca/cryptography/issues/15363">#15363</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/48.0.1...50.0.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/react-agent/network/alerts). </details>
Bumps the uv group with 1 update in the / directory: [h2](https://github.com/python-hyper/h2). Updates `h2` from 4.3.0 to 4.4.1 - [Changelog](https://github.com/python-hyper/h2/blob/master/CHANGELOG.rst) - [Commits](python-hyper/h2@v4.3.0...v4.4.1) --- updated-dependencies: - dependency-name: h2 dependency-version: 4.4.1 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>
…ectory (#57) Bumps the uv group with 1 update in the / directory: [h2](https://github.com/python-hyper/h2). Updates `h2` from 4.3.0 to 4.4.1 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python-hyper/h2/blob/master/CHANGELOG.rst">h2's changelog</a>.</em></p> <blockquote> <h2>4.4.1 (2026-08-03)</h2> <p><strong>Bugfixes</strong></p> <ul> <li>Performance improvement: remove consumed frames in-place from data buffer.</li> <li>Reject duplicate Host headers in request headers. Thanks to Sunand Mohan for the report.</li> </ul> <h2>4.4.0 (2026-07-23)</h2> <p><strong>API Changes (Backward Incompatible)</strong></p> <ul> <li>Support for Python 3.9 has been removed.</li> <li>Support for PyPy 3.9 has been removed.</li> <li><code>Stream.end_stream()</code> now raises <code>NoSuchStreamError</code> or <code>StreamClosedError</code> exceptions, instead of a generic <code>KeyError</code>.</li> <li>Duplicate <code>content-length</code> headers with different values now raise <code>ProtocolError</code>. Previously, the first <code>content-length</code> header was accepted and later conflicting values were ignored. Thanks to Harshal Parekh for the report.</li> <li>Parse <code>content-length</code> headers according to RFC9110 grammar for numbers (1*DIGIT). Thanks to Arkadiusz Marta for the report.</li> <li><strong>backfill from v4.3.0</strong> Convert emitted events into Python <code>dataclass</code>, which introduces new constructors with required arguments. Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.</li> </ul> <p><strong>API Changes (Backward Compatible)</strong></p> <ul> <li>Support for Python 3.14 has been added.</li> <li><code>H2Connection.receive_data</code> now accepts any byte-like object that implements the buffer protocol, such as <code>bytes</code>, <code>bytearray</code>, and <code>memoryview</code>. Existing <code>bytes</code> callers are unaffected.</li> <li>Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4. Ordinary CONNECT now requires <code>:method=CONNECT</code> and <code>:authority</code>, and forbids <code>:scheme</code>/<code>:path</code>. Extended CONNECT (e.g., WebSocket) requires <code>:scheme</code>, <code>:path</code>, <code>:authority</code> plus <code>:protocol</code>. (PR <a href="https://redirect.github.com/python-hyper/h2/issues/1309">#1309</a>)</li> <li>Fix incorrect substring matching of secure header in <code>cookie</code> and <code>:method</code>.</li> </ul> <p><strong>Bugfixes</strong></p> <ul> <li>Fix to allow sending 0 bytes on a stream even if the flow control window is negative.</li> <li>Reject non-zero <code>SETTINGS_ENABLE_PUSH</code> values received from servers.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-hyper/h2/commit/bc239af1d1b85bc70482804f30a0e0e587d90a08"><code>bc239af</code></a> v4.4.1</li> <li><a href="https://github.com/python-hyper/h2/commit/92b925ed1b1817c82db32893503f74f47fcf4452"><code>92b925e</code></a> add test for duplicate host headers</li> <li><a href="https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6"><code>292a408</code></a> reject duplicate Host headers in request headers</li> <li><a href="https://github.com/python-hyper/h2/commit/04d3b87cbc1db020d28c7cfb44fe194558efbdde"><code>04d3b87</code></a> update changelog</li> <li><a href="https://github.com/python-hyper/h2/commit/439b970d0fa19891fa81068907de97dfa3a07c3a"><code>439b970</code></a> prepare for next release cycle</li> <li><a href="https://github.com/python-hyper/h2/commit/9a7ff7430df669fa8e90b6121f3cc1ed64d1115a"><code>9a7ff74</code></a> performance: remove consumed frames in place from data buffer (<a href="https://redirect.github.com/python-hyper/h2/issues/1321">#1321</a>)</li> <li><a href="https://github.com/python-hyper/h2/commit/6cce763997eca5b826f3e435a611b7a7fc73f633"><code>6cce763</code></a> v4.4.0</li> <li><a href="https://github.com/python-hyper/h2/commit/dfafda3b0cd96455b45d1785ef1ebc6968bba5cf"><code>dfafda3</code></a> Bump pytest from 8.4.2 to 9.0.3 (<a href="https://redirect.github.com/python-hyper/h2/issues/1320">#1320</a>)</li> <li><a href="https://github.com/python-hyper/h2/commit/b45207cedf9fabe2c77bb3c1c10f403a610599a0"><code>b45207c</code></a> dependencies and packaging++</li> <li><a href="https://github.com/python-hyper/h2/commit/c40145f69c5473850849fe96301ac0416b1afea6"><code>c40145f</code></a> parse <code>content-length</code> headers according to RFC9110 grammar for numbers (1*DI...</li> <li>Additional commits viewable in <a href="https://github.com/python-hyper/h2/compare/v4.3.0...v4.4.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/react-agent/network/alerts). </details>
## Summary This PR runs the explicitly invoked `langster-modernize-all-dependencies-explicit` workflow. It is a broad dependency modernization, not a routine narrow Dependabot patch. - modernizes all 12 runtime/dev direct dependencies to their current stable releases - updates build requirements to `setuptools>=84.0.0` and `wheel>=0.48.0` - regenerates the complete uv lockfile, including major upgrades for LangChain provider packages, Fireworks, mypy, ruff, and transitive SDK/runtime packages - removes the temporary PyJWT constraint because `langgraph-api==0.13.0` now directly requires `pyjwt>=2.13.0` - applies compatibility formatting/type-annotation changes required by ruff 0.16.4 and modernizes the SPDX license declaration required by current setuptools ## Scope and package roots - package root: repository root (`pyproject.toml`, `uv.lock`) - runtime: Python 3.11 and 3.12 - no new package sources or direct dependencies were introduced ## Caps removed, changed, or retained - removed: temporary transitive `pyjwt>=2.12.0` constraint; upstream now enforces a newer safe minimum - dependency maximum caps: none were present - retained: `requires-python = ">=3.11,<4.0"` because Python 4 is outside the repository/runtime support matrix rather than a dependency compatibility cap ## Major-version migrations and compatibility edits - `langchain-openai` 1.1.14 → 1.6.0 - `langchain-anthropic` 1.4.6 → 1.6.1 - `langchain-fireworks` 1.1.0 → 1.6.0 - `mypy` 1.19.1 → 2.3.1 - compatibility edits are limited to ruff's modern union annotation and formatting changes ## Validation - `uv lock --check` - `uv sync --all-extras --dev` - `uv run ruff check .` - `uv run ruff format . --check` - `uv run mypy --strict src/` - `uv run pytest tests/unit_tests -q` (3 passed on Python 3.12) - Python 3.11 sync + unit tests + strict mypy (3 passed; mypy clean) - `uv run pytest --collect-only tests/integration_tests -q` (1 collected) - `uv build` (sdist and wheel built) The live integration test was not executed locally because it requires repository API-key secrets; CI/scheduled integration coverage remains authoritative. ## Review hotspots and rollback - review the broad transitive changes from LangGraph API 0.10.0 → 0.13.0 and provider SDK major versions - rollback is a single-commit revert of this PR; no data or schema migration is involved
## Summary - add weekly Dependabot updates for the root uv dependency set - add weekly Dependabot updates for GitHub Actions - preserve declared Python dependency bounds with `versioning-strategy: increase` ## Validation - [x] Parsed `.github/dependabot.yml` with Ruby YAML - [x] Ran `git diff --check` - [x] Confirmed the PR only adds `.github/dependabot.yml`
Bumps [codespell-project/actions-codespell](https://github.com/codespell-project/actions-codespell) from 2.1 to 2.2. - [Release notes](https://github.com/codespell-project/actions-codespell/releases) - [Commits](codespell-project/actions-codespell@406322e...8f01853) --- updated-dependencies: - dependency-name: codespell-project/actions-codespell dependency-version: '2.2' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v4...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…#60) Bumps [codespell-project/actions-codespell](https://github.com/codespell-project/actions-codespell) from 2.1 to 2.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/codespell-project/actions-codespell/releases">codespell-project/actions-codespell's releases</a>.</em></p> <blockquote> <h2>v2.2</h2> <!-- raw HTML omitted --> <h2>What's Changed</h2> <ul> <li>Add the config file option and tests by <a href="https://github.com/rdimaio"><code>@rdimaio</code></a> in <a href="https://redirect.github.com/codespell-project/actions-codespell/pull/80">codespell-project/actions-codespell#80</a></li> <li>Use <code>pip install</code> with <code>--no-cache-dir</code> in the Dockerfile by <a href="https://github.com/PeterDaveHello"><code>@PeterDaveHello</code></a> in <a href="https://redirect.github.com/codespell-project/actions-codespell/pull/89">codespell-project/actions-codespell#89</a></li> <li>Upgrade to Python 3.13 by <a href="https://github.com/candrews"><code>@candrews</code></a> in <a href="https://redirect.github.com/codespell-project/actions-codespell/pull/82">codespell-project/actions-codespell#82</a></li> <li>Add checkout action and problem matcher to README by <a href="https://github.com/vadi2"><code>@vadi2</code></a> in <a href="https://redirect.github.com/codespell-project/actions-codespell/pull/32">codespell-project/actions-codespell#32</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/rdimaio"><code>@rdimaio</code></a> made their first contribution in <a href="https://redirect.github.com/codespell-project/actions-codespell/pull/80">codespell-project/actions-codespell#80</a></li> <li><a href="https://github.com/PeterDaveHello"><code>@PeterDaveHello</code></a> made their first contribution in <a href="https://redirect.github.com/codespell-project/actions-codespell/pull/89">codespell-project/actions-codespell#89</a></li> <li><a href="https://github.com/candrews"><code>@candrews</code></a> made their first contribution in <a href="https://redirect.github.com/codespell-project/actions-codespell/pull/82">codespell-project/actions-codespell#82</a></li> <li><a href="https://github.com/vadi2"><code>@vadi2</code></a> made their first contribution in <a href="https://redirect.github.com/codespell-project/actions-codespell/pull/32">codespell-project/actions-codespell#32</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/codespell-project/actions-codespell/compare/v2...v2.2">https://github.com/codespell-project/actions-codespell/compare/v2...v2.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/codespell-project/actions-codespell/commit/8f01853be192eb0f849a5c7d721450e7a467c579"><code>8f01853</code></a> MAINT: Release notes</li> <li><a href="https://github.com/codespell-project/actions-codespell/commit/23a4abea248a30208f0b9d8682ac515b5714cd3e"><code>23a4abe</code></a> Add checkout action and problem matcher to README (<a href="https://redirect.github.com/codespell-project/actions-codespell/issues/32">#32</a>)</li> <li><a href="https://github.com/codespell-project/actions-codespell/commit/906f13fba196b1478f876bf3fdc4f9798c77b6f3"><code>906f13f</code></a> Upgrade to Python 3.13 (<a href="https://redirect.github.com/codespell-project/actions-codespell/issues/82">#82</a>)</li> <li><a href="https://github.com/codespell-project/actions-codespell/commit/df0bba344d8a1022f611728aa58c5fdfd7c094b1"><code>df0bba3</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/codespell-project/actions-codespell/issues/85">#85</a>)</li> <li><a href="https://github.com/codespell-project/actions-codespell/commit/c460eef33ec1d5171b201b66ffc77bbdbdbb6b2a"><code>c460eef</code></a> Use <code>pip install</code> with <code>--no-cache-dir</code> in the Dockerfile (<a href="https://redirect.github.com/codespell-project/actions-codespell/issues/89">#89</a>)</li> <li><a href="https://github.com/codespell-project/actions-codespell/commit/037a23a348b32d9060fe3b94ddf99986b779de2c"><code>037a23a</code></a> Add the config file option and tests (<a href="https://redirect.github.com/codespell-project/actions-codespell/issues/80">#80</a>)</li> <li><a href="https://github.com/codespell-project/actions-codespell/commit/8d1a4b1bd974b8082be0842c2e7e57c8bf6b9b63"><code>8d1a4b1</code></a> Bump actions/setup-python from 5 to 6 (<a href="https://redirect.github.com/codespell-project/actions-codespell/issues/92">#92</a>)</li> <li><a href="https://github.com/codespell-project/actions-codespell/commit/71286cb40fe09b3222aff820311357b4e67cc206"><code>71286cb</code></a> Bump actions/checkout from 4 to 5 (<a href="https://redirect.github.com/codespell-project/actions-codespell/issues/91">#91</a>)</li> <li><a href="https://github.com/codespell-project/actions-codespell/commit/fad9339798e1ee3fe979ae0a022c931786a408b8"><code>fad9339</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/codespell-project/actions-codespell/issues/84">#84</a>)</li> <li>See full diff in <a href="https://github.com/codespell-project/actions-codespell/compare/406322ec52dd7b488e48c1c4b82e2a8b3a1bf630...8f01853be192eb0f849a5c7d721450e7a467c579">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.1.0</h2> <h2>What's Changed</h2> <ul> <li><strong>[BREAKING]</strong> backport <code>allow-unsafe-pr-checkout</code> to v6 by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2500">actions/checkout#2500</a></li> <li>backport fixes to releases-v6 by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2527">actions/checkout#2527</a></li> </ul> <p><a href="https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/">https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/</a> for more details about this breaking change</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v6.1.0">https://github.com/actions/checkout/compare/v6.0.3...v6.1.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a> prep v7.0.1 release (<a href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li> <li><a href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a> escape values passed to --unset (<a href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li> <li><a href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li> <li><a href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li> <li><a href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a> eslint 9 (<a href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li> <li><a href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li> <li><a href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/v4...v7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-python/releases">actions/setup-python's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <h3>Enhancements</h3> <ul> <li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1330">actions/setup-python#1330</a></li> <li>Pin SHA commits and update docs with latest versions by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1338">actions/setup-python#1338</a></li> <li>Remove the pip-install input by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1336">actions/setup-python#1336</a></li> </ul> <h3>Bug Fix</h3> <ul> <li>Fix to Classify stderr warning messages as warnings instead of errors in annotations by <a href="https://github.com/lmvysakh"><code>@lmvysakh</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li> <li>Validate and retry manifest fetch to prevent silent failures by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1332">actions/setup-python#1332</a></li> </ul> <h3>Dependency Upgrade</h3> <ul> <li>Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1328">actions/setup-python#1328</a></li> <li>Remove EOL Python versions and Bumps numpy text fixture by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1333">actions/setup-python#1333</a></li> <li>Upgrade <code>@actions/cache</code> to 6.2.0 by <a href="https://github.com/philip-gai"><code>@philip-gai</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/lmvysakh"><code>@lmvysakh</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li> <li><a href="https://github.com/philip-gai"><code>@philip-gai</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6...v7.0.0">https://github.com/actions/setup-python/compare/v6...v7.0.0</a></p> <h2>v6.3.0</h2> <h2>What's Changed</h2> <h3>Enhancement</h3> <ul> <li>Add RHEL support and include Linux distro in cache keys by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li> <li>Fix pip cache error handling on Windows by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li> </ul> <h3>Dependency update</h3> <ul> <li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li> <li>Upgrade actions dependencies by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li>Upgrade dependency versions and test workflow configuration by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li> </ul> <h3>Documentation</h3> <ul> <li>Update advanced-usage.md by <a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> with <a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li> <li><a href="https://github.com/Dunky-Z"><code>@Dunky-Z</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0">https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0</a></p> <h2>v6.2.0</h2> <h2>What's Changed</h2> <h3>Dependency Upgrades</h3> <ul> <li>Upgrade dependencies to Node 24 compatible versions by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/setup-python/pull/1259">actions/setup-python#1259</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97"><code>5fda3b9</code></a> Pin SHA commits and update docs with latest versions (<a href="https://redirect.github.com/actions/setup-python/issues/1338">#1338</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e"><code>4ab7e95</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-python/issues/1337">#1337</a> from actions/philip-gai/bump-actions-cache-6-2-0</li> <li><a href="https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c"><code>0f3a009</code></a> Remove the pip-install input (<a href="https://redirect.github.com/actions/setup-python/issues/1336">#1336</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932"><code>f8cf429</code></a> Migrate to ESM and upgrade dependencies (<a href="https://redirect.github.com/actions/setup-python/issues/1330">#1330</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5"><code>54baeea</code></a> Validate and retry manifest fetch to prevent silent failures (<a href="https://redirect.github.com/actions/setup-python/issues/1332">#1332</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5"><code>c709277</code></a> Annotation code fix (<a href="https://redirect.github.com/actions/setup-python/issues/1335">#1335</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a"><code>6849080</code></a> remove EOL Python versions and Bumps numpy text fixture (<a href="https://redirect.github.com/actions/setup-python/issues/1333">#1333</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e"><code>0903b46</code></a> Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data (<a href="https://redirect.github.com/actions/setup-python/issues/1328">#1328</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1"><code>ece7cb0</code></a> Fix pip cache error handling on Windows. (<a href="https://redirect.github.com/actions/setup-python/issues/1040">#1040</a>)</li> <li><a href="https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf"><code>1d18d7a</code></a> Update advanced-usage.md (<a href="https://redirect.github.com/actions/setup-python/issues/811">#811</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-python/compare/v4...v7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
Bumps [anyio](https://github.com/agronholm/anyio) from 4.14.2 to 4.15.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/agronholm/anyio/releases">anyio's releases</a>.</em></p> <blockquote> <h2>4.15.1</h2> <ul> <li>Implemented a compatibility fix for supporting direct access of <code>anyio.*</code> submodules from the main package even when those submodules were not directly imported first (<!-- raw HTML omitted --><a href="https://redirect.github.com/agronholm/anyio/issues/1311">#1311</a> <<a href="https://redirect.github.com/agronholm/anyio/issues/1311%5C%3E">agronholm/anyio#1311</a><!-- raw HTML omitted -->)</li> </ul> <h2>4.15.0</h2> <ul> <li> <p>Added support for the newer keyword-only arguments on <code>anyio.Path</code> methods to match the standard library <code>pathlib.Path</code>:</p> <ul> <li><code>follow_symlinks</code> on <code>exists()</code> (Python 3.12+)</li> <li><code>follow_symlinks</code> on <code>is_dir()</code> (Python 3.13+)</li> <li><code>follow_symlinks</code> on <code>is_file()</code> (Python 3.13+)</li> <li><code>follow_symlinks</code> on <code>owner()</code> (Python 3.13+)</li> <li><code>follow_symlinks</code> on <code>group()</code> (Python 3.13+)</li> <li><code>newline</code> on <code>read_text()</code> (Python 3.13+)</li> </ul> <p>(<a href="https://redirect.github.com/agronholm/anyio/pull/1286">#1286</a>, <a href="https://redirect.github.com/agronholm/anyio/pull/1293">#1293</a>; PR by <a href="https://github.com/jaideeppyne"><code>@jaideeppyne</code></a>)</p> </li> <li> <p>Added <code>amap</code>, <code>gather</code>, and <code>as_completed</code> utility functions to simplify common patterns (<a href="https://redirect.github.com/agronholm/anyio/pull/1173">#1173</a>; PR by <a href="https://github.com/Graeme22"><code>@Graeme22</code></a>)</p> </li> <li> <p>Added <code>--anyio-mode</code> command-line option as an alternative to the <code>anyio_mode</code> ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: <code>pytest_asyncio</code>). (<a href="https://redirect.github.com/agronholm/anyio/pull/1242">#1242</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Added the <code>anyio.Future</code> synchronization primitive which behaves similar to <code>asyncio.Future</code>, allowing tasks to wait for a value (or exception) from another task (<a href="https://redirect.github.com/agronholm/anyio/pull/1146">#1146</a>; PR by <a href="https://github.com/Vizonex"><code>@Vizonex</code></a>)</p> </li> <li> <p>Added guidance for managing multiple memory object stream producers and consumers with cloned streams (<a href="https://redirect.github.com/agronholm/anyio/issues/330">#330</a>; PR by <a href="https://github.com/nightcityblade"><code>@nightcityblade</code></a>)</p> </li> <li> <p>Added <code>StapledObjectStream.send_nowait()</code> that delegates to the underlying <code>ObjectSendStream</code>, if it implements it (<a href="https://redirect.github.com/agronholm/anyio/pull/1241">#1241</a>; PR by <a href="https://github.com/davidbrochart"><code>@davidbrochart</code></a>)</p> </li> <li> <p>Added the <code>move_on_at()</code> and <code>fail_at()</code> functions to complement <code>move_on_after()</code> and <code>fail_after()</code></p> </li> <li> <p>Changed the default name for a task spawned with <code>TaskGroup.create_task(func())</code> to match the default task name for the analogous task spawned with <code>TaskGroup.start_soon(func)</code> or <code>TaskGroup.start(func)</code> in more situations. Previously, the default name of a <code>TaskGroup.create_task</code> task never included the module name. (The default name for a task spawned with <code>TaskGroup.start_soon</code> or <code>TaskGroup.start</code> typically includes the module name.) (<a href="https://redirect.github.com/agronholm/anyio/pull/1234">#1234</a>; PR by <a href="https://github.com/gschaffner"><code>@gschaffner</code></a>)</p> </li> <li> <p>Changed the <code>anyio</code> and <code>anyio.abc</code> modules to lazily (much like <code>810</code>) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the <code>if TYPE_CHECKING:</code> block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (<a href="https://redirect.github.com/agronholm/anyio/pull/1169">#1169</a>)</p> </li> <li> <p>Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to <code>start_blocking_portal()</code> and <code>anyio.to_thread.run_sync()</code> (<a href="https://redirect.github.com/agronholm/anyio/pull/1224">#1224</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Fixed <code>SpooledTemporaryFile.readinto()</code> and <code>readinto1()</code> reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (<a href="https://redirect.github.com/agronholm/anyio/pull/1215">#1215</a>; PR by <a href="https://github.com/c-tonneslan"><code>@c-tonneslan</code></a>)</p> </li> <li> <p>Added a <code>reason</code> parameter to <code>fail_after</code> (and the new <code>fail_at</code>) allowing for added exception context when raising <code>TimeoutError</code> (<a href="https://redirect.github.com/agronholm/anyio/pull/1227">#1227</a>; PR by <a href="https://github.com/Graeme22"><code>@Graeme22</code></a>)</p> </li> <li> <p>Fixed the default <code>TaskHandle.name</code> missing part of the task name for tasks started with <code>TaskGroup.start</code> on Trio (<a href="https://redirect.github.com/agronholm/anyio/issues/1231">#1231</a>; PR by <a href="https://github.com/gschaffner"><code>@gschaffner</code></a>)</p> </li> <li> <p>Fixed <code>anyio.run</code> leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a <code>RunVar</code>. (<a href="https://redirect.github.com/agronholm/anyio/issues/1203">#1203</a>; PR by <a href="https://github.com/tapetersen"><code>@tapetersen</code></a>)</p> </li> <li> <p>Fixed <code>anyio.Path.with_stem()</code> silently producing a wrong path (e.g. <code>Path(".txt")</code>) instead of raising <code>ValueError</code> when given an empty stem on a path with a non-empty suffix, unlike <code>pathlib.PurePath.with_stem</code> (<a href="https://redirect.github.com/agronholm/anyio/pull/1200">#1200</a>; PR by <a href="https://github.com/Sanjays2402"><code>@Sanjays2402</code></a>)</p> </li> <li> <p>Fixed <code>UNIXSocketStream.aclose()</code> raising <code>asyncio.InvalidStateError</code> when a concurrent receive or send operation had just been cancelled on the asyncio backend (<a href="https://redirect.github.com/agronholm/anyio/issues/1267">#1267</a>; PR by <a href="https://github.com/alloutflo"><code>@alloutflo</code></a>)</p> </li> <li> <p>Fixed the pytest plugin importing the deprecated <code>_pytest.python.CallSpec2</code> alias, which triggers <code>PytestRemovedIn10Warning</code> on <code>pytest>=9.2</code> and crashes pytest at startup when <code>filterwarnings = error</code> is configured (<a href="https://redirect.github.com/agronholm/anyio/issues/1271">#1271</a>; PR by <a href="https://github.com/matthewfeickert"><code>@matthewfeickert</code></a>)</p> </li> <li> <p>Fixed an asyncio worker thread race that could raise <code>RuntimeError</code> when the event loop closed between checking its state and scheduling the worker result (<a href="https://redirect.github.com/agronholm/anyio/issues/1265">#1265</a>; PR by <a href="https://github.com/hansu650"><code>@hansu650</code></a>)</p> </li> <li> <p>Fixed <code>CapacityLimiter</code> on the asyncio backend over-granting tokens when <code>total_tokens</code> was raised while the limiter was over-subscribed (<a href="https://redirect.github.com/agronholm/anyio/pull/1223">#1223</a>; PR by <a href="https://github.com/zelinewang"><code>@zelinewang</code></a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/agronholm/anyio/commit/ffcd1542cd6d127980205f90a0100078849dd703"><code>ffcd154</code></a> Bumped up the version</li> <li><a href="https://github.com/agronholm/anyio/commit/0ecf5ed98d294242509b043ebd1a0843e52d892f"><code>0ecf5ed</code></a> Added a workaround for third party code accessing unimported submodules (<a href="https://redirect.github.com/agronholm/anyio/issues/1309">#1309</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/928366259543412a2deb1e2ba09ea45ffa92ef4f"><code>9283662</code></a> Bumped up the version</li> <li><a href="https://github.com/agronholm/anyio/commit/d137692a90f76e4f71605e32ea5ca94cab3a539d"><code>d137692</code></a> Improved the instructions for AI agents</li> <li><a href="https://github.com/agronholm/anyio/commit/033fc52b8fa8e90c5d0ef24b10b3860e974a6265"><code>033fc52</code></a> Shield TemporaryDirectory cleanup from cancellation (<a href="https://redirect.github.com/agronholm/anyio/issues/1304">#1304</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/942e9a6552cc10b5aaa779d84bfc8e2c3d5fcffc"><code>942e9a6</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/agronholm/anyio/issues/1305">#1305</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/b825c3be7cb4ca1a8000b8065d4e147843deb704"><code>b825c3b</code></a> Fixed pyproject.toml changes not triggering the test suite</li> <li><a href="https://github.com/agronholm/anyio/commit/9727dc504681e2986b5bc285de9571fb467539af"><code>9727dc5</code></a> Fixed start inconsistencies between trio and asyncio (<a href="https://redirect.github.com/agronholm/anyio/issues/1198">#1198</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/b05fe6d160a640355c201363cab286a7d2581da8"><code>b05fe6d</code></a> Fixed wrong type in move_on_after (<a href="https://redirect.github.com/agronholm/anyio/issues/1297">#1297</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/44d0c93cc20079acbf38ba4dbed5ab9df323f153"><code>44d0c93</code></a> Fixed asyncio task group coroutine cleanup (<a href="https://redirect.github.com/agronholm/anyio/issues/1275">#1275</a>)</li> <li>Additional commits viewable in <a href="https://github.com/agronholm/anyio/compare/4.14.2...4.15.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [langchain-fireworks](https://github.com/langchain-ai/langchain) from 1.6.0 to 1.6.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-fireworks's releases</a>.</em></p> <blockquote> <h2>langchain-fireworks==1.6.1</h2> <p>Changes since langchain-fireworks==1.6.0</p> <p>release(fireworks): 1.6.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39975">#39975</a>) fix(fireworks): drop reasoning history blocks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39973">#39973</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39844">#39844</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/885e858ac4361685be4b3dc87940a0d07ea0471f"><code>885e858</code></a> release(fireworks): 1.6.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39975">#39975</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/033ff67b33caea00d2b890433bb3f3fa39f622a9"><code>033ff67</code></a> fix(fireworks): drop reasoning history blocks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39973">#39973</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4fe9d3062f4b68e2e472eb92decf369c93aebb46"><code>4fe9d30</code></a> chore(openai): fix tests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39972">#39972</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/8fa38dc143faecec0287395bce4484af4b82254c"><code>8fa38dc</code></a> revert: release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39971">#39971</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/122030d79e944a5b55c33847d29bcfbe64488372"><code>122030d</code></a> release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39967">#39967</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/7d4b42b57235020e6f496fdfebab44c3ca1b1f5b"><code>7d4b42b</code></a> release(langchain): 1.3.18 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39966">#39966</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4a66e355da07b8fad7d6cb8db99287fb4d7e6d83"><code>4a66e35</code></a> fix(langchain): preserve content-block shape in PIIMiddleware redaction (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39894">#39894</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/38e211359f0b65b480d9ee4c53f2385f8c249bb3"><code>38e2113</code></a> fix(core): shore up indexing in genai v1 streaming content (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39964">#39964</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/13b1b2feae476fdcebc0a285a723d5cbfed9df2e"><code>13b1b2f</code></a> fix(core): make <code>StructuredTool</code> JSON-serializable (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39631">#39631</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/3b3b308e6d956c9a670e41e66a468466fe6f8c26"><code>3b3b308</code></a> release(anthropic): 1.7.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39963">#39963</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-fireworks==1.6.0...langchain-fireworks==1.6.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [langchain-anthropic](https://github.com/langchain-ai/langchain) from 1.6.1 to 1.7.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-anthropic's releases</a>.</em></p> <blockquote> <h2>langchain-anthropic==1.7.1</h2> <p>Changes since langchain-anthropic==1.7.0</p> <p>release(anthropic): 1.7.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40181">#40181</a>) perf(anthropic,langchain): omit middleware trace inputs (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40098">#40098</a>) feat(anthropic): add Claude Fable 5.1 support (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40106">#40106</a>)</p> <h2>langchain-anthropic==1.7.0</h2> <p>Changes since langchain-anthropic==1.6.1</p> <p>release(anthropic): 1.7.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39963">#39963</a>) feat(anthropic): support top-level param for skills via <code>container</code>; <code>updates</code> thinking display mode (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39962">#39962</a>) feat(anthropic): support 1.0 sdk (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39938">#39938</a>) fix(anthropic): auto-append <code>advisor-tool-2026-03-01</code> beta header for <code>advisor_20260301</code> tool (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39917">#39917</a>) feat(anthropic): surface gateway response metadata (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39809">#39809</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/79cab2dc7f58be720cac43db3677b4c1fd971f91"><code>79cab2d</code></a> release(anthropic): 1.7.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40181">#40181</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/1e6a4f0b45b60475f566f3ad49fb32ea99d22233"><code>1e6a4f0</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40171">#40171</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/8330dfe987988c1bcbbc5e8d9af9a67e5a1c2744"><code>8330dfe</code></a> docs(langchain): runnable <code>langchain.mcp</code> examples (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39976">#39976</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/280442b54c80db2175ced4a20ab59eab86a32dc1"><code>280442b</code></a> feat(langchain): <code>langchain.mcp</code> namespace, <code>MCPAdapter</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39939">#39939</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/f5ee2b65f4cf2f1a9fe688bcae6ad2af966582bd"><code>f5ee2b6</code></a> chore(chroma): bump Pygments security constraint (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40162">#40162</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/234255c1c7427b5ed6dc505abad41ddfa6c9ff8f"><code>234255c</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40009">#40009</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/79e0e4adbafc1fda1ca9956e184be8b8819aa7ab"><code>79e0e4a</code></a> chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/langchain (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40149">#40149</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/e90201b7af5cd32762744c974ca9ce3f27efc9d8"><code>e90201b</code></a> chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40150">#40150</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4240248e7b08ed72e85ce0744350c33beddb0ac8"><code>4240248</code></a> chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/text-splitters (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40148">#40148</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/530290a9d445069d80a68cdcd4d0da768f2aa2b0"><code>530290a</code></a> chore(deps): bump uv to 0.12.8 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40092">#40092</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-anthropic==1.6.1...langchain-anthropic==1.7.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.16.4 to 0.16.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.6</h2> <h2>Release Notes</h2> <p>Released on 2026-09-03.</p> <h3>Preview features</h3> <ul> <li>Move <code>pytest-fixture-autouse</code> to the <code>restriction</code> category (<a href="https://redirect.github.com/astral-sh/ruff/pull/28219">#28219</a>)</li> <li>[<code>flake8-pytest-style</code>] Add an autofix for <code>PT020</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27993">#27993</a>)</li> <li>[<code>flake8-tidy-imports</code>] Prevent fix loop between <code>TID254</code> and <code>TID255</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28262">#28262</a>)</li> <li>[<code>isort</code>] Exclude pragma comments from line length calculation (<code>I001</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27313">#27313</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Validate unary expressions when parsing (<a href="https://redirect.github.com/astral-sh/ruff/pull/28233">#28233</a>)</li> <li>[<code>flake8-async</code>, <code>pylint</code>] Recognize <code>builtins.open</code> (<code>ASYNC230</code>, <code>PLW1514</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28021">#28021</a>)</li> <li>[<code>flake8-bugbear</code>] Fix panic on <code>match</code> subjects (<code>B031</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27781">#27781</a>)</li> <li>[<code>flake8-datetimez</code>] Reject <code>tzinfo=None</code> for <code>datetime</code> bounds (<code>DTZ901</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28022">#28022</a>)</li> <li>[<code>flake8-pytest-style</code>] Avoid duplicate <code>PT017</code> diagnostics (<a href="https://redirect.github.com/astral-sh/ruff/pull/27918">#27918</a>)</li> <li>[<code>ruff</code>] Remove <code>lint.external</code> hint for Ruff-specific suppressions (<code>RUF102</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27923">#27923</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>flake8-use-pathlib</code>] Add display-only fix for <code>os.listdir</code> (<code>PTH208</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28027">#28027</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add another example and glob reference for <code>lint.per-file-ignores</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28106">#28106</a>)</li> <li>Add duplicate work guidance (<a href="https://redirect.github.com/astral-sh/ruff/pull/28229">#28229</a>)</li> <li>[<code>flake8-async</code>] Document thread offloading (<code>ASYNC240</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28008">#28008</a>)</li> <li>[<code>pyupgrade</code>] Clarify default <code>encoding</code> argument handling (<code>UP012</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27315">#27315</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Allow unary plus in match patterns on Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28231">#28231</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/flying-sheep"><code>@flying-sheep</code></a></li> <li><a href="https://github.com/pikammmmm"><code>@pikammmmm</code></a></li> <li><a href="https://github.com/fly1d"><code>@fly1d</code></a></li> <li><a href="https://github.com/waterWang"><code>@waterWang</code></a></li> <li><a href="https://github.com/Pierre-Sassoulas"><code>@Pierre-Sassoulas</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/ericbuehl"><code>@ericbuehl</code></a></li> <li><a href="https://github.com/tjkuson"><code>@tjkuson</code></a></li> <li><a href="https://github.com/AbhinavMir"><code>@AbhinavMir</code></a></li> <li><a href="https://github.com/Whning0513"><code>@Whning0513</code></a></li> <li><a href="https://github.com/chirizxc"><code>@chirizxc</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.6</h2> <p>Released on 2026-09-03.</p> <h3>Preview features</h3> <ul> <li>Move <code>pytest-fixture-autouse</code> to the <code>restriction</code> category (<a href="https://redirect.github.com/astral-sh/ruff/pull/28219">#28219</a>)</li> <li>[<code>flake8-pytest-style</code>] Add an autofix for <code>PT020</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27993">#27993</a>)</li> <li>[<code>flake8-tidy-imports</code>] Prevent fix loop between <code>TID254</code> and <code>TID255</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28262">#28262</a>)</li> <li>[<code>isort</code>] Exclude pragma comments from line length calculation (<code>I001</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27313">#27313</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Validate unary expressions when parsing (<a href="https://redirect.github.com/astral-sh/ruff/pull/28233">#28233</a>)</li> <li>[<code>flake8-async</code>, <code>pylint</code>] Recognize <code>builtins.open</code> (<code>ASYNC230</code>, <code>PLW1514</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28021">#28021</a>)</li> <li>[<code>flake8-bugbear</code>] Fix panic on <code>match</code> subjects (<code>B031</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27781">#27781</a>)</li> <li>[<code>flake8-datetimez</code>] Reject <code>tzinfo=None</code> for <code>datetime</code> bounds (<code>DTZ901</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28022">#28022</a>)</li> <li>[<code>flake8-pytest-style</code>] Avoid duplicate <code>PT017</code> diagnostics (<a href="https://redirect.github.com/astral-sh/ruff/pull/27918">#27918</a>)</li> <li>[<code>ruff</code>] Remove <code>lint.external</code> hint for Ruff-specific suppressions (<code>RUF102</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27923">#27923</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>flake8-use-pathlib</code>] Add display-only fix for <code>os.listdir</code> (<code>PTH208</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28027">#28027</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add another example and glob reference for <code>lint.per-file-ignores</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28106">#28106</a>)</li> <li>Add duplicate work guidance (<a href="https://redirect.github.com/astral-sh/ruff/pull/28229">#28229</a>)</li> <li>[<code>flake8-async</code>] Document thread offloading (<code>ASYNC240</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28008">#28008</a>)</li> <li>[<code>pyupgrade</code>] Clarify default <code>encoding</code> argument handling (<code>UP012</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27315">#27315</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Allow unary plus in match patterns on Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28231">#28231</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/flying-sheep"><code>@flying-sheep</code></a></li> <li><a href="https://github.com/pikammmmm"><code>@pikammmmm</code></a></li> <li><a href="https://github.com/fly1d"><code>@fly1d</code></a></li> <li><a href="https://github.com/waterWang"><code>@waterWang</code></a></li> <li><a href="https://github.com/Pierre-Sassoulas"><code>@Pierre-Sassoulas</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/ericbuehl"><code>@ericbuehl</code></a></li> <li><a href="https://github.com/tjkuson"><code>@tjkuson</code></a></li> <li><a href="https://github.com/AbhinavMir"><code>@AbhinavMir</code></a></li> <li><a href="https://github.com/Whning0513"><code>@Whning0513</code></a></li> <li><a href="https://github.com/chirizxc"><code>@chirizxc</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/22f65a2ab5052990503985c7c794de37598d531e"><code>22f65a2</code></a> Bump 0.16.6 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28280">#28280</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/7cc9f1ed53e5ce175f17fde3a75fe792ac41e8cd"><code>7cc9f1e</code></a> [ty] Document <code>CallableTypeKind</code> variants (<a href="https://redirect.github.com/astral-sh/ruff/issues/28277">#28277</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/056ce07a895c217dab7929a616540c246cf8a078"><code>056ce07</code></a> Add UV_LOCKED to all workflows (<a href="https://redirect.github.com/astral-sh/ruff/issues/28261">#28261</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/6d6e35d03a72d23d3b0f23fb348692b03c9b81b6"><code>6d6e35d</code></a> [<code>flake8-pytest-style</code>] Avoid duplicate <code>PT017</code> diagnostics (<a href="https://redirect.github.com/astral-sh/ruff/issues/27918">#27918</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/80b4891b64cb916dce080e8fa15af5c2179d776a"><code>80b4891</code></a> [ty] Temporarily disable tuple types in property tests (<a href="https://redirect.github.com/astral-sh/ruff/issues/28275">#28275</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/3f7a54d1d7b9480a18d86a8211bf676354a2f8a0"><code>3f7a54d</code></a> [<code>flake8-tidy-imports</code>] Prevent fix loop between <code>TID254</code> and <code>TID255</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28262">#28262</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/35656cf37d34f30116d4f4a9cb13853a6ad9fd0d"><code>35656cf</code></a> [ty] Preserve deprecations on decorated callables (<a href="https://redirect.github.com/astral-sh/ruff/issues/28256">#28256</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/d2626c866ee08495cfa0da5236e130030d37e0cf"><code>d2626c8</code></a> [ty] Reject missing attributes on <code>type[]</code> aliases (<a href="https://redirect.github.com/astral-sh/ruff/issues/28267">#28267</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ee6a6d19aa0707df942febe9768488d39f383c8c"><code>ee6a6d1</code></a> [ty] Support ParamSpecs in <code>ConstraintSet</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28028">#28028</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/7f6a170080dab08f754ef086369a2623c70f753d"><code>7f6a170</code></a> [ty] Move bound APIs to constraint owners (<a href="https://redirect.github.com/astral-sh/ruff/issues/28094">#28094</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.4...0.16.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [langchain](https://github.com/langchain-ai/langchain) from 1.3.17 to 1.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain's releases</a>.</em></p> <blockquote> <h2>langchain-perplexity==1.4.0</h2> <p>Changes since langchain-perplexity==1.3.2</p> <p>release(perplexity): 1.4.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37993">#37993</a>) feat(perplexity): <code>bind_tools</code> and Responses-API tool round-trip (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37934">#37934</a>) hotfix(openai): min core dep (<a href="https://redirect.github.com/langchain-ai/langchain/issues/37990">#37990</a>)</p> <h2>langchain-openai==1.4.0</h2> <p>Changes since langchain-openai==1.3.5</p> <p>release(openai): 1.4.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38983">#38983</a>) chore: bump pillow from 12.2.0 to 12.3.0 in /libs/partners/openai (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38999">#38999</a>) feat(core): add <code>reasoning_effort</code> as a standard chat model parameter (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38887">#38887</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38797">#38797</a>)</p> <h2>langchain==1.4.0</h2> <p>Changes since langchain==1.3.18</p> <p>docs(langchain): runnable <code>langchain.mcp</code> examples (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39976">#39976</a>) feat(langchain): <code>langchain.mcp</code> namespace, <code>MCPAdapter</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39939">#39939</a>) perf(anthropic,langchain): omit middleware trace inputs (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40098">#40098</a>) fix(langchain): include model destination in agent tool routing (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38355">#38355</a>) chore(langchain): bump vcrpy test dependency minimum to <code>>=8.2.0</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39942">#39942</a>)</p> <h2>langchain==1.4.0a4</h2> <p>Initial release</p> <p>release(langchain): 1.4.0a4 test(langchain): cover mixed-era ClientGroup and group elicitation Update libs/langchain_v1/langchain/mcp/adapter.py fix(langchain): drive MCP elicitation via member session for fastmcp 4.0.1 fix(sdk): use latest fastmcp and rm reentrant impl cr cr refactor(langchain): inline MCP client arming into <code>__init__</code> refactor(langchain): stamp an arm marker instead of introspecting the handler closure fix(langchain): gate MCP interrupt routing on the negotiated protocol era refactor(langchain): drop MCP <code>elicitation</code> flag, derive interrupt routing from the client fix(sdk): add _ReentrantClientGroup fix(langchain): narrow <code>MCPAdapter.client</code> union in mcp tests for mypy chore(langchain): format <code>mcp/adapter.py</code> release(langchain): 1.4.0a3 feat(langchain): group MCP tool metadata under an <code>mcp</code> namespace refactor(langchain): stop exporting <code>MCPAdapterTarget</code> from <code>langchain.mcp</code> refactor(langchain): rename <code>convert_mcp_tool_to_langchain_tool</code> to <code>as_langchain_tool</code> refactor(langchain): rename <code>MCPAdapter.get_tools</code> to <code>list_tools</code> feat(langchain): expose <code>cache_mode</code> on <code>MCPAdapter.get_tools</code> chore(langchain): require <code>fastmcp</code> 4.0.0 feat(langchain): accept a <code>ClientGroup</code> as an <code>MCPAdapter</code> target feat(langchain): mark the <code>langchain.mcp</code> namespace as beta</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/79cab2dc7f58be720cac43db3677b4c1fd971f91"><code>79cab2d</code></a> release(anthropic): 1.7.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40181">#40181</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/1e6a4f0b45b60475f566f3ad49fb32ea99d22233"><code>1e6a4f0</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40171">#40171</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/8330dfe987988c1bcbbc5e8d9af9a67e5a1c2744"><code>8330dfe</code></a> docs(langchain): runnable <code>langchain.mcp</code> examples (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39976">#39976</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/280442b54c80db2175ced4a20ab59eab86a32dc1"><code>280442b</code></a> feat(langchain): <code>langchain.mcp</code> namespace, <code>MCPAdapter</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39939">#39939</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/f5ee2b65f4cf2f1a9fe688bcae6ad2af966582bd"><code>f5ee2b6</code></a> chore(chroma): bump Pygments security constraint (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40162">#40162</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/234255c1c7427b5ed6dc505abad41ddfa6c9ff8f"><code>234255c</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40009">#40009</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/79e0e4adbafc1fda1ca9956e184be8b8819aa7ab"><code>79e0e4a</code></a> chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/langchain (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40149">#40149</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/e90201b7af5cd32762744c974ca9ce3f27efc9d8"><code>e90201b</code></a> chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/core (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40150">#40150</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4240248e7b08ed72e85ce0744350c33beddb0ac8"><code>4240248</code></a> chore(deps): bump mistune from 3.3.0 to 3.3.3 in /libs/text-splitters (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40148">#40148</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/530290a9d445069d80a68cdcd4d0da768f2aa2b0"><code>530290a</code></a> chore(deps): bump uv to 0.12.8 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40092">#40092</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain==1.3.17...langchain==1.4.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [langchain-anthropic](https://github.com/langchain-ai/langchain) from 1.7.1 to 1.7.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-anthropic's releases</a>.</em></p> <blockquote> <h2>langchain-anthropic==1.7.2</h2> <p>Changes since langchain-anthropic==1.7.1</p> <p>release(anthropic): 1.7.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40387">#40387</a>) fix(anthropic): preserve invalid tool use blocks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40372">#40372</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/d5d7cc56ab3932c9a10dc76b31cd5d4a778c3f2a"><code>d5d7cc5</code></a> release(anthropic): 1.7.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40387">#40387</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4436bd2b67814877a3797613de28882adcdb6edf"><code>4436bd2</code></a> fix(anthropic): preserve invalid tool use blocks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40372">#40372</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/443154df9db5251d73730e1de3eb63bf352e586f"><code>443154d</code></a> feat(huggingface): use torch.accelerator for device-agnostic device count det...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/3539ca08d92e10b65b6f3117cfd657b16b05c865"><code>3539ca0</code></a> fix(huggingface): remove retired IPEX backend (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39649">#39649</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/45d94fb0fa10bf8cab95dcb1e76c2bc39165535d"><code>45d94fb</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40358">#40358</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/60357692c76651a7cd6153496a24658fa355bdcc"><code>6035769</code></a> release(openai): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40339">#40339</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/a7b0f0ae50acebb527a25e153ff16621d37ba650"><code>a7b0f0a</code></a> docs: update OpenWiki (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40318">#40318</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/1611938f49dda48aa069d1fdce429430257488b7"><code>1611938</code></a> fix(openai): add GPT-6 Astra reasoning efforts (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40330">#40330</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/f092c9a78b3c532ef4c01935c0d4514209ff9f96"><code>f092c9a</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40317">#40317</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/22f3421aeedec55962f712a34d86d9683bf6cf59"><code>22f3421</code></a> docs: update OpenWiki (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40218">#40218</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-anthropic==1.7.1...langchain-anthropic==1.7.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.16.6 to 0.16.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.8</h2> <h2>Release Notes</h2> <p>Released on 2026-09-16.</p> <h3>Bug fixes</h3> <ul> <li>Visit functional <code>TypedDict</code> keyword arguments correctly (<a href="https://redirect.github.com/astral-sh/ruff/pull/28584">#28584</a>)</li> <li>[<code>flake8-simplify</code>] Detect nested <code>async with</code> under sync parent (<code>SIM117</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27821">#27821</a>)</li> <li>[<code>flake8-simplify</code>] Preserve operand order in <code>SIM109</code> fix (<a href="https://redirect.github.com/astral-sh/ruff/pull/27824">#27824</a>)</li> <li>[<code>pyupgrade</code>] Preserve required parentheses in multiline <code>UP040</code> fixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28164">#28164</a>)</li> <li>[<code>pyupgrade</code>] Skip <code>TypeVarTuple</code> and <code>ParamSpec</code> conversions with bounds or constraints (<code>UP040</code>, <code>UP046</code>, <code>UP047</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28505">#28505</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Add support for <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28459">#28459</a>)</li> <li>Recognize PEP-728 <code>TypedDict</code> class keywords (<a href="https://redirect.github.com/astral-sh/ruff/pull/28533">#28533</a>)</li> <li>Recognize quoted types in <code>typing.TypeForm</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28507">#28507</a>)</li> <li>Support conditional assignment to <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28491">#28491</a>)</li> <li>[<code>flake8-type-checking</code>] Prefer lazy imports over <code>TYPE_CHECKING</code> on Python 3.15 and later (<code>TC001</code>, <code>TC002</code>, <code>TC003</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28541">#28541</a>)</li> <li>[<code>pyupgrade</code>] Make the fix for <code>UP040</code> always unsafe (<a href="https://redirect.github.com/astral-sh/ruff/pull/28526">#28526</a>)</li> <li>[<code>pyupgrade</code>] Stop recommending deprecated <code>ByteString</code> aliases (<code>UP035</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28498">#28498</a>)</li> <li>[<code>ruff</code>, <code>flake8-use-pathlib</code>] Recognize the <code>parent_mode</code> argument (<code>RUF064</code>, <code>PTH103</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28528">#28528</a>)</li> <li>[<code>ruff</code>] Detect <code>\Z</code> in <code>pytest.raises()</code> match patterns (<code>RUF043</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28598">#28598</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Use rule name and code in formatter incompatibility warnings (<a href="https://redirect.github.com/astral-sh/ruff/pull/28571">#28571</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>[<code>flake8-tidy-imports</code>] Add <code>extend-banned-api</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28644">#28644</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/VedantMadane"><code>@VedantMadane</code></a></li> <li><a href="https://github.com/alzeph"><code>@alzeph</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/fredrikblau"><code>@fredrikblau</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/zsol"><code>@zsol</code></a></li> <li><a href="https://github.com/Aniket-a14"><code>@Aniket-a14</code></a></li> <li><a href="https://github.com/r-b-1"><code>@r-b-1</code></a></li> </ul> <h2>Install ruff 0.16.8</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.8</h2> <p>Released on 2026-09-16.</p> <h3>Bug fixes</h3> <ul> <li>Visit functional <code>TypedDict</code> keyword arguments correctly (<a href="https://redirect.github.com/astral-sh/ruff/pull/28584">#28584</a>)</li> <li>[<code>flake8-simplify</code>] Detect nested <code>async with</code> under sync parent (<code>SIM117</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27821">#27821</a>)</li> <li>[<code>flake8-simplify</code>] Preserve operand order in <code>SIM109</code> fix (<a href="https://redirect.github.com/astral-sh/ruff/pull/27824">#27824</a>)</li> <li>[<code>pyupgrade</code>] Preserve required parentheses in multiline <code>UP040</code> fixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28164">#28164</a>)</li> <li>[<code>pyupgrade</code>] Skip <code>TypeVarTuple</code> and <code>ParamSpec</code> conversions with bounds or constraints (<code>UP040</code>, <code>UP046</code>, <code>UP047</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28505">#28505</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Add support for <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28459">#28459</a>)</li> <li>Recognize PEP-728 <code>TypedDict</code> class keywords (<a href="https://redirect.github.com/astral-sh/ruff/pull/28533">#28533</a>)</li> <li>Recognize quoted types in <code>typing.TypeForm</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28507">#28507</a>)</li> <li>Support conditional assignment to <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28491">#28491</a>)</li> <li>[<code>flake8-type-checking</code>] Prefer lazy imports over <code>TYPE_CHECKING</code> on Python 3.15 and later (<code>TC001</code>, <code>TC002</code>, <code>TC003</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28541">#28541</a>)</li> <li>[<code>pyupgrade</code>] Make the fix for <code>UP040</code> always unsafe (<a href="https://redirect.github.com/astral-sh/ruff/pull/28526">#28526</a>)</li> <li>[<code>pyupgrade</code>] Stop recommending deprecated <code>ByteString</code> aliases (<code>UP035</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28498">#28498</a>)</li> <li>[<code>ruff</code>, <code>flake8-use-pathlib</code>] Recognize the <code>parent_mode</code> argument (<code>RUF064</code>, <code>PTH103</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28528">#28528</a>)</li> <li>[<code>ruff</code>] Detect <code>\Z</code> in <code>pytest.raises()</code> match patterns (<code>RUF043</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28598">#28598</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Use rule name and code in formatter incompatibility warnings (<a href="https://redirect.github.com/astral-sh/ruff/pull/28571">#28571</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>[<code>flake8-tidy-imports</code>] Add <code>extend-banned-api</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28644">#28644</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/VedantMadane"><code>@VedantMadane</code></a></li> <li><a href="https://github.com/alzeph"><code>@alzeph</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/fredrikblau"><code>@fredrikblau</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/zsol"><code>@zsol</code></a></li> <li><a href="https://github.com/Aniket-a14"><code>@Aniket-a14</code></a></li> <li><a href="https://github.com/r-b-1"><code>@r-b-1</code></a></li> </ul> <h2>0.16.7</h2> <p>Released on 2026-09-10.</p> <h3>Preview features</h3> <ul> <li>[<code>ruff</code>] Add rule for default values on method receivers (<code>RUF077</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/26700">#26700</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/62914c4b9b79a9e5004374a9c482ad2ed69290e1"><code>62914c4</code></a> Bump version to 0.16.8 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28648">#28648</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/c47e0cdc665f56536ce7f7a8ac40fa0ff3f79482"><code>c47e0cd</code></a> [ty] Bound aliased intersection expansion during inference (<a href="https://redirect.github.com/astral-sh/ruff/issues/28546">#28546</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ff4747b509ab4fffbe5689fcae39caa7503d1dcf"><code>ff4747b</code></a> renovate: update uv hashes correctly with setup-uv (<a href="https://redirect.github.com/astral-sh/ruff/issues/28621">#28621</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/94efeaa28630d80b2a74adf3c3963de99ed4ee29"><code>94efeaa</code></a> [ty] Compact reachable binding and declaration histories (<a href="https://redirect.github.com/astral-sh/ruff/issues/28349">#28349</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/50020fb1e8aa83b0826fa6f5f33a1e93c10cc60e"><code>50020fb</code></a> [ty] Avoid storing constraint nodes twice (<a href="https://redirect.github.com/astral-sh/ruff/issues/28375">#28375</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/446bb68da50014bb75f5ce1504a80c5883e3b0b2"><code>446bb68</code></a> [ty] Compare bound-method receivers before signatures (<a href="https://redirect.github.com/astral-sh/ruff/issues/28384">#28384</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/304ab86be5de6507e276ab09f5b43f44aeb92469"><code>304ab86</code></a> [<code>flake8-type-checking</code>] Prefer lazy imports over <code>TYPE_CHECKING</code> on 3.15+ (`...</li> <li><a href="https://github.com/astral-sh/ruff/commit/d940b244f7512427b0d87c7953e88c60e69f9bdf"><code>d940b24</code></a> [ty] Watch script dependencies in CLI watch mode (<a href="https://redirect.github.com/astral-sh/ruff/issues/28125">#28125</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/fe9f065a504127b11da72c2ff6d7813ddf3ce8ac"><code>fe9f065</code></a> [flake8-tidy-imports] Add <code>extend-banned-api</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28644">#28644</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/31131db44f057cce68fa6b95552b7db54167b0b3"><code>31131db</code></a> [ty] Support <code>type[A & B]</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/27124">#27124</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.6...0.16.8">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [langchain-openai](https://github.com/langchain-ai/langchain) from 1.6.0 to 1.6.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-openai's releases</a>.</em></p> <blockquote> <h2>langchain-openai==1.6.2</h2> <p>Changes since langchain-openai==1.6.1</p> <p>release(openai): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40339">#40339</a>) fix(openai): add GPT-6 Astra reasoning efforts (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40330">#40330</a>) chore(deps): bump httpx2 from 2.10.0 to 2.12.0 in /libs/partners/openai (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40309">#40309</a>)</p> <h2>langchain-openai==1.6.1</h2> <p>Changes since langchain-openai==1.6.0</p> <p>fix(openai): bump <code>max_completion_tokens</code> in cache breakpoint integration test (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40284">#40284</a>) release(openai): 1.6.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40268">#40268</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40217">#40217</a>) fix(openai): support Azure AD auth with OpenAI 3.8 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40190">#40190</a>) feat(openai): support async tools (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40208">#40208</a>) feat(openai): support <code>configuration_update</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40201">#40201</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40171">#40171</a>) fix(openai): route <code>gpt-5.6-sol</code> to responses API (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40133">#40133</a>) chore(openai): fix tests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39972">#39972</a>) fix(openai): correct <code>reasoning_effort_levels</code> for gpt-5 and gpt-5.1 profiles (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39936">#39936</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39954">#39954</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/60357692c76651a7cd6153496a24658fa355bdcc"><code>6035769</code></a> release(openai): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40339">#40339</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/a7b0f0ae50acebb527a25e153ff16621d37ba650"><code>a7b0f0a</code></a> docs: update OpenWiki (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40318">#40318</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/1611938f49dda48aa069d1fdce429430257488b7"><code>1611938</code></a> fix(openai): add GPT-6 Astra reasoning efforts (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40330">#40330</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/f092c9a78b3c532ef4c01935c0d4514209ff9f96"><code>f092c9a</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40317">#40317</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/22f3421aeedec55962f712a34d86d9683bf6cf59"><code>22f3421</code></a> docs: update OpenWiki (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40218">#40218</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/1c40140b3daf80c5baa7427d707ef2beb6c404b2"><code>1c40140</code></a> chore(deps): bump httpx2 from 2.10.0 to 2.12.0 in /libs/partners/openai (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40309">#40309</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/db613a96050bc6e594fdcd618af7532264dcceb8"><code>db613a9</code></a> fix(openai): bump <code>max_completion_tokens</code> in cache breakpoint integration tes...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/9f2eb7f46719742875ebea9e31d53e168e8b81a2"><code>9f2eb7f</code></a> release(openai): 1.6.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40268">#40268</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/765eb32901fa524e1428f94a9ee91b371a63ab62"><code>765eb32</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40277">#40277</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/e670c7a03ba36fd1516f0185f7ec1186c89aa471"><code>e670c7a</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40258">#40258</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-openai==1.6.0...langchain-openai==1.6.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [langchain](https://github.com/langchain-ai/langchain) from 1.4.0 to 1.4.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain's releases</a>.</em></p> <blockquote> <h2>langchain-openai==1.4.2</h2> <p>Changes since langchain-openai==1.4.1</p> <p>release(openai): 1.4.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39322">#39322</a>) fix(openai): handle <code>ContextWindowExceededError</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39300">#39300</a>) chore: bump the minor-and-patch group across 3 directories with 7 updates (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39187">#39187</a>) fix(openai): filter langchain-generated content block IDs (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39209">#39209</a>) fix(openai): preserve Responses <code>text</code> options (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39204">#39204</a>) fix(openai): redact MCP <code>authorization</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39155">#39155</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39050">#39050</a>)</p> <h2>langchain==1.4.2</h2> <p>Changes since langchain==1.4.1</p> <p>release(langchain): 1.4.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40621">#40621</a>) fix(langchain): preserve model-generated tool calls in HITL tool call edits and add notice to ToolMessage (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40463">#40463</a>)</p> <h2>langchain-openai==1.4.1</h2> <p>Changes since langchain-openai==1.4.0</p> <p>release(openai): 1.4.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39045">#39045</a>) feat(anthropic,fireworks,openai): support langsmith gateway through env var (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38742">#38742</a>) fix(openai): correct <code>gpt-5.3-chat-latest</code> profile (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39009">#39009</a>)</p> <h2>langchain-perplexity==1.4.1</h2> <p>Changes since langchain-perplexity==1.4.0</p> <p>release(perplexity): 1.4.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39826">#39826</a>) fix(perplexity): include type="message" on Responses input items (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39774">#39774</a>) fix(perplexity): preserve caller <code>extra_body</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39203">#39203</a>) chore: bump pillow from 12.2.0 to 12.3.0 in /libs/partners/perplexity (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38991">#38991</a>) chore(deps): refresh lockfiles (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38746">#38746</a>) fix(perplexity): use supported Responses API model (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38337">#38337</a>) chore: bump vcrpy from 8.1.1 to 8.2.1 in /libs/partners/perplexity (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38290">#38290</a>) chore: bump langsmith from 0.8.5 to 0.8.18 in /libs/partners/perplexity (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38289">#38289</a>) docs: refresh <code>README</code> installation and resources (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38119">#38119</a>) release(core): 1.4.7 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38111">#38111</a>) fix(core,partners): rename package version trace metadata (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38110">#38110</a>) style(core,langchain,langchain-classic,partners): replace double backticks in docstrings (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38095">#38095</a>) release(core): 1.4.6 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38061">#38061</a>) feat(core,partners): add package version tracking to tracing metadata (<a href="https://redirect.github.com/langchain-ai/langchain/issues/35295">#35295</a>) chore(infra): bump mypy to 2.1 and unify type-check config across the monorepo (<a href="https://redirect.github.com/langchain-ai/langchain/issues/36470">#36470</a>) feat(standard-tests): validate tool call chunks during streaming (<a href="https://redirect.github.com/langchain-ai/langchain/issues/34707">#34707</a>) chore(partners): bump locks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38052">#38052</a>)</p> <h2>langchain==1.4.1</h2> <p>Changes since langchain==1.4.0</p> <p>release(langchain): 1.4.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40498">#40498</a>) fix(langchain): preserve open MCP object arguments (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40414">#40414</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/a18de590e7ccf5c647fbf3d689e5f1a15f78e9f5"><code>a18de59</code></a> release(langchain): 1.4.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40621">#40621</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/5bf6a15466cad3313a4ba906a88486215f0f42b7"><code>5bf6a15</code></a> fix(langchain): preserve model-generated tool calls in HITL tool call edits a...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/a893bbda77f69d75bd7579c4450bad04891b5aab"><code>a893bbd</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40600">#40600</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/fd4f1615359371fbb1b3b2de9183a18a15ee9e34"><code>fd4f161</code></a> chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/text-splitters (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40579">#40579</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/3b81e028b1598548d575b55e9ad32cf586743885"><code>3b81e02</code></a> chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/chroma (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40582">#40582</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/fa369c965bb280c2b3de8c4cb9a7642e2c6a6328"><code>fa369c9</code></a> chore(deps): bump langsmith from 0.12.1 to 0.12.6 in /libs/partners/chroma (#...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/eb544d31d5ac3eb6327fbb7eaa3b6c87d62d3c80"><code>eb544d3</code></a> chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/fireworks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/4">#4</a>...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/5e8888f7e644ca0c3ee95559aa115d8db66fd2ea"><code>5e8888f</code></a> chore(deps): bump filelock from 3.32.5 to 4.0.0 in /libs/partners/chroma (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40">#40</a>...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/a62361a6d93c3554d7d7521541cacee7f7188b29"><code>a62361a</code></a> chore(deps): bump langsmith from 0.12.1 to 0.12.6 in /libs/partners/fireworks...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/e2d39c4cdbf4b9479a5e0bd8d2742dc541e170d7"><code>e2d39c4</code></a> chore(deps): bump pygments from 2.20.0 to 2.21.0 in /libs/partners/fireworks ...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain==1.4.0...langchain==1.4.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [langgraph](https://github.com/langchain-ai/langgraph) from 1.2.11 to 1.2.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langgraph/releases">langgraph's releases</a>.</em></p> <blockquote> <h2>langgraph==1.2.12</h2> <p>Changes since 1.2.11</p> <ul> <li>release(langgraph): 1.2.12 (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8987">#8987</a>)</li> <li>chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/langgraph (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8958">#8958</a>)</li> <li>feat(langgraph): add response_schema to interrupt() (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8886">#8886</a>)</li> <li>fix(langgraph): type undeclared v3 stream projections (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8596">#8596</a>)</li> <li>chore(langgraph): bump mistune to 3.3.4 (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8804">#8804</a>)</li> <li>chore(deps): bump the minor-and-patch group across 1 directory with 7 updates (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8779">#8779</a>)</li> <li>chore(deps): bump the minor-and-patch group across 1 directory with 4 updates (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8782">#8782</a>)</li> <li>chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/langgraph (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8792">#8792</a>)</li> <li>chore(deps): bump the major group in /libs/langgraph with 2 updates (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8783">#8783</a>)</li> <li>fix(langgraph): detect subgraphs from bytecode instead of source (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8569">#8569</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langgraph/commit/49cce0ca852be4cfb567a1cbe0e511ff325a1682"><code>49cce0c</code></a> release(sdk-py): 0.4.5 (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8988">#8988</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/19273fa88bbb791f94aafabe78b658d4d255624b"><code>19273fa</code></a> release(langgraph): 1.2.12 (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8987">#8987</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/ed384f3a124660db6dccd6c53eaad48e1457e0b5"><code>ed384f3</code></a> fix(cli): remediate AnyIO vulnerabilities in example lockfiles (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/9022">#9022</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/aa742fb31e2827d569b843e3600aeda2e0528e4b"><code>aa742fb</code></a> chore(deps): bump anyio from 4.14.2 to 4.15.1 in /libs/sdk-py (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8997">#8997</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/b58044ac7a5f4b94b126eca0311c512a98d16f2f"><code>b58044a</code></a> chore(deps): bump anyio from 4.13.0 to 4.14.2 in /libs/cli (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8998">#8998</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/daa514a98863fbe555aeb8a8c7255fc48d06e037"><code>daa514a</code></a> chore(deps): bump anyio from 4.13.0 to 4.14.2 in /libs/checkpoint-conformance...</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/022043a67991192513f564c33f72d35cd705cabd"><code>022043a</code></a> chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/checkpoint (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8995">#8995</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/d7b99cc3ab40a3670d97d4d51d920959c69985ca"><code>d7b99cc</code></a> chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/sdk-py (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8994">#8994</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/b19edd783bc123ee5bb17e53d2dab01cb9d222ae"><code>b19edd7</code></a> chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/checkpoint-sqlite (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8993">#8993</a>)</li> <li><a href="https://github.com/langchain-ai/langgraph/commit/c81c13533ee48c1ae0ef2de314737ef0c455f2be"><code>c81c135</code></a> chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/langgraph (<a href="https://redirect.github.com/langchain-ai/langgraph/issues/8958">#8958</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langgraph/compare/1.2.11...1.2.12">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [ruff](https://github.com/astral-sh/ruff) from 0.16.8 to 0.16.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.9</h2> <h2>Release Notes</h2> <p>Released on 2026-09-24.</p> <h3>Preview features</h3> <ul> <li>[<code>ruff</code>] Avoid false positives for overloaded division (<code>RUF069</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28309">#28309</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-bugbear</code>] Avoid false positives for calls with keyword arguments (<code>B009</code>, <code>B010</code>, <code>B043</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28776">#28776</a>)</li> <li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in deferred annotations (<code>TID255</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28767">#28767</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Update LibCST-based fixes for Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28616">#28616</a>)</li> <li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message (<code>PYI002</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28542">#28542</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix horizontal overflow on the rules documentation page (<a href="https://redirect.github.com/astral-sh/ruff/pull/28699">#28699</a>)</li> <li>Update rules table with category information (<a href="https://redirect.github.com/astral-sh/ruff/pull/28651">#28651</a>)</li> <li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code> checks return types in addition to arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28334">#28334</a>)</li> <li>[<code>flake8-bugbear</code>] Document type-checker interaction (<code>B010</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28509">#28509</a>)</li> <li>[<code>flake8-comprehensions</code>] Document <code>map</code>/generator exception behavior (<code>C417</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27794">#27794</a>)</li> <li>[<code>ruff</code>] Mention related isort settings (<code>RUF022</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28719">#28719</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/qinpei-dev"><code>@qinpei-dev</code></a></li> <li><a href="https://github.com/sanjayrohith"><code>@sanjayrohith</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/webdevsamran"><code>@webdevsamran</code></a></li> <li><a href="https://github.com/zaniebot"><code>@zaniebot</code></a></li> <li><a href="https://github.com/ewdurbin"><code>@ewdurbin</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@MichaReiser</code></a></li> <li><a href="https://github.com/spaceone"><code>@spaceone</code></a></li> <li><a href="https://github.com/IbrahimKhan12"><code>@IbrahimKhan12</code></a></li> <li><a href="https://github.com/devtechedge"><code>@devtechedge</code></a></li> <li><a href="https://github.com/GruffElixir"><code>@GruffElixir</code></a></li> </ul> <h2>Install ruff 0.16.9</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh | sh </code></pre> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.9</h2> <p>Released on 2026-09-24.</p> <h3>Preview features</h3> <ul> <li>[<code>ruff</code>] Avoid false positives for overloaded division (<code>RUF069</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28309">#28309</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-bugbear</code>] Avoid false positives for calls with keyword arguments (<code>B009</code>, <code>B010</code>, <code>B043</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28776">#28776</a>)</li> <li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in deferred annotations (<code>TID255</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28767">#28767</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Update LibCST-based fixes for Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28616">#28616</a>)</li> <li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message (<code>PYI002</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28542">#28542</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix horizontal overflow on the rules documentation page (<a href="https://redirect.github.com/astral-sh/ruff/pull/28699">#28699</a>)</li> <li>Update rules table with category information (<a href="https://redirect.github.com/astral-sh/ruff/pull/28651">#28651</a>)</li> <li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code> checks return types in addition to arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28334">#28334</a>)</li> <li>[<code>flake8-bugbear</code>] Document type-checker interaction (<code>B010</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28509">#28509</a>)</li> <li>[<code>flake8-comprehensions</code>] Document <code>map</code>/generator exception behavior (<code>C417</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27794">#27794</a>)</li> <li>[<code>ruff</code>] Mention related isort settings (<code>RUF022</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28719">#28719</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/qinpei-dev"><code>@qinpei-dev</code></a></li> <li><a href="https://github.com/sanjayrohith"><code>@sanjayrohith</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/webdevsamran"><code>@webdevsamran</code></a></li> <li><a href="https://github.com/zaniebot"><code>@zaniebot</code></a></li> <li><a href="https://github.com/ewdurbin"><code>@ewdurbin</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@MichaReiser</code></a></li> <li><a href="https://github.com/spaceone"><code>@spaceone</code></a></li> <li><a href="https://github.com/IbrahimKhan12"><code>@IbrahimKhan12</code></a></li> <li><a href="https://github.com/devtechedge"><code>@devtechedge</code></a></li> <li><a href="https://github.com/GruffElixir"><code>@GruffElixir</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1"><code>0be08a2</code></a> Bump version to 0.16.9 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28882">#28882</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02"><code>b4920b7</code></a> Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28881">#28881</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18"><code>47c751b</code></a> Update dependency astral-sh/uv to v0.12.18 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28880">#28880</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c"><code>8c244e5</code></a> [<code>flake8-comprehensions</code>] Document <code>map</code>/generator exception behavior (<code>C417</code>...</li> <li><a href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d"><code>5edf5a1</code></a> Use <code>target</code> form in <code>rooster.version_files</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28876">#28876</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b"><code>915bb2b</code></a> [ty] Prefer existing @ paths over response files in Ruff and ty (<a href="https://redirect.github.com/astral-sh/ruff/issues/28877">#28877</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7"><code>4710e1a</code></a> ci(github): update version number in placeholder of issue template (<a href="https://redirect.github.com/astral-sh/ruff/issues/28871">#28871</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca"><code>eedfc62</code></a> [ty] Propagate outer type context through cast calls (<a href="https://redirect.github.com/astral-sh/ruff/issues/28855">#28855</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1"><code>ceaa6a0</code></a> [ty] Contain rendered code within Markdown fences (<a href="https://redirect.github.com/astral-sh/ruff/issues/28869">#28869</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff"><code>dba0f30</code></a> authorize ruff-pre-commit dispatch via OIDC (<a href="https://redirect.github.com/astral-sh/ruff/issues/28867">#28867</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.8...0.16.9">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [langchain-fireworks](https://github.com/langchain-ai/langchain) from 1.6.1 to 1.6.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-fireworks's releases</a>.</em></p> <blockquote> <h2>langchain-fireworks==1.6.3</h2> <p>Changes since langchain-fireworks==1.6.2</p> <p>release(fireworks): 1.6.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40834">#40834</a>) fix(fireworks): declare native PDF inputs unsupported (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40814">#40814</a>) fix(fireworks): preserve malformed tool arguments as diagnostic JSON (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40818">#40818</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40804">#40804</a>)</p> <h2>langchain-fireworks==1.6.2</h2> <p>Changes since langchain-fireworks==1.6.1</p> <p>fix(fireworks): use current completions model in LLM tests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40740">#40740</a>) hotfix(fireworks): use available model in LLM tests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40737">#40737</a>) release(fireworks): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40735">#40735</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40665">#40665</a>) chore(deps): bump anyio from 4.11.0 to 4.14.2 in /libs/partners/fireworks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40639">#40639</a>) chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/partners/fireworks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40587">#40587</a>) chore(deps): bump langsmith from 0.12.1 to 0.12.6 in /libs/partners/fireworks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40586">#40586</a>) chore(deps): bump pygments from 2.20.0 to 2.21.0 in /libs/partners/fireworks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40585">#40585</a>) chore(deps): bump idna from 3.19 to 3.20 in /libs/partners/fireworks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40584">#40584</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40541">#40541</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40500">#40500</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40452">#40452</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40416">#40416</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40399">#40399</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40277">#40277</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40217">#40217</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40198">#40198</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40171">#40171</a>) chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40009">#40009</a>) chore(deps): bump orjson from 3.11.6 to 3.12.0 in /libs/partners/fireworks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40129">#40129</a>) chore(deps): bump langsmith from 0.10.16 to 0.12.1 in /libs/partners/fireworks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40130">#40130</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/e75dae1f53c99c2b5ddb0c7bb36022c6aea25569"><code>e75dae1</code></a> release(fireworks): 1.6.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40834">#40834</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/38cee0db98b11352210dee5e391fdc2dc3add974"><code>38cee0d</code></a> fix(fireworks): declare native PDF inputs unsupported (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40814">#40814</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/846e1611216ff58108840cde49f72f6aca683565"><code>846e161</code></a> feat(openai): discover Azure workload identity (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40532">#40532</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/fbd70b73d430df143c489465c426da7facdb8d9b"><code>fbd70b7</code></a> fix(fireworks): preserve malformed tool arguments as diagnostic JSON (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40818">#40818</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/c5ab14d42a3e22865c9def909de0b11d70b0bbf0"><code>c5ab14d</code></a> release(core): 1.6.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40816">#40816</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/5704d9d4813f8c0527f04e2662cf313e1350f96f"><code>5704d9d</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40804">#40804</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/7622d3dce760ac4be6d9aef4c653277e06064aea"><code>7622d3d</code></a> release(openai): 1.6.6 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40800">#40800</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/2dd956b8add667dac4f97605ae441d75b8ae228e"><code>2dd956b</code></a> docs(infra): fix AGENTS.md root setup guidance and package doc accuracy (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40794">#40794</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/49f4b4016b82513c3dc1623bf3daa10453861621"><code>49f4b40</code></a> fix(openai): raise on error events in stream path (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40791">#40791</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/19cadaa1a1e0cac71f3148e2f18b414dcab17426"><code>19cadaa</code></a> fix(core): abbreviate long tool IDs in XML buffer strings (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40792">#40792</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-fireworks==1.6.1...langchain-fireworks==1.6.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [langchain-openai](https://github.com/langchain-ai/langchain) from 1.6.2 to 1.6.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-openai's releases</a>.</em></p> <blockquote> <h2>langchain-openai==1.6.6</h2> <p>Changes since langchain-openai==1.6.5</p> <p>release(openai): 1.6.6 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40800">#40800</a>) fix(openai): raise on error events in stream path (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40791">#40791</a>)</p> <h2>langchain-openai==1.6.5</h2> <p>Changes since langchain-openai==1.6.4</p> <p>release(openai): 1.6.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40787">#40787</a>) fix(anthropic): add Opus 5.5 and GPT-6 profile augmentations (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40785">#40785</a>) feat(anthropic,openai): mid-conversation tool changes on <code>SystemMessage</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40758">#40758</a>)</p> <h2>langchain-openai==1.6.4</h2> <p>Changes since langchain-openai==1.6.3</p> <p>release(openai): 1.6.4 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40775">#40775</a>) chore(model-profiles): refresh openai model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40774">#40774</a>)</p> <h2>langchain-openai==1.6.3</h2> <p>Changes since langchain-openai==1.6.2</p> <p>release(openai): 1.6.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40719">#40719</a>) fix(openai): expose inferred Responses API routing at initialization (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40715">#40715</a>) chore(deps): bump anyio from 4.11.0 to 4.14.2 in /libs/partners/openai (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40629">#40629</a>) fix(openai): support GPT-6 request constraints (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40443">#40443</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/7622d3dce760ac4be6d9aef4c653277e06064aea"><code>7622d3d</code></a> release(openai): 1.6.6 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40800">#40800</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/2dd956b8add667dac4f97605ae441d75b8ae228e"><code>2dd956b</code></a> docs(infra): fix AGENTS.md root setup guidance and package doc accuracy (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40794">#40794</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/49f4b4016b82513c3dc1623bf3daa10453861621"><code>49f4b40</code></a> fix(openai): raise on error events in stream path (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40791">#40791</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/19cadaa1a1e0cac71f3148e2f18b414dcab17426"><code>19cadaa</code></a> fix(core): abbreviate long tool IDs in XML buffer strings (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40792">#40792</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/798441e8b07e88e79db355db452cd9492f9628f2"><code>798441e</code></a> chore(anthropic): fix integration test cassette (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40790">#40790</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/a476942bac3fe5e521676d0f53fabafcb7ba71b1"><code>a476942</code></a> release(openai): 1.6.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40787">#40787</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/46c6bdf1b4e23028a5acc060d8b2797dbf200291"><code>46c6bdf</code></a> release(anthropic): 1.7.4 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40786">#40786</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/290dabaff27ee379920d55d155d5055d2fe29cc8"><code>290daba</code></a> fix(anthropic): add Opus 5.5 and GPT-6 profile augmentations (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40785">#40785</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/59baeb26d6cba54329a626ccf883d0f3a20ff44f"><code>59baeb2</code></a> feat(anthropic,openai): mid-conversation tool changes on <code>SystemMessage</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40">#40</a>...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4b6599640691866c7328a0158944bdc524bc962f"><code>4b65996</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40780">#40780</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-openai==1.6.2...langchain-openai==1.6.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [langchain-anthropic](https://github.com/langchain-ai/langchain) from 1.7.2 to 1.7.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-anthropic's releases</a>.</em></p> <blockquote> <h2>langchain-anthropic==1.7.4</h2> <p>Changes since langchain-anthropic==1.7.3</p> <p>chore(anthropic): fix integration test cassette (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40790">#40790</a>) release(anthropic): 1.7.4 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40786">#40786</a>) fix(anthropic): add Opus 5.5 and GPT-6 profile augmentations (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40785">#40785</a>) feat(anthropic,openai): mid-conversation tool changes on <code>SystemMessage</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40758">#40758</a>)</p> <h2>langchain-anthropic==1.7.3</h2> <p>Changes since langchain-anthropic==1.7.2</p> <p>release(anthropic): 1.7.3 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40773">#40773</a>) chore(model-profiles): refresh anthropic model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40772">#40772</a>) fix(anthropic): auto-route <code>with_structured_output</code> to <code>method="json_schema"</code> for fable and opus 5.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40766">#40766</a>) chore(anthropic): update docs for Opus 5.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40765">#40765</a>) feat(anthropic): send mid-conversation <code>SystemMessage</code>s in place (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40622">#40622</a>) chore(deps): bump anyio from 4.11.0 to 4.14.2 in /libs/partners/anthropic (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40643">#40643</a>)</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/798441e8b07e88e79db355db452cd9492f9628f2"><code>798441e</code></a> chore(anthropic): fix integration test cassette (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40790">#40790</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/a476942bac3fe5e521676d0f53fabafcb7ba71b1"><code>a476942</code></a> release(openai): 1.6.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40787">#40787</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/46c6bdf1b4e23028a5acc060d8b2797dbf200291"><code>46c6bdf</code></a> release(anthropic): 1.7.4 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40786">#40786</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/290dabaff27ee379920d55d155d5055d2fe29cc8"><code>290daba</code></a> fix(anthropic): add Opus 5.5 and GPT-6 profile augmentations (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40785">#40785</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/59baeb26d6cba54329a626ccf883d0f3a20ff44f"><code>59baeb2</code></a> feat(anthropic,openai): mid-conversation tool changes on <code>SystemMessage</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40">#40</a>...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4b6599640691866c7328a0158944bdc524bc962f"><code>4b65996</code></a> chore(model-profiles): refresh model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40780">#40780</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/c36e3f826fb7b66c746b8235ef83ab3910dd32be"><code>c36e3f8</code></a> chore(infra): remove Claude instructions and sync workflow (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40779">#40779</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/0c40dbf4892bbbb6aa0cfcde2736a423c1f19409"><code>0c40dbf</code></a> docs: update OpenWiki (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40750">#40750</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/9fa192ea35cfce616ef655ba854f7a3eb019ebeb"><code>9fa192e</code></a> release(openai): 1.6.4 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40775">#40775</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/af6e0dbefd08b71d0fe6f0f7aaac769f4c15a22c"><code>af6e0db</code></a> chore(model-profiles): refresh openai model profile data (<a href="https://redirect.github.com/langchain-ai/langchain/issues/40774">#40774</a>)</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-anthropic==1.7.2...langchain-anthropic==1.7.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the uv group with 2 updates in the / directory: [pyjwt](https://github.com/jpadilla/pyjwt) and [urllib3](https://github.com/urllib3/urllib3). Updates `pyjwt` from 2.13.0 to 2.15.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.15.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst">2.15.0 changelog</a> for complete release details.</p> <h2>2.14.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst">2.14.0 changelog</a> for the complete release details and related security advisories.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0></code>__</h2> <p>Security</p> <pre><code> - Wrap recursion errors from deeply nested JWT payloads in ``DecodeError`` instead of exposing a raw ``RecursionError``. <p>Added</p> <pre><code> - Support Python 3.15 by @kytta in `[#1202](jpadilla/pyjwt#1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__ Changed </code></pre> <ul> <li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code> rather than the raw JWKS payload, so a cache hit no longer re-parses every key. <code>JWKSetCache.put()</code> accepts either form and raises <code>PyJWKSetError</code> for anything else. As a result, <code>PyJWKClient.get_jwk_set()</code> returns the same <code>PyJWKSet</code> instance for as long as it stays cached, rather than a freshly built one per call in <code>[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> <li><code>PyJWKClient.fetch_data()</code> now raises <code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)</code> when the endpoint response is not a JSON object, instead of returning it for <code>get_jwk_set()</code> to reject. Callers reaching the JWKS through <code>get_jwk_set()</code> see the same error as before in <code>[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> </ul> <p>Fixed</p> <pre><code> - Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value, so callers pre-populating the cache to avoid a network round-trip could not read it back in `[#914](jpadilla/pyjwt#914) &lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and `[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a ``fetch_data()`` override that filters or transforms the JWKS is no longer undone by the next cache hit in `[#1208](jpadilla/pyjwt#1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - Raise the documented ``PyJWTError`` subclass instead of leaking a ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a non-numeric, non-string value such as a list, dict, or ``null``. - Reject OKP JWK private keys when their public ``x`` component does not match the private ``d`` component. - Treat malformed JWK Set members as unusable keys rather than letting ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="jpadilla/pyjwt@1d41a6478e1562e68ff667fcd703356acf085f68"><code>1d41a64</code></a> chore: prepare 2.15.0 release</li> <li><a href="jpadilla/pyjwt@9bc06658f875b9b40091539140bbbdc4639161c3"><code>9bc0665</code></a> fix: make recursive payload tests deterministic</li> <li><a href="jpadilla/pyjwt@5fde08a6cf906aa7698de2d6391d88b73006b17b"><code>5fde08a</code></a> fix: normalize recursive JWT payload errors</li> <li><a href="jpadilla/pyjwt@171062d2d734315272a901100aa4b109f2fc3c19"><code>171062d</code></a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173">#1173</a>)</li> <li><a href="jpadilla/pyjwt@c9d4d5375bf464ef363506fed9eb6e7f33217ab6"><code>c9d4d53</code></a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174">#1174</a>)</li> <li><a href="jpadilla/pyjwt@2763752196113e1473b0ed7905aa6034aedfbe53"><code>2763752</code></a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202">#1202</a>)</li> <li><a href="jpadilla/pyjwt@4adcd02722f5011c60079d3978dfc167b9a8eaa5"><code>4adcd02</code></a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201">#1201</a>)</li> <li><a href="jpadilla/pyjwt@9e501d993b4d3e7dba14bdb1722b1d993ac75097"><code>9e501d9</code></a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179">#1179</a>)</li> <li><a href="jpadilla/pyjwt@4047c44d51950ffda15f40054508d3f17c43b1e2"><code>4047c44</code></a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212">#1212</a>)</li> <li><a href="jpadilla/pyjwt@f4e2b59f543cc82d46d9d69922bba59e804216b9"><code>f4e2b59</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210">#1210</a>)</li> <li>Additional commits viewable in <a href="jpadilla/pyjwt@2.13.0...2.15.0">compare view</a></li> </ul> </details> <br /></code></pre> Updates `urllib3` from 2.7.0 to 2.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](urllib3/urllib3#5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](urllib3/urllib3#4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](urllib3/urllib3#5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/react-agent/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.