Skip to content

chore(deps): uv: bump the all-python group across 1 directory with 6 updates - #661

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/agent/all-python-c43a540882
Open

chore(deps): uv: bump the all-python group across 1 directory with 6 updates#661
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/agent/all-python-c43a540882

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-python group with 6 updates in the /agent directory:

Package From To
boto3 1.43.40 1.43.51
claude-agent-sdk 0.2.110 0.2.123
fastapi 0.139.0 0.139.2
uvicorn 0.50.0 0.51.0
ruff 0.15.20 0.15.22
ty 0.0.56 0.0.61

Updates boto3 from 1.43.40 to 1.43.51

Commits
  • 09cf399 Merge branch 'release-1.43.51'
  • b8f600d Bumping version to 1.43.51
  • f0973ec Add changelog entries from botocore
  • a8ae7f0 Merge branch 'release-1.43.50'
  • acbe14c Merge branch 'release-1.43.50' into develop
  • b8c36a9 Bumping version to 1.43.50
  • fa19980 Add changelog entries from botocore
  • 2ce2fd5 Merge branch 'release-1.43.49'
  • d2937da Merge branch 'release-1.43.49' into develop
  • 159cb6a Bumping version to 1.43.49
  • Additional commits viewable in compare view

Updates claude-agent-sdk from 0.2.110 to 0.2.123

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.123

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.215

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.123/

pip install claude-agent-sdk==0.2.123

v0.2.122

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.214

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.122/

pip install claude-agent-sdk==0.2.122

v0.2.121

Bug Fixes

  • Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

  • Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)
  • CI now lints and typechecks scripts/ alongside src/ and tests/
  • CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)
  • Updated bundled Claude CLI to version 2.1.212

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.121/

pip install claude-agent-sdk==0.2.121
</tr></table>

... (truncated)

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.123

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.215

0.2.122

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.214

0.2.121

Bug Fixes

  • Fixed argv flag injection via resume and session_id options: --resume and --session-id are now passed as single =-joined argv tokens (e.g. --resume=<value>) so that a dash-prefixed value is never misinterpreted as an independent CLI flag (#1123)

Internal/Other Changes

  • Hardened build scripts against command injection via CLAUDE_CLI_VERSION: Added version validation (_cli_version_validation.py) and eliminated shell interpolation in download_cli.py and update_cli_version.py so that a malformed version string cannot inject shell or Python code during builds (#1117)
  • CI now lints and typechecks scripts/ alongside src/ and tests/
  • CI CLI install steps now fail properly when curl errors (added shell: bash for pipefail)
  • Updated bundled Claude CLI to version 2.1.212

0.2.120

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.211

0.2.119

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.210

0.2.118

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.209

0.2.117

Bug Fixes

  • Escaped untrusted fields in Slack issue notification workflow: Fixed the Slack notification workflow to properly escape issue titles and usernames using jq instead of bash substitution, preventing malformed JSON payloads and mrkdwn injection from specially crafted issue titles (#1116)

Internal/Other Changes

... (truncated)

Commits
  • 2d4ef94 docs: update changelog for v0.2.123
  • d65bf4a chore: release v0.2.123
  • 4fa1389 chore: bump bundled CLI version to 2.1.215
  • 94ff18e docs: update changelog for v0.2.122
  • 1829240 chore: release v0.2.122
  • b461f55 chore: bump bundled CLI version to 2.1.214
  • f604b8c docs: update changelog for v0.2.121
  • 0a87d2c chore: release v0.2.121
  • 1cd470d chore: bump bundled CLI version to 2.1.212
  • 0278287 Validate CLAUDE_CLI_VERSION and remove shell interpolation from the build scr...
  • Additional commits viewable in compare view

Updates fastapi from 0.139.0 to 0.139.2

Release notes

Sourced from fastapi's releases.

0.139.2

Fixes

  • 🐛 Refactor router route building to make it thread-safe, mainly relevant for tests running in parallel threads (uncommon). PR #16013 by @​tiangolo.

0.139.1

Fixes

  • 🐛 Fix frontend fallback support for doted paths like /users/john.doe. PR #16011 by @​tiangolo.

Docs

  • 📝 Fix topic repository list not being displayed and skip_users not being applied. PR #15995 by @​YuriiMotov.

Translations

Internal

Commits
  • 866b7a3 🔖 Release version 0.139.2 (#16014)
  • 7b3effe 📝 Update release notes
  • 7fe315c 🐛 Refactor router route building to make it thread-safe, mainly relevant for ...
  • c48e67b 🔖 Release version 0.139.1 (#16012)
  • 2acc4fb 📝 Update release notes
  • eb75fd0 🐛 Fix frontend fallback support for doted paths like /users/john.doe (#16011)
  • 9b8410b 📝 Update release notes
  • e24d44c 📝 Fix topic repository list not being displayed and skip_users not being ap...
  • 93b78f8 📝 Update release notes
  • b959b44 📝 Update release notes
  • Additional commits viewable in compare view

Updates uvicorn from 0.50.0 to 0.51.0

Release notes

Sourced from uvicorn's releases.

Version 0.51.0

What's Changed

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Version 0.50.1

What's Changed

New Contributors

Full Changelog: Kludex/uvicorn@0.50.0...0.50.1

Changelog

Sourced from uvicorn's changelog.

0.51.0 (July 8, 2026)

Added

  • Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

  • Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

  • Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

  • Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)
Commits
  • e4d0b05 Version 0.51.0 (#3028)
  • 944e43d Remove colorama from the standard extra (#3027)
  • 2e78770 Restart workers with overlap on SIGHUP for near-zero-downtime reloads (#3025)
  • a1b570c Version 0.50.2 (#3022)
  • 83c7da7 Require websockets>=13.0 for the default sansio implementation (#3021)
  • b4d0116 Version 0.50.1 (#3020)
  • 2a9151d Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansi...
  • 1bf3ab4 Cover the excluded-directory branch in FileFilter with a direct test (#3014)
  • 837b5f9 Deflake multiprocess, reload, and signal supervisor tests (#2975)
  • See full diff in compare view

Updates ruff from 0.15.20 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

Install ruff 0.15.22

Install prebuilt binaries via shell script

</tr></table>

... (truncated)

Changelog

Sourced from ruff's changelog.

0.15.22

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [flake8-pyi] Fix false positive in __all__ (PYI053) (#26872)

Rule changes

  • [pylint] Ignore mutable type updates in redefined-loop-name (PLW2901) (#25733)

Performance

  • Avoid redundant lexer token bookkeeping (#26765)
  • Avoid redundant pending-indentation writes (#26774)
  • Avoid unnecessary identifier lookahead (#26525)
  • Reuse parser scratch buffers (#26798)

Documentation

  • Document argfile support (#26803)
  • [flake8-datetimez] Clarify naming guidance for datetime.today (DTZ002) (#26658)
  • [pycodestyle] Document E731 fix safety (#26847)
  • [ruff] Clarify intentional async contexts for unused-async (RUF029) (#26641)

Contributors

0.15.21

Released on 2026-07-09.

Preview features

... (truncated)

Commits

Updates ty from 0.0.56 to 0.0.61

Release notes

Sourced from ty's releases.

0.0.61

Release Notes

Released on 2026-07-17.

Bug fixes

  • Avoid recursive protocol structural comparisons (#26721)

LSP server

  • Render Google docstrings as structured Markdown (#26599)

Library support

  • Pydantic: Collect field metadata through subscripted generic Annotated aliases (#26885)

Diagnostics

  • Avoid extending own-line suppressions in --add-ignore (#26808)

Core type checking

  • Derive descriptor setter domains for protocols (#26683)
  • Enforce declared receiver TypeVar domains (#26863)
  • Infer isinstance results for aliases and type variables (#26961)
  • Infer isinstance results for fixed class tuples (#26935)
  • Narrow inline list and set membership checks (#26955)
  • Narrow tagged unions by tag truthiness (#26887)
  • Narrow walrus expression values (#26949)
  • Project intersections in to_instance (#26892)
  • Remove inferable TypeVar artifacts recursively (#26787)
  • Respect mixin receiver domains in method overrides (#26941)
  • Support TypeVarTuple and Unpack (#25240)

Performance

  • Deduplicate completion labels (#26890)
  • Only collect expected types for files open in the editor (#25546)
  • Parallelize subtype hierarchy search (#26875)
  • Share heap-backed parser names with CharStr (#26594)
  • Use the new incremental checker from the ignore crate (#26933)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.61

Released on 2026-07-17.

Bug fixes

  • Avoid recursive protocol structural comparisons (#26721)

LSP server

  • Render Google docstrings as structured Markdown (#26599)

Library support

  • Pydantic: Collect field metadata through subscripted generic Annotated aliases (#26885)

Diagnostics

  • Avoid extending own-line suppressions in --add-ignore (#26808)

Core type checking

  • Derive descriptor setter domains for protocols (#26683)
  • Enforce declared receiver TypeVar domains (#26863)
  • Infer isinstance results for aliases and type variables (#26961)
  • Infer isinstance results for fixed class tuples (#26935)
  • Narrow inline list and set membership checks (#26955)
  • Narrow tagged unions by tag truthiness (#26887)
  • Narrow walrus expression values (#26949)
  • Project intersections in to_instance (#26892)
  • Remove inferable TypeVar artifacts recursively (#26787)
  • Respect mixin receiver domains in method overrides (#26941)
  • Support TypeVarTuple and Unpack (#25240)

Performance

  • Deduplicate completion labels (#26890)
  • Only collect expected types for files open in the editor (#25546)
  • Parallelize subtype hierarchy search (#26875)
  • Share heap-backed parser names with CharStr (#26594)
  • Use the new incremental checker from the ignore crate (#26933)

Contributors

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): uv: bump the all-python group across 1 directory with 6 …
5f6d7a1 
…updates

Bumps the all-python group with 6 updates in the /agent directory:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.40` | `1.43.51` |
| [claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-python) | `0.2.110` | `0.2.123` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.139.2` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.50.0` | `0.51.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.15.22` |
| [ty](https://github.com/astral-sh/ty) | `0.0.56` | `0.0.61` |



Updates `boto3` from 1.43.40 to 1.43.51
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.40...1.43.51)

Updates `claude-agent-sdk` from 0.2.110 to 0.2.123
- [Release notes](https://github.com/anthropics/claude-agent-sdk-python/releases)
- [Changelog](https://github.com/anthropics/claude-agent-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-agent-sdk-python@v0.2.110...v0.2.123)

Updates `fastapi` from 0.139.0 to 0.139.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.0...0.139.2)

Updates `uvicorn` from 0.50.0 to 0.51.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.50.0...0.51.0)

Updates `ruff` from 0.15.20 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/0.15.22/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.15.22)

Updates `ty` from 0.0.56 to 0.0.61
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.56...0.0.61)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.51
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-python
- dependency-name: claude-agent-sdk
  dependency-version: 0.2.123
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-python
- dependency-name: fastapi
  dependency-version: 0.139.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-python
- dependency-name: uvicorn
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-python
- dependency-name: ruff
  dependency-version: 0.15.22
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-python
- dependency-name: ty
  dependency-version: 0.0.61
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 27, 2026
@dependabot
dependabot Bot requested review from a team as code owners July 27, 2026 13:04
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants