Skip to content

chore(deps): uv: bump the all-python group across 1 directory with 9 updates - #947

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/agent/all-python-57502f052b
Closed

chore(deps): uv: bump the all-python group across 1 directory with 9 updates#947
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/agent/all-python-57502f052b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-python group with 9 updates in the /agent directory:

Package From To
boto3 1.43.78 1.43.108
bedrock-agentcore 1.18.1 1.24.0
claude-agent-sdk 0.2.110 0.2.163
uvicorn 0.50.0 0.54.0
aws-opentelemetry-distro 0.18.0 0.21.0
mcp 1.28.1 2.3.0
ruff 0.15.20 0.16.10
ty 0.0.56 0.0.84
pygments 2.20.0 2.21.0

Updates boto3 from 1.43.78 to 1.43.108

Commits

Updates bedrock-agentcore from 1.18.1 to 1.24.0

Release notes

Sourced from bedrock-agentcore's releases.

Bedrock AgentCore SDK v1.24.0

Installation

pip install bedrock-agentcore==1.24.0

What's Changed

See CHANGELOG.md for details.

What's Changed

New Contributors

Full Changelog: aws/bedrock-agentcore-sdk-python@v1.23.1...v1.24.0

Bedrock AgentCore SDK v1.23.1

Installation

pip install bedrock-agentcore==1.23.1

What's Changed

See CHANGELOG.md for details.

What's Changed

New Contributors

Full Changelog: aws/bedrock-agentcore-sdk-python@v1.23.0...v1.23.1

Bedrock AgentCore SDK v1.23.0

Installation

pip install bedrock-agentcore==1.23.0

... (truncated)

Changelog

Sourced from bedrock-agentcore's changelog.

[1.24.0] - 2026-09-28

Fixed

  • fix: handle empty payload gracefully (#683) (3a6496e)

Other Changes

  • feat(endpoints): support AWS China (aws-cn) partition (#684) (35c315e)
  • fix(ci): stop flaky sleep test and compat evaluation errors (#677) (c7423e5)
  • fix(clients): expose WaitConfig and accept region_name aliases (#675) (e9dcd40)
  • fix(evaluation): expose shared span helpers and evaluator level lookup (#674) (5554fb8)
  • feat(payments): attribute SDK usage via user-agent integration source (#669) (889615f)

[1.23.1] - 2026-09-16

Other Changes

  • fix(integ): adjust timeout on memory test. (#667) (2715d6f)
  • fix(memory): use current Strands bidi session hooks (#664) (cc980d1)

[1.23.0] - 2026-09-11

Added

  • feat: add RAGAS adapter for third-party eval metrics (#618) (d53af20)

Other Changes

  • Bump agentcore-devx-devtools reusable workflow pin (#660) (3c9f15e)
  • feat(tools): add WebSearchClient for invoking Amazon Web Search (#658) (cf71b14)
  • feat(gateway): add create_web_search_target() helper (#656) (7f75652)
  • fix(runtime): update shell session wire protocol (#642) (826416a)
  • ci: use dedicated release runners (#645) (ddfab76)

[1.22.0] - 2026-08-18

Other Changes

  • feat(payments): add MPP, x402 upto, and Quick Create support (#643) (66a68e3)

[1.21.0] - 2026-08-06

Other Changes

  • feat(memory): add AgentCoreMemoryStore Strands integration (#588) (439d788)
  • feat(runtime): propagate X-Amz-Bedrock-AgentCore-Identity-WAT on outbound calls (#607) (01d3800)

[1.20.0] - 2026-08-04

Added

  • feat: third-party eval metrics adapter (DeepEval + Autoevals) with strands-evals mappers (#568) (9b7d38e)

Fixed

  • fix: validate sample agent inputs (#612) (528471e)

Other Changes

... (truncated)

Commits
  • b2a094d chore: bump version to 1.24.0 (#685)
  • 35c315e feat(endpoints): support AWS China (aws-cn) partition (#684)
  • 3a6496e fix: handle empty payload gracefully (#683)
  • c7423e5 fix(ci): stop flaky sleep test and compat evaluation errors (#677)
  • e9dcd40 fix(clients): expose WaitConfig and accept region_name aliases (#675)
  • 5554fb8 fix(evaluation): expose shared span helpers and evaluator level lookup (#674)
  • 889615f feat(payments): attribute SDK usage via user-agent integration source (#669)
  • aea2005 chore: bump version to 1.23.1 (#668)
  • 2715d6f fix(integ): adjust timeout on memory test. (#667)
  • cc980d1 fix(memory): use current Strands bidi session hooks (#664)
  • Additional commits viewable in compare view

Updates claude-agent-sdk from 0.2.110 to 0.2.163

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.163

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.286
  • CI: pinned the model for issue triage to fix failures caused by the CLI's new default model (#1328)

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.163/

pip install claude-agent-sdk==0.2.163

v0.2.162

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.285

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.162/

pip install claude-agent-sdk==0.2.162

v0.2.161

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.284

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.161/

pip install claude-agent-sdk==0.2.161

v0.2.160

Bug Fixes

... (truncated)

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.163

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.286
  • CI: pinned the model for issue triage to fix failures caused by the CLI's new default model (#1328)

0.2.162

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.285

0.2.161

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.284

0.2.160

Bug Fixes

  • Fixed follow-up turns failing after background subagents: When using query() with hooks, can_use_tool, or SDK MCP servers, stdin was closed too early if a subagent finished just before the turn's result arrived. Follow-up turns would then fail with "Stream closed" and the model would report the tool as refused. The SDK now listens for the CLI's session_state_changed messages and keeps stdin open until the CLI reports idle, matching the TypeScript SDK's behavior. A bounded wait ceiling (configurable via CLAUDE_CODE_PRINT_BG_WAIT_CEILING_MS, default 10 minutes) prevents indefinite hangs. Older CLIs without state events fall back to the previous close-at-first-result behavior. (#1190, #1279)

Documentation

  • Aligned docstrings with the code and fixed docstring formatting (#1293)

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.283
  • CI: skip wheels over PyPI's per-file limit instead of failing the release (#1309)

0.2.159

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.281
  • Pinned default model for e2e tests to claude-opus-5 to work around CI failures with the CLI's new default model (#1287)

0.2.158

New Features

  • verbatim_prompts option: Added ClaudeAgentOptions.verbatim_prompts (default False). When True, user messages are delivered to the CLI exactly as written — no @path file expansion and no slash-command dispatch. This prevents untrusted text inlined into prompts from triggering unintended file reads or command execution. Works with query(), ClaudeSDKClient.connect(), and ClaudeSDKClient.query() for both string and async-iterable prompts. Requires CLI 2.1.248+; a warning is logged on older CLIs. (#1269)

Internal/Other Changes

  • Updated bundled Claude CLI to version 2.1.280

... (truncated)

Commits
  • 1ef6d8c docs: update changelog for v0.2.163
  • a65207d chore: release v0.2.163
  • 635b2ca chore: bump bundled CLI version to 2.1.286
  • bbf09e3 ci: pin the model for issue triage (#1328)
  • f2204bb docs: update changelog for v0.2.162
  • c75eaa5 chore: release v0.2.162
  • de0ff3e chore: bump bundled CLI version to 2.1.285
  • 37422c2 docs: update changelog for v0.2.161
  • 86f74a5 chore: release v0.2.161
  • 75f3af2 chore: bump bundled CLI version to 2.1.284
  • Additional commits viewable in compare view

Updates uvicorn from 0.50.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0
  • Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
  • HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

  • Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

  • Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
  • Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
  • Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

... (truncated)

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

... (truncated)

Commits

Updates aws-opentelemetry-distro from 0.18.0 to 0.21.0

Release notes

Sourced from aws-opentelemetry-distro's releases.

Release v0.20.0

What's Changed

  • feat(genai): add AWS-prefixed controls for GenAI instrumentation, MCP HTTP suppression, OpenAI Agents trace export, and span attribute redaction; retain AWS_AGENTIC_INSTRUMENTATION and OTEL_MCP_SUPPRESS_HTTP_INSTRUMENTATION as legacy fallbacks (#893)
  • fix: restrict native GenAI instrumentations to supported dependency major versions (#884)
  • fix(langchain): propagate first input, last output, and system instructions to internal agent spans (#889)
  • feat: redact span, span event, and span link attributes via AWS_REDACT_SPAN_ATTRIBUTES (#886)
  • feat(langchain): classify LangGraph StateGraph invocations as agent or workflow spans through the Pregel runtime (#888)
  • fix: stop logging a noisy Invalid key/value pair (xrsr, None) found. warning on span creation when no X-Ray sampling rule hash is available (#874)
  • fix(crewai): correctly complete and isolate spans across tool calls and concurrent crew runs (#881)
  • fix(mcp-instrumentation): record errors and session IDs on MCP session spans (#880)
  • [BREAKING CHANGE] Delete experimental code level attributes (#883)
  • Only demote duplicate nested GenAI client spans (#872)
  • (fix): Align and capture missing GenAI request attributes from framework LLM calls (#871)
  • fix: align LlamaIndex tools with the OTel GenAI schema and expand GenAI contract coverage (#866)
  • feat(openai-agents): [BREAKING CHANGE] add native ADOT OpenAI Agents instrumentation and remove the opentelemetry-instrumentation-openai-agents-v2 dependency (#865)
  • fix: support non-recording parent spans in AttributePropagatingSpanProcessor (#744)
  • feat: attribute presigned S3 URLs as AWS::S3 dependencies in Application Signals, opt-in via OTEL_AWS_APPLICATION_SIGNALS_PRESIGNED_URL_ATTRIBUTION_ENABLED (#841)
  • fix: redact AWS presigned URL credentials from span attributes (#840)
  • fix(genai): capture per-call token usage for Amazon Bedrock (and Anthropic) in crewai and langchain by reading provider-specific usage keys — crewai's Converse inputTokens/outputTokens and langchain's ChatBedrockConverse message usage_metadata (#838)

Upstream Components

  • opentelemetry-api - 1.44.0
  • opentelemetry-sdk - 1.44.0
  • opentelemetry-exporter-otlp-proto-grpc - 1.44.0
  • opentelemetry-exporter-otlp-proto-http - 1.44.0
  • opentelemetry-propagator-b3 - 1.44.0
  • opentelemetry-propagator-jaeger - 1.44.0
  • opentelemetry-exporter-otlp-proto-common - 1.44.0
  • opentelemetry-sdk-extension-aws - 2.1.0
  • opentelemetry-propagator-aws-xray - 1.0.2
  • opentelemetry-distro - 0.65b0
  • opentelemetry-processor-baggage - 0.65b0
  • opentelemetry-propagator-ot-trace - 0.65b0
  • opentelemetry-instrumentation - 0.65b0
  • opentelemetry-instrumentation-aws-lambda - 0.65b0
  • opentelemetry-instrumentation-aio-pika - 0.65b0
  • opentelemetry-instrumentation-aiohttp-client - 0.65b0
  • opentelemetry-instrumentation-aiokafka - 0.65b0
  • opentelemetry-instrumentation-aiopg - 0.65b0
  • opentelemetry-instrumentation-asgi - 0.65b0
  • opentelemetry-instrumentation-asyncpg - 0.65b0
  • opentelemetry-instrumentation-boto3sqs - 0.65b0
  • opentelemetry-instrumentation-botocore - 0.65b0
  • opentelemetry-instrumentation-celery - 0.65b0
  • opentelemetry-instrumentation-confluent-kafka - 0.65b0
  • opentelemetry-instrumentation-dbapi - 0.65b0
  • opentelemetry-instrumentation-django - 0.65b0
  • opentelemetry-instrumentation-falcon - 0.65b0
  • opentelemetry-instrumentation-fastapi - 0.65b0

... (truncated)

Changelog

Sourced from aws-opentelemetry-distro's changelog.

Changelog

All notable changes to this project will be documented in this file.

Note: This CHANGELOG was created starting from version 0.12.0. Earlier changes are not documented here.

For any change that affects end users of this package, please add an entry under the Unreleased section. Briefly summarize the change and provide the link to the PR. Example:

  • add GenAI attribute support for Amazon Bedrock models (#300)

If your change does not need a CHANGELOG entry, add the "skip changelog" label to your PR.

Unreleased

  • revert: remove the aws_sigv4 OTLP credential-provider entry point and session factory introduced in #794. (#926)
  • chore: update OpenTelemetry dependencies to 1.45.1/0.66b1. The CloudWatch Logs OTLP exporter now relies on the upstream OTLP HTTP client's retry handling, which retries HTTP 429, 502, 503 and 504 and honors Retry-After (previously 408, 429 and all 5xx were retried). requests is now declared as a direct dependency. (#905)
  • fix(mcp): inject client transport info into ClientSession to preserve it across task and thread boundaries (#921)
  • feat: recognize and SigV4-sign X-Ray, CloudWatch Logs, and CloudWatch Metrics OTLP endpoints in every AWS partition: GovCloud, European Sovereign Cloud (amazonaws.eu), ISO (c2s.ic.gov), ISO-B (sc2s.sgov.gov), ISO-E (cloud.adc-e.uk), and ISO-F (csp.hci.ic.gov), in addition to commercial and China. Agent observability default endpoints now use the partition's DNS suffix.
  • fix(agent-observability): support X-Ray and CloudWatch Logs OTLP endpoints in AWS China regions
  • feat(metrics): sign collector-less OTLP metrics with SigV4 when exporting to the CloudWatch Metrics OTLP endpoint, in both the commercial and AWS China partitions. Requires OTEL_METRICS_EXPORTER=otlp, OTEL_EXPORTER_OTLP_METRICS_PROTOCOL=http/protobuf, and OTEL_EXPORTER_OTLP_METRICS_ENDPOINT=https://monitoring.<region>.amazonaws.com/v1/metrics (.amazonaws.com.cn in China). An Authorization header set in OTEL_EXPORTER_OTLP_<SIGNAL>_HEADERS is preserved and SigV4 is not applied on top.

v0.20.0 - 2026-09-14

  • feat(genai): add AWS-prefixed controls for GenAI instrumentation, MCP HTTP suppression, OpenAI Agents trace export, and span attribute redaction; retain AWS_AGENTIC_INSTRUMENTATION and OTEL_MCP_SUPPRESS_HTTP_INSTRUMENTATION as legacy fallbacks (#893)
  • fix: restrict native GenAI instrumentations to supported dependency major versions (#884)
  • fix(langchain): propagate first input, last output, and system instructions to internal agent spans (#889)
  • feat: redact span, span event, and span link attributes via AWS_REDACT_SPAN_ATTRIBUTES (#886)
  • feat(langchain): classify LangGraph StateGraph invocations as agent or workflow spans through the Pregel runtime (#888)
  • fix: stop logging a noisy Invalid key/value pair (xrsr, None) found. warning on span creation when no X-Ray sampling rule hash is available

... (truncated)

Commits

Updates mcp from 1.28.1 to 2.3.0

Release notes

Sourced from mcp's releases.

v2.3.0

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

Mostly fixes, plus three new options. A few things behave differently, so skim these first:

Behaviour changes

httpx2>=2.10.0 is now required (#3600)

  • It was >=2.5.0. The new max_sse_event_size option needs it.
  • Nothing to do unless you pin httpx2 below 2.10.

A tool with an invalid x-mcp-header annotation fails at registration (#3620)

  • @mcp.tool(), add_tool and Tool.from_function raise InvalidSignature, naming the tool and the problem.
  • Until now the server started, and 2026-07-28 clients silently dropped the tool from their listing.
  • Refused: anything other than a plain str, int or bool parameter (so also str | None, float, lists and enums), a header name that isn't a valid token, and two names that differ only by case.
  • For an optional header parameter, give the schema directly: Annotated[str | None, WithJsonSchema({"type": "string", "x-mcp-header": "Region"})] = None.

Empty _meta and params are no longer sent (#3628)

  • On 2025-11-25 and earlier connections, 2.x sent "_meta": {} on every request. Some servers reject that. It is now left out, as in v1.
  • ping and list requests without a cursor go out with no params member.
  • On the receiving side ctx.meta is None rather than {}, and middleware sees ctx.params as None for a request without params.
  • 2026-07-28 connections are unchanged.

initialize leaves out experimental when none is configured (#3614)

  • It used to send "experimental": {}. server/discover already left it out.
  • Client code reading capabilities.experimental on a legacy connection should handle None.

Mcp-Param-* validation looks the tool up by name (#3630)

  • MCPServer no longer runs tools/list for every tools/call, so middleware no longer sees that extra request.
  • The registered schema is what gets checked. Middleware that filters or rewrites tools/list no longer affects it.

An interactive OAuth login no longer counts against request timeouts (#3635)

  • The timeout pauses while OAuthClientProvider waits on redirect_handler and callback_handler.
  • This fixes Client(mode="auto") settling on 2025-11-25 when the login took longer than 10 seconds.
  • A request timeout no longer ends a login nobody finishes. Put a limit inside callback_handler if you need one.

New

  • max_sse_event_size= on streamable_http_client and StreamableHttpParameters. The default stays 1 MiB per SSE event; raise it, or pass None, for larger tool results (#3600).
  • MCPServer(subscriptions=False) stops serving subscriptions/listen and advertises listChanged and subscribe as false (#3626).
  • Server(get_tool_input_schema=...) lets a low-level server supply a tool's schema for header validation without running its tools/list handler (#3630).
  • Client.call_tool re-lists the tools and retries once after a HeaderMismatch (-32020) rejection (#3627).

Fixes

  • ctx: Context[AppState] works on prompts and resource templates, not only on tools (#3624).
  • An explicit "structuredContent": null is checked against the output schema instead of being treated as missing (#3621).
  • A progress_callback that raises no longer fails the call on an in-process Client(server) (#3623).
  • Client OpenTelemetry spans record JSON-RPC error responses. With mode="auto", connecting to a server without server/discover now shows one ERROR span for the probe (#3629).
  • stdio_client resolves the executable off the event loop on Windows (#3510).

... (truncated)

Commits
  • 2118f14 docs: refresh translations for recent English changes (#3636)
  • ed9b2d6 Stop counting an interactive OAuth login against request timeouts (#3635)
  • d5cebd1 Keep inline-snapshot disabled when pytest runs in a terminal (#3634)
  • c15566c Link What's new to the Header parameters page (#3632)
  • 4d29994 Let a newer Deploy Docs run cancel the one in progress (#3633)
  • 0acea60 Bump urllib3 from 2.7.0 to 2.8.0 (#3607)
  • c54075c Look the tool schema up by name for Mcp-Param-* validation instead of running...
  • 9afccae Retry a tool call once after a HeaderMismatch rejection (#3627)
  • cafa33b Record JSON-RPC error responses on the client OpenTelemetry span (#3629)
  • 0b2fd3e Omit an empty _meta and empty params from outbound requests (#3628)
  • Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.16.10

Release notes

Sourced from ruff's releases.

0.16.10

Release Notes

Released on 2026-10-01.

Preview features

  • Add a migration guide for categories (#28087)
  • [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

  • Reduce memory used by diagnostics (#28951)

Server

  • Avoid running uv format in untrusted workspaces (#28873)

Documentation

  • Fix links to moved changelog sections and renamed mdtests (#28941)
  • Add Python 3.15 as a supported version (#28907)
  • Add ty as a type checker example (#28906)

Other changes

  • Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

Install ruff 0.16.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.10/ruff-installer.ps1 | iex"

Download ruff 0.16.10

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.10

Released on 2026-10-01.

Preview features

  • Add a migration guide for categories (#28087)
  • [pyupgrade] Add rule for context manager iterator annotations (UP052) (#29000)

Performance

  • Reduce memory used by diagnostics (#28951)

Server

  • Avoid running uv format in untrusted workspaces (#28873)

Documentation

  • Fix links to moved changelog sections and renamed mdtests (#28941)
  • Add Python 3.15 as a supported version (#28907)
  • Add ty as a type checker example (#28906)

Other changes

  • Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)

Contributors

0.16.9

Released on 2026-09-24.

Preview features

  • [ruff] Avoid false positives for overloaded division (RUF069) (#28309)

Bug fixes

  • [flake8-bugbear] Avoid false positives for calls with keyword arguments (B009, B010, B043) (#28776)
  • [flake8-tidy-imports] Allow lazy imports to be used in deferred annotations (TID255) (#28767)

Rule changes

  • Update LibCST-based fixes for Python 3.15 (#28616)

... (truncated)

Commits
  • 3265ed1 Bump version to 0.16.10 (#29055)
  • e786964 Authorize shared PR security-review workflow to publish findings (#29052)
  • a81291e [ty] Defer uv workspace discovery until after project configuration (#28525)
  • b6a74d2 [ty] Refresh uv project metadata when uv files change (#28529)
  • 41d30df Update Rust toolchain to 1.99 and MSRV to 1.97 (#29047)
  • 317e0a3 [ty] Bound nested callable signature display (#29049)
  • 8546752 [ty] Fix member lookup on union-bounded type variables (#29018)
  • 56180bc [ty] Specialize instance members once (#29043)
  • aa9a1ff [ty] Avoid stale I/O diagnostics when closing deleted files (#28988)
  • 2d25346 [ty] Improve unresolved-import documentation (#29039)
  • Additional commits viewable in compare view

Updates ty from 0.0.56 to 0.0.84

Release notes

Sourced from ty's releases.

0.0.84

Release Notes

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution when analyzing a specially crafted Python project. Users who run ty on untrusted code should upgrade to 0.0.84 or newer.

Bug fixes

  • Fix stale diagnostics from the LSP server after toggling showSyntaxErrors (#28759)

LSP server

  • Complete string keys from dictionary initializers (#28820)
  • Support LSP requests against closed documents (#28595)
  • Select projects for external files using import search paths (#28594)
  • Use workspace editor settings for external files (#28639)

Performance

  • Avoid repeated subtyping checks for materialized recursive protocols (#28774)
  • Skip reading notebooks when discovering scripts (#28781)

Core type checking

  • Avoid incorrect simplification of TypeIs materializations (#28817)
  • Fix disjointness of generic class types (#28787)
  • Fix staticmethod shadowing through generic receivers and unions (#28766)
  • Infer callable signatures from bounded type variables (#28599)
  • Infer constant membership in inline list and set literals (e.g. "foo" in ["foo"] is now inferred as Literal[True]) (#28676)
  • Infer through optional generic containers in the legacy solver (#28791)
  • Preserve call narrowing during cyclic inference (#28708)
  • Preserve intersections of type guard return types (#28796)
  • Use subtyping for constraint-set implication (#28657)

Configuration

  • Disable invalid-legacy-positional-parameter by default (#28834)

Other changes

  • Only consider reachable definitions when determining whether a condition should be exempted from redundant-condition(-strict) due to the condition being defined relative to sys.version_info, sys.platform, os.name or typing.TYPE_CHECKING (#28788)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.84

Released on 2026-09-24.

This release addresses GHSA-vxvm-j4xq-q7m4, a use-after-free vulnerability during incremental type checking that can result in arbitrary code execution whe...

Description has been truncated

@dependabot
chore(deps): uv: bump the all-python group across 1 directory with 9 …
f6142ba 
…updates

Bumps the all-python group with 9 updates in the /agent directory:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.78` | `1.43.108` |
| [bedrock-agentcore](https://github.com/aws/bedrock-agentcore-sdk-python) | `1.18.1` | `1.24.0` |
| [claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-python) | `0.2.110` | `0.2.163` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.50.0` | `0.54.0` |
| [aws-opentelemetry-distro](https://github.com/aws-observability/aws-otel-python-instrumentation) | `0.18.0` | `0.21.0` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.28.1` | `2.3.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.16.10` |
| [ty](https://github.com/astral-sh/ty) | `0.0.56` | `0.0.84` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |



Updates `boto3` from 1.43.78 to 1.43.108
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.78...1.43.108)

Updates `bedrock-agentcore` from 1.18.1 to 1.24.0
- [Release notes](https://github.com/aws/bedrock-agentcore-sdk-python/releases)
- [Changelog](https://github.com/aws/bedrock-agentcore-sdk-python/blob/main/CHANGELOG.md)
- [Commits](aws/bedrock-agentcore-sdk-python@v1.18.1...v1.24.0)

Updates `claude-agent-sdk` from 0.2.110 to 0.2.163
- [Release notes](https://github.com/anthropics/claude-agent-sdk-python/releases)
- [Changelog](https://github.com/anthropics/claude-agent-sdk-python/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-agent-sdk-python@v0.2.110...v0.2.163)

Updates `uvicorn` from 0.50.0 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.50.0...0.54.0)

Updates `aws-opentelemetry-distro` from 0.18.0 to 0.21.0
- [Release notes](https://github.com/aws-observability/aws-otel-python-instrumentation/releases)
- [Changelog](https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws-observability/aws-otel-python-instrumentation/commits)

Updates `mcp` from 1.28.1 to 2.3.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.28.1...v2.3.0)

Updates `ruff` from 0.15.20 to 0.16.10
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/0.16.10/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.16.10)

Updates `ty` from 0.0.56 to 0.0.84
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.56...0.0.84)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.108
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-python
- dependency-name: bedrock-agentcore
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-python
- dependency-name: claude-agent-sdk
  dependency-version: 0.2.163
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-python
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-python
- dependency-name: aws-opentelemetry-distro
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-python
- dependency-name: mcp
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-python
- dependency-name: ruff
  dependency-version: 0.16.10
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-python
- dependency-name: ty
  dependency-version: 0.0.84
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-python
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested review from a team and backgroundagents as code owners October 10, 2026 06:15
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 10, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 16, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 16, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/agent/all-python-57502f052b branch October 16, 2026 22:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@backgroundagents backgroundagents Awaiting requested review from backgroundagents backgroundagents is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants