Skip to content

build(deps): Bump the python-minor-and-patch group across 1 directory with 39 updates - #433

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-5cfeb48abb
Closed

build(deps): Bump the python-minor-and-patch group across 1 directory with 39 updates#433
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-minor-and-patch-5cfeb48abb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the python-minor-and-patch group with 39 updates in the / directory:

Package From To
certifi 2026.6.17 2026.10.23
cryptography 50.0.1 50.0.2
jsonschema 4.23.0 4.26.0
litellm 1.96.0 1.106.6
mcp 1.28.1 1.30.0
packaging 26.2 26.3
pydantic 2.14.1 2.14.2
pymongo 4.17.0 4.19.0
starlette 1.3.1 1.10.0
uvicorn 0.49.0 0.54.0
modal 1.6.2.dev1 1.6.4.dev2
e2b 2.46.4 2.62.0
fastapi 0.141.1 0.162.0
openenv 0.10.0 0.11.0
transformers 5.21.0 5.22.1
omegaconf 2.3.1 2.4.0
boto3 1.43.38 1.43.123
botocore 1.43.38 1.43.123
google-api-core 2.31.0 2.43.2
google-auth 2.55.1 2.62.0
google-cloud-secret-manager 2.30.0 2.31.0
google-cloud-storage 3.15.0 3.17.1
sail 0.12.8 0.17.2
anyio 4.14.2 4.15.1
httpx2 2.13.1 2.16.0
vercel-sandbox 0.7.0 0.10.0
tensorlake 0.5.149 0.5.160
boxd 0.2.17 0.2.22
daytona 0.224.1 0.227.0
cwsandbox 1.19.6 1.22.0
griffelib 2.3.0 2.4.1
moto 5.2.2 5.2.5
psycopg2-binary 2.9.12 2.9.13
pytest 9.1.1 9.2.0
pytest-asyncio 1.4.0 1.4.1
pytest-socket 0.8.0 0.8.1
ruff 0.16.10 0.17.3
smolmachines 1.27.3 1.32.4
regex 2026.6.28 2026.9.29

Updates certifi from 2026.6.17 to 2026.10.23

Commits

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.

.. _v50-0-1:

Commits

Updates jsonschema from 4.23.0 to 4.26.0

Release notes

Sourced from jsonschema's releases.

v4.26.0

What's Changed

New Contributors

Full Changelog: python-jsonschema/jsonschema@v4.25.1...v4.26.0

v4.25.1

What's Changed

... (truncated)

Changelog

Sourced from jsonschema's changelog.

v4.26.0

  • Decrease import time by delaying importing of urllib.request (#1416).

v4.25.1

  • Fix an incorrect required argument in the Validator protocol's type annotations (#1396).

v4.25.0

  • Add support for the iri and iri-reference formats to the format-nongpl extra via the MIT-licensed rfc3987-syntax. They were alread supported by the format extra. (#1388).

v4.24.1

  • Properly escape segments in ValidationError.json_path (#139).

v4.24.0

  • Fix improper handling of unevaluatedProperties in the presence of additionalProperties (#1351).
  • Support for Python 3.8 has been dropped, as it is end-of-life.
Commits
  • a727743 Add a changelog entry for 4.26.
  • 6d28c13 Update the lockfile.
  • 739499e Update pre-commit hooks.
  • cb2d779 Merge pull request #1443 from python-jsonschema/pre-commit-ci-update-config
  • e6bbbb7 [pre-commit.ci] pre-commit autoupdate
  • d56037a Merge pull request #1442 from python-jsonschema/dependabot/github_actions/ast...
  • e54ce13 Bump astral-sh/setup-uv from 7.1.4 to 7.1.6
  • 1f7c9fb Partially update docs requirements.
  • 241aec9 Merge pull request #1441 from python-jsonschema/pre-commit-ci-update-config
  • 2818efb Apache-2.0 -> nongpl
  • Additional commits viewable in compare view

Updates litellm from 1.96.0 to 1.106.6

Release notes

Sourced from litellm's releases.

v1.106.6

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. This release is signed with the key introduced in commit e82a3c6.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the published signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.6

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.106.6/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.6

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

Full Changelog: BerriAI/litellm@v1.106.5...v1.106.6

v1.106.5

Verify this release

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.5

Same command for litellm-database, litellm-non_root and the docker.io/litellm/* images

... (truncated)

Commits
  • 61c6ab7 Merge pull request #48680 from BerriAI/litellm_backport_46712_stable_1_106_x
  • 3f6653c bump: version 1.106.6
  • a1391ac fix(proxy): limit gzip to dashboard analytics and offload compression (#46712)
  • 2569eb8 Merge pull request #48605 from BerriAI/litellm_backport_48599_stable_1_106_x
  • 5197c97 bump: version 1.106.5
  • fb0506d fix(proxy): merge only dict client metadata into pass-through logging
  • 6566067 fix(proxy): always strip client guardrail info and mirror failure attribution...
  • 116dd05 fix(proxy): keep allowlisted metadata in proxy-only failure logs
  • 97474e4 fix(proxy): drop caller metadata from proxy-only failure logs
  • dd8d12d fix(proxy): build proxy-only failure logs from an allowlist and ignore reques...
  • Additional commits viewable in compare view

Updates mcp from 1.28.1 to 1.30.0

Release notes

Sourced from mcp's releases.

v1.30.0

Maintenance release of the 1.x line. 2.x is the current line; 1.x docs are at https://py.sdk.modelcontextprotocol.io/v1/.

A few defaults changed in this release. If you run a server or client on 1.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3448)

  • streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
  • A redirect anywhere else now fails the request with httpx.HTTPStatusError. If that other URL is the server you meant, use it as the endpoint URL.
  • The follow_redirects setting on an httpx.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
  • OAuthClientProvider applies the same rule to its own requests.

Idle Streamable HTTP sessions now expire (#3426)

  • A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
  • Clients that keep the GET stream open (the SDK's client does) are not affected.
  • A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
  • To turn either off: FastMCP(..., session_idle_timeout=None, max_sessions=None).

The OAuth client checks the authorization server's issuer (#3431)

  • Authorization server metadata whose issuer doesn't match the server it was fetched for is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch.
  • Client registrations are now remembered per issuer; if the server later points at a different authorization server, the client registers again.
  • If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new DeprecationWarnings (#3431, #3451)

  • ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL.
  • AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False.
  • Both keep working as before in 1.x; this mostly matters if your tests turn warnings into errors.

New

  • AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3451).
  • issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3431).
  • session_idle_timeout= and max_sessions= on FastMCP (#3426).

What's Changed

Full Changelog: modelcontextprotocol/python-sdk@v1.29.1...v1.30.0

v1.29.1

What's Changed

... (truncated)

Commits
  • 8c2fa6e [v1.x] Add AuthSettings.validate_token_resource to check a bearer token's res...
  • 2106335 [v1.x] Follow redirects only within the MCP endpoint's origin (#3448)
  • 3eed7ce [v1.x] Validate the authorization server metadata issuer on every discovery p...
  • 92120b4 [v1.x] Expire idle Streamable HTTP sessions by default and cap concurrent ses...
  • 5ebdfed [v1.x] Resolve tool output-schema references within the schema document only ...
  • b222713 [v1.x] Give recursive tool return types an object-rooted output schema (#3377)
  • 4dc224f [v1.x] Apply the request body limit to the SSE and OAuth endpoints (#3344)
  • ae3338f [v1.x] Complete the FastMCP Settings model at import time (#3352)
  • 98b7159 [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line (#3177)
  • c0c5a9d [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh (#3082)
  • Additional commits viewable in compare view

Updates packaging from 26.2 to 26.3

Release notes

Sourced from packaging's releases.

26.3

What's Changed

Features

  • Add a public VersionRange API and SpecifierSet.to_range(), representing the versions a specifier set accepts as an interval set that supports intersection, union, difference, complement, set relations, membership tests, and filtering. VersionRange.to_specifier_set() converts a range back to a SpecifierSet where a PEP 440 form exists. (#1267, #1270, #1298)
  • PEP 808: accept Metadata-Version: 2.6. (#1194)
  • Add a limit argument to parse_tag() for compressed tag sets. (#1220)
  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer source distributions over wheels for selected packages. (#1334)
  • Add pure_python_tags() to generate the pure-Python tags for a Python version without touching the running platform. (#1346)
  • Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and SpecifierSet.is_disjoint(), which compare the versions two specifier sets accept. (#1313)

Behavior adaptations

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later. (#1157)
  • Prefer native linux_* platform tags over manylinux and musllinux tags on Linux. (#160)

Fixes for versions and specifiers

  • Raise InvalidVersion instead of TypeError when Version is given a non-string. (#1319)
  • Raise InvalidVersion for non-string pre-release letters passed to Version.from_parts. (#1241)
  • Fix an AttributeError when hashing internally trimmed versions. (#1242)
  • Fix SpecifierSet.is_unsatisfiable for post-release boundary intersections. (#1257)

Fixes for requirements and markers

  • Make Requirement.__hash__ consistent with __eq__ for trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and foo==1.0.0.0), so equal requirements hash equal and deduplicate in sets and dicts. (#1232)
  • Normalize requested extra names before comparing or hashing requirements. (#644)
  • Preserve a Requirement's specifier prereleases override across a pickle round trip. (#1204)
  • Raise InvalidRequirement instead of InvalidSpecifier when a requirement contains an invalid specifier. (#1332)
  • Clarify the error for post-release prefix wildcards like ==1.0.post1.*. (#1299)
  • Preserve quoting semantics when serializing marker values, so round-tripped markers parse back to the same marker. (#1213)
  • Keep the parentheses of a nested group when serializing markers. (#1316)
  • Normalize extra and dependency_groups values in nested markers at parse time. (#1246, #1310)
  • Raise UndefinedComparison when a set-valued variable like extras is used outside the membership form. (#1265)
  • Raise UndefinedEnvironmentName (a KeyError subclass) for missing environment keys during marker evaluation. (#1276)
  • Wrap malformed string literal errors in InvalidMarker / InvalidRequirement instead of leaking a low-level error. (#1249)
  • Reject requirements and markers with a trailing line break. (#1345)

Fixes for metadata and licenses

  • Collect all from_email validation errors into one ExceptionGroup instead of raising the first. (#1268)
  • Accept the UTF-8 charset case-insensitively in email payloads. (#1330)
  • Reject malformed Description-Content-Type values. (#1329)
  • Don't rewrite user values that contain {field} placeholders in error messages. (#1327)
  • Route multipart email payloads to unparsed instead of asserting. (#1247)
  • Make InvalidMetadata and CyclicDependencyGroup picklable. (#1328)
  • Fold every line boundary str.splitlines recognizes when writing a header with RFC822Message. (#1356)

... (truncated)

Changelog

Sourced from packaging's changelog.

26.3 - 2026-08-03


Features:

    

  • Add a public :class:~packaging.ranges.VersionRange API and
    
:meth:SpecifierSet.to_range() <packaging.specifiers.SpecifierSet.to_range>,
    
representing the versions a specifier set accepts as an interval set that
    
supports intersection, union, difference, complement, set relations,
    
membership tests, and filtering.
    
:meth:~packaging.ranges.VersionRange.to_specifier_set converts a range back
    
to a :class:~packaging.specifiers.SpecifierSet where a PEP 440 form exists.
    
(:pull:1267, :pull:1270, :pull:1298)
    • 

  • PEP 808: accept Metadata-Version: 2.6. (:pull:1194)
    • 

  • Add a limit argument to parse_tag() for compressed tag sets.
    
(:issue:1220)
    • 

  • Add a prefer_sdist_predicate argument to Pylock.select() to prefer
    
source distributions over wheels for selected packages. (:pull:1334)
    • 

  • Add :func:~packaging.tags.pure_python_tags to generate the pure-Python
    
tags for a Python version without touching the running platform.
    
(:pull:1346)
    • 

  • Add :meth:SpecifierSet.is_subset() <packaging.specifiers.SpecifierSet.is_subset>, :meth:~packaging.specifiers.SpecifierSet.is_superset,
    
and :meth:~packaging.specifiers.SpecifierSet.is_disjoint, which compare the
    
versions two specifier sets accept. (:pull:1313)
    • 



Behavior adaptations:


    

  • Drop support for Python 3.8; packaging now requires Python 3.9 or later.
    
(:pull:1157)
    • 

  • Prefer native linux_* platform tags over manylinux and musllinux
    
tags on Linux. (:issue:160)
    • 



Fixes for versions and specifiers:


    

  • Raise InvalidVersion instead of TypeError when Version is given a
    
non-string. (:pull:1319)
    • 

  • Raise InvalidVersion for non-string pre-release letters passed to
    
Version.from_parts. (:pull:1241)
    • 

  • Fix an AttributeError when hashing internally trimmed versions.
    
(:pull:1242)
    • 

  • Fix SpecifierSet.is_unsatisfiable for post-release boundary
    
intersections. (:pull:1257)
    • 



Fixes for requirements and markers:


    

  • Make Requirement.__hash__ consistent with __eq__ for
    
trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    
foo==1.0.0.0), so equal requirements hash equal and deduplicate in
    
sets and dicts. (:pull:1232)
    
</tr></table>

... (truncated)

Commits
  • 929fd4b Bump for release
  • f300ebf chore(deps): bump the pre-commit group with 5 updates (#1357)
  • f91d975 ci(downstream): bump hatchling to 1.31.0 and fix its pytest rootdir (#1361)
  • b1a7124 chore(deps): bump the github-actions group with 7 updates (#1358)
  • 2d873eb fix(metadata): fold every line boundary when writing headers (#1356)
  • 413d006 docs: changelog for 26.3 (#1343)
  • 4eb0753 docs(metadata): explain selective field validation (#1342)
  • 77e9ed4 feat(tags): add pure Python tag generator (#1346)
  • 7cea5e8 ci: drop 3.13t on Windows (3.13.14t may fail to build, run takes 9 minutes) (...
  • 45a8b34 docs: add missing versionadded/versionchanged directives (#1344)
  • Additional commits viewable in compare view

Updates pydantic from 2.14.1 to 2.14.2

Release notes

Sourced from pydantic's releases.

v2.14.2 2026-10-29

v2.14.2 (2026-10-29)

This release addresses 2 security issues, GHSA-qpmf-fgh3-ff25 and GHSA-3r8g-cqwr-jr29.

Packaging

Performance

Fixes

  • Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

    JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

    from pydantic import BaseModel, ConfigDict
from pydantic.alias_generators import to_camel
class Page(BaseModel):
model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
page_size: int = 10

Page.model_validate_json('{"page_size": 50}')
Before: Page(page_size=10)
After: ValidationError (extra_forbidden)

    See the pull request for the full list of behavior changes. This change addresses GHSA-qpmf-fgh3-ff25.

  • Ignore extra data matching a field name in TypedDict and dataclasses with extra=allow by @​Viicos in #14090. Addresses GHSA-3r8g-cqwr-jr29.

  • Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

  • Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

  • Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

  • Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

  • Implement recursion guard for validate_strings() by @​Viicos in #14029

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.2 (2026-10-29)

GitHub release

What's Changed

Packaging

Performance

Fixes

  • Make JSON validation by iteration consistent with Python approach by @​davidhewitt in #13275.

    JSON validation now handles field lookup and extra data the same way as Python validation. In particular, keys that only match an unused alias or field name are now treated as extra data, instead of being silently dropped:

    from pydantic import BaseModel, ConfigDict
from pydantic.alias_generators import to_camel
class Page(BaseModel):
model_config = ConfigDict(extra='forbid', alias_generator=to_camel)
page_size: int = 10

Page.model_validate_json('{"page_size": 50}')
Before: Page(page_size=10)
After: ValidationError (extra_forbidden)

    See the pull request for the full list of behavior changes.

  • Fix unpickling of generic classes defined in separate module by @​Viicos in #13994

  • Support explicit by_alias overriding validate_by_alias in validation JSON schemas by @​Viicos in #13997

  • Fix mypy plugin crash on deferred empty model by @​ilevkivskyi in #14027

  • Fix infinite recursion when validating an invalid default with PydanticUseDefault by @​Viicos in #14028

  • Implement recursion guard for validate_strings() by @​Viicos in #14029

  • Support named tuples in Sequence serialization by @​Viicos in #14033

... (truncated)

Commits
  • aa540ac Update changelog for v2.14.2
  • 6cde12f Update changelog for v2.14.2
  • 2db7c25 Fix deep copy of self-referential models
  • d783154 Update changelog for v2.14.2
  • df49b6c Avoid heap allocation for small JSON model field buffers
  • cd93e69 Skip decorator field checks when no field decorators exist
  • 2771e57 Make JSON validation by iteration consistent with Python approach
  • 8102e3f Avoid Python tuple allocation during model fields validation
  • dd139b5 Bump pydantic.v1 namespace to v1.10.27
  • 66155f9 Prepare release v2.14.2
  • Additional commits viewable in compare view

Updates pymongo from 4.17.0 to 4.19.0

Release notes

Sourced from pymongo's releases.

PyMongo 4.19.0

Release notes: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52147

PyMongo 4.18.3

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-3-released/344145

CVE-2026-106435

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.19.0 (2026/10/14)

PyMongo 4.19 brings a number of changes including:

.. warning:: PyMongo 4.19 drops support for Python 3.9 and 3.10 and removes PyPy support: Python 3.11+ is now required.

  • Added support for Python 3.15.
  • Dropped support for Python 3.9 and 3.10.
  • Removed support for PyPy.
  • Removed the deprecated Algorithm.RANGEPREVIEW and QueryType.RANGEPREVIEW members (PYTHON-6009_).
  • Added support for running the synchronous and asynchronous clients in subinterpreters, including inside concurrent.futures.InterpreterPoolExecutor (Python 3.14+). Only in subinterpreters, which do not allow daemon threads, the synchronous client's monitor threads now start as non-daemon threads and are stopped and joined when the interpreter is torn down. Monitor threads in the main interpreter remain daemon threads and shutdown behavior is unchanged. Note that because these threads are non-daemon, a subinterpreter may block on teardown until any in-flight monitor work completes.
  • Added support for routing Key Management Service (KMS) requests for Client-Side Field Level Encryption and Queryable Encryption through an HTTP proxy, using the new kms_connect_callback option on :class:~pymongo.encryption_options.AutoEncryptionOpts, :class:~pymongo.encryption.ClientEncryption, and :class:~pymongo.asynchronous.encryption.AsyncClientEncryption. The callback opens the connection and the driver performs the KMS TLS handshake over it, so verification still targets the KMS host rather than the proxy. For an ordinary HTTP proxy, pass :class:~pymongo.encryption_options.HTTPProxyKMSConnect or :class:~pymongo.encryption_options.AsyncHTTPProxyKMSConnect instead of writing a callback. Both helpers accept custom CONNECT headers, e.g. Proxy-Authorization for proxies that require authentication.
  • Added the srv_host_validator keyword argument to :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient, an alternative to srvAllowedHostsSuffix for deployments whose acceptable SRV hosts cannot be expressed as a single suffix. The callback is invoked once per SRV-returned host and must return a boolean: True to accept the host and False to reject it. During initial DNS discovery a non-boolean return raises an error; during SRV polling it is treated as a rejection. It is mutually exclusive with srvAllowedHostsSuffix and, because it takes a callable, cannot be set in a connection string. See the :class:~pymongo.synchronous.mongo_client.MongoClient and :class:~pymongo.asynchronous.mongo_client.AsyncMongoClient documentation for security considerations.
  • srvAllowedHostsSuffix may now be set to a single label reserved for private or special use, such as localhost, test, or internal.

... (truncated)

Commits
  • a58b4f4 Prep 4.19 Release (#3122)
  • 3242611 PYTHON-6147 Add CSFLE HTTP proxy KMS connect helpers (#3101)
  • b5a7f26 PYTHON-6009 Remove deprecated Algorithm.RANGEPREVIEW and QueryType.RANGEPREVI...
  • RetriggerView in GreptileConfidence Score: 4/5

    The PR should not merge until the previously reported AWS missing-extra tests are corrected.

    Fix All in CursorFindings

    1. P1 AWS tests now fail ▶
    2. P2 SDK changes escape unit tests ▶
    Fix with agent prompt 
    ### Issue 1
uv.lock:undefined-3322
`litellm` now installs `boto3` and its dependency `botocore` in core. These are the only packages declared by the `aws` extra, so `_only_in("aws")` now returns an empty list. `test_core_and_every_store_module_import_without_the_extra` rejects that empty list, causing the required unit job to fail.

The other AWS missing-extra tests also stop hiding `boto3`, so they cannot produce their expected install hint. Update these tests to account for AWS packages now being installed by core, or keep a compatible `litellm` version.

### Issue 2
pyproject.toml:undefined-49
The wider `e2b` and `sail` ranges cross several minor releases, but their unit tests replace SDK calls with permissive fakes. Those tests still pass if the installed SDK rejects an argument or removes a method. The live checks require a configured remote backend, so an incompatible release could fail only when a user deploys a sandbox.

Add offline checks against the installed SDKs, following `modal_create_signature_test.py`, or keep the previously checked ranges until compatibility is covered. This is a non-blocking coverage concern, not a confirmed SDK break.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

    Summary

    This PR updates 39 Python dependencies and refreshes the lockfile.

    • Framework installs now resolve newer Python package versions.

    Reviews (10) · Last reviewed commit: "build(deps): Bump the python-minor-and-p..." · Reviewed by Greptile

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Nov 1, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner November 1, 2026 17:32
@socket-security

socket-security Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedpypi/​botocore@​1.43.38 ⏵ 1.43.12398 +110010010070
Updatedpypi/​smolmachines@​1.27.3 ⏵ 1.32.49710010010070 -30
Updatedpypi/​e2b@​2.46.4 ⏵ 2.62.073 +1100100100100
Updatedpypi/​openenv@​0.10.0 ⏵ 0.11.073 +1100100100100
Updatedpypi/​litellm@​1.96.0 ⏵ 1.106.674 +1100 +18100100100
Updatedpypi/​moto@​5.2.2 ⏵ 5.2.575100100100100
Updatedpypi/​transformers@​5.21.0 ⏵ 5.22.177 +1100100100100
Updatedpypi/​modal@​1.6.2.dev1 ⏵ 1.6.4.dev280 +1100100100100
Updatedpypi/​pytest@​9.1.1 ⏵ 9.2.087 +1100100100100
Updatedpypi/​google-auth@​2.55.1 ⏵ 2.62.089 +1100100100100
Updatedpypi/​pymongo@​4.17.0 ⏵ 4.19.089 -1100 +31100100100
Updatedpypi/​vercel-sandbox@​0.7.0 ⏵ 0.10.090 -3100100100100
Updatedpypi/​google-cloud-storage@​3.15.0 ⏵ 3.17.193 +1100100100100
Updatedpypi/​daytona@​0.224.1 ⏵ 0.227.096100100100100
Updatedpypi/​sail@​0.12.8 ⏵ 0.17.296 +1100100100100
Updatedpypi/​tensorlake@​0.5.149 ⏵ 0.5.16098 +1100100100100
Updatedpypi/​griffelib@​2.3.0 ⏵ 2.4.199 +1100100100100
Updatedpypi/​omegaconf@​2.3.1 ⏵ 2.4.099 -1100100100100
Updatedpypi/​boto3@​1.43.38 ⏵ 1.43.12399100100100100
Updatedpypi/​google-api-core@​2.31.0 ⏵ 2.43.299100100100100
Updatedpypi/​google-cloud-secret-manager@​2.30.0 ⏵ 2.31.099100100100100
Updatedpypi/​cwsandbox@​1.19.6 ⏵ 1.22.0100 +1100100100100
Updatedpypi/​cryptography@​50.0.1 ⏵ 50.0.2100100100100100
Updatedpypi/​starlette@​1.3.1 ⏵ 1.10.0100 +1100100100100
Updatedpypi/​ruff@​0.16.10 ⏵ 0.17.3100100100100100
Updatedpypi/​boxd@​0.2.17 ⏵ 0.2.22100 +1100100100100
Updatedpypi/​regex@​2026.6.28 ⏵ 2026.9.29100100100100100
Updatedpypi/​httpx2@​2.13.1 ⏵ 2.16.0100100100100100
Updatedpypi/​pytest-socket@​0.8.0 ⏵ 0.8.1100 +1100100100100
Updatedpypi/​pytest-asyncio@​1.4.0 ⏵ 1.4.1100 +1100100100100

View full report

@socket-security

socket-security Bot commented Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
High priority
High CVE: Hydra logging configuration permits unsafe callable resolution in pypi hydra-core

CVE: GHSA-c3wx-c55w-pxjq Hydra logging configuration permits unsafe callable resolution (HIGH)

Affected versions: < 1.3.6; >= 1.4.0.dev0 < 1.4.0.dev9

Patched version: 1.3.6

From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
High priority
High CVE: Hydra: hydra.utils.instantiate with untrusted config can lead to code execution in pypi hydra-core

CVE: GHSA-2cp2-2r3c-7p7r Hydra: hydra.utils.instantiate with untrusted config can lead to code execution (HIGH)

Affected versions: < 1.3.4

Patched version: 1.3.4

From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Potential vulnerability: pypi hydra-core with risk level "medium"

Location: Package overview

From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0

ℹ Read more on: This package | This alert | Navigating potential vulnerabilities

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Potential vulnerability: pypi hydra-core with risk level "medium"

Location: Package overview

From: uv.lock → pypi/nemo-gym@0.7.0 → pypi/hydra-core@1.3.0

ℹ Read more on: This package | This alert | Navigating potential vulnerabilities

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/hydra-core@1.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

greptile-apps[bot]
greptile-apps Bot reviewed Nov 1, 2026
View reviewed changes
Comment thread pyproject.toml
"uvicorn>=0.47", # 0.47 adds ssl_context_factory, how the local grant server gets its TLS context
"modal>=1.5.2.dev22", # dev22 adds _experimental_create(tags=); dev2 added VM-mode V2 (vm_runtime)
"e2b~=2.46.4", # AsyncSandbox/AsyncTemplate APIs validated against the 2.46 line
"e2b>=2.46.4,<2.63.0", # AsyncSandbox/AsyncTemplate APIs validated against the 2.46 line

@greptile-apps greptile-apps Bot Nov 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 SDK changes escape unit tests

The wider e2b and sail ranges cross several minor releases, but their unit tests replace SDK calls with permissive fakes. Those tests still pass if the installed SDK rejects an argument or removes a method. The live checks require a configured remote backend, so an incompatible release could fail only when a user deploys a sandbox.

Add offline checks against the installed SDKs, following modal_create_signature_test.py, or keep the previously checked ranges until compatibility is covered. This is a non-blocking coverage concern, not a confirmed SDK break.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: pyproject.toml
Line: 49

Comment:
**SDK changes escape unit tests**

The wider `e2b` and `sail` ranges cross several minor releases, but their unit tests replace SDK calls with permissive fakes. Those tests still pass if the installed SDK rejects an argument or removes a method. The live checks require a configured remote backend, so an incompatible release could fail only when a user deploys a sandbox.

Add offline checks against the installed SDKs, following `modal_create_signature_test.py`, or keep the previously checked ranges until compatibility is covered. This is a non-blocking coverage concern, not a confirmed SDK break.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Fix in Cursor Fix in Claude Code Fix in Codex

@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-5cfeb48abb branch 5 times, most recently from cb01f4b to 8563293 Compare November 2, 2026 15:46
greptile-apps[bot]
greptile-apps Bot reviewed Nov 2, 2026
View reviewed changes
Comment thread uv.lock
source = { registry = "https://pypi.org/simple" }
dependencies = [
{ name = "aiohttp" },
{ name = "boto3" },

@greptile-apps greptile-apps Bot Nov 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 AWS tests now fail

litellm now installs boto3 and its dependency botocore in core. These are the only packages declared by the aws extra, so _only_in("aws") now returns an empty list. test_core_and_every_store_module_import_without_the_extra rejects that empty list, causing the required unit job to fail.

The other AWS missing-extra tests also stop hiding boto3, so they cannot produce their expected install hint. Update these tests to account for AWS packages now being installed by core, or keep a compatible litellm version.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: uv.lock
Line: 3322

Comment:
**AWS tests now fail**

`litellm` now installs `boto3` and its dependency `botocore` in core. These are the only packages declared by the `aws` extra, so `_only_in("aws")` now returns an empty list. `test_core_and_every_store_module_import_without_the_extra` rejects that empty list, causing the required unit job to fail.

The other AWS missing-extra tests also stop hiding `boto3`, so they cannot produce their expected install hint. Update these tests to account for AWS packages now being installed by core, or keep a compatible `litellm` version.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Cursor Fix in Claude Code Fix in Codex

@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-5cfeb48abb branch 3 times, most recently from ca3cf42 to 36a9b53 Compare November 2, 2026 17:51
@dependabot
build(deps): Bump the python-minor-and-patch group across 1 directory…
7b3cac3 
… with 39 updates

---
updated-dependencies:
- dependency-name: anyio
  dependency-version: 4.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: boto3
  dependency-version: 1.43.123
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: botocore
  dependency-version: 1.43.123
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: boxd
  dependency-version: 0.2.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: certifi
  dependency-version: 2026.10.23
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: cwsandbox
  dependency-version: 1.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: daytona
  dependency-version: 0.227.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: e2b
  dependency-version: 2.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: fastapi
  dependency-version: 0.162.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-api-core
  dependency-version: 2.43.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-auth
  dependency-version: 2.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-cloud-secret-manager
  dependency-version: 2.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: google-cloud-storage
  dependency-version: 3.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: griffelib
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: httpx2
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: jsonschema
  dependency-version: 4.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: litellm
  dependency-version: 1.106.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: mcp
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: modal
  dependency-version: 1.6.4.dev1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: moto
  dependency-version: 5.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: omegaconf
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: openenv
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: packaging
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pydantic
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pymongo
  dependency-version: 4.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pytest-asyncio
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pytest-socket
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: regex
  dependency-version: 2026.9.29
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.17.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: sail
  dependency-version: 0.17.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: smolmachines
  dependency-version: 1.32.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: starlette
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: tensorlake
  dependency-version: 0.5.159
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: transformers
  dependency-version: 5.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: vercel-sandbox
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/uv/python-minor-and-patch-5cfeb48abb branch from 36a9b53 to 7b3cac3 Compare November 2, 2026 21:08
@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python-minor-and-patch-5cfeb48abb branch November 2, 2026 22:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants