Skip to content

deps(deps): bump the python-all group with 5 updates - #498

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/python-all-87d1b17a32
Closed

deps(deps): bump the python-all group with 5 updates#498
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/python-all-87d1b17a32

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-all group with 5 updates:

Package From To
uv 0.11.26 0.11.28
fastmcp 3.4.3 3.4.4
openai 2.44.0 2.45.0
websockets 16.0 16.1
build 1.5.0 1.5.1

Updates uv from 0.11.26 to 0.11.28

Release notes

Sourced from uv's releases.

0.11.28

Release Notes

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

  • Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

  • Improve trace logs for unexpected error chains (#20220)
  • Move lockfile update guidance to a hint (#20219)
  • Preserve indentation for multiline error causes (#20156)
  • Render user errors with their cause chains (#20217)
  • Route final command errors through the printer to respect -q and -qq (#20163)
  • Use standard rendering for uv build errors (#20159)
  • Use standard rendering for tool requirement errors (#20160)

Performance

  • Only compile bytecode for installed distributions in uv pip install (#19914)
  • Avoid allocating URL-safe Git revisions (#20194)
  • Avoid allocating canonical Python request strings (#20193)
  • Avoid allocating custom Astral mirror URLs (#20204)
  • Avoid allocating expanded compatibility tags (#20190)
  • Avoid allocating shell strings that need no escaping (#20196)
  • Avoid allocating static ABI descriptions (#20201)
  • Avoid allocating static Windows executable names (#20200)
  • Avoid allocating static dependency table names (#20199)
  • Avoid allocating static platform triple components (#20195)
  • Avoid allocating static resolver report labels (#20198)
  • Avoid allocating static unavailable-version messages (#20197)
  • Avoid allocating unchanged Python download architectures (#20202)
  • Avoid allocating unchanged paths during case normalization (#20203)
  • Avoid allocations when expanding group conflicts (#20211)
  • Avoid allocations when formatting requirements (#20206)
  • Avoid cloning credential lookup services (#20210)
  • Avoid cloning dry-run distributions (#20209)
  • Avoid cloning owned dependency metadata (#20212)
  • Avoid redundant direct URL clones (#20207)
  • Create metadata version errors lazily (#20205)
  • Optimize expanded tag compatibility checks (#20171)
  • Optimize parsing of single-digit three-part versions (#20118)

... (truncated)

Changelog

Sourced from uv's changelog.

0.11.28

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

  • Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

  • Improve trace logs for unexpected error chains (#20220)
  • Move lockfile update guidance to a hint (#20219)
  • Preserve indentation for multiline error causes (#20156)
  • Render user errors with their cause chains (#20217)
  • Route final command errors through the printer to respect -q and -qq (#20163)
  • Use standard rendering for uv build errors (#20159)
  • Use standard rendering for tool requirement errors (#20160)

Performance

  • Only compile bytecode for installed distributions in uv pip install (#19914)
  • Avoid allocating URL-safe Git revisions (#20194)
  • Avoid allocating canonical Python request strings (#20193)
  • Avoid allocating custom Astral mirror URLs (#20204)
  • Avoid allocating expanded compatibility tags (#20190)
  • Avoid allocating shell strings that need no escaping (#20196)
  • Avoid allocating static ABI descriptions (#20201)
  • Avoid allocating static Windows executable names (#20200)
  • Avoid allocating static dependency table names (#20199)
  • Avoid allocating static platform triple components (#20195)
  • Avoid allocating static resolver report labels (#20198)
  • Avoid allocating static unavailable-version messages (#20197)
  • Avoid allocating unchanged Python download architectures (#20202)
  • Avoid allocating unchanged paths during case normalization (#20203)
  • Avoid allocations when expanding group conflicts (#20211)
  • Avoid allocations when formatting requirements (#20206)
  • Avoid cloning credential lookup services (#20210)
  • Avoid cloning dry-run distributions (#20209)
  • Avoid cloning owned dependency metadata (#20212)
  • Avoid redundant direct URL clones (#20207)
  • Create metadata version errors lazily (#20205)
  • Optimize expanded tag compatibility checks (#20171)
  • Optimize parsing of single-digit three-part versions (#20118)

... (truncated)

Commits

Updates fastmcp from 3.4.3 to 3.4.4

Release notes

Sourced from fastmcp's releases.

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

What's Changed

Enhancements ✨

Fixes 🐞

Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v3.4.3...v3.4.4

Changelog

Sourced from fastmcp's changelog.

title: "Changelog" icon: "list-check" rss: true tag: NEW

v3.4.4: Host in Translation

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

Enhancements ✨

Fixes 🐞

New Contributors

Full Changelog: v3.4.3...v3.4.4

v3.4.3: The Fast and the Secure-ious

FastMCP 3.4.3 closes out a month of SSRF and OAuth hardening: NAT64, 6to4, Teredo, and ISATAP transition addresses can no longer smuggle private IPv4 targets past the SSRF allow-list, Streamable HTTP now validates Host and Origin before session handling to block DNS rebinding against localhost-bound servers, and OAuth redirect validation rejects unsafe schemes and unregistered DCR redirect URIs. Alongside the security work, this release also fixes proxy session teardown races, discriminator-tag handling in JSON schema conversion, and several smaller reliability issues.

Enhancements ✨

  • Dedupe discriminator-required helper across schema converters by @​jlowin in #4362
  • Add real Monty sandbox e2e coverage for CodeMode call_tool by @​AlexlaGuardia in #4274
  • Switch prettier hook to rbubley/mirrors-prettier by @​jlowin in #4366
  • feat(remote): add --verify flag for TLS certificate verification by @​jlowin in #4369

Security 🔒

Fixes 🐞

  • fix: caching middleware TypeError on cache miss due to mismatched call_next parameter by @​gmenziesint in #4301
  • Fix: async rate limiting middleware get_client_id callbacks by @​Chotom in #4319

... (truncated)

Commits

Updates openai from 2.44.0 to 2.45.0

Release notes

Sourced from openai's releases.

v2.45.0

2.45.0 (2026-07-09)

Full Changelog: v2.44.0...v2.45.0

Features

  • api: gpt-5.6-sol updates (039d1fe)

Bug Fixes

  • api: restore beta resource accessors (2dfc130)

Chores

  • retrigger release automation (7b61351)
Changelog

Sourced from openai's changelog.

2.45.0 (2026-07-09)

Full Changelog: v2.44.0...v2.45.0

Features

  • api: gpt-5.6-sol updates (039d1fe)

Bug Fixes

  • api: restore beta resource accessors (2dfc130)

Chores

  • retrigger release automation (7b61351)
Commits

Updates websockets from 16.0 to 16.1

Release notes

Sourced from websockets's releases.

16.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits
  • 4df6f90 Release version 16.1.
  • 7c69eca Increase timeout for building wheels.
  • 493864e Complete and review changelog.
  • 73ff538 Temporarily remove the trio implementation (again).
  • 77f7d71 Shorten changelog and docstring for previous commit.
  • 84859e1 Add text argument to broadcast() to force the frame type
  • 1a38f5a Document research on removing a workaround.
  • 99431ee Apply code style to docs/conf.py.
  • bf97b98 Fix typos in tests.
  • 21a3418 Fix typos in comments
  • Additional commits viewable in compare view

Updates build from 1.5.0 to 1.5.1

Release notes

Sourced from build's releases.

1.5.1

What's Changed

... (truncated)

Changelog

Sourced from build's changelog.

#################### 1.5.1 (2026-07-09) ####################

Features

  • Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
  • The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
  • The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
  • Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
  • Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds - by :user:gaborbernat (:issue:655)
  • Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
  • On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

Bugfixes

  • Drain verbose subprocess output inline instead of using a ThreadPoolExecutor, which silently swallowed logging errors - by :user:henryiii (:issue:1098)
  • Reject a file passed as --env-dir with a clear error instead of a raw FileExistsError - by :user:henryiii (:issue:1100)
  • Emit CLI warnings to stderr instead of stdout, so they no longer corrupt --metadata JSON output on stdout - by :user:ymyzk (:issue:1111)
  • Fix the Windows symlink support probe always returning False due to a stale object interpolated into the destination path - by :user:henryiii (:issue:1118)
  • Fix metadata_path's build-backend fallback returning a nonexistent dist-info path for wheels with a build tag - by :user:henryiii (:issue:1119)
  • Write pip/uv requirements and constraints files with \n instead of os.linesep, avoiding doubled \r\r\n line endings on Windows - by :user:henryiii (:issue:1120)
  • Batch of small robustness fixes: correct macOS release parsing for the minimum pip version, avoid sharing the mutable default build-system table between builders, keep the original error when isolated-environment setup fails early, and raise BuildException for an invalid wheel - by :user:henryiii (:issue:1121)
  • Decide color support independently for stdout and stderr instead of only checking stdout.isatty(), so redirecting one stream no longer disables or leaks ANSI colors on the other - by :user:henryiii (:issue:1123)

Deprecations and Removals

  • Deprecate :func:build.util.project_wheel_metadata; use python -m build --metadata instead - by :user:gaborbernat (:issue:557)
  • Warn on config settings without a value (e.g. -C--my-flag); use -C--my-flag= instead for compatibility with pip

... (truncated)

Commits
  • d08fcd7 chore: prepare for 1.5.1
  • 135801c test: isolate color tests from NO_COLOR and FORCE_COLOR (#1128)
  • 820d4e5 perf: memoize check_dependency (#1122)
  • 6c03264 pre-commit: bump repositories (#1127)
  • 43c337a refactor: simplify code paths found in review (#1124)
  • 260ae22 fix: minor robustness fixes from code review (#1121)
  • 100e86e refactor: open the wheel only once in metadata_path (#1126)
  • 272db6c fix: decide color support per output stream, not solely from stdout (#1123)
  • bc4ca7c fix: use LF instead of os.linesep when writing pip/uv requirements files (#1120)
  • 16d8143 fix: derive dist-info directory from wheel contents, not filename (#1119)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(deps): bump the python-all group with 5 updates
3a1805e 
Bumps the python-all group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [uv](https://github.com/astral-sh/uv) | `0.11.26` | `0.11.28` |
| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `3.4.3` | `3.4.4` |
| [openai](https://github.com/openai/openai-python) | `2.44.0` | `2.45.0` |
| [websockets](https://github.com/python-websockets/websockets) | `16.0` | `16.1` |
| [build](https://github.com/pypa/build) | `1.5.0` | `1.5.1` |


Updates `uv` from 0.11.26 to 0.11.28
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.11.26...0.11.28)

Updates `fastmcp` from 3.4.3 to 3.4.4
- [Release notes](https://github.com/PrefectHQ/fastmcp/releases)
- [Changelog](https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx)
- [Commits](PrefectHQ/fastmcp@v3.4.3...v3.4.4)

Updates `openai` from 2.44.0 to 2.45.0
- [Release notes](https://github.com/openai/openai-python/releases)
- [Changelog](https://github.com/openai/openai-python/blob/main/CHANGELOG.md)
- [Commits](openai/openai-python@v2.44.0...v2.45.0)

Updates `websockets` from 16.0 to 16.1
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@16.0...16.1)

Updates `build` from 1.5.0 to 1.5.1
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.5.0...1.5.1)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.11.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-all
- dependency-name: fastmcp
  dependency-version: 3.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-all
- dependency-name: openai
  dependency-version: 2.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-all
- dependency-name: websockets
  dependency-version: '16.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-all
- dependency-name: build
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github

dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 15, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python-all-87d1b17a32 branch July 15, 2026 09:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants