Skip to content

MAINT: Bump minor-and-patch dependencies, retaining Copilot SDK 1.0.22 - #3616

Merged
Roman Lutz (romanlutz) merged 4 commits into
mainfrom
dependabot/uv/minor-and-patch-4fef0890f9
Oct 29, 2026
Merged

MAINT: Bump minor-and-patch dependencies, retaining Copilot SDK 1.0.22#3616
Roman Lutz (romanlutz) merged 4 commits into
mainfrom
dependabot/uv/minor-and-patch-4fef0890f9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 20 updates:

Package From To
alembic 1.20.0 1.20.1
fastapi 0.146.0 0.162.0
httpx2 2.14.0 2.16.0
reportlab 5.0.1 5.1.0
starlette 1.9.0 1.10.0
transformers 5.20.1 5.20.2
websockets 17.2 17.3
wcwidth 0.9.2 0.9.4
playwright 1.64.0 1.64.1
azure-cognitiveservices-speech 1.52.0 1.53.0
litellm 1.106.0 1.106.4
github-copilot-sdk 1.0.22 1.0.26
a2a-sdk 1.2.2 1.2.3
griffe 2.3.2 2.4.1
ty 0.0.89 0.0.91
pandas 3.0.6 3.1.0
uv 0.13.4 0.13.5
sse-starlette 3.5.0 3.5.1
ruff 0.17.1 0.17.2
setuptools 84.1.0 84.2.1

Updates alembic from 1.20.0 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

  • [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

    References: #1085

  • [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

    References: #1360

  • [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

    References: #1462

  • [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

  • [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

Updates fastapi from 0.146.0 to 0.162.0

Release notes

Sourced from fastapi's releases.

0.162.0

Omitted bool and bool | None form fields now use their declared defaults or produce missing-field errors, consistent with other fields and Pydantic behavior. FastAPI no longer infers False for omitted booleans. This applies to individual form parameters, form models, and unions of form models.

Omitted boolean model fields are excluded from model_dump(exclude_unset=True), and their defaults no longer count as submitted fields during union selection. Default factories and validate_default follow the usual rules.

For HTML checkboxes, declare a boolean with a default of False. See Boolean Form Fields.

Breaking Changes

  • 🐛 Restore default handling for omitted boolean form fields. PR #16605 by @​tiangolo.

0.161.1

Fixes

  • 🐛 Fix OpenAPI schemas for standalone nullable form unions. PR #16598 by @​tiangolo.

0.161.0

Features

0.160.0

Query, header, cookie, and form parameter models now apply their extra configuration to all submitted fields in the same parameter location, consistent with Pydantic behavior. This includes fields declared in other models, individual parameters, or dependencies, which were previously excluded.

With extra="forbid", fields outside the model are rejected even if another parameter declares them. With extra="allow", those fields are included as model extras. With the default extra="ignore", they are ignored.

Breaking Changes

  • 🐛 Apply each parameter model's extra configuration to sibling fields. PR #16594 by @​tiangolo.

Internal

0.159.1

Features

0.159.0

Features

  • ✨ Add support for optional query, header, and cookie parameter models. PR #16584 by @​tiangolo.

0.158.2

Features

0.158.1

... (truncated)

Commits

Updates httpx2 from 2.14.0 to 2.16.0

Release notes

Sourced from httpx2's releases.

v2.16.0

Highlights

🍪 Faster requests with large cookie jars

Building the Cookie header no longer scans every cookie in the jar. The client reuses its jar instead of copying it on every request and redirect (#1284), only looks up the domains that can match the request host, and skips the expired cookie sweep until a cookie is due (#1285). With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster.

Cookies from different domains are now sent from the least to the most specific domain, for example .example.org before sub.example.org, instead of in the order the domains were added. Cookies with longer paths still come first.

httpx2

Changed

  • Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain (#1285).

Fixed

  • Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests (#1284).

httpcore2

No changes since 2.15.1. Version bumped to stay in lockstep with httpx2.

Full Changelog: pydantic/httpx2@v2.15.1...v2.16.0

v2.15.1

Highlights

🔒 Flat CPU usage for long-lived clients on Linux

On Linux, the default SSL context is now configured once instead of on every handshake (#1253). With OpenSSL older than 3.4, each handshake added a duplicate certificate lookup path, so CPU usage per request grew over the lifetime of a reused client. Certificate verification is unchanged, and Windows and macOS still use truststore.

httpx2

Fixed

  • Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

httpcore2

Fixed

  • Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client (#1253).

Full Changelog: pydantic/httpx2@v2.15.0...v2.15.1

v2.15.0

Highlights

🐍 Python 3.11+ required

... (truncated)

Changelog

Sourced from httpx2's changelog.

2.16.0 (October 21st, 2026)

Changed

  • Look up only the cookie domains that match the request host, and skip the expired cookie sweep until a cookie is due. With 1,000 cookies across 500 domains, building the Cookie header is about 18 times faster. Cookies from different domains are now sent from the least to the most specific domain. (#1285)

Fixed

  • Reuse the client cookie jar instead of copying it on every request and redirect. A custom policy set with client.cookies.jar.set_policy() now applies to outgoing requests. (#1284)

2.15.1 (October 19th, 2026)

Fixed

  • Configure the default SSL context once on Linux, instead of on every handshake. With OpenSSL older than 3.4, CPU usage grew over the lifetime of a reused client. (#1253)

2.15.0 (October 19th, 2026)

Removed

  • Drop support for Python 3.10. (#1274)
Commits

Updates reportlab from 5.0.1 to 5.1.0

Updates starlette from 1.9.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0
  • Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
  • The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
  • FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

  • Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
  • starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

  • Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
  • Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
  • WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
  • FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

  • Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
  • Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
  • FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
  • Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

  • Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
  • Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
  • Compare Match members by identity during routing #3665 and #3722.

Deprecated

  • Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

  • Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.
  • Keep path parameter values that look like another placeholder in url_path_for() #3725.
  • Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.
  • Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.
  • Strip only one pair of matching outer quotes from Config env file values #3720.
  • Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.
  • Report NaN and infinity correctly in FloatConvertor.to_string() #3716.
  • Ignore Range on requests other than GET and HEAD in FileResponse #3679.
Commits
  • 8aa828c Version 1.10.0 (#3728)
  • a85a5c3 Substitute URL path parameters in a single pass (#3725)
  • 6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
  • b973efd Build URL-encoded form fields in parser callbacks (#3724)
  • d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
  • fb3e818 Compare remaining Match members by identity in routing (#3722)
  • fc23aa1 Compare Match members by identity in Router.app (#3665)
  • fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
  • 4114432 Default omitted http.response.start headers in middlewares (#3721)
  • 1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
  • Additional commits viewable in compare view

Updates transformers from 5.20.1 to 5.20.2

Release notes

Sourced from transformers's releases.

Patch release v5.20.2

Patch release: v5.20.2

This patch notably solves an issue where some inputs could loose their original type inside prepare_inputs_for_generation in generate, leading to problems with multimodal models. It also fixes some other issues listed on the below commits.

It contains the following commits:

Commits
  • 18329f1 Release: v5.20.2
  • 2ce3082 Avoid a host-to-device copy in eager_mask (#49684)
  • 62bc6fd Declare the input modalities of the VLMs that report text only (#49677)
  • 30f4e38 Fix zero expert gradients in bfloat16 with expert parallelism and ep_size < f...
  • ce8231f Fix inputs dict casting in generate (#49731)
  • See full diff in compare view

Updates websockets from 17.2 to 17.3

Release notes

Sourced from websockets's releases.

17.3

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits
  • 86a1ad5 Release version 17.3.
  • 5cc46ca Bump pypa/cibuildwheel from 4.2.1 to 4.3.1
  • f6702a5 Deindent more test assertions.
  • 7fe5d60 Deindent assertions on raised exceptions.
  • 8549c24 Support arbitrary data in basic auth credentials.
  • a8a898b Support UTF-8 passwords in server basic auth.
  • bc17da4 Parse integers strictly in the HTTP protocol.
  • 7f56717 Increase timeout for running tests.
  • 47e2926 Simplify issue template and fix typo.
  • 77875e1 Fix intermittent errors on free-threaded Python.
  • Additional commits viewable in compare view

Updates wcwidth from 0.9.2 to 0.9.4

Release notes

Sourced from wcwidth's releases.

0.9.4

What's Changed

Full Changelog: jquast/wcwidth@0.9.3...0.9.4

0.9.3

What's Changed

Full Changelog: jquast/wcwidth@0.9.2...0.9.3

Changelog

Sourced from wcwidth's changelog.

0.9.4 2026-10-24

  • Bugfix Flag emojis were split by grapheme breaks when following control characters, like newline or tab, PR [#301](https://github.com/jquast/wcwidth/issues/301)_.
  • Improved performance of most general functions by +64% PR [#303](https://github.com/jquast/wcwidth/issues/303)_.

0.9.3 2026-10-20

  • Bugfix libwcwidth no longer has undefined behavior on NULL or empty input in the UTF-8 and alignment functions, PR [#293](https://github.com/jquast/wcwidth/issues/293), PR [#294](https://github.com/jquast/wcwidth/issues/294).
  • Changed HyperlinkParams.parse()_ now rejects trailing text, PR [#296](https://github.com/jquast/wcwidth/issues/296)_.
  • Bugfix wrap()_ should keep a link's own OSC 8 params across a line break, PR [#299](https://github.com/jquast/wcwidth/issues/299)_.
Commits
  • 2a8edf1 stamp for release
  • ffb4a74 Various performance gains, shortcuts and bitsets (#303)
  • 4bb1017 Add benchmarks for width and grapheme performance (#302)
  • f22d465 Bugfix flag emojis after control characters (#301)
  • d137ffb upgrade cibuildwheel for released python3.15 (#300)
  • 12a9d13 this symlink renders bad in github
  • 949a082 fix: preserve hyperlink parameters across wrapped lines (#299)
  • bcdf2c1 make CHANGELOG.rst symlink
  • ff8072d note that 0.9.3 is not released (to PyPI) yet
  • 4f35759 document and fold into test_hyperlinkparams_parse_invalid
  • Additional commits viewable in compare view

Updates playwright from 1.64.0 to 1.64.1

Release notes

Sourced from playwright's releases.

v1.64.1

Highlights

microsoft/playwright-python#3283 - chore: roll Node.js to 24.22.1

The bundled Node.js 24.22.1 is a security release that distrusts the compromised eMudhra intermediate CAs. The driver uses Node's CA store for its own TLS connections, for example connect_over_cdp to a wss:// endpoint.

Browser Versions

  • Chromium 156.0.8078.4
  • Mozilla Firefox 157.0
  • WebKit 27.2

This version was also tested against the following stable channels:

  • Google Chrome 155
  • Microsoft Edge 155
Commits

Updates azure-cognitiveservices-speech from 1.52.0 to 1.53.0

Updates litellm from 1.106.0 to 1.106.4

Release notes

Sourced from litellm's releases.

v1.106.4

Verify this release

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.4

Same command for litellm-database, litellm-non_root and the docker.io/litellm/* images

What's new in 1.106.4

3 PRs. 2 fixed. No action needed to upgrade

Changes

  • Deployment: Fixed the proxy sometimes exiting on startup with an ImportError when it cannot reach the remote model cost map, broken since v1.104.0 (#46711) Also in 1.104.7, 1.105.5
  • Deployment: Fixed image scans flagging brotli 1.2.0, the emSign ECC Root CA - G3 and unused lockfile packages (#48283, #48300)

Backport #48294 · Full changelog

v1.106.3

[!IMPORTANT] The image-signing key has changed. Starting with this release, every Docker image and Helm chart is signed with the new cosign key from commit e82a3c6. Verifying with the previous key from commit 0112e53 will fail.

Update anything that pins the old cosign.pub: cosign verify scripts, CI checks, and admission policies such as Kyverno, Sigstore policy-controller or Connaisseur.

New cosign.pub SHA-256: e3fe3e08c44b16407fe0b37c43b4f8b603b3a0f4ee74c29e647bc022d762c2c0

Verify this release

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/e82a3c646908ba0a6ee0beddc4310d7a6cac4065/cosign.pub \
  ghcr.io/berriai/litellm:v1.106.3

Same command for litellm-database, litellm-non_root and the docker.io/litellm/* images

What's new in 1.106.3

4 PRs. 1 changed, 1 removed. 1 needs action

Action required

  • Deployment: Verify image signatures with the cosign.pub from commit e82a3c6, the previous key no longer matches (#48103) Also in 1.103.8, 1.104.6, 1.105.4

... (truncated)

Commits
  • ea7ca16 Merge pull request #48300 from BerriAI/lens-runtime-1.106
  • 8c3bd28 build(deps): bump webpki-roots and webpki-root-certs to 1.0.11
  • 020f635 build(docker): move the lens image to the newer wolfi-base
  • a554fcf Merge pull request #48294 from BerriAI/diag-catalog-1.106
  • 3af2c05 Merge pull request #48283 from BerriAI/image-content-cleanup-slim-1.106
  • 1cf20bf bump: version 1.106.4
  • f1ca9f9 refactor(rust-bridge): remove the LoggerRule concept from the catalog (#46711)
  • 77fc426 build(docker): copy only runtime files into the gateway, backend and migratio...
  • b027ce7 build(docker): move to newer wolfi-base and nginx base images
  • 4fa8bf1 Merge pull request #48142 from BerriAI/litellm_backport_1_106_x_liteadmin_pin
  • Additional commits viewable in compare view

Updates github-copilot-sdk from 1.0.22 to 1.0.26

Release notes

Sourced from github-copilot-sdk's releases.

v1.0.26

Other changes

  • improvement: Updated the bundled Copilot CLI snapshot to 1.0.103

Full Changelog: github/copilot-sdk@v1.0.25...v1.0.26

[!WARNING]

The following domain was blocked by the firewall during workflow execution:

  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by Release Notes Generator · copilot · auto · 20.4 AIC · ⌖ 0.551 AIC · ⊞ 10K

v1.0.26-preview.0

Full Changelog: github/copilot-sdk@v1.0.25...v1.0.26-preview.0

v1.0.25

Full Changelog: github/copilot-sdk@v1.0.24...v1.0.25

v1.0.25-preview.1

Full Changelog: github/copilot-sdk@v1.0.24...v1.0.25-preview.1

v1.0.24

Other changes

  • improvement: [All SDKs] internal dependency updates only (SDK snapshot refreshed for newer Copilot CLI builds; no SDK API changes)

Full Changelog: github/copilot-sdk@v1.0.22...v1.0.24

[!WARNING]

... (truncated)

Commits
  • f527e61 Update SDK snapshot for Copilot CLI 1.0.103
  • f2b720c Update SDK snapshot for Copilot CLI 1.0.103-0
  • bb8a5c3 Update SDK snapshot for Copilot CLI 1.0.102-1
  • 15fe467 Update SDK snapshot for Copilot CLI 1.0.102-0
  • 51e9556 Update SDK snapshot for Copilot CLI 1.0.101-1
  • 374b773 Update SDK snapshot for Copilot CLI 1.0.101-0
  • b96cd2b Update SDK snapshot for Copilot CLI 1.0.100-1
  • 18f0730 Update SDK snapshot for Copilot CLI 1.0.100-0
  • b04171f Update SDK snapshot for Copilot CLI 1.0.99-3
  • 4043044 Update SDK snapshot for Copilot CLI 1.0.99-2
  • Additional commits viewable in compare view

Updates a2a-sdk from 1.2.2 to 1.2.3

Release notes

Sourced from a2a-sdk's releases.

v1.2.3

1.2.3 (2026-10-17)

Bug Fixes

  • client: ignore the patch version when preferring a 1.0 interface (#1304) (cbb2d84)
  • client: normalize malformed agent card parsing errors (#1307) (486f0f6)
  • compat: block on a v0.3 gRPC and REST send without configuration (#1334) (8160310), closes #1321
  • compat: treat a v0.3 history_length of 0 as unlimited in JSON-RPC and REST (#1312) (e86695c)
  • jcs: count open containers for the nesting bound, so an empty container leaf is refused (#1294) (5653daf)
  • server: isolate push notification failures from the task lifecycle (#1329) (0ee47d7)
  • server: mark internal lifecycle events done so a cancelled stream frees its producer (#1336) (a4c4fc9)
  • server: reject push URLs in shared address space (#1326) (01da00b)
  • server: release the ActiveTask after a direct Message response (#1297) (49ebce6)
  • server: run follow-up messages in the sender's contextvars (#1317) (a016002)
  • server: warn when an AgentCard is missing required fields (#1279) (4f4101c)
  • telemetry: let trace_function alone decide a span's status (#1309) (59dcbfb)
Changelog

Sourced from a2a-sdk's changelog.

1.2.3 (2026-10-17)

Bug Fixes

  • client: ignore the patch version when preferring a 1.0 interface (#1304) (cbb2d84)
  • client: normalize malformed agent card parsing errors (#1307) (486f0f6)
  • compat: block on a v0.3 gRPC and REST send without configuration (#1334) (8160310), closes #1321
  • compat: treat a v0.3 history_length of 0 as unlimited in JSON-RPC and REST (#1312) (e86695c)
  • jcs: count open containers for the nesting bound, so an empty container leaf is refused (#1294) (5653daf)
  • server: isolate push notification failures from the task lifecycle (#1329) (0ee47d7)
  • server: mark internal lifecycle events done so a cancelled stream frees its producer (#1336) (a4c4fc9)
  • server: reject push URLs in shared address space (#1326) (01da00b)
  • server: release the ActiveTask after a direct Message response (#1297) (49ebce6)
  • server: run follow-up messages in the sender's contextvars (#1317) (a016002)
  • server: warn when an AgentCard is missing required fields (#1279) (4f4101c)
  • telemetry: let trace_function alone decide a span's status (#1309) (59dcbfb)
Commits
  • 44b2f76 chore(main): release 1.2.3 (#1315)
  • 01da00b fix(server): reject push URLs in shared address space (#1326)
  • e86695c fix(compat): treat a v0.3 history_length of 0 as unlimited in JSON-RPC and RE...
  • a4c4fc9 fix(server): mark internal lifecycle events done so a cancelled stream frees ...
  • 8160310 fix(compat): block on a v0.3 gRPC and REST send without configuration (#1334)
  • 49ebce6 fix(server): release the ActiveTask after a direct Message response (#1297)
  • 0ee47d7 fix(server): isolate push notification failures from the task lifecycle (#1329)
  • 799fcae test: install HTTP dependencies for the legacy cross-version server (#1320)
  • 494a8ec test(signing): add cross-SDK signature vectors (#1286)
  • 4f4101c fix(server): warn when an AgentCard is missing required fields (#1279)
  • Additional commits viewable in compare view

Updates griffe from 2.3.2 to 2.4.1

Release notes

Sourced from griffe's releases.

2.4.1

2.4.1 - 2026-10-22

Compare with 2.4.0

Bug Fixes

  • Load symbols gated behing __getattr__ during dynamic analysis (3faeeb1 by Timothée Mazzucotelli).

Code Refactoring

2.4.0

2.4.0 - 2026-10-19

Compare with 2.3.2

Features

  • Expose reference_path in addition to canonical_path (2f6b419 by Timothée Mazzucotelli). Issue-448

Bug Fixes

  • Preserve standalone named expression parentheses (dc6300d by Alperen). PR-488, Co-authored-by: Timothée Mazzucotelli [email protected]
  • Propagate public value to inherited members (aliases) (8b94205 by Timothée Mazzucotelli). Issue-495, PR-503, Co-authored-...

    Description has been truncated

@dependabot
MAINT: Bump the minor-and-patch group with 20 updates
b9b8e1e 
Bumps the minor-and-patch group with 20 updates:

| Package | From | To |
| --- | --- | --- |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.20.0` | `1.20.1` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.146.0` | `0.162.0` |
| [httpx2](https://github.com/pydantic/httpx2) | `2.14.0` | `2.16.0` |
| [reportlab](https://www.reportlab.com/) | `5.0.1` | `5.1.0` |
| [starlette](https://github.com/Kludex/starlette) | `1.9.0` | `1.10.0` |
| [transformers](https://github.com/huggingface/transformers) | `5.20.1` | `5.20.2` |
| [websockets](https://github.com/python-websockets/websockets) | `17.2` | `17.3` |
| [wcwidth](https://github.com/jquast/wcwidth) | `0.9.2` | `0.9.4` |
| [playwright](https://github.com/microsoft/playwright-python) | `1.64.0` | `1.64.1` |
| azure-cognitiveservices-speech | `1.52.0` | `1.53.0` |
| [litellm](https://github.com/BerriAI/litellm) | `1.106.0` | `1.106.4` |
| [github-copilot-sdk](https://github.com/github/copilot-sdk) | `1.0.22` | `1.0.26` |
| [a2a-sdk](https://github.com/a2aproject/a2a-python) | `1.2.2` | `1.2.3` |
| [griffe](https://github.com/mkdocstrings/griffe) | `2.3.2` | `2.4.1` |
| [ty](https://github.com/astral-sh/ty) | `0.0.89` | `0.0.91` |
| [pandas](https://github.com/pandas-dev/pandas) | `3.0.6` | `3.1.0` |
| [uv](https://github.com/astral-sh/uv) | `0.13.4` | `0.13.5` |
| [sse-starlette](https://github.com/sysid/sse-starlette) | `3.5.0` | `3.5.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.17.1` | `0.17.2` |
| [setuptools](https://github.com/pypa/setuptools) | `84.1.0` | `84.2.1` |


Updates `alembic` from 1.20.0 to 1.20.1
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `fastapi` from 0.146.0 to 0.162.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.146.0...0.162.0)

Updates `httpx2` from 2.14.0 to 2.16.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.14.0...v2.16.0)

Updates `reportlab` from 5.0.1 to 5.1.0

Updates `starlette` from 1.9.0 to 1.10.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.9.0...1.10.0)

Updates `transformers` from 5.20.1 to 5.20.2
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.20.1...v5.20.2)

Updates `websockets` from 17.2 to 17.3
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@17.2...17.3)

Updates `wcwidth` from 0.9.2 to 0.9.4
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Changelog](https://github.com/jquast/wcwidth/blob/master/docs/history.rst)
- [Commits](jquast/wcwidth@0.9.2...0.9.4)

Updates `playwright` from 1.64.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright-python/releases)
- [Commits](microsoft/playwright-python@v1.64.0...v1.64.1)

Updates `azure-cognitiveservices-speech` from 1.52.0 to 1.53.0

Updates `litellm` from 1.106.0 to 1.106.4
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.106.0...v1.106.4)

Updates `github-copilot-sdk` from 1.0.22 to 1.0.26
- [Release notes](https://github.com/github/copilot-sdk/releases)
- [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md)
- [Commits](github/copilot-sdk@v1.0.22...v1.0.26)

Updates `a2a-sdk` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/a2aproject/a2a-python/releases)
- [Changelog](https://github.com/a2aproject/a2a-python/blob/main/CHANGELOG.md)
- [Commits](a2aproject/a2a-python@v1.2.2...v1.2.3)

Updates `griffe` from 2.3.2 to 2.4.1
- [Release notes](https://github.com/mkdocstrings/griffe/releases)
- [Changelog](https://github.com/mkdocstrings/griffe/blob/main/CHANGELOG.md)
- [Commits](mkdocstrings/griffe@2.3.2...2.4.1)

Updates `ty` from 0.0.89 to 0.0.91
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.89...0.0.91)

Updates `pandas` from 3.0.6 to 3.1.0
- [Release notes](https://github.com/pandas-dev/pandas/releases)
- [Commits](pandas-dev/pandas@v3.0.6...v3.1.0)

Updates `uv` from 0.13.4 to 0.13.5
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.13.4...0.13.5)

Updates `sse-starlette` from 3.5.0 to 3.5.1
- [Release notes](https://github.com/sysid/sse-starlette/releases)
- [Commits](sysid/sse-starlette@v3.5.0...v3.5.1)

Updates `ruff` from 0.17.1 to 0.17.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.1...0.17.2)

Updates `setuptools` from 84.1.0 to 84.2.1
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v84.1.0...v84.2.1)

---
updated-dependencies:
- dependency-name: alembic
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fastapi
  dependency-version: 0.162.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: httpx2
  dependency-version: 2.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: reportlab
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: starlette
  dependency-version: 1.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: transformers
  dependency-version: 5.20.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: websockets
  dependency-version: '17.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: wcwidth
  dependency-version: 0.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: azure-cognitiveservices-speech
  dependency-version: 1.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: litellm
  dependency-version: 1.106.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: github-copilot-sdk
  dependency-version: 1.0.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: a2a-sdk
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: griffe
  dependency-version: 2.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ty
  dependency-version: 0.0.91
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pandas
  dependency-version: 3.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: uv
  dependency-version: 0.13.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: sse-starlette
  dependency-version: 3.5.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: ruff
  dependency-version: 0.17.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: setuptools
  dependency-version: 84.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 28, 2026
@github-actions

github-actions Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.13, dev)

     1 files  ±0       1 suites  ±0   5m 23s ⏱️ - 3m 1s
32 305 tests ±0  31 844 ✅ ±0  461 💤 ±0  0 ❌ ±0 
32 438 runs  ±0  31 977 ✅ ±0  461 💤 ±0  0 ❌ ±0 

Results for commit ad864d8. ± Comparison against base commit be7240a.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.12, dev)

     1 files  ±0       1 suites  ±0   8m 12s ⏱️ + 1m 54s
32 305 tests ±0  31 844 ✅ ±0  461 💤 ±0  0 ❌ ±0 
32 438 runs  ±0  31 977 ✅ ±0  461 💤 ±0  0 ❌ ±0 

Results for commit ad864d8. ± Comparison against base commit be7240a.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.11, dev_all)

     1 files  ±0       1 suites  ±0   6m 48s ⏱️ - 2m 2s
32 677 tests ±0  32 660 ✅ ±0  17 💤 ±0  0 ❌ ±0 
32 810 runs  ±0  32 793 ✅ ±0  17 💤 ±0  0 ❌ ±0 

Results for commit ad864d8. ± Comparison against base commit be7240a.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.14, dev_all)

     1 files  ±0       1 suites  ±0   7m 6s ⏱️ - 2m 9s
32 677 tests ±0  32 660 ✅ ±0  17 💤 ±0  0 ❌ ±0 
32 810 runs  ±0  32 793 ✅ ±0  17 💤 ±0  0 ❌ ±0 

Results for commit ad864d8. ± Comparison against base commit be7240a.

♻️ This comment has been updated with latest results.

@romanlutz Roman Lutz (romanlutz) mentioned this pull request Oct 28, 2026
Open
@romanlutz
FIX: Keep Copilot SDK on the supported session API
7cfe586 
Cap both optional dependency extras below 1.0.23 and restore the known working 1.0.22 lock entry. Track migration to the newer session API in #3623.

Co-authored-by: Copilot App <[email protected]>
@romanlutz Roman Lutz (romanlutz) changed the title MAINT: Bump the minor-and-patch group with 20 updates MAINT: Bump minor-and-patch dependencies, retaining Copilot SDK 1.0.22 Oct 28, 2026
@romanlutz

Roman Lutz (romanlutz) commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

Kept github-copilot-sdk at 1.0.22 and added >=1.0.11,<1.0.23 to both optional dependency extras. SDK 1.0.26 removes session options used by GitHubCopilotTarget, causing the typing failure and 65 test failures. Migration is tracked in #3623 (help wanted). The other dependency updates remain. Merged the latest main without rebasing. Validation: uv lock --check passed; uv run --frozen --extra github-copilot pytest -q tests/unit/prompt_target/target/test_github_copilot_target.py passed (92 tests); uv run --frozen --extra github-copilot ty check pyrit/prompt_target/github_copilot_target.py passed.

@github-actions

github-actions Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.13, dev_all)

     1 files  ±0       1 suites  ±0   6m 49s ⏱️ - 1m 49s
32 677 tests ±0  32 660 ✅ ±0  17 💤 ±0  0 ❌ ±0 
32 810 runs  ±0  32 793 ✅ ±0  17 💤 ±0  0 ❌ ±0 

Results for commit ad864d8. ± Comparison against base commit be7240a.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.14, dev)

     1 files  ±0       1 suites  ±0   6m 17s ⏱️ +15s
32 305 tests ±0  31 844 ✅ ±0  461 💤 ±0  0 ❌ ±0 
32 438 runs  ±0  31 977 ✅ ±0  461 💤 ±0  0 ❌ ±0 

Results for commit ad864d8. ± Comparison against base commit be7240a.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.11, dev)

     1 files  ±0       1 suites  ±0   5m 16s ⏱️ - 3m 0s
32 305 tests ±0  31 844 ✅ ±0  461 💤 ±0  0 ❌ ±0 
32 438 runs  ±0  31 977 ✅ ±0  461 💤 ±0  0 ❌ ±0 

Results for commit ad864d8. ± Comparison against base commit be7240a.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pytest (3.12, dev_all)

     1 files  ±0       1 suites  ±0   8m 57s ⏱️ -32s
32 677 tests ±0  32 660 ✅ ±0  17 💤 ±0  0 ❌ ±0 
32 810 runs  ±0  32 793 ✅ ±0  17 💤 ±0  0 ❌ ±0 

Results for commit ad864d8. ± Comparison against base commit be7240a.

♻️ This comment has been updated with latest results.

@romanlutz
Roman Lutz (romanlutz) merged commit 3209afb into main Oct 29, 2026
75 checks passed
@romanlutz
Roman Lutz (romanlutz) deleted the dependabot/uv/minor-and-patch-4fef0890f9 branch October 29, 2026 00:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@romanlutz Roman Lutz (romanlutz) romanlutz approved these changes

Assignees

@romanlutz Roman Lutz (romanlutz)

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@romanlutz