Skip to content

chore(deps): bump the runtime-dependencies group across 1 directory with 9 updates - #82

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/runtime-dependencies-8ece525504
Closed

chore(deps): bump the runtime-dependencies group across 1 directory with 9 updates#82
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/runtime-dependencies-8ece525504

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the runtime-dependencies group with 9 updates in the / directory:

Package From To
alembic 1.18.5 1.19.0
greenlet 3.5.3 3.5.4
aiohttp 3.14.1 3.14.3
typer 0.26.8 0.27.1
fastapi 0.139.0 0.141.1
ruff 0.15.21 0.16.2
pre-commit 4.6.0 4.6.1
openai-agents 0.18.2 0.19.4
bump-my-version 1.4.1 1.5.1

Updates alembic from 1.18.5 to 1.19.0

Release notes

Sourced from alembic's releases.

1.19.0

Released: August 4, 2026

changed

  • [changed] [installation] Environmental updates:

    -   Trove classifiers now include Python 3.15 which is now part of CI
    integration

      

    • 

      Python 3.14 is also added to trove classifiers which had been previously
omitted
      

      • 

    • 

      Implemented PEP 604 style unions in type annotations

feature

  • [feature] [autogenerate] Autogenerate now detects the addition and removal of named CHECK constraints, as part of the default autogenerate behavior. Detection is name-based only; a constraint whose name is unchanged is presumed equivalent regardless of its expression text, as reliably normalizing SQL expressions across backends for comparison purposes is not generally feasible. This behavior is implemented as a plugin named alembic.autogenerate.checkconstraint_byname, and may be disabled if not desired by excluding it from the EnvironmentContext.configure.autogenerate_plugins list. Pull request courtesy Francois van Kempen.

    References: #508

bug

  • [bug] [commands] Fixed inconsistency where running stamp or downgrade to base in offline (--sql) mode would emit a DROP TABLE alembic_version statement, while the same operations in online mode never drop the version table. Offline mode no longer emits this DROP, matching online behavior. The version table continues to be created when it does not exist; only the spurious offline-only drop has been removed. Pull request courtesy imurodl.

    References: #1822

Commits

Updates greenlet from 3.5.3 to 3.5.4

Changelog

Sourced from greenlet's changelog.

3.5.4 (2026-07-22)

  • Fix a crash (segfault) on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet that was started from a non-empty C-stack-reference state is active. See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

  • Fix a potential use-after-free on free-threaded builds of Python 3.14 and later when the garbage collector runs while a greenlet is suspended holding a _PyCStackRef (for example, mid attribute resolution). See issue 515 <https://github.com/python-greenlet/greenlet/issues/515>_. Thanks to ddorian and Kumar Aditya.

  • Fix a deadlock on free-threaded builds when a greenlet switch happened while a PyCriticalSection was held -- for example inside asyncio's Task.__step, which holds one on the running task for the duration of the step. See PR 519 <https://github.com/python-greenlet/greenlet/pull/519/>. Thanks to ddorian and Kumar Aditya.

.. note:: Binary 3.15 wheels are now built with Python 3.15b4. These may not be compatible with earlier or later versions of 3.15. Binary 3.15 wheels of greenlet from previous releases (e.g., 3.5.3) may not be compatible with Python 3.15b4.

Commits
  • 384be88 Preparing release 3.5.4
  • bbdf57b Add note to CHANGES about versions of 3.15 binary wheels may/not be compatibl...
  • 7599023 Merge pull request #517 from ddorian/issue515-c-stack-refs
  • 73a0a1a Fix the suspended C-stack-ref GC test to catch its regression
  • 1ff35f4 Merge branch 'master' into issue515-c-stack-refs
  • 847fb82 Merge pull request #520 from dynapx/fix-test-extension-npd
  • 0b471ba Merge pull request #519 from ddorian/freethread-switch-critical-section
  • d55914d Simplify the CHANGES.rst entry
  • 78932dc Change notes are for end users, they don't need to go into technical detail
  • 39bf70c Hold the C-stack ref snapshot in a std::vector<OwnedObject>
  • Additional commits viewable in compare view

Updates aiohttp from 3.14.1 to 3.14.3
Updates typer from 0.26.8 to 0.27.1

Release notes

Sourced from typer's releases.

0.27.1

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

0.27.0

Breaking Changes

Internal

Changelog

Sourced from typer's changelog.

0.27.1 (2026-08-03)

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

0.27.0 (2026-07-15)

Breaking Changes

Internal

Commits
  • fe2aa0e 🔖 Release version 0.27.1 (#1919)
  • 680dc99 📝 Update release notes
  • ac3efd5 ✨ Make epilog formatting consistent with other parts of the help string (#1...
  • 32d80ef 📝 Update release notes
  • 10cb3c9 ⬆️ Upgrade latest-changes to 0.7.1 (#1909)
  • ac329a0 📝 Update release notes
  • c37ae2f 📝 Add Library Skills documentation (#1906)
  • 0974a7e 📝 Update release notes
  • 951178c 🐛 Prevent scroll-to-top on restart/fast buttons in the documentation (#1904)
  • 9051baa 📝 Update release notes
  • Additional commits viewable in compare view

Updates fastapi from 0.139.0 to 0.141.1

Release notes

Sourced from fastapi's releases.

0.141.1

Fixes

  • 🐛 Fix support for background tasks and headers from dependencies in app.frontend(). PR #16105 by @​tiangolo.

Docs

0.141.0

Features

  • ✨ Add app.frontend(check_dir="auto"), to make local development more convenient with fastapi dev. PR #16102 by @​tiangolo.

0.140.13

Fixes

Docs

0.140.12

Fixes

0.140.11

Fixes

  • 🐛 Fix response_model_* params ignored for non-generator endpoints with Iterable[..] return type. PR #15093 by @​YuriiMotov.

0.140.10

Fixes

Internal

0.140.9

Fixes

  • 🐛 Fix exclude_defaults not propagated to dict keys and values in jsonable_encoder. PR #16043 by @​MBGrao.

... (truncated)

Commits
  • 95f8322 🔖 Release version 0.141.1 (#16106)
  • f137944 📝 Update release notes
  • d623544 🐛 Fix support for background tasks and headers from dependencies in `app.fron...
  • 1d211b9 📝 Update release notes
  • 8a1f876 📝 Document FASTAPI_ENV in FastAPI CLI guide (#16104)
  • c7e7b65 🔖 Release version 0.141.0 (#16103)
  • 6bceb84 📝 Update release notes
  • 5429fed ✨ Add app.frontend(check_dir="auto"), to make local development more conven...
  • 628663f 🔖 Release version 0.140.13 (#16096)
  • 0b54fd0 📝 Update release notes
  • Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.16.2

Release notes

Sourced from ruff's releases.

0.16.2

Release Notes

Released on 2026-08-06.

Bug fixes

  • [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

  • Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

Install ruff 0.16.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.ps1 | iex"

Download ruff 0.16.2

File Platform Checksum
ruff-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
ruff-x86_64-apple-darwin.tar.gz Intel macOS checksum
ruff-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
ruff-i686-pc-windows-msvc.zip x86 Windows checksum
ruff-x86_64-pc-windows-msvc.zip x64 Windows checksum
ruff-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
ruff-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz PPC64 Linux checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
ruff-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum
ruff-s390x-unknown-linux-gnu.tar.gz S390x Linux checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.2

Released on 2026-08-06.

Bug fixes

  • [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

  • Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

0.16.1

Released on 2026-07-30.

Preview features

  • Add an option to opt out of human-readable names (#27160)
  • [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
  • [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
  • [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

  • Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
  • [flake8-bugbear] Mark range as immutable (B008) (#27247)
  • [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
  • [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
  • [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
  • [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

  • [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
  • [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

  • Fix indexing of excluded nested Ruff workspaces (#27303)
  • Lint TOML files in the LSP (#26862)

... (truncated)

Commits
  • 5b48a04 Bump 0.16.2 (#27555)
  • 1b9e5fc Update Swatinem/rust-cache action to v2.9.2 (#27568)
  • c4e86fc [ty] Add helper extension methods for half-range and equality constraints (#2...
  • 17a00de [ty] Reuse primer commands in memory reports (#27553)
  • 6ea296b [ty] Normalize type labels in structured docstrings (#26923)
  • 2fc445f [ty] Diagnose invalid getattr calls (#27502)
  • 22c7823 [ty] Enable (but downrank) auto-import completion suggestions from stub-only ...
  • 05160d5 [ty] Diagnose invalid descriptor __get__ calls (#27400)
  • baea3d0 [ty] Expose strict analysis options in the playground (#27543)
  • c88946e [ty] Bump ecosystem-analyzer for strict project settings (#27542)
  • Additional commits viewable in compare view

Updates pre-commit from 4.6.0 to 4.6.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.1

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.1 - 2026-07-21

Fixes

Commits
  • 242ce8a v4.6.1
  • 766e550 Merge pull request #3727 from pre-commit/dedupe
  • 1558d06 Merge pull request #3726 from pre-commit/exists-faster
  • 8a1c47a avoid duplicate files in --all-files during conflict
  • 2e01c99 faster check of rev existing locally as a commit
  • 3613bf2 Merge pull request #3701 from pre-commit/autoupdate-repos
  • 1d811d9 Return an error for invalid --repo
  • 374d354 Merge pull request #3711 from damonbayer/dmb_JULIA_DEPOT_PATH
  • 1e7994f set JULIA_DEPOT_PATH
  • b2b9119 Merge pull request #3719 from pre-commit/npm-unknown-options
  • Additional commits viewable in compare view

Updates openai-agents from 0.18.2 to 0.19.4

Release notes

Sourced from openai-agents's releases.

v0.19.4

What's Changed

Documentation & Other Changes

New Contributors

Full Changelog: openai/openai-agents-python@v0.19.3...v0.19.4

v0.19.3

What's Changed

... (truncated)

Changelog

Sourced from openai-agents's changelog.

Release process/changelog

The project follows a slightly modified version of semantic versioning using the form 0.Y.Z. The leading 0 indicates the SDK is still evolving rapidly. Increment the components as follows:

Minor (Y) versions

We will increase minor versions Y for breaking changes to any public interfaces that are not marked as beta. For example, going from 0.0.x to 0.1.x might include breaking changes.

If you don't want breaking changes, we recommend pinning to 0.0.x versions in your project.

Patch (Z) versions

We will increment Z for non-breaking changes:

  • Bug fixes
  • New features
  • Changes to private interfaces
  • Updates to beta features

Breaking change changelog

0.20.0

Version 0.20.0 includes a potentially breaking MCP dependency migration for applications that customize local MCP HTTP transports. It also updates the SDK default model used when an agent or run does not explicitly select one.

Highlights:

  • The SDK default model is now gpt-5.6-luna instead of gpt-5.4-mini. The default reasoning.effort="none" and verbosity="low" settings are unchanged.
  • Explicit agent models, run-level model overrides, and the OPENAI_DEFAULT_MODEL environment variable continue to take precedence over the SDK default.
  • Realtime input transcription settings now recognize gpt-transcribe, gpt-live-transcribe, and gpt-realtime-whisper. For low-latency gpt-live-transcribe sessions, nested audio.input.transcription settings can supply prompt, keywords, and multiple expected languages. The OpenAI client version pinned by this SDK supports the delay latency/accuracy level only with gpt-realtime-whisper. Use gpt-transcribe over WebSocket for transcription after a committed audio turn or for detected-language output. Setting audio.input.turn_detection=None explicitly disables automatic turn detection. See Input transcription settings.
  • Local MCP connections created by the Agents SDK now support MCP Python SDK v2 while retaining v1 compatibility through mcp>=1.19.0,<3. The Agents SDK adapts ordinary stdio, SSE, and Streamable HTTP connections automatically. With MCP v2 installed, these connections use mcp.Client(mode="auto") to probe the newest supported protocol and fall back to the legacy initialize handshake for older servers. If dependency resolution selects MCP v2, applications that supply custom httpx.Auth objects or httpx.AsyncClient factories must migrate those values to httpx2, or pin mcp<2 to retain the v1 HTTP stack. MCPServerStreamableHttp's params["ignore_initialized_notification_failure"] = True option also remains v1-only. See MCP Python SDK v1 and v2 for migration details.
  • Sandbox mount validation now rejects unsafe credential placement before sandbox or mount-helper side effects. Trusted applications can acknowledge mount-scoped or broad credential exposure for an exact in-container mount path without changing the storage capability tables. These acknowledgements are runtime-only and serialized sandbox state never grants credential authority by itself. At protected mount boundaries, the SDK returns a fresh redacted exception. If the source exception is an exact recognized SDK sandbox error and its approved structured fields validate, the replacement preserves that subtype and the validated safe fields. A recognized MountConfigError can also retain an SDK-generated safe validation message. Otherwise, the SDK returns a fresh generic redacted error. Provider-controlled or otherwise unapproved messages, command data, notes, context, causes, and source traceback state are not retained. See Mounts and remote storage and Resume from session state.
  • Retry policies can inspect stable replay-safety facts and explicitly set RetryDecision(approve_unsafe_replay=True) for a non-streaming request that the provider marked unsafe. This approval does not bypass aborts, emitted streamed output, or separate local-side-effect vetoes such as Programmatic Tool Calling. See Runner-managed retries.
  • Resumable RunState objects can now stage durable user input with add_input() before the next model call. Staged input survives serialization, runs through input guardrails, and produces one durable SDK input occurrence across local sessions and server-managed conversations. An explicitly approved unsafe replay can still resend the input to the provider and repeat provider-side work. See Add input before resuming.
  • Runtime reliability fixes align streamed and non-streamed output-guardrail session persistence, preserve FunctionTool subclasses during copying and namespacing, and raise an explicit error for unsupported Chat Completions audio output instead of silently completing an empty stream. The OpenAIResponsesCompactionSession wrapper attempts and awaits pre-compaction history recovery before cancellation reaches the caller. A VoicePipeline consumer now receives transcription-session close failures after a clean run, while an earlier turn failure retains precedence over a later close failure. RunState round trips now preserve local shell output, acknowledged computer safety checks, default-valued tool output fields, and Pydantic model or dataclass outputs encountered while traversing dictionaries, lists, or tuples. MCP conversion preserves free-form object schemas and image output, and serializes other raw content blocks such as audio and resource blocks as valid JSON text. MCPServerManager serializes overlapping lifecycle operations and applies finite default timeouts to connection and cleanup. Model replay removes server-owned created_by metadata from output items before using them as input.

0.19.0

This minor release does not introduce a breaking change. The minor version bump reflects a significant new OpenAI Responses feature area: Programmatic Tool Calling.

Highlights:

  • Added [ProgrammaticToolCallingTool][agents.tool.ProgrammaticToolCallingTool], which lets supported OpenAI Responses models generate JavaScript to coordinate tools eligible for Programmatic Tool Calling. It supports per-tool allowed_callers, structured outputs from FunctionTool instances, and integration with Runner streaming, guardrails, approvals, sessions, and RunState. See Programmatic Tool Calling for setup and constraints.
  • Added the public agents.decorators module and @tool as a shorter alias for the existing @function_tool decorator, alongside the existing guardrail decorators. FunctionTool instances now also support async callable objects.
  • SDK configuration now consistently accepts either typed settings objects or dictionaries across agents, runs, models, sessions, sandboxes, and voice pipelines, with validation for unknown settings.
  • Hardened error and diagnostic logging across models, tools, MCP, Realtime, sessions, sandboxes, and tracing to avoid exposing raw sensitive payloads while preserving useful debugging context.
  • Improved AnyLLM, LiteLLM, and Chat Completions compatibility, preserved session history across model retries, and added provider retry guidance for WebSocket overloads that occur before a response starts, so opt-in Runner retry policies can replay the failed attempt when permitted.
  • Added S3 mounts that can be configured only when a Vercel sandbox is created through VercelCloudBucketMountStrategy. Mounted sessions exclude bucket contents from workspace persistence and intentionally do not support dynamic mount changes or session resume.

0.18.0

... (truncated)

Commits
  • 92aa1b9 Bump version to 0.19.4 (#4194)
  • b438627 docs: fix tool duplication in sandbox examples
  • e064ab6 test: make parent cancellation tests deterministic (#4193)
  • 7379e75 fix(memory): reject reused branch IDs when creating a branch (#4186)
  • bf00f45 test: make async tool and guardrail tests deterministic (#4192)
  • 107260f fix(tracing): mark non-streaming agent span failures (#4191)
  • 81de0d0 fix(realtime): clean up failed connection attempts (#4189)
  • 36829b6 fix(models): surface non-streaming content-filter refusals (

@dependabot
chore(deps): bump the runtime-dependencies group across 1 directory w…
8b05206 
…ith 9 updates

---
updated-dependencies:
- dependency-name: alembic
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: greenlet
  dependency-version: 3.5.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: typer
  dependency-version: 0.27.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: fastapi
  dependency-version: 0.141.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: ruff
  dependency-version: 0.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: pre-commit
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: openai-agents
  dependency-version: 0.19.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: bump-my-version
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 11, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 18, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 18, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/runtime-dependencies-8ece525504 branch August 18, 2026 11:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants