chore(deps): bump the dev-dependencies group across 1 directory with 19 updates

[dependabot]

Updates the requirements on pydantic, starlette, uvicorn, python-multipart, sqlalchemy, fastapi, granian, redis, opentelemetry-api, opentelemetry-sdk, opentelemetry-instrumentation-starlette, presidio-analyzer, presidio-anonymizer, pyjwt, click, pytest-asyncio, coverage, mypy and ruff to permit the latest version.
Updates pydantic to 2.13.4

Release notes

Sourced from pydantic's releases.

v2.13.4 2026-05-06

v2.13.4 (2026-05-06)

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

Full Changelog: pydantic/pydantic@v2.13.3...v2.13.4

Changelog

Sourced from pydantic's changelog.

v2.13.4 (2026-05-06)

GitHub release

What's Changed

Packaging

• Bump libc from 0.2.155 to 0.2.185 by @​Viicos in #13109
• Adapt pydantic-core linker flags on macOS by @​washingtoneg and @​Viicos in #13147

Fixes

• Preserve RootModel core metadata by @​Viicos in #13129

v2.13.3 (2026-04-20)

GitHub release

What's Changed

Fixes

• Handle AttributeError subclasses with from_attributes by @​Viicos in #13096

v2.13.2 (2026-04-17)

GitHub release

What's Changed

Fixes

• Fix ValidationInfo.field_name missing with model_validate_json() by @​Viicos in #13084

v2.13.1 (2026-04-15)

GitHub release

What's Changed

Fixes

• Fix ValidationInfo.data missing with model_validate_json() by @​davidhewitt in #13079

v2.13.0 (2026-04-13)

GitHub release

The highlights of the v2.13 release are available in the blog post.

... (truncated)

Commits

• cf67d4b Fix linting
• f0d8a21 Prepare release v2.13.4
• 5e3fe1d Check for pydantic tag pattern in CI
• 7f9edcc Document tagging conventions
• b46a0c9 Adapt pydantic-core linker flags on macOS
• 50629c8 Update to PyPy 7.3.22
• 8522ebb Preserve RootModel core metadata
• a37f3af Adapt MISSING sentinel test to work with unreleased typing_extensions ver...
• 909259a Remove Logfire example in documentation
• 2c4174c Bump libc from 0.2.155 to 0.2.185
• See full diff in compare view

Updates starlette to 1.2.1

Release notes

Sourced from starlette's releases.

Version 1.2.1

What's Changed

• Use httpx2 for type checking in the testclient module by @​leifwar in Kludex/starlette#3304
• Add assert error for requires() when request param is not Request type by @​KeeganOP in Kludex/starlette#3298

New Contributors

• @​leifwar made their first contribution in Kludex/starlette#3304
• @​diskeu made their first contribution in Kludex/starlette#3243
• @​KeeganOP made their first contribution in Kludex/starlette#3298

Full Changelog: Kludex/starlette@1.2.0...1.2.1

Changelog

Sourced from starlette's changelog.

1.2.1 (May 31, 2026)

Fixed

• Use httpx2 for type checking in the testclient module #3304.
• Add assert error for requires() when the request parameter is not a Request type #3298.

1.2.0 (May 28, 2026)

Added

• Support httpx2 in the test client #3291.

1.1.0 (May 23, 2026)

Added

• Use "application/octet-stream" as the FileResponse media type fallback #3283.

Fixed

• Only dispatch standard HTTP verbs in HTTPEndpoint #3286.
• Reject absolute paths in StaticFiles.lookup_path #3287.

1.0.1 (May 21, 2026)

Fixed

• Ignore malformed Host header when constructing request.url #3279.

1.0.0 (March 22, 2026)

Starlette 1.0 is here!

After nearly eight years since its creation, Starlette has reached its first stable release. Thank you to everyone who tested the release candidate and reported issues.

You can read more on the blog post.

Added

• Track session access and modification in SessionMiddleware #3166.

Fixed

• Handle websocket denial responses in StreamingResponse and FileResponse #3189.
• Use bytearray for field accumulation in FormParser #3179.
• Move parser.finalize() inside try/except in MultiPartParser.parse() #3153.

1.0.0rc1 (February 23, 2026)

... (truncated)

Commits

• ef773fe Version 1.2.1 (#3306)
• 3fc68a7 Add sponsors section to docs sidebar (#3305)
• b053f7b chore(deps): bump the python-packages group across 1 directory with 6 updates...
• 1478775 Add assert error for requires() when request param is not Request type (#3298)
• 6576547 Describe disconnected-after-response behavior in test docstring (#3243)
• 9cb1553 Use same module (httpx|httpx2) for type checking as for runtime (#3304)
• 4060987 Version 1.2.0 (#3300)
• 1e289ca Migrate docs deploy from Cloudflare Pages to Workers Static Assets (#3282)
• 100f05a Add httpx2 as a dev dependency (#3295)
• 508023b Support httpx2 in the test client (#3291)
• Additional commits viewable in compare view

Updates uvicorn to 0.49.0

Release notes

Sourced from uvicorn's releases.

Version 0.49.0

What's Changed

• Bump httptools minimum version to 0.8.0 by @​Kludex in Kludex/uvicorn#2962
• Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) by @​Kludex in Kludex/uvicorn#2971

Full Changelog: Kludex/uvicorn@0.48.0...0.49.0

Changelog

Sourced from uvicorn's changelog.

0.49.0 (June 3, 2026)

Changed

• Bump httptools minimum version to 0.8.0 (#2962)
• Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) (#2971)

0.48.0 (May 24, 2026)

Changed

• Default ssl_ciphers to None and use OpenSSL defaults (#2940)

Fixed

• Ignore duplicate forwarding headers in ProxyHeadersMiddleware (#2944)

0.47.0 (May 14, 2026)

Added

• Add ssl_context_factory for custom SSLContext configuration (#2920)

Changed

• Eagerly import the ASGI app in the parent process (#2919)

Fixed

• Treat fd=0 as a valid file descriptor with reload/workers (#2927)

0.46.0 (April 23, 2026)

Added

• Support ws_max_size in wsproto implementation (#2915)
• Support ws_ping_interval and ws_ping_timeout in wsproto implementation (#2916)

Changed

• Use bytearray for incoming WebSocket message buffer in websockets-sansio (#2917)

0.45.0 (April 21, 2026)

Added

• Add --reset-contextvars flag to isolate ASGI request context (#2912)
• Accept os.PathLike for log_config (#2905)
• Accept log_level strings case-insensitively (#2907)

... (truncated)

Commits

• 3ef2e3e Version 0.49.0 (#2973)
• eeb64b1 Consume duplicate forwarding headers in ProxyHeadersMiddleware (#2971)
• 630f4ac Make the watchfiles reload tests deterministic (#2972)
• 9154922 chore(deps): bump the github-actions group across 1 directory with 6 updates ...
• 739727a Migrate docs deploy from Cloudflare Pages to Workers (#2967)
• be4a240 Gate docs preview deploy on Cloudflare token presence (#2966)
• c489d7e Bump httptools minimum version to 0.8.0 (#2962)
• 9f547bd Skip docs preview deploy for Dependabot PRs (#2961)
• 44446b8 Migrate documentation from MkDocs Material to Zensical (#2959)
• cfd659c Bump pymdown-extensions to 10.21.3 (#2958)
• Additional commits viewable in compare view

Updates python-multipart to 0.0.32

Release notes

Sourced from python-multipart's releases.

Version 0.0.32

What's Changed

• Replace per-byte partial-boundary scan with rfind lookbehind by @​Kludex in Kludex/python-multipart#300

Full Changelog: Kludex/python-multipart@0.0.31...0.0.32

Changelog

Sourced from python-multipart's changelog.

0.0.32 (2026-06-04)

• Speed up partial-boundary scanning for CR/LF-dense part data #300.

0.0.31 (2026-06-04)

• Speed up multipart header parsing and callback dispatch #295.
• Bound header field name size before validating #296.
• Validate Content-Length is non-negative in parse_form #297.

0.0.30 (2026-05-31)

• Parse application/x-www-form-urlencoded bodies per the WHATWG URL standard, treating only & as a field separator #290.
• Ignore RFC 2231/5987 extended parameters (name*, filename*) in parse_options_header, keeping the plain parameter authoritative per RFC 7578 §4.2 #291.

0.0.29 (2026-05-17)

• Handle malformed RFC 2231 continuations in parse_options_header #270.

0.0.28 (2026-05-10)

• Speed up partial-boundary tail scan via bytes.find #281.
• Cap multipart boundary length at 256 bytes #282.

0.0.27 (2026-04-27)

• Add multipart header limits #267.
• Pass parse offsets via constructors #268.

0.0.26 (2026-04-10)

• Skip preamble before the first multipart boundary more efficiently #262.
• Silently discard epilogue data after the closing multipart boundary #259.

0.0.25 (2026-04-10)

• Add MIME content type info to File #143.
• Handle CTE values case-insensitively #258.
• Remove custom FormParser classes #257.
• Add UPLOAD_DELETE_TMP to FormParser config #254.
• Emit field_end for trailing bare field names on finalize #230.
• Handle multipart headers case-insensitively #252.
• Apply Apache-2.0 properly #247.

0.0.24 (2026-04-05)

• Validate chunk_size in parse_form() #244.

0.0.23 (2026-04-05)

... (truncated)

Commits

• 238ead6 Version 0.0.32 (#302)
• 8672979 Replace per-byte partial-boundary scan with rfind lookbehind (#300)
• 8190779 Bump the python-packages group with 7 updates (#301)
• 0d3c086 Use uv package ecosystem for Dependabot (#299)
• 4cffc68 Version 0.0.31 (#298)
• c814948 Reject negative Content-Length in parse_form (#297)
• 6b837d4 Bound header field name size before validating (#296)
• e0c4f9d Bump the github-actions group with 3 updates (#294)
• b8a01bb Bump the python-packages group with 3 updates (#293)
• 6732164 Speed up multipart header parsing and callback dispatch (#295)
• Additional commits viewable in compare view

Updates sqlalchemy to 2.0.50

Release notes

Sourced from sqlalchemy's releases.

2.0.50

Released: May 24, 2026

orm

• [orm] [bug] Fixed issue where using _orm.joinedload() with PropComparator.of_type() targeting a joined-table subclass combined with PropComparator.and_() referencing a column on that subclass would generate invalid SQL, where the subclass column was not adapted to the subquery alias. Pull request courtesy Joaquin Hui Gomez.

  References: #13203

• [orm] [bug] Fixed issue where the presence of a SessionEvents.do_orm_execute() event hook would cause internal execution options such as yield_per and loader-specific state from the first orm_pre_session_exec pass to leak into the second pass, leading to errors when using relationship loaders such as selectinload() and immediateload(). The execution options passed to the second compilation pass are now based on the original options plus only the explicit updates made via ORMExecuteState.update_execution_options() within the event hook.

  References: #13301

• [orm] [bug] Fixed issue where using _orm.with_polymorphic() on a leaf class (a subclass with no further descendants) or a non-inherited class would fail with an AttributeError when used in an ORM statement, due to _orm.configure_mappers() not being triggered implicitly. The fix ensures that AliasedInsp participates in the _post_inspect hook, triggering mapper configuration during ORM statement compilation.

  References: #13319

sql

• [sql] [bug] Fixed issue where floor division (//) between a Float or Numeric numerator and an Integer denominator would omit the FLOOR() SQL wrapper on dialects where Dialect.div_is_floordiv is True (the default, including PostgreSQL and SQLite). FLOOR() is now applied if either the denominator or the numerator is a non-integer, so that expressions such as float_col // int_col render as FLOOR(float_col / int_col) instead of the incorrect float_col / int_col. Pull request courtesy r266-tech.

  References: #10528

postgresql

... (truncated)

Commits

• See full diff in compare view

Updates fastapi to 0.136.3

Release notes

Sourced from fastapi's releases.

0.136.3

Refactors

• ♻️ Do not accept underscore headers when using convert_underscores=True (the default). PR #15589 by @​tiangolo.

Commits

• 8206485 🔖 Release version 0.136.3
• c910e01 📝 Update release notes
• 063b5bf ♻️ Do not accept underscore headers when using convert_underscores=True (th...
• 22b02e2 🔖 Release version 0.136.2
• 3b252a2 📝 Update release notes
• c7fb785 ♻️ Validate Server Sent Event fields to avoid applications from sending broke...
• cb83b83 📝 Update release notes
• 00f805c ✅ Update tests, don't double dispose the engine (#15587)
• 3675137 📝 Update release notes
• 7b57e42 📝 Document --entrypoint CLI option (#15464)
• Additional commits viewable in compare view

Updates granian to 2.7.5

Release notes

Sourced from granian's releases.

Granian 2.7.5

Patch release

Changes since 2.7.4:

• Fix a bug in IPC implementation causing crashes on shutdown (#847 by @​askedrelic)
• Enhance proxy helpers implementation
• Bump dependencies

Commits

• 822548b Review proxy headers util impl
• a7d8f1d Drop handle with interpreter attached on ipc shutdown (#847)
• 54e8faa Bump dependencies
• 93d2249 Lint with new clippy
• aa66fc3 Bump version to 2.7.5
• 0ca9ec6 Add zizmor to pre-commit and harden GitHub Actions workflows (#851)
• See full diff in compare view

Updates redis to 8.0.0

Release notes

Sourced from redis's releases.

8.0.0

Changes

🚀 Highlights

Async Cluster PubSub

This release introduces full asyncio Cluster PubSub support, bringing shard-channel capabilities (SSUBSCRIBE, SUNSUBSCRIBE, SPUBLISH) to the async RedisCluster client. The new ClusterPubSub class in redis.asyncio.cluster automatically routes shard-channel subscriptions to the correct cluster node based on key-slot hashing, manages per-node PubSub connections, and supports round-robin message retrieval across nodes. Users can create a cluster pubsub instance via RedisCluster.pubsub() and use ssubscribe(), sunsubscribe(), and get_sharded_message() just as they would with the sync cluster client.

Keyspace and subkey notifications

Redis Keyspace Notifications are now supported for standalone and cluster deployments in both sync and async modes. New classes — KeyspaceNotifications, ClusterKeyspaceNotifications, AsyncKeyspaceNotifications, and AsyncClusterKeyspaceNotifications — provide a high-level API for keyspace/keyevent subscriptions and subkey notification families: subkeyspace, subkeyevent, subkeyspaceitem, and subkeyspaceevent. Convenience methods like subscribe_keyspace(), subscribe_keyevent(), subscribe_subkeyspace(), subscribe_subkeyevent(), subscribe_subkeyspaceitem(), and subscribe_subkeyspaceevent() simplify common patterns, with channel classes for both key and subkey channels.

In cluster mode, subscriptions are managed across primary nodes because each node emits notifications only for keys it owns, with built-in topology-change handling. Sync run_in_thread() and async listen() workflows are supported.

Redis Array commands(https://redis.io/docs/latest/develop/data-types/arrays/)

redis-py now supports Redis Arrays, a preview Redis data type for sparse, index-addressable sequences of strings. New AR* command helpers cover indexed reads/writes, range scans, deletion, cursor-based insertion, ring-buffer writes, metadata, text search, and aggregation, including ARGET, ARSET, ARMGET, ARMSET, ARSCAN, ARGREP, ARRING, and AROP.

Type Hints Improvements (breaking changes)

The @overload pattern has been applied systematically across core commands (core.py), VectorSet commands, and module commands (Search, JSON, TimeSeries, Bloom filters) to provide distinct return types for sync and async clients. Previously, methods returned a combined ResponseT (i.e., Union[Awaitable[Any], Any]), which caused static analysis tools like mypy and Pyright to flag false positives. Now, sync clients see concrete return types (e.g., int, bool, list[str]) while async clients see Awaitable[...] wrappers. This is a breaking change for type-checking only—runtime behavior is unchanged, but code relying on the old union return types in type annotations may need updates. Two new protocol types, SyncClientProtocol and AsyncClientProtocol, are used in overload signatures to enable this distinction.

RESP3 by default with opt-in unified responses

redis-py 8.0.0 now uses RESP3 on the wire by default while preserving legacy RESP2-compatible Python response shapes for existing applications (#4052). Protocol-independent unified response shapes are available by setting legacy_responses=False, so affected commands return the same Python structure with RESP2 or RESP3.

Use protocol=2 to force RESP2 on the wire, protocol=3 to opt into native RESP3 response shapes, or legacy_responses=False to migrate to unified responses. See https://github.com/redis/redis-py/blob/HEAD/docs/unified_responses.rst and https://github.com/redis/redis-py/blob/HEAD/specs/unified_responses_migration_guide.md for the affected commands and migration details.

Connection and retry defaults

Default connection settings were updated: socket_timeout and socket_connect_timeout now default to 5 seconds, TCP keepalive is enabled by default, socket reads use a 32 KB buffer, connection pools default to max_connections=100, and retry defaults now use 10 attempts with exponential jitter backoff.

Note: socket_timeout can affect blocking commands such as BLPOP/BRPOP; if a command blocks longer than the client socket timeout, it may raise TimeoutError before the command timeout elapses (#2807).

🧪 Experimental Features

• Added support for new array commands (#4055)

🚀 New Features

• Support Cluster PubSub in asyncio (#3736)
• Add Redis Keyspace Notifications Support for Redis Cluster (#3962)
• Add random load balancing strategy which allows for use of the primary (#4027)
• Add FPHA (floating-point homogeneous array) arg support to JSON.SET (#4011)
• Added custom Claude command + XNACK command support (#4030)
• Adding Time Series Multiple Aggregators support (#4035)
• Adding support for new COUNT aggregator for some sorted set commands - ZINTER, ZINTERSTORE, ZUNION, ZUNIONSTORE (#4034)
• Adding support for new INCREX command (#4067 #4077)
• Add support for PubSub subscriptions with binary channel names and handlers (#4068)

... (truncated)

Commits

• 733f80e Updates in default connection and retry settings (#4082)
• a68a16c Updating Redis supported versions in README.md and lib version to 8.0.0
• 43a41d3 Updating INCREX command arg - SATURATE now controls overflow behaviour (#4077)
• 1496deb Preserve explicit None for client metadata config (#4081)
• 57dc08c Avoid zero-timeout async reads in hiredis connections readiness checks and re...
• cd54ddd fix(typing): correct type annotation for XReadResponse (#4046)
• ab2d41f Add support for PubSub subscriptions with binary channel names and handlers (...
• ef24dc9 Randomize cluster startup node order during topology refresh (#4060)
• b604015 Add CLAUDE.md and /sync-claude-md skill for managing (#4066)
• 2b8b4fc Fix flaky tests (#4071)
• Additional commits viewable in compare view

Updates opentelemetry-api to 1.42.1

Changelog

Sourced from opentelemetry-api's changelog.

Version 1.42.1/0.63b1 (2026-05-21)

Fixed

• Preserve the random trace ID flag when creating child spans instead of always setting the random trace id bit depending on the available trace id generator. (#5241)

Version 1.42.0/0.63b0 (2026-05-19)

Added

• opentelemetry-api, opentelemetry-sdk: add support for 'random-trace-id' flags in W3C traceparent header trace flags. Implementations of IdGenerator that do randomly generate the 56 least significant bits, should also implement a is_trace_id_random methods that returns True. (#4854)
• logs: add exception support to Logger emit and LogRecord attributes (#4908)
• opentelemetry-exporter-otlp-proto-grpc: make retryable gRPC error codes configurable for gRPC exporters (#4917)
• opentelemetry-sdk: Add create_logger_provider/configure_logger_provider to declarative file configuration, enabling LoggerProvider instantiation from config files without reading env vars (#4990)
• opentelemetry-exporter-otlp-json-common: add 'opentelemetry-exporter-otlp-json-common' package for OTLP JSON exporters (#4996)
• opentelemetry-sdk: Add service resource detector support to declarative file configuration via detection_development.detectors[].service (#5003)
• opentelemetry-docker-tests: add docker-tests coverage of opentelemetry-exporter-otlp-proto-grpc and opentelemetry-exporter-otlp-proto-http metrics export (#5030)
• Add registry keyword argument to PrometheusMetricReader to allow passing a custom Prometheus registry (#5055)
• Add WeaverLiveCheck test util (#5088)
• opentelemetry-sdk: add load_entry_point shared utility to declarative file configuration for loading plugins via entry points; refactor propagator loading to use it (#5093)
• opentelemetry-sdk: add sampler plugin loading to declarative file configuration via the opentelemetry_sampler entry point group, matching the spec's PluginComponentProvider mechanism (#5095)

... (truncated)

Commits

• 367e14d Prepare release 1.42.1/0.63b1 (#5243)
• fd8e504 Preserve random trace ID flag for child spans (#5241) (#5242)
• 013045e [release/v1.42.x-0.63bx] Prepare release 1.42.0/0.63b0 (#5225)
• 1731583 ci: Enable GitHub Merge Queue support (#5209)
• 7fab34d fix(config): allow deflate for OTLP HTTP exporters (#5075)
• 0b690d2 ci: validate changelog fragment filenames (#5212)
• d4fabb4 feat(config): exporter plugin loading via entry points for declarative config...
• e19d346 feat(config): generic resource detector plugin loading for declarative config...
• 1d69bd2 sdk/metrics: copy attributes dict to prevent post-recording mutation (#5106)
• 990a611 feat(config): propagator plugin loading via entry points for declarative conf...
• Additional commits viewable in compare view

Updates opentelemetry-sdk to 1.42.1

Changelog

Sourced from opentelemetry-sdk's changelog.

Version 1.42.1/0.63b1 (2026-05-21)

Fixed

• Preserve the random trace ID flag when creating child spans instead of always setting the random trace id bit depending on the available trace id generator. (#5241)

Version 1.42.0/0.63b0 (2026-05-19)

Added

• opentelemetry-api, opentelemetry-sdk: add support for 'random-trace-id' flags in W3C traceparent header trace flags. Implementations of IdGenerator that do randomly generate the 56 least significant bits, should also implement a is_trace_id_random methods that returns True. (#4854)
• logs: add exception support to Logger emit and LogRecord attributes (#4908)
• opentelemetry-exporter-otlp-proto-grpc: make retryable gRPC error codes configurable for gRPC exporters (#4917)
• opentelemetry-sdk: Add create_logger_provider/configure_logger_provider to declarative file configuration, enabling LoggerProvider instantiation from config files without reading env vars (#4990)
• opentelemetry-exporter-otlp-json-common: add 'opentelemetry-exporter-otlp-json-common' package for OTLP JSON exporters (#4996)
• opentelemetry-sdk: Add service resource detector support to declarative file configuration via detection_development.detectors[].service (#5003)
• opentelemetry-docker-tests: add docker-tests coverage of opentelemetry-exporter-otlp-proto-grpc and opentelemetry-exporter-otlp-proto-http metrics export (#5030)
• Add registry keyword argument to PrometheusMetricReader to allow passing a custom Prometheus registry (#5055)
• Add WeaverLiveCheck test util (#5088)
• opentelemetry-sdk: add load_entry_point shared utility to declarative file configuration for loading plugins via entry points; refactor propagator loading to use it (#5093)
• opentelemetry-sdk: add sampler plugin loading to declarative file configuration via the opentelemetry_sampler entry point group, matching the spec's PluginComponentProvider mechanism (#5095)

... (truncated)

Commits

• 367e14d Prepare release 1.42.1/0.63b1 (#5243)
• fd8e504 Preserve random trace ID flag for child spans (#5241) (#5242)
• 013045e [release/v1.42.x-0.63bx] Prepare release 1.42.0/0.63b0 (#5225)
• 1731583 ci: Enable GitHub Merge Queue support (#5209)
• 7fab34d fix(config): allow deflate for OTLP HTTP exporters (#5075)
• 0b690d2 ci: validate changelog fragment filenames (#5212)
• d4fabb4 feat(config): exporter plugin loading via entry points for declarative config...
• e19d346 feat(config): generic resource detector plugin loading for declarative config...
• 1d69bd2 sdk/metrics: copy attributes dict to prevent post-recording mutation (#5106)
• 990a611 feat(config): propagator plugin loading via entry points for declarative conf...
• Additional commits viewable in compare view

Updates opentelemetry-instrumentation-starlette to 0.63b1

Changelog

Sourced from opentelemetry-instrumentation-starlette's changelog.

Version 1.42.1/0.63b1 (2026-05-21)

No significant changes.

Version 1.42.0/0.63b0 (2026-05-19)

Added

• opentelemetry-exporter-richconsole: Add support for suppressing resource information (#3898)
• opentelemetry-instrumentation: Add experimental metrics attributes Labeler utility (#4288)
• opentelemetry-instrumentation-logging: Add OTEL_PYTHON_LOG_HANDLER_LEVEL and OTEL_PYTHON_LOG_FORMAT environment variables to configure the log level and formatter of the auto-instrumented LoggingHandler. (#4298)
• opentelemetry-instrumentation-sqlite3: Add uninstrument, error status, suppress, and no-op tests (#4335)
• Add BaggageLogProcessor to opentelemetry-processor-baggage (#4371)
• opentelemetry-instrumentation-system-metrics: Add support for process.disk.io metric in system-metrics instrumentation (#4397)
• opentelemetry-instrumentation: Register OTEL_SEMCONV_STABILITY_OPT_IN in environment_variables.py so opentelemetry-instrument exposes a --semconv_stability_opt_in CLI argument (#4438)
• Expand AGENTS.md with instrumentation/GenAI guidance and add PR review instructions. (#4457)
• opentelemetry-instrumentation: update auto-instrumentation to re-inject instrumentation path after init (#4469)
• opentelemetry-instrumentation-dbapi: Add Database client operation duration and returned rows metrics (#4481)

Changed

• Remove redundant pylint: disable=attribute-defined-outside-init comments and add rule to global .pylintrc disable list (#3839)
• Bump pylint to 4.0.5 (#4244)
• opentelemetry-instrumentation-logging: Use LogRecord.getMessage() to format and extract each log record's body text to more closely match the expected usage of the logging system. As a result, all OTel log record bodies

... (truncated)

Commits

• See full diff in compare view

Updates presidio-analyzer to 2.2.362

Release notes

Sourced from presidio-analyzer's releases.

Release 2.2.362

What's Changed

• Feature - GPU Device Control via Environment Variable by @​RonShakutai in microsoft/presidio#1844
• feat: Add HuggingFaceNerRecognizer for direct NER model inference by @​ultramancode in microsoft/presidio#1834
• Fix Broken Links by @​andyjessen in microsoft/presidio#1856
• Pin dependencies to mitigate supply chain attacks by @​Copilot in microsoft/presidio#1861
• Fixing CVE-2024-47874 and CVE-2025-54121 by @​SharonHart in microsoft/presidio#1860
• Fixing CVE-2025-2953 and CVE-2025-3730 by @​SharonHart in microsoft/presidio#1859
• fix: Fixed context enhancement substring matching bug by @​ravi-jindal in microsoft/presidio#1827
• Fix _process_names unconditionally treating all metadata as PHI by @​Mr-Neutr0n in microsoft/presidio#1855
• feat: Add UK Postcode (UK_POSTCODE) recognizer by @​tee-jagz in microsoft/presidio#1858
• Pin ruff and build pip installs by hash for OSSF scorecard compliance by @​Copilot in microsoft/presidio#1864
• Add US NPI (National Provider Identifier) recognizer by...

  Description has been truncated