Skip to content

chore(deps): Bump the minor-and-patch group across 1 directory with 5 updates - #815

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/a2a/git_issue_agent/minor-and-patch-534cfcb478
Open

chore(deps): Bump the minor-and-patch group across 1 directory with 5 updates#815
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/a2a/git_issue_agent/minor-and-patch-534cfcb478

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 5 updates in the /a2a/git_issue_agent directory:

Package From To
python-dotenv 1.2.2 1.2.3
a2a-sdk 1.1.0 1.1.2
litellm 1.91.1 1.97.0
starlette 1.3.1 1.6.0
orjson 3.11.9 3.12.0

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • f7b18d9 fix: round-trip backslashes through set_key (#680)
  • 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
  • f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
  • 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
  • 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
  • 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
  • 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
  • Additional commits viewable in compare view

Updates a2a-sdk from 1.1.0 to 1.1.2

Release notes

Sourced from a2a-sdk's releases.

v1.1.2

1.1.2 (2026-07-20)

Features

  • server: add aclose() to drain ActiveTask background tasks (#1101) (#1105) (9801f46)

Bug Fixes

  • agent_execution: resolve ActiveTask 'destroyed but pending' warning during teardown (#1122) (d19c4d2)
  • persist early producer failure as FAILED with originating message (#1106) (4e3d724)

v1.1.1

1.1.1 (2026-07-15)

Bug Fixes

  • server: improve Swagger /docs example annotations for A2A routes (#1092) (46b292b)

Miscellaneous Chores

  • grpc: eliminate third-party grpcio-status dependency (#1130) (723880e)
  • http: eliminate httpx-sse dependency (#1132) (0d82ab9)
Changelog

Sourced from a2a-sdk's changelog.

1.1.2 (2026-07-20)

Features

  • server: add aclose() to drain ActiveTask background tasks (#1101) (#1105) (9801f46)

Bug Fixes

  • agent_execution: resolve ActiveTask 'destroyed but pending' warning during teardown (#1122) (d19c4d2)
  • persist early producer failure as FAILED with originating message (#1106) (4e3d724)

1.1.1 (2026-07-15)

Bug Fixes

  • server: improve Swagger /docs example annotations for A2A routes (#1092) (46b292b)

Miscellaneous Chores

  • grpc: eliminate third-party grpcio-status dependency (#1130) (723880e)
  • http: eliminate httpx-sse dependency (#1132) (0d82ab9)
Commits
  • 3e6fa6a chore(main): release 1.1.2 (#1139)
  • 9801f46 feat(server): add aclose() to drain ActiveTask background tasks (#1101) (#1105)
  • d19c4d2 fix(agent_execution): resolve ActiveTask 'destroyed but pending' warning duri...
  • 4e3d724 fix: persist early producer failure as FAILED with originating message (#1106)
  • 86c6b0d chore(main): release 1.1.1 (#1103)
  • 0d82ab9 refactor(http): eliminate third-party httpx-sse dependency (#1132)
  • 723880e refactor(grpc): remove grpcio-status dependency (#1130)
  • 343373b test: expand itk scenarios with ts java and rust agents (#1129)
  • e7eafe3 chore(deps): bump cryptography from 48.0.0 to 48.0.1 (#1109)
  • 46b292b fix(server): improve Swagger /docs example annotations for A2A routes (#1092)
  • Additional commits viewable in compare view

Updates litellm from 1.91.1 to 1.97.0

Release notes

Sourced from litellm's releases.

v1.97.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.97.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.97.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.97.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • ef84494 Merge pull request #37058 from BerriAI/litellm_passthrough_accept_encoding
  • 6a919ae Merge pull request #36304 from BerriAI/litellm_internal_staging
  • 27d2fa8 Merge pull request #36297 from BerriAI/litellm_/release-ui-build-528a42
  • 84d63cb chore: update Next.js build artifacts (2026-08-08 20:14 UTC, node v24.19.0)
  • 10798ca Merge pull request #36286 from BerriAI/litellm_internal_staging
  • 97a59c8 Merge pull request #36293 from BerriAI/litellm_fix_circleci_88641_outdated_tests
  • e35ee4e feat(router): independent, default-on deployment affinity for the auto-router...
  • 554f065 Merge pull request #36296 from BerriAI/litellm_claude_md_descending_importance
  • ff5f813 docs: clarify guideline priority ordering in CLAUDE.md
  • 1a40a67 fix: stabilize generated user role ordering
  • Additional commits viewable in compare view

Updates starlette from 1.3.1 to 1.6.0

Release notes

Sourced from starlette's releases.

Version 1.6.0

What's Changed

New Contributors

Full Changelog: Kludex/starlette@1.5.1...1.6.0

Version 1.5.1

What's Changed

Full Changelog: Kludex/starlette@1.5.0...1.5.1

Version 1.5.0

This release is all about giving GZipMiddleware some love. 🗜️

What's Changed

Full Changelog: Kludex/starlette@1.4.1...1.5.0

Version 1.4.1

What's Changed

Full Changelog: Kludex/starlette@1.4.0...1.4.1

Version 1.4.0

What's Changed

New Contributors

Full Changelog: Kludex/starlette@1.3.1...1.4.0

Changelog

Sourced from starlette's changelog.

1.6.0 (August 8, 2026)

Added

  • Add max_body_size to Starlette and route classes #3431.
  • Expose http.response.debug information via response extensions #3130.

1.5.1 (August 8, 2026)

Fixed

  • Reject inverted single-byte ranges in FileResponse #3389.
  • Limit FileResponse to 100 ranges #3430.

1.5.0 (August 8, 2026)

Added

  • Add exclude_content_types parameter to GZipMiddleware #3418.

Changed

  • Expand default excluded content types in GZipMiddleware #3421.

Fixed

  • Flush GZip output for each streamed chunk #3419.
  • Skip compression of partial responses in GZipMiddleware #3420.

1.4.1 (August 5, 2026)

Fixed

  • Default thread_minimum_size to 128 KiB in GZipResponder, keeping it usable without the new keyword argument #3415.

1.4.0 (August 5, 2026)

Added

  • Offload large GZip compression to a worker thread, keeping the event loop responsive. GZipMiddleware accepts a new thread_minimum_size parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread #3410.

Changed

  • Use zlib.compressobj instead of GzipFile in GZipMiddleware, reducing memory usage during compression #3411.
  • Lazily allocate GZipMiddleware compression resources, avoiding compressor allocation for responses that are never compressed #3407.
Commits
  • 4f250d6 Version 1.6.0 (#3434)
  • 9eea41a Expose http.response.debug info via response extensions (#3130)
  • 38f8999 Add max_body_size to Starlette and route classes (#3431)
  • c41236c Version 1.5.1 (#3432)
  • 9c500db Limit FileResponse to 100 ranges (#3430)
  • 78ae82c Reject inverted single-byte Range like bytes=5-4 (#3389)
  • c1d6eda chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (#3429)
  • ee66ca4 chore(deps): bump the python-packages group across 1 directory with 8 updates...
  • 00d1016 fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...
  • d96887e Add Pydantic Logfire banner to the docs (#3428)
  • Additional commits viewable in compare view

Updates orjson from 3.11.9 to 3.12.0

Release notes

Sourced from orjson's releases.

3.12.0

Changed

  • Serialization implementation substantially rewritten.
  • Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
  • No longer publish PyPI wheels for ppc64le and s390x.
Changelog

Sourced from orjson's changelog.

3.12.0 - 2026-08-14

Changed

  • Serialization implementation substantially rewritten.
  • Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
  • No longer publish PyPI wheels for ppc64le and s390x.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the minor-and-patch group across 1 directory with 5…
d869419 
… updates

Bumps the minor-and-patch group with 5 updates in the /a2a/git_issue_agent directory:

| Package | From | To |
| --- | --- | --- |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.3` |
| [a2a-sdk](https://github.com/a2aproject/a2a-python) | `1.1.0` | `1.1.2` |
| [litellm](https://github.com/BerriAI/litellm) | `1.91.1` | `1.97.0` |
| [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` |
| [orjson](https://github.com/ijl/orjson) | `3.11.9` | `3.12.0` |



Updates `python-dotenv` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3)

Updates `a2a-sdk` from 1.1.0 to 1.1.2
- [Release notes](https://github.com/a2aproject/a2a-python/releases)
- [Changelog](https://github.com/a2aproject/a2a-python/blob/main/CHANGELOG.md)
- [Commits](a2aproject/a2a-python@v1.1.0...v1.1.2)

Updates `litellm` from 1.91.1 to 1.97.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.91.1...v1.97.0)

Updates `starlette` from 1.3.1 to 1.6.0
- [Release notes](https://github.com/Kludex/starlette/releases)
- [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md)
- [Commits](Kludex/starlette@1.3.1...1.6.0)

Updates `orjson` from 3.11.9 to 3.12.0
- [Release notes](https://github.com/ijl/orjson/releases)
- [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md)
- [Commits](ijl/orjson@3.11.9...3.12.0)

---
updated-dependencies:
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: a2a-sdk
  dependency-version: 1.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: litellm
  dependency-version: 1.97.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: starlette
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: orjson
  dependency-version: 3.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

Rossoctl Issue Prioritization
Status: New/ToDo

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rubambiza