Skip to content

chore(deps): uv: bump the all-python group across 1 directory with 8 updates - #956

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/agent/all-python-abaa10b432
Open

chore(deps): uv: bump the all-python group across 1 directory with 8 updates#956
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/agent/all-python-abaa10b432

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the all-python group with 8 updates in the /agent directory:

Package From To
boto3 1.43.78 1.43.111
bedrock-agentcore 1.18.1 1.24.1
uvicorn 0.50.0 0.54.0
aws-opentelemetry-distro 0.18.0 0.21.0
mcp 1.30.0 2.3.0
ruff 0.15.20 0.17.0
ty 0.0.56 0.0.86
pygments 2.20.0 2.21.0

Updates boto3 from 1.43.78 to 1.43.111

Commits

Updates bedrock-agentcore from 1.18.1 to 1.24.1

Release notes

Sourced from bedrock-agentcore's releases.

Bedrock AgentCore SDK v1.24.1

Installation

pip install bedrock-agentcore==1.24.1

What's Changed

See CHANGELOG.md for details.

What's Changed

New Contributors

Full Changelog: aws/bedrock-agentcore-sdk-python@v1.24.0...v1.24.1

Bedrock AgentCore SDK v1.24.0

Installation

pip install bedrock-agentcore==1.24.0

What's Changed

See CHANGELOG.md for details.

What's Changed

New Contributors

Full Changelog: aws/bedrock-agentcore-sdk-python@v1.23.1...v1.24.0

Bedrock AgentCore SDK v1.23.1

Installation

pip install bedrock-agentcore==1.23.1

... (truncated)

Changelog

Sourced from bedrock-agentcore's changelog.

[1.24.1] - 2026-10-06

Other Changes

  • feat(payments): add RotatePaymentConnectorCredentials support (#676) (2f4224d)
  • fix(ci): require approval before publishing Python SDK releases (#692) (2225a97)

[1.24.0] - 2026-09-28

Fixed

  • fix: handle empty payload gracefully (#683) (3a6496e)

Other Changes

  • feat(endpoints): support AWS China (aws-cn) partition (#684) (35c315e)
  • fix(ci): stop flaky sleep test and compat evaluation errors (#677) (c7423e5)
  • fix(clients): expose WaitConfig and accept region_name aliases (#675) (e9dcd40)
  • fix(evaluation): expose shared span helpers and evaluator level lookup (#674) (5554fb8)
  • feat(payments): attribute SDK usage via user-agent integration source (#669) (889615f)

[1.23.1] - 2026-09-16

Other Changes

  • fix(integ): adjust timeout on memory test. (#667) (2715d6f)
  • fix(memory): use current Strands bidi session hooks (#664) (cc980d1)

[1.23.0] - 2026-09-11

Added

  • feat: add RAGAS adapter for third-party eval metrics (#618) (d53af20)

Other Changes

  • Bump agentcore-devx-devtools reusable workflow pin (#660) (3c9f15e)
  • feat(tools): add WebSearchClient for invoking Amazon Web Search (#658) (cf71b14)
  • feat(gateway): add create_web_search_target() helper (#656) (7f75652)
  • fix(runtime): update shell session wire protocol (#642) (826416a)
  • ci: use dedicated release runners (#645) (ddfab76)

[1.22.0] - 2026-08-18

Other Changes

  • feat(payments): add MPP, x402 upto, and Quick Create support (#643) (66a68e3)

[1.21.0] - 2026-08-06

Other Changes

  • feat(memory): add AgentCoreMemoryStore Strands integration (#588) (439d788)
  • feat(runtime): propagate X-Amz-Bedrock-AgentCore-Identity-WAT on outbound calls (#607) (01d3800)

[1.20.0] - 2026-08-04

Added

... (truncated)

Commits
  • 99663b0 chore: bump version to 1.24.1 (#697)
  • 2f4224d feat(payments): add RotatePaymentConnectorCredentials support (#676)
  • 2225a97 fix(ci): require approval before publishing Python SDK releases (#692)
  • b2a094d chore: bump version to 1.24.0 (#685)
  • 35c315e feat(endpoints): support AWS China (aws-cn) partition (#684)
  • 3a6496e fix: handle empty payload gracefully (#683)
  • c7423e5 fix(ci): stop flaky sleep test and compat evaluation errors (#677)
  • e9dcd40 fix(clients): expose WaitConfig and accept region_name aliases (#675)
  • 5554fb8 fix(evaluation): expose shared span helpers and evaluator level lookup (#674)
  • 889615f feat(payments): attribute SDK usage via user-agent integration source (#669)
  • Additional commits viewable in compare view

Updates uvicorn from 0.50.0 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0
  • Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
  • HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

  • Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

  • Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
  • Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
  • Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Version 0.52.3

... (truncated)

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

0.52.3 (August 13, 2026)

Changed

  • Update zttp to 0.0.24 and use its combined receive path, improving HTTP/1.1 request parsing performance (#3067)

0.52.2 (August 13, 2026)

Fixed

  • Update zttp to 0.0.22, fixing bodyless request receives and improving HTTP/1 request parsing performance (#3063)

0.52.1 (August 1, 2026)

Fixed

  • Complete the closing handshake on server-initiated WebSocket closes in the websockets-sansio and wsproto implementations, waiting for the client's close reply with a 10 second timeout instead of resetting the connection (#3053)
  • Add missing write flow control to the websockets-sansio implementation, preventing data truncation on server-initiated closes with large in-flight payloads (#3048)
  • Handle connection loss while a WebSocket write is waiting on backpressure (#3050)

... (truncated)

Commits

Updates aws-opentelemetry-distro from 0.18.0 to 0.21.0

Release notes

Sourced from aws-opentelemetry-distro's releases.

Release v0.21.0

What's Changed

  • fix(agent-observability): support X-Ray and CloudWatch Logs OTLP endpoints in AWS China regions
  • feat(metrics): sign collector-less OTLP metrics with SigV4 when exporting to the CloudWatch Metrics OTLP endpoint, in both the commercial and AWS China partitions. Requires OTEL_METRICS_EXPORTER=otlp, OTEL_EXPORTER_OTLP_METRICS_PROTOCOL=http/protobuf, and OTEL_EXPORTER_OTLP_METRICS_ENDPOINT=https://monitoring.<region>.amazonaws.com/v1/metrics (.amazonaws.com.cn in China). An Authorization header set in OTEL_EXPORTER_OTLP_<SIGNAL>_HEADERS is preserved and SigV4 is not applied on top.

Upstream Components

  • opentelemetry-api - 1.44.0
  • opentelemetry-sdk - 1.44.0
  • opentelemetry-exporter-otlp-proto-grpc - 1.44.0
  • opentelemetry-exporter-otlp-proto-http - 1.44.0
  • opentelemetry-propagator-b3 - 1.44.0
  • opentelemetry-propagator-jaeger - 1.44.0
  • opentelemetry-exporter-otlp-proto-common - 1.44.0
  • opentelemetry-sdk-extension-aws - 2.1.0
  • opentelemetry-propagator-aws-xray - 1.0.2
  • opentelemetry-distro - 0.65b0
  • opentelemetry-processor-baggage - 0.65b0
  • opentelemetry-propagator-ot-trace - 0.65b0
  • opentelemetry-instrumentation - 0.65b0
  • opentelemetry-instrumentation-aws-lambda - 0.65b0
  • opentelemetry-instrumentation-aio-pika - 0.65b0
  • opentelemetry-instrumentation-aiohttp-client - 0.65b0
  • opentelemetry-instrumentation-aiokafka - 0.65b0
  • opentelemetry-instrumentation-aiopg - 0.65b0
  • opentelemetry-instrumentation-asgi - 0.65b0
  • opentelemetry-instrumentation-asyncpg - 0.65b0
  • opentelemetry-instrumentation-boto3sqs - 0.65b0
  • opentelemetry-instrumentation-botocore - 0.65b0
  • opentelemetry-instrumentation-celery - 0.65b0
  • opentelemetry-instrumentation-confluent-kafka - 0.65b0
  • opentelemetry-instrumentation-dbapi - 0.65b0
  • opentelemetry-instrumentation-django - 0.65b0
  • opentelemetry-instrumentation-falcon - 0.65b0
  • opentelemetry-instrumentation-fastapi - 0.65b0
  • opentelemetry-instrumentation-flask - 0.65b0
  • opentelemetry-instrumentation-grpc - 0.65b0
  • opentelemetry-instrumentation-httpx - 0.65b0
  • opentelemetry-instrumentation-jinja2 - 0.65b0
  • opentelemetry-instrumentation-kafka-python - 0.65b0
  • opentelemetry-instrumentation-logging - 0.65b0
  • opentelemetry-instrumentation-mysql - 0.65b0
  • opentelemetry-instrumentation-mysqlclient - 0.65b0
  • opentelemetry-instrumentation-pika - 0.65b0
  • opentelemetry-instrumentation-psycopg2 - 0.65b0
  • opentelemetry-instrumentation-pymemcache - 0.65b0
  • opentelemetry-instrumentation-pymongo - 0.65b0
  • opentelemetry-instrumentation-pymysql - 0.65b0
  • opentelemetry-instrumentation-pyramid - 0.65b0
  • opentelemetry-instrumentation-redis - 0.65b0

... (truncated)

Changelog

Sourced from aws-opentelemetry-distro's changelog.

v0.21.0 - 2026-10-01

  • fix(agent-observability): support X-Ray and CloudWatch Logs OTLP endpoints in AWS China regions
  • feat(metrics): sign collector-less OTLP metrics with SigV4 when exporting to the CloudWatch Metrics OTLP endpoint, in both the commercial and AWS China partitions. Requires OTEL_METRICS_EXPORTER=otlp, OTEL_EXPORTER_OTLP_METRICS_PROTOCOL=http/protobuf, and OTEL_EXPORTER_OTLP_METRICS_ENDPOINT=https://monitoring.<region>.amazonaws.com/v1/metrics (.amazonaws.com.cn in China). An Authorization header set in OTEL_EXPORTER_OTLP_<SIGNAL>_HEADERS is preserved and SigV4 is not applied on top.

v0.20.0 - 2026-09-14

  • feat(genai): add AWS-prefixed controls for GenAI instrumentation, MCP HTTP suppression, OpenAI Agents trace export, and span attribute redaction; retain AWS_AGENTIC_INSTRUMENTATION and OTEL_MCP_SUPPRESS_HTTP_INSTRUMENTATION as legacy fallbacks (#893)
  • fix: restrict native GenAI instrumentations to supported dependency major versions (#884)
  • fix(langchain): propagate first input, last output, and system instructions to internal agent spans (#889)
  • feat: redact span, span event, and span link attributes via AWS_REDACT_SPAN_ATTRIBUTES (#886)
  • feat(langchain): classify LangGraph StateGraph invocations as agent or workflow spans through the Pregel runtime (#888)
  • fix: stop logging a noisy Invalid key/value pair (xrsr, None) found. warning on span creation when no X-Ray sampling rule hash is available (#874)
  • fix(crewai): correctly complete and isolate spans across tool calls and concurrent crew runs (#881)
  • fix(mcp-instrumentation): record errors and session IDs on MCP session spans (#880)
  • [BREAKING CHANGE] Delete experimental code level attributes (#883)
  • Only demote duplicate nested GenAI client spans (#872)
  • (fix): Align and capture missing GenAI request attributes from framework LLM calls (#871)
  • fix: align LlamaIndex tools with the OTel GenAI schema and expand GenAI contract coverage (#866)
  • feat(openai-agents): [BREAKING CHANGE] add native ADOT OpenAI Agents instrumentation and remove the opentelemetry-instrumentation-openai-agents-v2 dependency (#865)
  • fix: support non-recording parent spans in AttributePropagatingSpanProcessor (#744)
  • feat: attribute presigned S3 URLs as AWS::S3 dependencies in Application Signals, opt-in via OTEL_AWS_APPLICATION_SIGNALS_PRESIGNED_URL_ATTRIBUTION_ENABLED (#841)
  • fix: redact AWS presigned URL credentials from span attributes (#840)
  • fix(genai): capture per-call token usage for Amazon Bedrock (and Anthropic) in crewai and langchain by reading provider-specific usage keys — crewai's Converse inputTokens/outputTokens and langchain's ChatBedrockConverse message usage_metadata

... (truncated)

Commits
  • 5ec5f15 Pre-release: Update version to 0.21.0 (#912)
  • ffc960d Fix scheduled GenAI contract test setup (#908)
  • 2c46633 test(di): use OTLP http/protobuf for FastAPI route-handler contract test (#910)
  • b3228c6 feat(metrics): sign collector-less OTLP metrics with SigV4 (#909)
  • e75fb54 fix(agent-observability): support X-Ray and CloudWatch Logs OTLP endpoints in...
  • 00eb423 docs(langchain): document async API known issue (#903)
  • 53aace8 Post release 0.20.0: Update version to 0.20.0.dev0 (#902)
  • e9fe815 Disable unused build-agentcore-collector step (#901)
  • 7c0b989 Release PR for CW Plugin for OTel v0.1.1 (#900)
  • 7cc78ed Add dependency-edge derived attributes to span-metrics allowlist (#896)
  • Additional commits viewable in compare view

Updates mcp from 1.30.0 to 2.3.0

Release notes

Sourced from mcp's releases.

v2.3.0

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

Mostly fixes, plus three new options. A few things behave differently, so skim these first:

Behaviour changes

httpx2>=2.10.0 is now required (#3600)

  • It was >=2.5.0. The new max_sse_event_size option needs it.
  • Nothing to do unless you pin httpx2 below 2.10.

A tool with an invalid x-mcp-header annotation fails at registration (#3620)

  • @mcp.tool(), add_tool and Tool.from_function raise InvalidSignature, naming the tool and the problem.
  • Until now the server started, and 2026-07-28 clients silently dropped the tool from their listing.
  • Refused: anything other than a plain str, int or bool parameter (so also str | None, float, lists and enums), a header name that isn't a valid token, and two names that differ only by case.
  • For an optional header parameter, give the schema directly: Annotated[str | None, WithJsonSchema({"type": "string", "x-mcp-header": "Region"})] = None.

Empty _meta and params are no longer sent (#3628)

  • On 2025-11-25 and earlier connections, 2.x sent "_meta": {} on every request. Some servers reject that. It is now left out, as in v1.
  • ping and list requests without a cursor go out with no params member.
  • On the receiving side ctx.meta is None rather than {}, and middleware sees ctx.params as None for a request without params.
  • 2026-07-28 connections are unchanged.

initialize leaves out experimental when none is configured (#3614)

  • It used to send "experimental": {}. server/discover already left it out.
  • Client code reading capabilities.experimental on a legacy connection should handle None.

Mcp-Param-* validation looks the tool up by name (#3630)

  • MCPServer no longer runs tools/list for every tools/call, so middleware no longer sees that extra request.
  • The registered schema is what gets checked. Middleware that filters or rewrites tools/list no longer affects it.

An interactive OAuth login no longer counts against request timeouts (#3635)

  • The timeout pauses while OAuthClientProvider waits on redirect_handler and callback_handler.
  • This fixes Client(mode="auto") settling on 2025-11-25 when the login took longer than 10 seconds.
  • A request timeout no longer ends a login nobody finishes. Put a limit inside callback_handler if you need one.

New

  • max_sse_event_size= on streamable_http_client and StreamableHttpParameters. The default stays 1 MiB per SSE event; raise it, or pass None, for larger tool results (#3600).
  • MCPServer(subscriptions=False) stops serving subscriptions/listen and advertises listChanged and subscribe as false (#3626).
  • Server(get_tool_input_schema=...) lets a low-level server supply a tool's schema for header validation without running its tools/list handler (#3630).
  • Client.call_tool re-lists the tools and retries once after a HeaderMismatch (-32020) rejection (#3627).

Fixes

  • ctx: Context[AppState] works on prompts and resource templates, not only on tools (#3624).
  • An explicit "structuredContent": null is checked against the output schema instead of being treated as missing (#3621).
  • A progress_callback that raises no longer fails the call on an in-process Client(server) (#3623).
  • Client OpenTelemetry spans record JSON-RPC error responses. With mode="auto", connecting to a server without server/discover now shows one ERROR span for the probe (#3629).
  • stdio_client resolves the executable off the event loop on Windows (#3510).

... (truncated)

Commits
  • 2118f14 docs: refresh translations for recent English changes (#3636)
  • ed9b2d6 Stop counting an interactive OAuth login against request timeouts (#3635)
  • d5cebd1 Keep inline-snapshot disabled when pytest runs in a terminal (#3634)
  • c15566c Link What's new to the Header parameters page (#3632)
  • 4d29994 Let a newer Deploy Docs run cancel the one in progress (#3633)
  • 0acea60 Bump urllib3 from 2.7.0 to 2.8.0 (#3607)
  • c54075c Look the tool schema up by name for Mcp-Param-* validation instead of running...
  • 9afccae Retry a tool call once after a HeaderMismatch rejection (#3627)
  • cafa33b Record JSON-RPC error responses on the client OpenTelemetry span (#3629)
  • 0b2fd3e Omit an empty _meta and empty params from outbound requests (#3628)
  • Additional commits viewable in compare view

Updates ruff from 0.15.20 to 0.17.0

Release notes

Sourced from ruff's releases.

0.17.0

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

    The default full output format now shows unsafe fixes and suggestions requiring manual review, regardless of the unsafe-fixes setting. Actually applying unsafe fixes still requires explicit opt-in.

  • Remove the Python dependency from conda-forge builds (conda-forge/ruff-feedstock#361)

    The conda-forge build no longer depends on Python, now supports linux-riscv64, win-arm64, and linux-ppc64le platforms, and now includes shell completions. However, no longer depending on Python means that python -m ruff and import ruff will no longer work. Use ruff directly from PATH instead. PyPI installations and those from the standalone installer are unaffected.

  • Remove support for ruff-lsp (#28750)

    Support for ruff-lsp, the legacy Python language server deprecated in Ruff v0.9.5, has been removed. The Ruff VS Code extension now always uses the native language server; ruff.nativeServer is deprecated and ignored. See the migration guide.

Stabilization

The following rules have been stabilized and are no longer in preview:

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15 instead of 3.14.

  • Update the default rule set (#28786)

    Several of the flake8-datetimez rules (DTZ001, DTZ005, DTZ006, DTZ007, DTZ011, DTZ012, and DTZ901) are no longer enabled by default, while undefined-local-with-nested-import-star-usage (F406), which corresponds to a syntax error, is now enabled by default.

  • Update Rust crate quick-junit to 0.8.0 (#27295)

    JUnit output now uses a skipped attribute instead of disabled on <testsuite> elements and includes a skipped attribute on the root <testsuites> element.

  • [flake8-import-conventions] Add datetime as dt as a conventional alias (ICN001) (#28790)

  • Support Unicode dummy variable names (#28722)

    The default lint.dummy-variable-rgx now recognizes underscore-prefixed Unicode names, such as _次, as dummy variables.

  • Update to Unicode 17 (#21229, #28784)

    Ruff now uses Unicode 17 data for identifier normalization and named character escapes ("\N{...}").

  • Always show unsafe and display-only fixes in the CLI (#27810)

... (truncated)

Commits
  • 5b27c1c Bump version to 0.17.0 (#29259)
  • 8f362bf Integrate vendored Unicode names into Ruff
  • 88a50d6 Revert upstream Unicode loose matching
  • 276832a Revert upstream Unicode alias normalization
  • 26911ca Vendor unicode_names2 from upstream
  • 27e3797 [ruff] Stabilize os-path-commonprefix (RUF071) (#28764)
  • bbb52c1 [flake8-tidy-imports] Stabilize lazy-import-immediately-resolved (`TID255...
  • 5aa9cbd [flake8-tidy-imports] Stabilize lazy-import-mismatch (TID254) (#28760)
  • dba1bc8 [flake8-import-conventions] Add datetime as dt as a conventional alias (`...
  • ef23c9c Update default and latest Python versions for 3.15 (#28792)
  • Additional commits viewable in compare view

Updates ty from 0.0.56 to 0.0.86

Release notes

Sourced from ty's releases.

0.0.86

Release Notes

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ty wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

  • Infer empty collection branches from nonempty literals (#29131)
  • Invalidate dependency metadata when environments change (#29126)
  • Preserve final attribute restrictions on composite types (#29135)
  • Preserve recursive structure in Annotated values (#29058)
  • Specialize inherited dataclass field converters (#29192)

LSP server

  • Show documentation for annotation operators on hover (#29185)

Core type checking

  • Check attribute and property override types (#28556)
  • Narrow tuple unions through truthiness and type checks (#29125)
  • Preserve literal types when consuming dictionary literals (#29145)
  • Preserve non-boolean comparison results for intersections (#28045)
  • Preserve receiver specializations when calling unions of bound methods (#29015)
  • Represent uninhabited truthiness explicitly (#28843)
  • Solve validity type context through constraint sets (#28909)

Performance

  • Avoid recursion guards for non-generic nominal targets (#29202)
  • Check exact exclusions before intersection positives (#29195)

Memory usage improvements

  • Share constraints in retained sequent maps (#28966)

Other changes

  • Update the default Python version to 3.15 (#28792)
  • Update to Unicode 17 (#21229, #28784)
  • Always show fixes in the CLI (#27810)

Contributors

... (truncated)

Changelog

Sourced from ty's changelog.

0.0.86

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ty wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

  • Infer empty collection branches from nonempty literals (#29131)
  • Invalidate dependency metadata when environments change (#29126)
  • Preserve final attribute restrictions on composite types (#29135)
  • Preserve recursive structure in Annotated values (#29058)
  • Specialize inherited dataclass field converters (#29192)

LSP server

  • Show documentation for annotation operators on hover (#29185)

Core type checking

  • Check attribute and property override types (#28556)
  • Narrow tuple unions through truthiness and type checks (#29125)
  • Preserve literal types when consuming dictionary literals (#29145)
  • Preserve non-boolean comparison results for intersections (#28045)
  • Preserve receiver specializations when calling unions of bound methods (#29015)
  • Represent uninhabited truthiness explicitly (

@dependabot
chore(deps): uv: bump the all-python group across 1 directory with 8 …
63700a8 
…updates

Bumps the all-python group with 8 updates in the /agent directory:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.78` | `1.43.111` |
| [bedrock-agentcore](https://github.com/aws/bedrock-agentcore-sdk-python) | `1.18.1` | `1.24.1` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.50.0` | `0.54.0` |
| [aws-opentelemetry-distro](https://github.com/aws-observability/aws-otel-python-instrumentation) | `0.18.0` | `0.21.0` |
| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.30.0` | `2.3.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.17.0` |
| [ty](https://github.com/astral-sh/ty) | `0.0.56` | `0.0.86` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |



Updates `boto3` from 1.43.78 to 1.43.111
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.78...1.43.111)

Updates `bedrock-agentcore` from 1.18.1 to 1.24.1
- [Release notes](https://github.com/aws/bedrock-agentcore-sdk-python/releases)
- [Changelog](https://github.com/aws/bedrock-agentcore-sdk-python/blob/main/CHANGELOG.md)
- [Commits](aws/bedrock-agentcore-sdk-python@v1.18.1...v1.24.1)

Updates `uvicorn` from 0.50.0 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.50.0...0.54.0)

Updates `aws-opentelemetry-distro` from 0.18.0 to 0.21.0
- [Release notes](https://github.com/aws-observability/aws-otel-python-instrumentation/releases)
- [Changelog](https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/CHANGELOG.md)
- [Commits](aws-observability/aws-otel-python-instrumentation@v0.18.0...v0.21.0)

Updates `mcp` from 1.30.0 to 2.3.0
- [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md)
- [Commits](modelcontextprotocol/python-sdk@v1.30.0...v2.3.0)

Updates `ruff` from 0.15.20 to 0.17.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.17.0)

Updates `ty` from 0.0.56 to 0.0.86
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.56...0.0.86)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.111
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-python
- dependency-name: bedrock-agentcore
  dependency-version: 1.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-python
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-python
- dependency-name: aws-opentelemetry-distro
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-python
- dependency-name: mcp
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-python
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-python
- dependency-name: ty
  dependency-version: 0.0.86
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-python
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested review from a team and backgroundagents as code owners October 16, 2026 22:23
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 16, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@backgroundagents backgroundagents Awaiting requested review from backgroundagents backgroundagents is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants