Skip to content

deps: bump the minor-and-patch group across 1 directory with 21 updates - #612

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/minor-and-patch-4638ad645e
Open

deps: bump the minor-and-patch group across 1 directory with 21 updates#612
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/minor-and-patch-4638ad645e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 17, 2026

Copy link
Copy Markdown
Contributor

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps the minor-and-patch group with 21 updates in the / directory:

Package From To
mcp 2.1.1 2.2.0
tree-sitter-language-pack 1.16.1 1.19.1
ruff 0.16.6 0.16.7
pyright 1.1.411 1.1.414
build 1.6.0 1.6.1
coverage 7.16.0 7.16.1
filelock 3.32.5 3.32.6
fsspec 2026.6.0 2026.7.0
httpcore2 2.12.0 2.13.0
httpx2 2.12.0 2.13.0
huggingface-hub 1.30.0 1.31.0
mcp-types 2.1.1 2.2.0
narwhals 2.25.0 2.26.0
pydantic-core 2.46.5 2.49.0
pyjwt 2.13.0 2.14.0
regex 2026.9.3 2026.9.10
tqdm 4.70.0 4.70.1
transformers 5.16.1 5.17.0
tzdata 2026.3 2026.4
uvicorn 0.52.4 0.53.0
multidict 6.7.1 6.8.0

Updates mcp from 2.1.1 to 2.2.0

Release notes

Sourced from mcp's releases.

v2.2.0

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

A few defaults changed in this release. If you run a server or client on 2.x, skim these first:

Behaviour changes

HTTP client redirects are only followed within the endpoint's origin (#3397)

  • Client("https://..."), streamable_http_client and sse_client follow a redirect only if it stays on the same scheme, host and port (or upgrades http to https on the same host).
  • A redirect anywhere else is not followed: the call fails with MCPError and the session stays usable (an SSE connect fails with httpx2.HTTPStatusError). If that other URL is the server you meant, use it as the endpoint URL.
  • The follow_redirects setting on an httpx2.AsyncClient you pass in is no longer used for MCP requests, so you don't need it for the trailing-slash redirect any more.
  • The OAuth providers apply the same rule to their own requests.

Idle Streamable HTTP sessions now expire (legacy <=2025-11-25 spec( (#3395)

  • A stateful session with nothing in flight for 30 minutes is closed. The client's next request gets a 404 and it has to initialize again.
  • Clients that keep the GET stream open (the SDK's Client does) are not affected. Neither are stateless servers or 2026-07-28 connections.
  • A server also holds at most 10 000 sessions at once; beyond that, new sessions get a 503.
  • To turn either off: mcp.run(transport="streamable-http", session_idle_timeout=None, max_sessions=None) (also on streamable_http_app() and run_streamable_http_async()).

The OAuth client checks the authorization server's issuer on the legacy path too (#3398)

  • For servers without protected resource metadata, authorization server metadata whose issuer isn't the server's own origin is now rejected with OAuthFlowError: Authorization server metadata issuer mismatch. The protected-resource-metadata path has done this since 2.0.
  • A 403 that isn't an insufficient_scope challenge is returned to the caller instead of retried.
  • If protected resource metadata can't be fetched because of a 5xx/429, the flow now stops instead of falling back to the legacy endpoints.

Two new MCPDeprecationWarnings (#3435, #3447)

  • ClientCredentialsOAuthProvider / PrivateKeyJWTOAuthProvider without issuer=. Pass your authorization server's issuer URL; 3.0 will require it.
  • AuthSettings with resource_server_url set but validate_token_resource unset. Set it to True or False; 3.0 defaults it to True.
  • Both keep working as before in 2.x; this mostly matters if your tests turn warnings into errors.

New

  • AuthSettings.validate_token_resource: only accept tokens your TokenVerifier reports as issued for this server (#3447).
  • issuer= on ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (#3398).
  • session_idle_timeout= and max_sessions= on the Streamable HTTP server entry points (#3395).

Fixes

  • A client DELETE frees its session immediately, and a refused opening request no longer leaves a session behind (#2455, #3228, #3300).
  • $refs in a tool's outputSchema resolve within that schema only; an unresolvable one surfaces as RuntimeError: Invalid schema for tool ... (#3394).

Known gaps

The tasks extension (SEP-2663), DPoP (SEP-1932) and the jwt-bearer grant are not implemented yet; https://github.com/modelcontextprotocol/python-sdk/blob/main/ROADMAP.md tracks them.

What's Changed

... (truncated)

Commits
  • 9972c21 Replace RootModel wrappers with type aliases and TypeAdapter validation (#3470)
  • fd66270 docs: refresh translations, and translate pages in parallel (#3458)
  • 08a3bc8 docs: ask for AI disclosure on comments too (#3459)
  • 7bb486a docs: stop presenting the in-memory client as the way to connect (#3443)
  • 0c91368 Add AuthSettings.validate_token_resource to check a bearer token's resource (...
  • 9771e6b Keep following a relative redirect when the endpoint URL carries userinfo (#3...
  • a925e55 Bump the locked versions of eight dev and test dependencies (#3449)
  • e8b9486 Bump pymdown-extensions from 11.0 to 11.0.1 (#3285)
  • c6762e8 Follow redirects only within the MCP endpoint's origin (#3397)
  • 5fd3abc Skip automatic docs previews for fork PRs and drop the setup-uv retry steps (...
  • Additional commits viewable in compare view

Updates tree-sitter-language-pack from 1.16.1 to 1.19.1

Release notes

Sourced from tree-sitter-language-pack's releases.

Release v1.19.1

What's Changed

Full Changelog: xberg-io/tree-sitter-language-pack@v1.16.0...v1.19.1

Release v1.19.0

Changed

  • Upgraded the tree-sitter runtime to 0.27, moving tree-sitter-language to 0.1.8 in the same step. The two pins are not independent: 0.27 requires tree-sitter-language ^0.1.8, and 0.1.8 relocates the 0.26 WASM shims under wasm/unsupported/ so they no longer compile against the older runtime. The grammar ABI is unchanged -- both 0.26 and 0.27 are TREE_SITTER_LANGUAGE_VERSION 15 with a minimum compatible version of 13 -- so every bundled grammar loads exactly as before and no regeneration is implied.
  • Consumers that also depend on tree-sitter directly must move to 0.27 in the same step. The tree-sitter crate declares links = "tree-sitter", and Cargo permits only one package per links value in a dependency graph, so pairing this release with a 0.26 pin fails to resolve rather than failing to compile. Nothing this crate exports changed: the requirement is a dependency floor, not a break in its own API.
  • Grammar scanners now compile with NDEBUG on wasm32. 0.27's WASM libc is a documented subset that excludes assert, so a scanner keeping its assertions emitted an unresolved __assert_fail. That became an env module import rather than a link error, and the package then failed to load at runtime with Cannot find module 'env'. Native builds keep their assertions.
  • Dropped this crate's own WASM libc shims (memchr, strcmp, iswalnum and friends) now that 0.27 defines them. Keeping both made the two definitions collide at link time, which broke the WASM package under the split-codegen-unit settings the release build uses.
  • Replaced the 0.26 WASM integration, which used a separate non-thread-safe allocator and an incomplete libc. 0.27 supplies its own WASM libc and forwards C allocation to the Rust application's global allocator.

Fixed

  • Swift binaries again link a single tree-sitter C runtime. SwiftPM builds tree-sitter 0.25.10 for SwiftTreeSitter as loose object files, while this package's Rust staticlib carries the 0.27 runtime in one archive member. Archive members load only to resolve an undefined symbol, and 0.27's new ts_language_is_parseable was the first symbol SwiftPM's copy could not supply -- pulling the member in and colliding on 253 other runtime symbols at link time. The C bridge now provides a weak definition, so the member stays unreferenced and yields to any future SwiftPM runtime that exports the symbol itself (#189).
  • wasm32 builds now find their headers under either wasi-sysroot include layout. wasi-libc renamed include/wasm32-wasi to include/wasm32-wasip1, and probing only the former meant a sysroot that existed but used the newer name contributed no include flag at all, failing every grammar with 'stdlib.h' file not found. Toolchains whose clang supplies its own sysroot were unaffected, which is why this surfaced only in local builds.
  • Node::child_count now returns tree-sitter's u32 widened to the usize this crate has always

... (truncated)

Changelog

Sourced from tree-sitter-language-pack's changelog.

[1.19.1] - 2026-09-13

Changed

  • Alef stays pinned at 0.85.15. 0.86.1 rewrites the Swift binding to real value types -- DataNode, ProcessResult and StructureItem become Codable structs with typed properties instead of typealiases to opaque Rust handles -- but does not update the Swift e2e suite it generates alongside them, which still calls result.language() and result.structure() on what are now properties. The two halves of its own output do not compile together, and e2e/ is generated with a CI freshness gate, so the mismatch cannot be patched downstream. Reported upstream; the upgrade lands once the e2e emitter follows the binding emitter.
  • Removed the eight superseded release/swift/<version> branches. publish.yaml moves the release tag onto the same checksummed commit it pushes the branch to, so each branch named a commit already reachable through v<version>; a consumer pinned to one can switch to exact: "<version>" with no other change. release/swift/1.19.0 is retained.

Fixed

  • Patched an indent-stack underflow in the vendored agda external scanner. VEC_POP is a bare len-- and VEC_BACK reads data[len - 1], so the dedent loop could drain the stack, wrap len to UINT32_MAX and dereference the buffer plus 16 GiB. 1023 or more repeated ' characters -- or NUL bytes -- crash the parser with SIGBUS. The same scanner also seeded its column-0 sentinel only when deserialize was called with a NULL buffer, while tree-sitter resets a scanner with a non-NULL inline buffer of length 0, leaving the following scan to read data[-1]. A survey of all 186 vendored scanners found both defects only in agda.
  • Dynamically loaded grammars are ABI-checked at load time. load_from_dir called Language::from_raw on a downloaded parser with only a null check, so an incompatible grammar was accepted and failed later at ts_parser_set_language -- or, just outside the compatible range, parsed wrongly. The ABI version is now compared against the linked runtime's MIN_COMPATIBLE_LANGUAGE_VERSION..=LANGUAGE_VERSION and rejected with both versions named. The bounds are read from the runtime, so a runtime upgrade moves them rather than leaving a stale literal behind.
  • scripts/sync_zig_zon_hashes.py now maintains alef.toml's [crates.e2e.registry.packages.zig.platform_hashes] alongside test_apps/zig/build.zig.zon. Nothing had ever populated that table, so it carried five STALE_HASH_REGENERATE placeholders; Alef responds to a placeholder by omitting the .hash line entirely, which is the only reason the manifest had to be declared user_owned in the first place. The five real digests are in place and the gate now fails on drift in either file.
  • The nightly sanitizer sweep finishes inside its job. Six consecutive nightlies were killed at the 120-minute limit, every one inside the parse sweep after all twelve preceding steps had passed, so the job reported neither its findings nor how far it got. The sweep now runs against a 90-minute budget checked between languages, states how many languages it swept, names any it did not reach, and bounds each parse with a timeout -- one pathological input had been running over ten minutes. The day's language order rotates by day-of-year so a truncated sweep stops dropping the same alphabetical tail every night.
  • That sweep also reports a finding it cannot attribute to a sanitizer exit code. UBSan raises SIGABRT where abort_on_error defaults to 1 and prints ERROR: UndefinedBehaviorSanitizer, neither of which the previous detector matched, so the agda crash above was exactly the shape it let through; any parse killed by a signal now counts. Its sanitizer environment is scoped to the ts-pack invocation as well -- as a step-level env: it also reached the shell, python3,

... (truncated)

Commits
  • 0a8a6b4 chore(swift): update Package.swift with checksum for v1.19.1
  • 481753f fix(swift): include stddef.h for NULL in the RustBridgeC shim
  • f5f9f78 fix(swift): re-stamp the RustBridge files alef owns
  • e57a51f fix(swift): restore the alef stamps the swift-bridge build strips
  • 1605195 fix(alef): hold the generator at 0.85.15 for 1.19.1
  • f070230 chore(release): 1.19.1
  • 025652d test(intel): name the grammars the configuration-node suite needs
  • 6ca0dae fix(zig): gate alef.toml's platform hashes alongside the manifest
  • 1d2d135 chore(swift): prune the superseded release/swift branches
  • 8462b54 fix(registry): reject dynamically loaded grammars with an unusable ABI
  • Additional commits viewable in compare view

Updates ruff from 0.16.6 to 0.16.7

Release notes

Sourced from ruff's releases.

0.16.7

Release Notes

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)
  • [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

  • Alternate nested quotes inside format spec interpolations (#28259)
  • [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
  • [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
  • [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

  • Correct D211 and D203 rule conflict diagnostic (#28444)
  • Recognize slice and frozendict generics (#28477)
  • Stop defining __cached__ for Python 3.15 (#28476)
  • [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

  • Reuse parser name lookups when interning (#28399)
  • Speed up inherited configuration resolution (#28299)

Documentation

  • Fix line-length path in --config example (#28392)
  • Remove the "Who’s Using Ruff?" list (#28455)

Other changes

  • Embed archive checksums in the shell installer (#28281)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.7

Released on 2026-09-10.

Preview features

  • [ruff] Add rule for default values on method receivers (RUF077) (#26700)
  • [ruff] Recognize re.prefixmatch (RUF039, RUF055) (#28311)

Bug fixes

  • Alternate nested quotes inside format spec interpolations (#28259)
  • [flake8-implicit-str-concat] Mark fix unsafe when it creates a docstring (ISC003) (#27981)
  • [flake8-tidy-imports] Skip fixes for multi-member imports (TID254) (#26584)
  • [pylint] Gate ImportCycleError on Python 3.15 (PLW0133) (#28310)

Rule changes

  • Correct D211 and D203 rule conflict diagnostic (#28444)
  • Recognize slice and frozendict generics (#28477)
  • Stop defining __cached__ for Python 3.15 (#28476)
  • [pyupgrade] Stop recommending removed typing.no_type_check_decorator (UP035) (#28475)

Performance

  • Reuse parser name lookups when interning (#28399)
  • Speed up inherited configuration resolution (#28299)

Documentation

  • Fix line-length path in --config example (#28392)
  • Remove the "Who’s Using Ruff?" list (#28455)

Other changes

  • Embed archive checksums in the shell installer (#28281)

Contributors

... (truncated)

Commits

Updates pyright from 1.1.411 to 1.1.414

Commits

Updates build from 1.6.0 to 1.6.1

Release notes

Sourced from build's releases.

1.6.1

What's Changed

Full Changelog: pypa/build@1.6.0...1.6.1

Changelog

Sourced from build's changelog.

#################### 1.6.1 (2026-09-10) ####################

Bugfixes

  • Avoid trying to detect symlinks on Windows, regression in 1.6.0 - by :user:henryiii (:issue:1175) (:issue:1175)

Documentation

  • Fix doubled backslashes in the Windows pip config path (%APPDATA%\pip\pip.ini) in the docs - by :user:aroh3006 (:issue:1149)

Miscellaneous

  • :issue:1168, :issue:1170, :issue:1178

#################### 1.6.0 (2026-08-27) ####################

Features

  • Add --report=PATH to write a machine-readable JSON report of built artifacts; --metadata now also accepts .whl files - by :user:gaborbernat (:issue:198)
  • The srcdir argument now accepts .tar.gz source distributions, extracting and building from them - by :user:gaborbernat (:issue:311)
  • The "Unmet dependencies" error from --no-isolation builds now shows the wanted version, found version, and interpreter - by :user:gaborbernat (:issue:504)
  • Add --sdist-extract-dir to extract the intermediate sdist into a persistent directory, enabling compiler cache reuse across rebuilds - by :user:gaborbernat (:issue:614)
  • Add --env-dir to place the isolated build environment at a fixed path, enabling compiler cache reuse across builds
    • by :user:gaborbernat (:issue:655)
  • Print a summary of resolved dependency versions (name==version) after installing them in isolated builds - by :user:gaborbernat (:issue:959)
  • On build failure, print a tip pointing to --env-dir and --sdist-extract-dir for debugging and link to the "Debug a failed build" how-to - reported by :user:dimpase, implemented by :user:gaborbernat (:issue:966)

Bugfixes

... (truncated)

Commits
  • 89cccef chore: prepare for 1.6.1
  • a6f707a ci: support releases from v* branches (#1178)
  • 7785161 docs: fix doubled backslashes in Windows pip config path (#1149)
  • 244b250 fix: always use copies for the isolated venv on Windows (#1176)
  • c93ca6f build(deps): bump re-actors/alls-green from 1.2.2 to 1.3.0 in the github-acti...
  • e02ffd3 pre-commit: bump repositories (#1173)
  • aad39a8 docs: fix changelog page heading levels and sidebar (#1171)
  • 5c3fd46 docs: use PyPI ref directly (#1172)
  • 1c5bd6c 🐛 fix(release): format generated changelog (#1170)
  • 7f0cc7e 🔧 build(type): replace mypy with pyrefly (#1168)
  • See full diff in compare view

Updates coverage from 7.16.0 to 7.16.1

Release notes

Sourced from coverage's releases.

7.16.1

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563 with pull 2269.
  • Fix: using CoverageData.update() twice on an in-memory database would fail, as described in issue 2279. This is now fixed.

➡️  PyPI page: coverage 7.16.1. :arrow_right:  To install: python3 -m pip install coverage==7.16.1

Changelog

Sourced from coverage's changelog.

Version 7.16.1 — 2026-09-13

  • Fix: when the body of an irrefutable case (like case _:) is entirely excluded, the case line is now excluded too, just as an excluded else: body removes the else: line. Previously the case line was left behind and reported as missing. Closes issue 1563_ with pull 2269_.

  • Fix: using :meth:.CoverageData.update twice on an in-memory database would fail, as described in issue 2279_. This is now fixed.

.. _issue 1563: coveragepy/coveragepy#1563 .. _pull 2269: coveragepy/coveragepy#2269 .. _issue 2279: coveragepy/coveragepy#2279

.. _changes_7-16-0:

Commits
  • ccbb992 docs: prep for 7.16.1
  • 0697ccc chore: make upgrade
  • 12f3595 chore: bump docker/setup-qemu-action in the action-dependencies group (#2280)
  • 35b58d3 fix: CoverageData.update() can be called twice on an in-memory database. #2279
  • 92e1ce9 chore: bump the action-dependencies group with 4 updates (#2278)
  • bf07310 build: quote var expansion (actionlint SC2086)
  • 3c434f5 quality: use shellcheck-py to get shellcheck in GitHub CI
  • 632f397 build: use .txt instead of .pip, even though it's a stupid extension
  • ffc6a4a test: only run diff-cover on pull requests
  • 33553b3 fix: exclude the case line when an irrefutable case body is excluded (#2269)
  • Additional commits viewable in compare view

Updates filelock from 3.32.5 to 3.32.6

Release notes

Sourced from filelock's releases.

3.32.6

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.5...3.32.6

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.0.0 (2026-09-17)

  • The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state, .write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:~filelock.StrictSoftFileLock, so a runtime without os.link raises :class:~filelock.SoftFileLockProtocolError on acquire. Constructing a singleton again with a different on_compromise, or with poll_interval at or above stale_threshold, now raises :class:ValueError. :pr:735
  • :class:~filelock.SoftReadWriteLock exposes :attr:~filelock.SoftReadWriteLock.generation as a fencing token for the protected resource and reports a lost hold through on_compromise and :attr:~filelock.SoftReadWriteLock.compromise. :pr:735
  • :class:~filelock.SoftReadWriteLock no longer deadlocks when a holder dies on another host mid-transition, and release() no longer waits on a mutex a dead host left behind (:pr:725, :pr:735). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an mtime read against another host's. :pr:735

3.32.7 (2026-09-16)

  • Validate final-symlink refusal by error number so the test works across libc implementations. :pr:737
  • Document that :meth:~filelock.BaseFileLock.acquire reads blocking=None as the lock's blocking attribute and raises :class:~filelock.Timeout after one attempt when blocking=False. :pr:733

3.32.6 (2026-09-08)

  • SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
  • Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724
  • Honor acquisition timeouts and blocking=False during SoftReadWriteLock state-mutex contention, including failed writer cleanup. Cross-host recovery of an abandoned .state marker remains unsupported. :pr:726
  • Allow acquiring existing lock files that grant write access through group permissions or an ACL even when their owner-write mode bit is unset. :pr:728
  • Preserve exception notes and custom attributes when copying or pickling Timeout and SoftFileLockProtocolError. :pr:729

... (truncated)

Commits
  • 4efd93e Release 3.32.6
  • 7b7b7a8 Fix SoftReadWriteLock state lock timeout (#726)
  • f2f7b86 fix: respect ACL write access when the owner write bit is absent (#728)
  • e947a69 test(soft-rw): reuse existing test module (#730)
  • da3ae2b fix: preserve exception notes when copying and pickling (#729)
  • ae9cb5b 🐛 fix(soft-rw): reject non-finite timing options (#724)
  • d00f9bb [pre-commit.ci] pre-commit autoupdate (#727)
  • 82f66d7 🐛 fix(lease): reject a duration no marker can carry (#723)
  • 1d9e9e7 [pre-commit.ci] pre-commit autoupdate (#722)
  • See full diff in compare view

Updates fsspec from 2026.6.0 to 2026.7.0

Commits

Updates httpcore2 from 2.12.0 to 2.13.0

Release notes

Sourced from httpcore2's releases.

v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (pydantic/httpx2#1140, pydantic/httpx2#1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (pydantic/httpx2#1204).

httpx2

Changed

  • Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in pydantic/httpx2#1179

Fixed

httpcore2

Changed

Fixed

  • Avoid nested async generator finalization errors when streamed responses are abandoned early in pydantic/httpx2#1204

Full Changelog: pydantic/httpx2@v2.12.0...v2.13.0

Commits
  • f295185 Prepare version 2.13.0 (#1208)
  • c518f71 Avoid nested async generator finalization errors (#1204)
  • 8f215b5 Use portable links in API docstrings (#1202)
  • 81c523f Revert "Maintain connection reservations incrementally in the pool" (#1197)
  • 23a24f0 Maintain connection reservations incrementally in the pool (#1076)
  • 36d636a Group httpx2.__all__ exports by source module (#1188)
  • f1064aa Bump the python-packages group across 1 directory with 11 updates (#1179)
  • bc27137 Update uv-dynamic-versioning requirement from >=0.14.0 to >=0.14.1 (#1180)
  • 62e0827 Restore --no-verify CLI flag (#1186)
  • c9b1d33 Replace --no-verify flag with --verify (#1140)
  • Additional commits viewable in compare view

Updates httpx2 from 2.12.0 to 2.13.0

Release notes

Sourced from httpx2's releases.

v2.13.0

Highlights

🔐 Reliable TLS verification controls

The CLI --no-verify flag now disables TLS certificate verification as intended, and --verify provides an explicit counterpart (pydantic/httpx2#1140, pydantic/httpx2#1186).

🧹 Safer async stream cleanup

Stopping a streamed response early no longer risks a nested async generator finalization error (pydantic/httpx2#1204).

httpx2

Changed

  • Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations in pydantic/httpx2#1179

Fixed

httpcore2

Changed

Fixed

  • Avoid nested async generator finalization errors when streamed responses are abandoned early in pydantic/httpx2#1204

Full Changelog: pydantic/httpx2@v2.12.0...v2.13.0

Changelog

Sourced from httpx2's changelog.

2.13.0 (September 14th, 2026)

Changed

  • Require brotlicffi 1.2.0.2 or later for the brotli extra on non-CPython implementations. (#1179)
    • ...

    Description has been truncated

@dependabot
deps: bump the minor-and-patch group across 1 directory with 21 updates
f02fbca 
Bumps the minor-and-patch group with 21 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `2.1.1` | `2.2.0` |
| [tree-sitter-language-pack](https://github.com/xberg-io/tree-sitter-language-pack) | `1.16.1` | `1.19.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.6` | `0.16.7` |
| [pyright](https://github.com/RobertCraigie/pyright-python) | `1.1.411` | `1.1.414` |
| [build](https://github.com/pypa/build) | `1.6.0` | `1.6.1` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.16.0` | `7.16.1` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.5` | `3.32.6` |
| [fsspec](https://github.com/fsspec/filesystem_spec) | `2026.6.0` | `2026.7.0` |
| [httpcore2](https://github.com/pydantic/httpx2) | `2.12.0` | `2.13.0` |
| [httpx2](https://github.com/pydantic/httpx2) | `2.12.0` | `2.13.0` |
| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.30.0` | `1.31.0` |
| [mcp-types](https://github.com/modelcontextprotocol/python-sdk) | `2.1.1` | `2.2.0` |
| [narwhals](https://github.com/narwhals-dev/narwhals) | `2.25.0` | `2.26.0` |
| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.5` | `2.49.0` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.14.0` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.9.3` | `2026.9.10` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.70.0` | `4.70.1` |
| [transformers](https://github.com/huggingface/transformers) | `5.16.1` | `5.17.0` |
| [tzdata](https://github.com/python/tzdata) | `2026.3` | `2026.4` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.4` | `0.53.0` |
| [multidict](https://github.com/aio-libs/multidict) | `6.7.1` | `6.8.0` |



Updates `mcp` from 2.1.1 to 2.2.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v2.1.1...v2.2.0)

Updates `tree-sitter-language-pack` from 1.16.1 to 1.19.1
- [Release notes](https://github.com/xberg-io/tree-sitter-language-pack/releases)
- [Changelog](https://github.com/xberg-io/tree-sitter-language-pack/blob/main/CHANGELOG.md)
- [Commits](xberg-io/tree-sitter-language-pack@v1.16.1...v1.19.1)

Updates `ruff` from 0.16.6 to 0.16.7
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.6...0.16.7)

Updates `pyright` from 1.1.411 to 1.1.414
- [Release notes](https://github.com/RobertCraigie/pyright-python/releases)
- [Commits](RobertCraigie/pyright-python@v1.1.411...v1.1.414)

Updates `build` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/pypa/build/releases)
- [Changelog](https://github.com/pypa/build/blob/main/CHANGELOG.rst)
- [Commits](pypa/build@1.6.0...1.6.1)

Updates `coverage` from 7.16.0 to 7.16.1
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.16.0...7.16.1)

Updates `filelock` from 3.32.5 to 3.32.6
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.5...3.32.6)

Updates `fsspec` from 2026.6.0 to 2026.7.0
- [Commits](fsspec/filesystem_spec@2026.6.0...2026.7.0)

Updates `httpcore2` from 2.12.0 to 2.13.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Commits](pydantic/httpx2@v2.12.0...v2.13.0)

Updates `httpx2` from 2.12.0 to 2.13.0
- [Release notes](https://github.com/pydantic/httpx2/releases)
- [Changelog](https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md)
- [Commits](pydantic/httpx2@v2.12.0...v2.13.0)

Updates `huggingface-hub` from 1.30.0 to 1.31.0
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.30.0...v1.31.0)

Updates `mcp-types` from 2.1.1 to 2.2.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v2.1.1...v2.2.0)

Updates `narwhals` from 2.25.0 to 2.26.0
- [Release notes](https://github.com/narwhals-dev/narwhals/releases)
- [Commits](narwhals-dev/narwhals@v2.25.0...v2.26.0)

Updates `pydantic-core` from 2.46.5 to 2.49.0
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](https://github.com/pydantic/pydantic/commits)

Updates `pyjwt` from 2.13.0 to 2.14.0
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.13.0...2.14.0)

Updates `regex` from 2026.9.3 to 2026.9.10
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.9.3...2026.9.10)

Updates `tqdm` from 4.70.0 to 4.70.1
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.70.0...v4.70.1)

Updates `transformers` from 5.16.1 to 5.17.0
- [Release notes](https://github.com/huggingface/transformers/releases)
- [Commits](huggingface/transformers@v5.16.1...v5.17.0)

Updates `tzdata` from 2026.3 to 2026.4
- [Release notes](https://github.com/python/tzdata/releases)
- [Changelog](https://github.com/python/tzdata/blob/master/NEWS.md)
- [Commits](python/tzdata@2026.3...2026.4)

Updates `uvicorn` from 0.52.4 to 0.53.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.4...0.53.0)

Updates `multidict` from 6.7.1 to 6.8.0
- [Release notes](https://github.com/aio-libs/multidict/releases)
- [Changelog](https://github.com/aio-libs/multidict/blob/master/CHANGES.rst)
- [Commits](aio-libs/multidict@v6.7.1...v6.8.0)

---
updated-dependencies:
- dependency-name: mcp
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tree-sitter-language-pack
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ruff
  dependency-version: 0.16.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pyright
  dependency-version: 1.1.414
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: build
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: coverage
  dependency-version: 7.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: filelock
  dependency-version: 3.32.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fsspec
  dependency-version: 2026.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: httpcore2
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: httpx2
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: huggingface-hub
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mcp-types
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: narwhals
  dependency-version: 2.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pydantic-core
  dependency-version: 2.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pyjwt
  dependency-version: 2.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: regex
  dependency-version: 2026.9.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tqdm
  dependency-version: 4.70.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: transformers
  dependency-version: 5.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tzdata
  dependency-version: '2026.4'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: uvicorn
  dependency-version: 0.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: multidict
  dependency-version: 6.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants