mirror of
https://github.com/langchain-ai/langgraph.git
synced 2026-10-14 12:15:25 +02:00
dc5bd4c02bae280460e07ab00a7952330f3edcba
7110
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 John Kennedyandopen-swe[bot] <open-swe@users.noreply.github.com>
|
dc5bd4c02b |
fix: pair psycopg releases and serialize test setup
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
dependabot[bot]andGitHub
|
6518e90255 |
chore(deps-dev): bump the minor-and-patch group
Bumps the minor-and-patch group in /libs/prebuilt with 6 updates: | Package | From | To | | --- | --- | --- | | [langchain-core](https://github.com/langchain-ai/langchain) | `1.6.1` | `1.6.5` | | [pytest-mock](https://github.com/pytest-dev/pytest-mock) | `3.15.1` | `3.16.0` | | [syrupy](https://github.com/syrupy-project/syrupy) | `6.0.0` | `6.1.1` | | [psycopg-binary](https://github.com/psycopg/psycopg) | `3.3.4` | `3.3.6` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.5` | `0.16.9` | | [ty](https://github.com/astral-sh/ty) | `0.0.75` | `0.0.84` | Updates `langchain-core` from 1.6.1 to 1.6.5 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](https://github.com/langchain-ai/langchain/compare/langchain-core==1.6.1...langchain-core==1.6.5) Updates `pytest-mock` from 3.15.1 to 3.16.0 - [Release notes](https://github.com/pytest-dev/pytest-mock/releases) - [Changelog](https://github.com/pytest-dev/pytest-mock/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pytest-dev/pytest-mock/compare/v3.15.1...v3.16.0) Updates `syrupy` from 6.0.0 to 6.1.1 - [Release notes](https://github.com/syrupy-project/syrupy/releases) - [Changelog](https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md) - [Commits](https://github.com/syrupy-project/syrupy/compare/v6.0.0...v6.1.1) Updates `psycopg-binary` from 3.3.4 to 3.3.6 - [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst) - [Commits](https://github.com/psycopg/psycopg/compare/3.3.4...3.3.6) Updates `ruff` from 0.16.5 to 0.16.9 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/ruff/compare/0.16.5...0.16.9) Updates `ty` from 0.0.75 to 0.0.84 - [Release notes](https://github.com/astral-sh/ty/releases) - [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md) - [Commits](https://github.com/astral-sh/ty/compare/0.0.75...0.0.84) --- updated-dependencies: - dependency-name: langchain-core dependency-version: 1.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: pytest-mock dependency-version: 3.16.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: syrupy dependency-version: 6.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: psycopg-binary dependency-version: 3.3.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: ruff dependency-version: 0.16.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: ty dependency-version: 0.0.84 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
|
4be610c6bc |
chore(deps): bump pyjwt from 2.15.0 to 2.15.1 in /libs/langgraph (#9140)
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.15.0 to 2.15.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.15.1</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.15.1/CHANGELOG.rst">2.15.1 changelog</a> for complete release details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1></code>__</h2> <p>Fixed</p> <pre><code> - Accept trailing Base64URL ``=`` padding when decoding JWS segments, so tokens issued by AWS ALB and similar systems verify instead of raising ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as ``!!!!`` remains rejected (`[#1209](https://github.com/jpadilla/pyjwt/issues/1209) <https://github.com/jpadilla/pyjwt/issues/1209>`__). </code></pre> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jpadilla/pyjwt/commit/7d5ef55e42ce42221f58dc49943e92ccad1fa66a"><code>7d5ef55</code></a> chore: prepare 2.15.1 release</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/7bf32526738fe837387bdedd4849a4a525c33a79"><code>7bf3252</code></a> Accept canonical Base64URL padding in JWT segments (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1216">#1216</a>)</li> <li>See full diff in <a href="https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>John Kennedy |
98b10ba0ff |
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/checkpoint-conformance (#9133)
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com> |
||
|
|
ffe4e8cd6d |
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/langgraph (#9138)
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
f75add0ee9 |
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/cli (#9137)
[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
902be1eb2b |
chore(deps): bump the uv group across 2 directories with 1 update (#9136)
Bumps the uv group with 1 update in the /libs/cli/uv-examples/monorepo directory: [urllib3](https://github.com/urllib3/urllib3). Bumps the uv group with 1 update in the /libs/cli/uv-examples/simple directory: [urllib3](https://github.com/urllib3/urllib3). Updates `urllib3` from 2.7.0 to 2.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> Updates `urllib3` from 2.7.0 to 2.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
3b969324db |
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/checkpoint-sqlite (#9135)
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
e43f0f5f1e |
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/sdk-py (#9134)
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
8ccdedcc1b |
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/checkpoint-postgres (#9132)
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
7ea31e5e45 |
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/checkpoint (#9131)
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
313e0e7e0a |
chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /libs/prebuilt (#9130)
Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.8.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)</li> </ul> <blockquote> <p>[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.</p> <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.</p> </blockquote> <blockquote> <p>[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.</p> </blockquote> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5044">#5044</a>)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4945">#4945</a>)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5092">#5092</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li> <p>Fixed response header handling to replace obsolete folded header lines (<code>obs-fold</code>) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as <code>Set-Cookie</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/1362">#1362</a>)</p> </li> <li> <p>Fixed usage of <code>proxy_ssl_context</code> with <code>ProxyManager</code> when <code>use_forwarding_for_https=True</code>. Passing <code>ssl_context</code> instead of <code>proxy_ssl_context</code> for HTTPS proxies in this configuration now emits a <code>FutureWarning</code> and will raise an error in v3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/2577">#2577</a>)</p> </li> <li> <p>Changed behavior of the default <code>ConnectionPool.pool</code> initialization. <code>LifoQueue</code> is now resolved from the <code>queue</code> module after the <code>ConnectionPool</code> is instantiated instead of using the default cached <code>QueueCls</code> class property. This is done because sometimes the <code>queue.LifoQueue</code> is monkey-patched late in the program, such as by gevent. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3289">#3289</a>)</p> </li> <li> <p>Raised <code>UnrewindableBodyError</code> instead of <code>ValueError</code> when retrying a request whose body had <code>tell()</code> but not <code>seek()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3779">#3779</a>)</p> </li> <li> <p>Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3785">#3785</a>)</p> </li> <li> <p>Fixed <code>HTTPResponse.drain_conn()</code> to discard unread response data in 64 KiB chunks (same as the default <code>amt</code> when doing <code>HTTPResponse.stream(...)</code>). (<a href="https://redirect.github.com/urllib3/urllib3/issues/5019">#5019</a>)</p> </li> <li> <p>Fixed <code>is_ipaddress()</code> to detect non-standard IPv4 forms accepted by <code>socket.connect</code>, such as hex (<code>0x7f000001</code>), octal (<code>0177.0.0.1</code>), and decimal integers (<code>2130706433</code>), ensuring SSL certificate verification uses the correct mode for these addresses. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5029">#5029</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen</code> raising a misleading <code>FullPoolError</code> instead of <code>ValueError</code> when called with an invalid <code>timeout</code> argument on a pool created with <code>block=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5059">#5059</a>)</p> </li> <li> <p>Fixed port-zero handling to preserve explicit <code>:0</code> values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, <code>connection_from_url()</code>, and HTTP/2 request authority. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5071">#5071</a>, <a href="https://redirect.github.com/urllib3/urllib3/issues/5101">#5101</a>)</p> </li> <li> <p>Fixed a bug where <code>PoolManager</code> passed the <code>assert_hostname</code> and <code>assert_fingerprint</code> parameters to HTTP connection pools. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5077">#5077</a>)</p> </li> <li> <p>Fixed <code>HTTPConnectionPool.urlopen()</code> and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5079">#5079</a>)</p> </li> <li> <p>Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5091">#5091</a>)</p> </li> <li> <p>Fixed <code>HTTPSConnection.connect()</code> overriding <code>ProxyConfig.ssl_context</code>'s certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.</p> <p><code>HTTPSConnection</code> no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its <code>ssl_context</code> as a fallback when an HTTPS proxy forwards an HTTP target. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5093">#5093</a>)</p> </li> <li> <p>Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (<a href="https://redirect.github.com/urllib3/urllib3/issues/5095">#5095</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.8.0 (2026-09-15)</h1> <h2>Security</h2> <p>Fixed the following security issues:</p> <ul> <li>The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, <code>GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77></code>__)</li> <li><code>HTTPResponse.stream()</code> and <code>read_chunked()</code> could buffer a chunk-size line of unbounded length in memory. (High severity, <code>GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw></code>__)</li> <li>Chunked Deflate streaming could enter an infinite loop. (Medium severity, <code>GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g></code>__)</li> </ul> <p>.. caution::</p> <pre><code>urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes. <p>Configure proxy CA certificates and client certificates in <code>proxy_ssl_context</code>, and proxy identity checks with <code>proxy_assert_hostname</code> or <code>proxy_assert_fingerprint</code>. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections. </code></pre></p> <h2>Deprecations & Removals</h2> <ul> <li>Deprecated using an empty collection as the <code>Retry</code> option <code>allowed_methods</code> to retry any verb. (<code>[#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044></code>__)</li> </ul> <h2>Features</h2> <ul> <li>Added <code>Url.auth_decoded</code> and <code>Url.auth_decoded_joined</code> convenience properties to the result of <code>parse_url()</code>. (<code>[#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945></code>__)</li> <li>Added <code>basic_auth_encoding</code> and <code>proxy_basic_auth_encoding</code> parameters to <code>urllib3.util.make_headers()</code>. (<code>[#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092></code>__)</li> </ul> <h2>Bugfixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/b1d30ab61fe0db8f11092805e8c5ac43e091064a"><code>b1d30ab</code></a> Release 2.8.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/9016d7e8afc68185496ef07f3c3a4a743d04922e"><code>9016d7e</code></a> Skip <code>test_read_chunked_with_trailing_data_does_not_hang</code> for brotlicffi (<a href="https://redirect.github.com/urllib3/urllib3/issues/5258">#5258</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/9101f581a8b3659af23b6ff335ae77200ca33533"><code>9101f58</code></a> Fix <code>nox -s docs</code> warning (<a href="https://redirect.github.com/urllib3/urllib3/issues/5256">#5256</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"><code>cd770b0</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"><code>ea2ad7b</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/0716e31534345dc1599ea95d903c79f276239bd8"><code>0716e31</code></a> Fix loading unencrypted client keys with a password in pyOpenSSL (<a href="https://redirect.github.com/urllib3/urllib3/issues/5255">#5255</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/43c68c8b43a9dcb44ed2cf4ec91384ca0d46b37d"><code>43c68c8</code></a> Test pickling of <code>InvalidChunkLength</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/5247">#5247</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/308b279b3fb28e7bee952e152ec5baeb5bfd0817"><code>308b279</code></a> Share security policy between GitHub and Read the Docs (<a href="https://redirect.github.com/urllib3/urllib3/issues/5253">#5253</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/53fa0731b27d4b71ab0755ea5b896422d005d706"><code>53fa073</code></a> Add policy on duplicate pull requests (<a href="https://redirect.github.com/urllib3/urllib3/issues/5252">#5252</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/5f2a6a843d0100d1351c3f94d58581ca98d17267"><code>5f2a6a8</code></a> Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (<a href="https://redirect.github.com/urllib3/urllib3/issues/5232">#5232</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.7.0...2.8.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
b9919ace32 |
chore(deps): bump pyjwt from 2.13.0 to 2.15.0 in /libs/cli (#9129)
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.13.0 to 2.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.15.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst">2.15.0 changelog</a> for complete release details.</p> <h2>2.14.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst">2.14.0 changelog</a> for the complete release details and related security advisories.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0></code>__</h2> <p>Security</p> <pre><code> - Wrap recursion errors from deeply nested JWT payloads in ``DecodeError`` instead of exposing a raw ``RecursionError``. <p>Added</p> <pre><code> - Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__ Changed </code></pre> <ul> <li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code> rather than the raw JWKS payload, so a cache hit no longer re-parses every key. <code>JWKSetCache.put()</code> accepts either form and raises <code>PyJWKSetError</code> for anything else. As a result, <code>PyJWKClient.get_jwk_set()</code> returns the same <code>PyJWKSet</code> instance for as long as it stays cached, rather than a freshly built one per call in <code>[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> <li><code>PyJWKClient.fetch_data()</code> now raises <code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)</code> when the endpoint response is not a JSON object, instead of returning it for <code>get_jwk_set()</code> to reject. Callers reaching the JWKS through <code>get_jwk_set()</code> see the same error as before in <code>[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> </ul> <p>Fixed</p> <pre><code> - Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value, so callers pre-populating the cache to avoid a network round-trip could not read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) &lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a ``fetch_data()`` override that filters or transforms the JWKS is no longer undone by the next cache hit in `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - Raise the documented ``PyJWTError`` subclass instead of leaking a ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a non-numeric, non-string value such as a list, dict, or ``null``. - Reject OKP JWK private keys when their public ``x`` component does not match the private ``d`` component. - Treat malformed JWK Set members as unusable keys rather than letting ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68"><code>1d41a64</code></a> chore: prepare 2.15.0 release</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3"><code>9bc0665</code></a> fix: make recursive payload tests deterministic</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b"><code>5fde08a</code></a> fix: normalize recursive JWT payload errors</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19"><code>171062d</code></a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173">#1173</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6"><code>c9d4d53</code></a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174">#1174</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53"><code>2763752</code></a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202">#1202</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5"><code>4adcd02</code></a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201">#1201</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097"><code>9e501d9</code></a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179">#1179</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2"><code>4047c44</code></a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212">#1212</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9"><code>f4e2b59</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210">#1210</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.15.0">compare view</a></li> </ul> </details> <br /></code></pre> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
4217373227 |
chore(deps): bump pyjwt from 2.14.0 to 2.15.0 in /libs/langgraph (#9139)
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.14.0 to 2.15.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.15.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst">2.15.0 changelog</a> for complete release details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0></code>__</h2> <p>Security</p> <pre><code> - Wrap recursion errors from deeply nested JWT payloads in ``DecodeError`` instead of exposing a raw ``RecursionError``. <p>Added</p> <pre><code> - Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__ Changed </code></pre> <ul> <li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code> rather than the raw JWKS payload, so a cache hit no longer re-parses every key. <code>JWKSetCache.put()</code> accepts either form and raises <code>PyJWKSetError</code> for anything else. As a result, <code>PyJWKClient.get_jwk_set()</code> returns the same <code>PyJWKSet</code> instance for as long as it stays cached, rather than a freshly built one per call in <code>[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> <li><code>PyJWKClient.fetch_data()</code> now raises <code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)</code> when the endpoint response is not a JSON object, instead of returning it for <code>get_jwk_set()</code> to reject. Callers reaching the JWKS through <code>get_jwk_set()</code> see the same error as before in <code>[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li> </ul> <p>Fixed</p> <pre><code> - Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value, so callers pre-populating the cache to avoid a network round-trip could not read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) &lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a ``fetch_data()`` override that filters or transforms the JWKS is no longer undone by the next cache hit in `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__ - Raise the documented ``PyJWTError`` subclass instead of leaking a ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a non-numeric, non-string value such as a list, dict, or ``null``. - Reject OKP JWK private keys when their public ``x`` component does not match the private ``d`` component. - Treat malformed JWK Set members as unusable keys rather than letting ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68"><code>1d41a64</code></a> chore: prepare 2.15.0 release</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3"><code>9bc0665</code></a> fix: make recursive payload tests deterministic</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b"><code>5fde08a</code></a> fix: normalize recursive JWT payload errors</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19"><code>171062d</code></a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173">#1173</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6"><code>c9d4d53</code></a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174">#1174</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53"><code>2763752</code></a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202">#1202</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5"><code>4adcd02</code></a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201">#1201</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097"><code>9e501d9</code></a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179">#1179</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2"><code>4047c44</code></a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212">#1212</a>)</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9"><code>f4e2b59</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210">#1210</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0">compare view</a></li> </ul> </details> <br /></code></pre> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
65ab10f017 |
chore(deps): bump pyjwt from 2.13.0 to 2.14.0 in /libs/langgraph (#9126)
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.13.0 to 2.14.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/releases">pyjwt's releases</a>.</em></p> <blockquote> <h2>2.14.0</h2> <p>See the <a href="https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst">2.14.0 changelog</a> for the complete release details and related security advisories.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's changelog</a>.</em></p> <blockquote> <h2><code>v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0></code>__</h2> <p>Security</p> <pre><code> - Harden HMAC key validation against public-key material supplied as JWK, JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__, `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__, `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__, and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__. - Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing redirected destinations from being treated as trusted key sources. See `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__. - Limit repeated JWKS refreshes caused by unknown key IDs while preserving normal key-rotation behavior. See `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__. - Handle deeply nested and malformed JWS/JWK input without uncaught recursion errors or whole-set parsing failures. See `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__ and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__. - Enforce compact JWS encoding rules during decoding. See `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__. - Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__. <p>Fixed</p> <pre><code> - Apply HMAC key validation consistently when keys are loaded through ``PyJWK`` and ``PyJWKClient``. See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__. - Reject empty HMAC keys when represented as JWKs. See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__. </code></pre> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jpadilla/pyjwt/commit/c6fe464b356ff4b1ebc9ba62172d331a40aa27df"><code>c6fe464</code></a> release: prepare v2.14.0</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/f5413029ae7a2e31b1367b5303ea86a2f54ccf42"><code>f541302</code></a> style: apply Ruff formatting</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95"><code>801cd12</code></a> fix: reject public JWK container HMAC keys</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb"><code>af8181c</code></a> fix: reject empty HMAC keys from JWKs</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1"><code>ba4853a</code></a> Throttle repeated PyJWKClient refreshes</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499"><code>2798504</code></a> fix: reject DER public keys as HMAC secrets</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07"><code>8b4e233</code></a> fix: reject loader-accepted PEM variants</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/1f8180a211256dfe5cf32294b6753f554a5a4258"><code>1f8180a</code></a> fix: format JWS tests</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/cff1ac55fe5f1096fd05295b269fce053ee290ab"><code>cff1ac5</code></a> Fix redirect handler return annotation</li> <li><a href="https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56"><code>0a795b8</code></a> Reject redirects in PyJWKClient fetches</li> <li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0">compare view</a></li> </ul> </details> <br /></code></pre> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
eb69f67b65 |
fix(checkpoint-sqlite): walk delta ancestors by parent pointer (#8557)
## Summary The sqlite delta history silently drops a parent checkpoint whose id sorts above its child's, losing that parent's stored value and its pending writes. The channel hydrates short with no error. Fixes #8550 ## Problem Stage 1 walked ancestors with: ```sql WHERE thread_id = ? AND checkpoint_ns = ? AND checkpoint_id <= ? ORDER BY checkpoint_id DESC ``` Ancestry is defined by the `parent_checkpoint_id` column. These two predicates add a second requirement: that every child's id sorts above its parent's. The contract promises monotonic ids, but that only holds within one process, so ids from processes with different clocks can break it. When the requirement is violated the parent is excluded from the stream and its seed and writes go with it. Dropping the range filter alone does not fix it: in `checkpoint_id DESC` order that parent arrives *before* the target, so the walk streams past it before it has started. ## Fix A recursive CTE anchored at the target, following `parent_checkpoint_id`: ```sql WITH RECURSIVE ancestors(checkpoint_id, parent_checkpoint_id, type, checkpoint) AS ( SELECT ... FROM checkpoints WHERE thread_id = ? AND checkpoint_ns = ? AND checkpoint_id = ? UNION ALL SELECT c.... FROM ancestors a CROSS JOIN checkpoints c ON c.checkpoint_id = a.parent_checkpoint_id WHERE c.thread_id = ? AND c.checkpoint_ns = ? ) SELECT checkpoint_id, type, checkpoint FROM ancestors ``` Rows now arrive in walk order (target, parent, grandparent, ...), so `step_walk_with_row` no longer needs its off-path skip or its `parent_cid` tracking; both are removed. The query reads only true ancestors, where the old one read every row at or below the target including sibling branches. `CROSS JOIN` pins the join order. The saver never runs `ANALYZE`, and with a plain `JOIN` sqlite put `checkpoints` as the outer loop, scanning the whole thread on every recursion step. With `ancestors` outside, each step is one primary key lookup. Through `get_delta_channel_history`: | chain length | plain `JOIN` | `CROSS JOIN` | | -- | -- | -- | | 1000 | 0.032s | 0.001s | | 2000 | 0.124s | 0.003s | | 4000 | 0.475s | 0.006s | ## Cycle guard Following pointers can loop where a bounded id scan could not, and a loop is reachable through `put` alone: `put` writes with `INSERT OR REPLACE`, so re-putting an existing checkpoint id under a descendant's config repoints that checkpoint at its own descendant. The walk stops on a repeated `checkpoint_id` (one set insert per row, no depth ceiling that could truncate a long migrated thread). sqlite yields recursive rows lazily, so abandoning the cursor ends the recursion. `test_walk_terminates_when_put_makes_the_parent_chain_cycle` fails by hanging, not by asserting, if the guard regresses (confirmed by deleting the guard locally). The package has no `pytest-timeout`, so the CI job timeout is the backstop. ## Postgres No equivalent change needed. It pages the whole thread with no id bound and follows parent pointers in Python, and its upsert never rewrites `parent_checkpoint_id`, so it can neither miss this parent nor form the loop. `BaseCheckpointSaver` and `InMemorySaver` also walk parent pointers. ## Test plan New `libs/checkpoint-sqlite/tests/test_delta_parent_walk.py`: - [x] Sync and async, parametrised over both id orders; the sync case also asserts equality with `BaseCheckpointSaver` on the same rows. `parent_id_sorts_above_child` is the bug, `parent_id_sorts_below_child` the control. - [x] `test_walk_reaches_root_of_long_chain_with_descending_ids`: 40 checkpoints, only stored value at the root. - [x] `test_walk_terminates_when_put_makes_the_parent_chain_cycle`. - [x] `test_walk_step_looks_up_the_parent_by_primary_key`: asserts the recursive step's `EXPLAIN QUERY PLAN` is a key lookup, so a plain `JOIN` can't come back. Fails with it. - [x] On `main`: 3 of the 6 walk tests fail (both `parent_id_sorts_above_child` cases and the long chain). The cycle test passes on `main` too, since the old bounded scan could not loop; it guards the new path. - [x] #8550's repro returns `{'writes': [('task', 'ch', 'write-root')], 'seed': 'seed'}` sync and async (was `{'writes': []}` on `main`). - [x] `libs/checkpoint-sqlite`: `make format`, `make lint` clean; full suite 125 passed, 2 skipped. - [x] `libs/langgraph`: `-k "delta or sqlite"` 739 passed, 1 skipped. Thanks to @lylelllll for the report, the minimal repro, the base-saver comparison that isolated it to the fast path, and for suggesting the recursive CTE. Co-authored-by: lylelllll <59271327+lylelllll@users.noreply.github.com> |
||
|
|
c0279f0910 |
fix(checkpoint-postgres): derive the delta walk cursor once the target loads (#8556)
## Summary `get_delta_channel_history` on Postgres returns an empty history for any `DeltaChannel` on a target checkpoint that is not within the first stage-1 pagination page (1024 rows) of the thread. No exception, no warning: the channel just hydrates empty. Fixes #8448 ## Problem Stage 1 pages `checkpoints` newest-first from the head of the thread, and after each page `_try_advance_walks` tries to move every not-yet-seeded channel's walk along the partial `parent_of` map accumulated so far. The walk starts at the target's parent: ```python if ch not in walk_cursor_by_ch: walk_cursor_by_ch[ch] = parent_of.get(target_id) ``` The target can be any checkpoint in the thread, not just the head, so on the first page `parent_of` frequently has no row for it yet. `.get` then returns `None`, which is also what a target with no parent returns, and the two are stored identically. Because the initialisation is guarded by `ch not in walk_cursor_by_ch`, it never runs again: once the walk is parked at `None` it stays there even after the target's real row and real parent load on a later page. The result is an empty chain and no seed. Downstream `channels_from_checkpoint` does ```python replay_ch = delta_spec.from_checkpoint(history.get("seed", MISSING)) replay_ch.replay_writes(history["writes"]) ``` so `get_state`, `get_state_history` and `update_state` against an older checkpoint reconstruct a `messages` channel as `[]` on a thread with hundreds of real messages. ## Fix Start the walk only once `target_id` is actually present in `parent_of`, so "the target has not loaded yet" stops sharing a representation with "the target is a root": ```python if ch not in walk_cursor_by_ch: if target_id not in parent_of: continue walk_cursor_by_ch[ch] = parent_of[target_id] ``` `_try_advance_walks` is a static method on `BasePostgresSaver`, so `PostgresSaver` and `AsyncPostgresSaver` are both covered by the one change. ## Why it's safe `continue` leaves the channel exactly as it was, so a later page retries. The three existing stop conditions are untouched: a channel that finds its seed still seeds, one that reaches a real root still parks at `None`, and one waiting on an ancestor still keeps its cursor. Paging still terminates on a short page, which is what ends the run for a target that really is a root. ## Long-term The sibling sqlite implementation avoids this class of bug differently, by starting its stage-1 scan at the target (`checkpoint_id <= ?`) instead of at the head. Postgres could adopt the same bound and would then never fetch a checkpoint newer than the target at all, which looks like the bigger win on a long thread. It makes the read path depend on ancestors always sorting below their descendants, though, which sqlite already assumes but the Postgres fast path currently does not. #8550 now reports that assumption as a bug in sqlite, on the grounds that ancestry is defined by `parent_checkpoint_id` and the contract does not require ids to be monotonic, so the bound is the wrong direction to move Postgres in. Paging the full thread and following parent pointers is what keeps this path correct when ids are not monotonic, and with this fix Postgres returns the right history for #8550's scenario at every page size. ## Test plan New `libs/checkpoint-postgres/tests/test_delta_pagination.py`. Page size is monkeypatched rather than writing 1024+ real checkpoints per case, since the only thing that decides the behaviour is which page the target lands on. - [x] `test_async_target_older_than_the_first_page` and its sync twin, parametrised over page sizes `[_DELTA_PAGE_SIZE, 3, 2, 1]`. The thread has 8 checkpoints with a snapshot at step 1 and the target at step 4, so every size at or below 3 leaves the target off the first page. The real page size is the control. - [x] `test_root_target_has_no_history_and_still_terminates` covers the case where a `None` cursor is the correct answer, at page size 1 so the paging loop runs the length of the thread. - [x] 6 of the 9 fail on `main` (`expected a snapshot seed, got '<missing>'`); the 3 that pass are the two controls and the root case. - [x] `make format`, `make lint_package`, `make lint_tests` clean. - [x] Full `libs/checkpoint-postgres` suite, rebased on current `main`: 279 passed, 3 skipped on Postgres 16. - [x] Graph-level repro with `_DELTA_PAGE_SIZE = 5`: 10 invocations, then `get_state` on the 8th-newest checkpoint returns `[]` on `main` and the full history on this branch. Thanks to @Navneet-Scaler for the report, the mechanism write-up, and the fix in #8453, which this matches. Co-authored-by: Navneet-Scaler <147032454+Navneet-Scaler@users.noreply.github.com> |
||
|
ccurmeandGitHub
|
f5804a5bf5 | fix(ci): test locally-built wheel and publish to test pypi after pre-release checks (#9124) | ||
|
|
07b33185ea |
fix: reject credential-bearing Git dependencies (#8542)
## Description Reject Git HTTP dependency URLs containing userinfo before Docker generation so credentials cannot persist in Dockerfiles or image layers. Validation now covers local requirement/package metadata and uv pyproject/lock inputs while keeping errors token-free. ## Test Plan - [x] Validate credentialed raw, local-manifest, and uv-managed Git URLs are rejected without echoing secrets - [x] Validate credential-free HTTPS and SSH Git URLs remain supported Made by [Open SWE](https://openswe.vercel.app/agents/81b07455-ece4-3ddc-9955-d7a5bea78d2c) --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
Hugo DURANDandGitHub
|
7daa3ab49d |
feat(cli): place self-hosted deployments on a listener (#9056)
Follow-up to #8482. `langgraph deploy --push-to` can now create a deployment in a workspace that deploys through a listener in the customer's own cluster, which is the hybrid case. Before this, creation in such a workspace was impossible from the CLI: the control plane rejected it and the CLI told the user to go and create the deployment in the UI first. ## Changes - Smart Auto-Placement: The CLI now proactively checks your workspace. If you only have one listener and one Kubernetes namespace configured (and are using the managed cloud control plane), it automatically routes your deployment there. No extra flags needed. - New Disambiguation Flags: If your workspace has multiple listeners or namespaces, the CLI will ask you to choose. You can now pass --listener-id and --k8s-namespace to tell it exactly where to deploy. - Failing Fast: The CLI now validates your listener and namespace choices before it starts building and pushing the heavy Docker image. If you provide an invalid ID, it stops immediately instead of wasting your time and bandwidth. - Fixed a Duplication Bug: Previously, if you had many deployments with similar names, a pagination issue could hide your existing deployment from the CLI, causing it to accidentally create a duplicate. The CLI now queries the server for the exact deployment name to guarantee this doesn't happen. - Cleaner Errors: Error messages from the control plane are now stripped of their clunky HTTP envelopes so you get clear, readable sentences when something goes wrong. ## Testing Deployment on 3 paths, hybrid, self-hosted, nominalcli==0.4.32 |
||
|
Sreekara YachamaneniandGitHub
|
e868c3ccfd |
feat(cli): clarify agent flags and support env defaults (#9063)
Agent deployment options now print a private-beta notice. Rename `--environment` to `--agent-environment` and accept `LANGSMITH_AGENT_ID` / `LANGSMITH_AGENT_ENVIRONMENT` as process-environment defaults for deploy and list. Explicit flags take precedence, and the backend payload is unchanged. Validation: formatting and lint pass. A local smoke check verified environment-only deployment, explicit flag precedence, list defaults, and structured JSON output. Full CLI suite: 411 passed; the two known Docker failures remain (`test_dockerfile_command_with_docker_compose` and `test_build_generate_proper_build_context`). No new tests added; the existing test invocation uses the renamed flag. |
||
|
|
bdb85b5aa8 |
chore: remove Claude-specific instructions (#9058)
Remove the root `CLAUDE.md` while retaining the shared `AGENTS.md` instructions. No Claude-specific GitHub workflows are present, so existing workflows remain unchanged. Made by [Open SWE](https://github.com/langchain-ai/open-swe) · [view thread](https://openswe.vercel.app/agents/541e1bd2-e302-582d-b6cf-bd1df1aadda7) · openai:gpt-6-astra (low) Co-authored-by: Mason Daugherty <mdrxy@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
Sreekara YachamaneniandGitHub
|
1211af45b1 |
feat(cli): Update langgraph deploy command to use agent_id and environment args (#9055)
- Accept agent_id and environment args for `lanngraph deploy` - Validate both arguments present or none - If agent arguments present, make sure deployment_id and name are not present |
||
|
|
1afaca35a0 |
feat(cli): add --image-uri flag for self-hosted deployments (#8482)
Adds `--image-uri <uri>` to `langgraph deploy` so self-hosted LangSmith customers can build, push, and deploy in one command without needing to script the three steps manually. When `--image-uri` is provided the CLI: - Builds the image tagged to the provided URI (same Docker build path as the local build flow) - Pushes using whatever Docker credentials are already in the environment (e.g. WIF, `aws ecr get-login-password`) — no auth handling in the CLI - PATCHes the deployment with `source_revision_config.image_uri` (no `revision_source`, which the self-hosted control plane rejects for `external_docker` deployments) Also fixes two self-hosted-specific issues uncovered during testing: - `LANGSMITH_ENDPOINT` is now used as a fallback when `LANGGRAPH_HOST_URL` isn't set — the CLI strips the `/api/v1` path and appends `/api-host` to reach the control plane - The httpx client now builds full URLs via string concatenation rather than relying on httpx base_url merging, which silently dropped the `/api-host` path prefix when paths started with `/` - The "Check status at" URL after a deploy now correctly points to the self-hosted LangSmith UI instead of `smith.langchain.com` **How did you verify your code works?** Tested end-to-end against a self-hosted LangSmith instance using ECR as the registry. `langgraph deploy --image-uri <ecr-uri>` successfully built, pushed, and triggered a deployment revision. Confirmed the existing SaaS flow (`langgraph deploy` without `--image-uri`) is unaffected — the new flag is opt-in and the `LANGSMITH_ENDPOINT` fallback only activates when `LANGGRAPH_HOST_URL` is unset and `LANGSMITH_ENDPOINT` is present. --------- Co-authored-by: Hari Dhanushkodi <hari-dhanushkodi@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> Co-authored-by: Hugo Durand <hugo.durand@langchain.dev> |
||
|
Elior Nataf LackritzandGitHub
|
49cce0ca85 |
release(sdk-py): 0.4.5 (#8988)
Bumps the Python SDK version from 0.4.4 to 0.4.5. Adds `response_schema` to the `Interrupt` TypedDict (#8886).1.2.12 sdk==0.4.5 |
||
|
Elior Nataf LackritzandGitHub
|
19273fa88b |
release(langgraph): 1.2.12 (#8987)
Bumps langgraph from 1.2.11 to 1.2.12. Ships `response_schema` on `interrupt()` (#8886). |
||
|
|
ed384f3a12 |
fix(cli): remediate AnyIO vulnerabilities in example lockfiles (#9022)
- Upgrade AnyIO from 4.13.0 to 4.14.2 in both uv example lockfiles, fixing GHSA-82r6-8w77-94w6 (TLS certificate spoofing) and GHSA-5p39-cfhj-2xmp (process-pool hangs). - Remove the orphaned examples Poetry lockfile left behind by the uv migration; current example tooling does not consume it. - Addresses all six currently open Dependabot alerts without changing unrelated dependencies. Made by [Open SWE](https://github.com/langchain-ai/open-swe) · [view thread](https://openswe.vercel.app/agents/37d08f4f-9fe6-51be-adc9-d58aa9e6e010) · openai:gpt-6-astra (medium) Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
|
aa742fb31e |
chore(deps): bump anyio from 4.14.2 to 4.15.1 in /libs/sdk-py (#8997)
Bumps [anyio](https://github.com/agronholm/anyio) from 4.14.2 to 4.15.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/agronholm/anyio/releases">anyio's releases</a>.</em></p> <blockquote> <h2>4.15.1</h2> <ul> <li>Implemented a compatibility fix for supporting direct access of <code>anyio.*</code> submodules from the main package even when those submodules were not directly imported first (<!-- raw HTML omitted --><a href="https://redirect.github.com/agronholm/anyio/issues/1311">#1311</a> <<a href="https://redirect.github.com/agronholm/anyio/issues/1311%5C%3E">agronholm/anyio#1311</a><!-- raw HTML omitted -->)</li> </ul> <h2>4.15.0</h2> <ul> <li> <p>Added support for the newer keyword-only arguments on <code>anyio.Path</code> methods to match the standard library <code>pathlib.Path</code>:</p> <ul> <li><code>follow_symlinks</code> on <code>exists()</code> (Python 3.12+)</li> <li><code>follow_symlinks</code> on <code>is_dir()</code> (Python 3.13+)</li> <li><code>follow_symlinks</code> on <code>is_file()</code> (Python 3.13+)</li> <li><code>follow_symlinks</code> on <code>owner()</code> (Python 3.13+)</li> <li><code>follow_symlinks</code> on <code>group()</code> (Python 3.13+)</li> <li><code>newline</code> on <code>read_text()</code> (Python 3.13+)</li> </ul> <p>(<a href="https://redirect.github.com/agronholm/anyio/pull/1286">#1286</a>, <a href="https://redirect.github.com/agronholm/anyio/pull/1293">#1293</a>; PR by <a href="https://github.com/jaideeppyne"><code>@jaideeppyne</code></a>)</p> </li> <li> <p>Added <code>amap</code>, <code>gather</code>, and <code>as_completed</code> utility functions to simplify common patterns (<a href="https://redirect.github.com/agronholm/anyio/pull/1173">#1173</a>; PR by <a href="https://github.com/Graeme22"><code>@Graeme22</code></a>)</p> </li> <li> <p>Added <code>--anyio-mode</code> command-line option as an alternative to the <code>anyio_mode</code> ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: <code>pytest_asyncio</code>). (<a href="https://redirect.github.com/agronholm/anyio/pull/1242">#1242</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Added the <code>anyio.Future</code> synchronization primitive which behaves similar to <code>asyncio.Future</code>, allowing tasks to wait for a value (or exception) from another task (<a href="https://redirect.github.com/agronholm/anyio/pull/1146">#1146</a>; PR by <a href="https://github.com/Vizonex"><code>@Vizonex</code></a>)</p> </li> <li> <p>Added guidance for managing multiple memory object stream producers and consumers with cloned streams (<a href="https://redirect.github.com/agronholm/anyio/issues/330">#330</a>; PR by <a href="https://github.com/nightcityblade"><code>@nightcityblade</code></a>)</p> </li> <li> <p>Added <code>StapledObjectStream.send_nowait()</code> that delegates to the underlying <code>ObjectSendStream</code>, if it implements it (<a href="https://redirect.github.com/agronholm/anyio/pull/1241">#1241</a>; PR by <a href="https://github.com/davidbrochart"><code>@davidbrochart</code></a>)</p> </li> <li> <p>Added the <code>move_on_at()</code> and <code>fail_at()</code> functions to complement <code>move_on_after()</code> and <code>fail_after()</code></p> </li> <li> <p>Changed the default name for a task spawned with <code>TaskGroup.create_task(func())</code> to match the default task name for the analogous task spawned with <code>TaskGroup.start_soon(func)</code> or <code>TaskGroup.start(func)</code> in more situations. Previously, the default name of a <code>TaskGroup.create_task</code> task never included the module name. (The default name for a task spawned with <code>TaskGroup.start_soon</code> or <code>TaskGroup.start</code> typically includes the module name.) (<a href="https://redirect.github.com/agronholm/anyio/pull/1234">#1234</a>; PR by <a href="https://github.com/gschaffner"><code>@gschaffner</code></a>)</p> </li> <li> <p>Changed the <code>anyio</code> and <code>anyio.abc</code> modules to lazily (much like <code>810</code>) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the <code>if TYPE_CHECKING:</code> block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (<a href="https://redirect.github.com/agronholm/anyio/pull/1169">#1169</a>)</p> </li> <li> <p>Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to <code>start_blocking_portal()</code> and <code>anyio.to_thread.run_sync()</code> (<a href="https://redirect.github.com/agronholm/anyio/pull/1224">#1224</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Fixed <code>SpooledTemporaryFile.readinto()</code> and <code>readinto1()</code> reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (<a href="https://redirect.github.com/agronholm/anyio/pull/1215">#1215</a>; PR by <a href="https://github.com/c-tonneslan"><code>@c-tonneslan</code></a>)</p> </li> <li> <p>Added a <code>reason</code> parameter to <code>fail_after</code> (and the new <code>fail_at</code>) allowing for added exception context when raising <code>TimeoutError</code> (<a href="https://redirect.github.com/agronholm/anyio/pull/1227">#1227</a>; PR by <a href="https://github.com/Graeme22"><code>@Graeme22</code></a>)</p> </li> <li> <p>Fixed the default <code>TaskHandle.name</code> missing part of the task name for tasks started with <code>TaskGroup.start</code> on Trio (<a href="https://redirect.github.com/agronholm/anyio/issues/1231">#1231</a>; PR by <a href="https://github.com/gschaffner"><code>@gschaffner</code></a>)</p> </li> <li> <p>Fixed <code>anyio.run</code> leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a <code>RunVar</code>. (<a href="https://redirect.github.com/agronholm/anyio/issues/1203">#1203</a>; PR by <a href="https://github.com/tapetersen"><code>@tapetersen</code></a>)</p> </li> <li> <p>Fixed <code>anyio.Path.with_stem()</code> silently producing a wrong path (e.g. <code>Path(".txt")</code>) instead of raising <code>ValueError</code> when given an empty stem on a path with a non-empty suffix, unlike <code>pathlib.PurePath.with_stem</code> (<a href="https://redirect.github.com/agronholm/anyio/pull/1200">#1200</a>; PR by <a href="https://github.com/Sanjays2402"><code>@Sanjays2402</code></a>)</p> </li> <li> <p>Fixed <code>UNIXSocketStream.aclose()</code> raising <code>asyncio.InvalidStateError</code> when a concurrent receive or send operation had just been cancelled on the asyncio backend (<a href="https://redirect.github.com/agronholm/anyio/issues/1267">#1267</a>; PR by <a href="https://github.com/alloutflo"><code>@alloutflo</code></a>)</p> </li> <li> <p>Fixed the pytest plugin importing the deprecated <code>_pytest.python.CallSpec2</code> alias, which triggers <code>PytestRemovedIn10Warning</code> on <code>pytest>=9.2</code> and crashes pytest at startup when <code>filterwarnings = error</code> is configured (<a href="https://redirect.github.com/agronholm/anyio/issues/1271">#1271</a>; PR by <a href="https://github.com/matthewfeickert"><code>@matthewfeickert</code></a>)</p> </li> <li> <p>Fixed an asyncio worker thread race that could raise <code>RuntimeError</code> when the event loop closed between checking its state and scheduling the worker result (<a href="https://redirect.github.com/agronholm/anyio/issues/1265">#1265</a>; PR by <a href="https://github.com/hansu650"><code>@hansu650</code></a>)</p> </li> <li> <p>Fixed <code>CapacityLimiter</code> on the asyncio backend over-granting tokens when <code>total_tokens</code> was raised while the limiter was over-subscribed (<a href="https://redirect.github.com/agronholm/anyio/pull/1223">#1223</a>; PR by <a href="https://github.com/zelinewang"><code>@zelinewang</code></a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/agronholm/anyio/commit/ffcd1542cd6d127980205f90a0100078849dd703"><code>ffcd154</code></a> Bumped up the version</li> <li><a href="https://github.com/agronholm/anyio/commit/0ecf5ed98d294242509b043ebd1a0843e52d892f"><code>0ecf5ed</code></a> Added a workaround for third party code accessing unimported submodules (<a href="https://redirect.github.com/agronholm/anyio/issues/1309">#1309</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/928366259543412a2deb1e2ba09ea45ffa92ef4f"><code>9283662</code></a> Bumped up the version</li> <li><a href="https://github.com/agronholm/anyio/commit/d137692a90f76e4f71605e32ea5ca94cab3a539d"><code>d137692</code></a> Improved the instructions for AI agents</li> <li><a href="https://github.com/agronholm/anyio/commit/033fc52b8fa8e90c5d0ef24b10b3860e974a6265"><code>033fc52</code></a> Shield TemporaryDirectory cleanup from cancellation (<a href="https://redirect.github.com/agronholm/anyio/issues/1304">#1304</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/942e9a6552cc10b5aaa779d84bfc8e2c3d5fcffc"><code>942e9a6</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/agronholm/anyio/issues/1305">#1305</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/b825c3be7cb4ca1a8000b8065d4e147843deb704"><code>b825c3b</code></a> Fixed pyproject.toml changes not triggering the test suite</li> <li><a href="https://github.com/agronholm/anyio/commit/9727dc504681e2986b5bc285de9571fb467539af"><code>9727dc5</code></a> Fixed start inconsistencies between trio and asyncio (<a href="https://redirect.github.com/agronholm/anyio/issues/1198">#1198</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/b05fe6d160a640355c201363cab286a7d2581da8"><code>b05fe6d</code></a> Fixed wrong type in move_on_after (<a href="https://redirect.github.com/agronholm/anyio/issues/1297">#1297</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/44d0c93cc20079acbf38ba4dbed5ab9df323f153"><code>44d0c93</code></a> Fixed asyncio task group coroutine cleanup (<a href="https://redirect.github.com/agronholm/anyio/issues/1275">#1275</a>)</li> <li>Additional commits viewable in <a href="https://github.com/agronholm/anyio/compare/4.14.2...4.15.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
b58044ac7a |
chore(deps): bump anyio from 4.13.0 to 4.14.2 in /libs/cli (#8998)
Bumps [anyio](https://github.com/agronholm/anyio) from 4.13.0 to 4.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/agronholm/anyio/releases">anyio's releases</a>.</em></p> <blockquote> <h2>4.14.2</h2> <ul> <li>Changed <code>ByteReceiveStream.receive()</code> implementations to raise a <code>ValueError</code> when <code>max_bytes</code> is not a positive integer (<a href="https://redirect.github.com/agronholm/anyio/pull/1191">#1191</a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting <code>float("inf")</code> when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (<code>value is math.inf</code>), so only the exact <code>math.inf</code> singleton was accepted, while every backend setter (using <code>math.isinf()</code>) accepts any positive infinity (<a href="https://redirect.github.com/agronholm/anyio/pull/1189">#1189</a>; PR by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker function writes enough data to <code>sys.stderr</code> to fill the (undrained) pipe buffer. The worker process now redirects <code>sys.stderr</code> to <code>os.devnull</code> as well, matching the documented behavior</li> <li>Fixed <code>TLSStream.wrap()</code> matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (<a href="https://redirect.github.com/agronholm/anyio/pull/1208">#1208</a>)</li> <li>Fixed <code>anyio.open_process()</code> (and <code>run_process()</code>) ignoring the <code>extra_groups</code> argument, as it mistakenly passed the value of the <code>group</code> argument instead (<a href="https://redirect.github.com/agronholm/anyio/pull/1209">#1209</a>)</li> <li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and <code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising <code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on the <code>trio</code> backend when there are no tokens available (<a href="https://redirect.github.com/agronholm/anyio/pull/1218">#1218</a>)</li> <li>Fixed <code>CapacityLimiter</code> on the asyncio backend over-granting tokens (<code>borrowed_tokens</code> exceeding <code>total_tokens</code> and <code>available_tokens</code> going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises <code>WouldBlock</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1170">#1170</a>; PR by <a href="https://github.com/gaoflow"><code>@gaoflow</code></a>)</li> <li>Fixed unnecessary CPU spin when delivering cancellation from <code>CancelScope</code> on asyncio under certain conditions, including improper cancel scope nesting (<a href="https://redirect.github.com/agronholm/anyio/issues/1111">#1111</a>)</li> </ul> <h2>4.14.1</h2> <ul> <li>Fixed teardown of higher-scoped async fixtures failing on asyncio with <code>RuntimeError: Attempted to exit cancel scope in a different task than it was entered in</code> when an async test raise an outcome exception (e.g., <code>pytest.skip()</code>, <code>pytest.xfail()</code>, or <code>pytest.fail()</code>) (<a href="https://redirect.github.com/agronholm/anyio/issues/1179">#1179</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting a value of <code>0</code> when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (<a href="https://redirect.github.com/agronholm/anyio/pull/1183">#1183</a>; PR by <a href="https://github.com/nyxst4ck"><code>@nyxst4ck</code></a>)</li> </ul> <h2>4.14.0</h2> <ul> <li> <p>Added support for Python 3.15</p> </li> <li> <p>Added an asynchronous implementation of the <code>itertools</code> module (<a href="https://redirect.github.com/agronholm/anyio/issues/998">#998</a>; PR by <a href="https://github.com/11kkw"><code>@11kkw</code></a>)</p> </li> <li> <p>Added the <code>local_port</code> parameter to <code>connect_tcp()</code> to allow binding to a specific local port before connecting (<a href="https://redirect.github.com/agronholm/anyio/issues/1067">#1067</a>; PR by <a href="https://github.com/nullwiz"><code>@nullwiz</code></a>)</p> </li> <li> <p>Added support for custom capacity limiters in async path and file I/O functions and classes</p> </li> <li> <p>Added the <code>create_task()</code> task group method for easier asyncio migration (returns a <code>TaskHandle</code>) (<a href="https://redirect.github.com/agronholm/anyio/pull/1098">#1098</a>)</p> </li> <li> <p>Changed <code>TaskGroup.start_soon()</code> to return a <code>TaskHandle</code></p> </li> <li> <p>Added an option for <code>TaskGroup.start()</code> to return a <code>TaskHandle</code> (which then contains the start value in the <code>start_value</code> property)</p> </li> <li> <p>Added the <code>cancel()</code> convenience method to <code>TaskGroup</code> as a shortcut for cancelling the task group's cancel scope</p> </li> <li> <p>Improved the error message when a known backend is not installed to suggest the install command (<a href="https://redirect.github.com/agronholm/anyio/pull/1115">#1115</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Improved <code>anyio.Path</code> to preserve subclass types by returning <code>Self</code> in methods that return path objects (<a href="https://redirect.github.com/agronholm/anyio/issues/1130">#1130</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Changed the parameter type annotation in <code>anyio.Path.write_bytes()</code> to accept any <code>ReadableBuffer</code>, thus allowing it to accept <code>bytearray</code> and <code>memoryview</code> to match <code>pathlib.Path.write_bytes()</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1135">#1135</a>; PR by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a>)</p> </li> <li> <p>Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:</p> <ul> <li><code>TaskGroup.start_soon()</code></li> <li><code>TaskGroup.start()</code></li> <li><code>anyio.from_thread.run()</code></li> </ul> <p>This reverts an earlier change from v3.7.0 which was made in error. (<a href="https://redirect.github.com/agronholm/anyio/pull/1153">#1153</a>)</p> </li> <li> <p>Changed <code>anyio.run</code> to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (<a href="https://redirect.github.com/agronholm/anyio/pull/1171">#1171</a>; PR by <a href="https://github.com/gschaffner"><code>@gschaffner</code></a>)</p> </li> <li> <p>Changed several classes (and their subclasses) to have <code>__slots__</code> (with <code>__weakref__</code>):</p> <ul> <li><code>anyio.CancelScope</code></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71"><code>c384f99</code></a> Bumped up the version</li> <li><a href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a"><code>dbba29d</code></a> Fixed 100% CPU spin on cancel scope misuse (<a href="https://redirect.github.com/agronholm/anyio/issues/1217">#1217</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8"><code>6bbc6c3</code></a> Fix CapacityLimiter over-granting tokens on asyncio (<a href="https://redirect.github.com/agronholm/anyio/issues/1172">#1172</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b"><code>6f82b25</code></a> Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky</li> <li><a href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e"><code>be24b04</code></a> Relaxed timeouts to fix test flakiness</li> <li><a href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf"><code>8113506</code></a> Fix test flakiness caused by slow callback duration logging</li> <li><a href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f"><code>1e988b6</code></a> Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1">#1</a>...</li> <li><a href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62"><code>44713f3</code></a> Pin setup-uv to a commit sha across downstream jobs (<a href="https://redirect.github.com/agronholm/anyio/issues/1213">#1213</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"><code>f1b7301</code></a> Fixed stderr writes in a worker subprocess causing a deadlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1207">#1207</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90"><code>212be93</code></a> Fix flaky test_tcp_listener_same_port using a hardcoded port (<a href="https://redirect.github.com/agronholm/anyio/issues/1206">#1206</a>)</li> <li>Additional commits viewable in <a href="https://github.com/agronholm/anyio/compare/4.13.0...4.14.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
daa514a988 |
chore(deps): bump anyio from 4.13.0 to 4.14.2 in /libs/checkpoint-conformance (#8996)
Bumps [anyio](https://github.com/agronholm/anyio) from 4.13.0 to 4.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/agronholm/anyio/releases">anyio's releases</a>.</em></p> <blockquote> <h2>4.14.2</h2> <ul> <li>Changed <code>ByteReceiveStream.receive()</code> implementations to raise a <code>ValueError</code> when <code>max_bytes</code> is not a positive integer (<a href="https://redirect.github.com/agronholm/anyio/pull/1191">#1191</a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting <code>float("inf")</code> when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (<code>value is math.inf</code>), so only the exact <code>math.inf</code> singleton was accepted, while every backend setter (using <code>math.isinf()</code>) accepts any positive infinity (<a href="https://redirect.github.com/agronholm/anyio/pull/1189">#1189</a>; PR by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker function writes enough data to <code>sys.stderr</code> to fill the (undrained) pipe buffer. The worker process now redirects <code>sys.stderr</code> to <code>os.devnull</code> as well, matching the documented behavior</li> <li>Fixed <code>TLSStream.wrap()</code> matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (<a href="https://redirect.github.com/agronholm/anyio/pull/1208">#1208</a>)</li> <li>Fixed <code>anyio.open_process()</code> (and <code>run_process()</code>) ignoring the <code>extra_groups</code> argument, as it mistakenly passed the value of the <code>group</code> argument instead (<a href="https://redirect.github.com/agronholm/anyio/pull/1209">#1209</a>)</li> <li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and <code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising <code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on the <code>trio</code> backend when there are no tokens available (<a href="https://redirect.github.com/agronholm/anyio/pull/1218">#1218</a>)</li> <li>Fixed <code>CapacityLimiter</code> on the asyncio backend over-granting tokens (<code>borrowed_tokens</code> exceeding <code>total_tokens</code> and <code>available_tokens</code> going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises <code>WouldBlock</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1170">#1170</a>; PR by <a href="https://github.com/gaoflow"><code>@gaoflow</code></a>)</li> <li>Fixed unnecessary CPU spin when delivering cancellation from <code>CancelScope</code> on asyncio under certain conditions, including improper cancel scope nesting (<a href="https://redirect.github.com/agronholm/anyio/issues/1111">#1111</a>)</li> </ul> <h2>4.14.1</h2> <ul> <li>Fixed teardown of higher-scoped async fixtures failing on asyncio with <code>RuntimeError: Attempted to exit cancel scope in a different task than it was entered in</code> when an async test raise an outcome exception (e.g., <code>pytest.skip()</code>, <code>pytest.xfail()</code>, or <code>pytest.fail()</code>) (<a href="https://redirect.github.com/agronholm/anyio/issues/1179">#1179</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting a value of <code>0</code> when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (<a href="https://redirect.github.com/agronholm/anyio/pull/1183">#1183</a>; PR by <a href="https://github.com/nyxst4ck"><code>@nyxst4ck</code></a>)</li> </ul> <h2>4.14.0</h2> <ul> <li> <p>Added support for Python 3.15</p> </li> <li> <p>Added an asynchronous implementation of the <code>itertools</code> module (<a href="https://redirect.github.com/agronholm/anyio/issues/998">#998</a>; PR by <a href="https://github.com/11kkw"><code>@11kkw</code></a>)</p> </li> <li> <p>Added the <code>local_port</code> parameter to <code>connect_tcp()</code> to allow binding to a specific local port before connecting (<a href="https://redirect.github.com/agronholm/anyio/issues/1067">#1067</a>; PR by <a href="https://github.com/nullwiz"><code>@nullwiz</code></a>)</p> </li> <li> <p>Added support for custom capacity limiters in async path and file I/O functions and classes</p> </li> <li> <p>Added the <code>create_task()</code> task group method for easier asyncio migration (returns a <code>TaskHandle</code>) (<a href="https://redirect.github.com/agronholm/anyio/pull/1098">#1098</a>)</p> </li> <li> <p>Changed <code>TaskGroup.start_soon()</code> to return a <code>TaskHandle</code></p> </li> <li> <p>Added an option for <code>TaskGroup.start()</code> to return a <code>TaskHandle</code> (which then contains the start value in the <code>start_value</code> property)</p> </li> <li> <p>Added the <code>cancel()</code> convenience method to <code>TaskGroup</code> as a shortcut for cancelling the task group's cancel scope</p> </li> <li> <p>Improved the error message when a known backend is not installed to suggest the install command (<a href="https://redirect.github.com/agronholm/anyio/pull/1115">#1115</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Improved <code>anyio.Path</code> to preserve subclass types by returning <code>Self</code> in methods that return path objects (<a href="https://redirect.github.com/agronholm/anyio/issues/1130">#1130</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Changed the parameter type annotation in <code>anyio.Path.write_bytes()</code> to accept any <code>ReadableBuffer</code>, thus allowing it to accept <code>bytearray</code> and <code>memoryview</code> to match <code>pathlib.Path.write_bytes()</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1135">#1135</a>; PR by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a>)</p> </li> <li> <p>Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:</p> <ul> <li><code>TaskGroup.start_soon()</code></li> <li><code>TaskGroup.start()</code></li> <li><code>anyio.from_thread.run()</code></li> </ul> <p>This reverts an earlier change from v3.7.0 which was made in error. (<a href="https://redirect.github.com/agronholm/anyio/pull/1153">#1153</a>)</p> </li> <li> <p>Changed <code>anyio.run</code> to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (<a href="https://redirect.github.com/agronholm/anyio/pull/1171">#1171</a>; PR by <a href="https://github.com/gschaffner"><code>@gschaffner</code></a>)</p> </li> <li> <p>Changed several classes (and their subclasses) to have <code>__slots__</code> (with <code>__weakref__</code>):</p> <ul> <li><code>anyio.CancelScope</code></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71"><code>c384f99</code></a> Bumped up the version</li> <li><a href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a"><code>dbba29d</code></a> Fixed 100% CPU spin on cancel scope misuse (<a href="https://redirect.github.com/agronholm/anyio/issues/1217">#1217</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8"><code>6bbc6c3</code></a> Fix CapacityLimiter over-granting tokens on asyncio (<a href="https://redirect.github.com/agronholm/anyio/issues/1172">#1172</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b"><code>6f82b25</code></a> Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky</li> <li><a href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e"><code>be24b04</code></a> Relaxed timeouts to fix test flakiness</li> <li><a href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf"><code>8113506</code></a> Fix test flakiness caused by slow callback duration logging</li> <li><a href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f"><code>1e988b6</code></a> Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1">#1</a>...</li> <li><a href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62"><code>44713f3</code></a> Pin setup-uv to a commit sha across downstream jobs (<a href="https://redirect.github.com/agronholm/anyio/issues/1213">#1213</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"><code>f1b7301</code></a> Fixed stderr writes in a worker subprocess causing a deadlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1207">#1207</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90"><code>212be93</code></a> Fix flaky test_tcp_listener_same_port using a hardcoded port (<a href="https://redirect.github.com/agronholm/anyio/issues/1206">#1206</a>)</li> <li>Additional commits viewable in <a href="https://github.com/agronholm/anyio/compare/4.13.0...4.14.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
022043a679 |
chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/checkpoint (#8995)
Bumps [anyio](https://github.com/agronholm/anyio) from 4.12.1 to 4.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/agronholm/anyio/releases">anyio's releases</a>.</em></p> <blockquote> <h2>4.14.2</h2> <ul> <li>Changed <code>ByteReceiveStream.receive()</code> implementations to raise a <code>ValueError</code> when <code>max_bytes</code> is not a positive integer (<a href="https://redirect.github.com/agronholm/anyio/pull/1191">#1191</a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting <code>float("inf")</code> when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (<code>value is math.inf</code>), so only the exact <code>math.inf</code> singleton was accepted, while every backend setter (using <code>math.isinf()</code>) accepts any positive infinity (<a href="https://redirect.github.com/agronholm/anyio/pull/1189">#1189</a>; PR by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker function writes enough data to <code>sys.stderr</code> to fill the (undrained) pipe buffer. The worker process now redirects <code>sys.stderr</code> to <code>os.devnull</code> as well, matching the documented behavior</li> <li>Fixed <code>TLSStream.wrap()</code> matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (<a href="https://redirect.github.com/agronholm/anyio/pull/1208">#1208</a>)</li> <li>Fixed <code>anyio.open_process()</code> (and <code>run_process()</code>) ignoring the <code>extra_groups</code> argument, as it mistakenly passed the value of the <code>group</code> argument instead (<a href="https://redirect.github.com/agronholm/anyio/pull/1209">#1209</a>)</li> <li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and <code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising <code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on the <code>trio</code> backend when there are no tokens available (<a href="https://redirect.github.com/agronholm/anyio/pull/1218">#1218</a>)</li> <li>Fixed <code>CapacityLimiter</code> on the asyncio backend over-granting tokens (<code>borrowed_tokens</code> exceeding <code>total_tokens</code> and <code>available_tokens</code> going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises <code>WouldBlock</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1170">#1170</a>; PR by <a href="https://github.com/gaoflow"><code>@gaoflow</code></a>)</li> <li>Fixed unnecessary CPU spin when delivering cancellation from <code>CancelScope</code> on asyncio under certain conditions, including improper cancel scope nesting (<a href="https://redirect.github.com/agronholm/anyio/issues/1111">#1111</a>)</li> </ul> <h2>4.14.1</h2> <ul> <li>Fixed teardown of higher-scoped async fixtures failing on asyncio with <code>RuntimeError: Attempted to exit cancel scope in a different task than it was entered in</code> when an async test raise an outcome exception (e.g., <code>pytest.skip()</code>, <code>pytest.xfail()</code>, or <code>pytest.fail()</code>) (<a href="https://redirect.github.com/agronholm/anyio/issues/1179">#1179</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting a value of <code>0</code> when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (<a href="https://redirect.github.com/agronholm/anyio/pull/1183">#1183</a>; PR by <a href="https://github.com/nyxst4ck"><code>@nyxst4ck</code></a>)</li> </ul> <h2>4.14.0</h2> <ul> <li> <p>Added support for Python 3.15</p> </li> <li> <p>Added an asynchronous implementation of the <code>itertools</code> module (<a href="https://redirect.github.com/agronholm/anyio/issues/998">#998</a>; PR by <a href="https://github.com/11kkw"><code>@11kkw</code></a>)</p> </li> <li> <p>Added the <code>local_port</code> parameter to <code>connect_tcp()</code> to allow binding to a specific local port before connecting (<a href="https://redirect.github.com/agronholm/anyio/issues/1067">#1067</a>; PR by <a href="https://github.com/nullwiz"><code>@nullwiz</code></a>)</p> </li> <li> <p>Added support for custom capacity limiters in async path and file I/O functions and classes</p> </li> <li> <p>Added the <code>create_task()</code> task group method for easier asyncio migration (returns a <code>TaskHandle</code>) (<a href="https://redirect.github.com/agronholm/anyio/pull/1098">#1098</a>)</p> </li> <li> <p>Changed <code>TaskGroup.start_soon()</code> to return a <code>TaskHandle</code></p> </li> <li> <p>Added an option for <code>TaskGroup.start()</code> to return a <code>TaskHandle</code> (which then contains the start value in the <code>start_value</code> property)</p> </li> <li> <p>Added the <code>cancel()</code> convenience method to <code>TaskGroup</code> as a shortcut for cancelling the task group's cancel scope</p> </li> <li> <p>Improved the error message when a known backend is not installed to suggest the install command (<a href="https://redirect.github.com/agronholm/anyio/pull/1115">#1115</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Improved <code>anyio.Path</code> to preserve subclass types by returning <code>Self</code> in methods that return path objects (<a href="https://redirect.github.com/agronholm/anyio/issues/1130">#1130</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Changed the parameter type annotation in <code>anyio.Path.write_bytes()</code> to accept any <code>ReadableBuffer</code>, thus allowing it to accept <code>bytearray</code> and <code>memoryview</code> to match <code>pathlib.Path.write_bytes()</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1135">#1135</a>; PR by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a>)</p> </li> <li> <p>Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:</p> <ul> <li><code>TaskGroup.start_soon()</code></li> <li><code>TaskGroup.start()</code></li> <li><code>anyio.from_thread.run()</code></li> </ul> <p>This reverts an earlier change from v3.7.0 which was made in error. (<a href="https://redirect.github.com/agronholm/anyio/pull/1153">#1153</a>)</p> </li> <li> <p>Changed <code>anyio.run</code> to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (<a href="https://redirect.github.com/agronholm/anyio/pull/1171">#1171</a>; PR by <a href="https://github.com/gschaffner"><code>@gschaffner</code></a>)</p> </li> <li> <p>Changed several classes (and their subclasses) to have <code>__slots__</code> (with <code>__weakref__</code>):</p> <ul> <li><code>anyio.CancelScope</code></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71"><code>c384f99</code></a> Bumped up the version</li> <li><a href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a"><code>dbba29d</code></a> Fixed 100% CPU spin on cancel scope misuse (<a href="https://redirect.github.com/agronholm/anyio/issues/1217">#1217</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8"><code>6bbc6c3</code></a> Fix CapacityLimiter over-granting tokens on asyncio (<a href="https://redirect.github.com/agronholm/anyio/issues/1172">#1172</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b"><code>6f82b25</code></a> Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky</li> <li><a href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e"><code>be24b04</code></a> Relaxed timeouts to fix test flakiness</li> <li><a href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf"><code>8113506</code></a> Fix test flakiness caused by slow callback duration logging</li> <li><a href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f"><code>1e988b6</code></a> Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1">#1</a>...</li> <li><a href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62"><code>44713f3</code></a> Pin setup-uv to a commit sha across downstream jobs (<a href="https://redirect.github.com/agronholm/anyio/issues/1213">#1213</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"><code>f1b7301</code></a> Fixed stderr writes in a worker subprocess causing a deadlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1207">#1207</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90"><code>212be93</code></a> Fix flaky test_tcp_listener_same_port using a hardcoded port (<a href="https://redirect.github.com/agronholm/anyio/issues/1206">#1206</a>)</li> <li>Additional commits viewable in <a href="https://github.com/agronholm/anyio/compare/4.12.1...4.14.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
d7b99cc3ab |
chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/sdk-py (#8994)
Bumps [anyio](https://github.com/agronholm/anyio) from 4.12.1 to 4.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/agronholm/anyio/releases">anyio's releases</a>.</em></p> <blockquote> <h2>4.14.2</h2> <ul> <li>Changed <code>ByteReceiveStream.receive()</code> implementations to raise a <code>ValueError</code> when <code>max_bytes</code> is not a positive integer (<a href="https://redirect.github.com/agronholm/anyio/pull/1191">#1191</a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting <code>float("inf")</code> when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (<code>value is math.inf</code>), so only the exact <code>math.inf</code> singleton was accepted, while every backend setter (using <code>math.isinf()</code>) accepts any positive infinity (<a href="https://redirect.github.com/agronholm/anyio/pull/1189">#1189</a>; PR by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker function writes enough data to <code>sys.stderr</code> to fill the (undrained) pipe buffer. The worker process now redirects <code>sys.stderr</code> to <code>os.devnull</code> as well, matching the documented behavior</li> <li>Fixed <code>TLSStream.wrap()</code> matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (<a href="https://redirect.github.com/agronholm/anyio/pull/1208">#1208</a>)</li> <li>Fixed <code>anyio.open_process()</code> (and <code>run_process()</code>) ignoring the <code>extra_groups</code> argument, as it mistakenly passed the value of the <code>group</code> argument instead (<a href="https://redirect.github.com/agronholm/anyio/pull/1209">#1209</a>)</li> <li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and <code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising <code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on the <code>trio</code> backend when there are no tokens available (<a href="https://redirect.github.com/agronholm/anyio/pull/1218">#1218</a>)</li> <li>Fixed <code>CapacityLimiter</code> on the asyncio backend over-granting tokens (<code>borrowed_tokens</code> exceeding <code>total_tokens</code> and <code>available_tokens</code> going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises <code>WouldBlock</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1170">#1170</a>; PR by <a href="https://github.com/gaoflow"><code>@gaoflow</code></a>)</li> <li>Fixed unnecessary CPU spin when delivering cancellation from <code>CancelScope</code> on asyncio under certain conditions, including improper cancel scope nesting (<a href="https://redirect.github.com/agronholm/anyio/issues/1111">#1111</a>)</li> </ul> <h2>4.14.1</h2> <ul> <li>Fixed teardown of higher-scoped async fixtures failing on asyncio with <code>RuntimeError: Attempted to exit cancel scope in a different task than it was entered in</code> when an async test raise an outcome exception (e.g., <code>pytest.skip()</code>, <code>pytest.xfail()</code>, or <code>pytest.fail()</code>) (<a href="https://redirect.github.com/agronholm/anyio/issues/1179">#1179</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting a value of <code>0</code> when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (<a href="https://redirect.github.com/agronholm/anyio/pull/1183">#1183</a>; PR by <a href="https://github.com/nyxst4ck"><code>@nyxst4ck</code></a>)</li> </ul> <h2>4.14.0</h2> <ul> <li> <p>Added support for Python 3.15</p> </li> <li> <p>Added an asynchronous implementation of the <code>itertools</code> module (<a href="https://redirect.github.com/agronholm/anyio/issues/998">#998</a>; PR by <a href="https://github.com/11kkw"><code>@11kkw</code></a>)</p> </li> <li> <p>Added the <code>local_port</code> parameter to <code>connect_tcp()</code> to allow binding to a specific local port before connecting (<a href="https://redirect.github.com/agronholm/anyio/issues/1067">#1067</a>; PR by <a href="https://github.com/nullwiz"><code>@nullwiz</code></a>)</p> </li> <li> <p>Added support for custom capacity limiters in async path and file I/O functions and classes</p> </li> <li> <p>Added the <code>create_task()</code> task group method for easier asyncio migration (returns a <code>TaskHandle</code>) (<a href="https://redirect.github.com/agronholm/anyio/pull/1098">#1098</a>)</p> </li> <li> <p>Changed <code>TaskGroup.start_soon()</code> to return a <code>TaskHandle</code></p> </li> <li> <p>Added an option for <code>TaskGroup.start()</code> to return a <code>TaskHandle</code> (which then contains the start value in the <code>start_value</code> property)</p> </li> <li> <p>Added the <code>cancel()</code> convenience method to <code>TaskGroup</code> as a shortcut for cancelling the task group's cancel scope</p> </li> <li> <p>Improved the error message when a known backend is not installed to suggest the install command (<a href="https://redirect.github.com/agronholm/anyio/pull/1115">#1115</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Improved <code>anyio.Path</code> to preserve subclass types by returning <code>Self</code> in methods that return path objects (<a href="https://redirect.github.com/agronholm/anyio/issues/1130">#1130</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Changed the parameter type annotation in <code>anyio.Path.write_bytes()</code> to accept any <code>ReadableBuffer</code>, thus allowing it to accept <code>bytearray</code> and <code>memoryview</code> to match <code>pathlib.Path.write_bytes()</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1135">#1135</a>; PR by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a>)</p> </li> <li> <p>Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:</p> <ul> <li><code>TaskGroup.start_soon()</code></li> <li><code>TaskGroup.start()</code></li> <li><code>anyio.from_thread.run()</code></li> </ul> <p>This reverts an earlier change from v3.7.0 which was made in error. (<a href="https://redirect.github.com/agronholm/anyio/pull/1153">#1153</a>)</p> </li> <li> <p>Changed <code>anyio.run</code> to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (<a href="https://redirect.github.com/agronholm/anyio/pull/1171">#1171</a>; PR by <a href="https://github.com/gschaffner"><code>@gschaffner</code></a>)</p> </li> <li> <p>Changed several classes (and their subclasses) to have <code>__slots__</code> (with <code>__weakref__</code>):</p> <ul> <li><code>anyio.CancelScope</code></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71"><code>c384f99</code></a> Bumped up the version</li> <li><a href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a"><code>dbba29d</code></a> Fixed 100% CPU spin on cancel scope misuse (<a href="https://redirect.github.com/agronholm/anyio/issues/1217">#1217</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8"><code>6bbc6c3</code></a> Fix CapacityLimiter over-granting tokens on asyncio (<a href="https://redirect.github.com/agronholm/anyio/issues/1172">#1172</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b"><code>6f82b25</code></a> Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky</li> <li><a href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e"><code>be24b04</code></a> Relaxed timeouts to fix test flakiness</li> <li><a href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf"><code>8113506</code></a> Fix test flakiness caused by slow callback duration logging</li> <li><a href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f"><code>1e988b6</code></a> Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1">#1</a>...</li> <li><a href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62"><code>44713f3</code></a> Pin setup-uv to a commit sha across downstream jobs (<a href="https://redirect.github.com/agronholm/anyio/issues/1213">#1213</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"><code>f1b7301</code></a> Fixed stderr writes in a worker subprocess causing a deadlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1207">#1207</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90"><code>212be93</code></a> Fix flaky test_tcp_listener_same_port using a hardcoded port (<a href="https://redirect.github.com/agronholm/anyio/issues/1206">#1206</a>)</li> <li>Additional commits viewable in <a href="https://github.com/agronholm/anyio/compare/4.12.1...4.14.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
b19edd783b |
chore(deps): bump anyio from 4.12.1 to 4.14.2 in /libs/checkpoint-sqlite (#8993)
Bumps [anyio](https://github.com/agronholm/anyio) from 4.12.1 to 4.14.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/agronholm/anyio/releases">anyio's releases</a>.</em></p> <blockquote> <h2>4.14.2</h2> <ul> <li>Changed <code>ByteReceiveStream.receive()</code> implementations to raise a <code>ValueError</code> when <code>max_bytes</code> is not a positive integer (<a href="https://redirect.github.com/agronholm/anyio/pull/1191">#1191</a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting <code>float("inf")</code> when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (<code>value is math.inf</code>), so only the exact <code>math.inf</code> singleton was accepted, while every backend setter (using <code>math.isinf()</code>) accepts any positive infinity (<a href="https://redirect.github.com/agronholm/anyio/pull/1189">#1189</a>; PR by <a href="https://github.com/greymoth-jp"><code>@greymoth-jp</code></a>).</li> <li>Fixed <code>to_process.run_sync()</code> deadlocking when the worker function writes enough data to <code>sys.stderr</code> to fill the (undrained) pipe buffer. The worker process now redirects <code>sys.stderr</code> to <code>os.devnull</code> as well, matching the documented behavior</li> <li>Fixed <code>TLSStream.wrap()</code> matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (<a href="https://redirect.github.com/agronholm/anyio/pull/1208">#1208</a>)</li> <li>Fixed <code>anyio.open_process()</code> (and <code>run_process()</code>) ignoring the <code>extra_groups</code> argument, as it mistakenly passed the value of the <code>group</code> argument instead (<a href="https://redirect.github.com/agronholm/anyio/pull/1209">#1209</a>)</li> <li>Fixed <code>CapacityLimiter.acquire_nowait()</code> and <code>CapacityLimiter.acquire_nowait_on_behalf_of()</code> raising <code>trio.WouldBlock</code> instead of <code>anyio.WouldBlock</code> on the <code>trio</code> backend when there are no tokens available (<a href="https://redirect.github.com/agronholm/anyio/pull/1218">#1218</a>)</li> <li>Fixed <code>CapacityLimiter</code> on the asyncio backend over-granting tokens (<code>borrowed_tokens</code> exceeding <code>total_tokens</code> and <code>available_tokens</code> going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises <code>WouldBlock</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1170">#1170</a>; PR by <a href="https://github.com/gaoflow"><code>@gaoflow</code></a>)</li> <li>Fixed unnecessary CPU spin when delivering cancellation from <code>CancelScope</code> on asyncio under certain conditions, including improper cancel scope nesting (<a href="https://redirect.github.com/agronholm/anyio/issues/1111">#1111</a>)</li> </ul> <h2>4.14.1</h2> <ul> <li>Fixed teardown of higher-scoped async fixtures failing on asyncio with <code>RuntimeError: Attempted to exit cancel scope in a different task than it was entered in</code> when an async test raise an outcome exception (e.g., <code>pytest.skip()</code>, <code>pytest.xfail()</code>, or <code>pytest.fail()</code>) (<a href="https://redirect.github.com/agronholm/anyio/issues/1179">#1179</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</li> <li>Fixed <code>CapacityLimiter.total_tokens</code> rejecting a value of <code>0</code> when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (<a href="https://redirect.github.com/agronholm/anyio/pull/1183">#1183</a>; PR by <a href="https://github.com/nyxst4ck"><code>@nyxst4ck</code></a>)</li> </ul> <h2>4.14.0</h2> <ul> <li> <p>Added support for Python 3.15</p> </li> <li> <p>Added an asynchronous implementation of the <code>itertools</code> module (<a href="https://redirect.github.com/agronholm/anyio/issues/998">#998</a>; PR by <a href="https://github.com/11kkw"><code>@11kkw</code></a>)</p> </li> <li> <p>Added the <code>local_port</code> parameter to <code>connect_tcp()</code> to allow binding to a specific local port before connecting (<a href="https://redirect.github.com/agronholm/anyio/issues/1067">#1067</a>; PR by <a href="https://github.com/nullwiz"><code>@nullwiz</code></a>)</p> </li> <li> <p>Added support for custom capacity limiters in async path and file I/O functions and classes</p> </li> <li> <p>Added the <code>create_task()</code> task group method for easier asyncio migration (returns a <code>TaskHandle</code>) (<a href="https://redirect.github.com/agronholm/anyio/pull/1098">#1098</a>)</p> </li> <li> <p>Changed <code>TaskGroup.start_soon()</code> to return a <code>TaskHandle</code></p> </li> <li> <p>Added an option for <code>TaskGroup.start()</code> to return a <code>TaskHandle</code> (which then contains the start value in the <code>start_value</code> property)</p> </li> <li> <p>Added the <code>cancel()</code> convenience method to <code>TaskGroup</code> as a shortcut for cancelling the task group's cancel scope</p> </li> <li> <p>Improved the error message when a known backend is not installed to suggest the install command (<a href="https://redirect.github.com/agronholm/anyio/pull/1115">#1115</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Improved <code>anyio.Path</code> to preserve subclass types by returning <code>Self</code> in methods that return path objects (<a href="https://redirect.github.com/agronholm/anyio/issues/1130">#1130</a>; PR by <a href="https://github.com/EmmanuelNiyonshuti"><code>@EmmanuelNiyonshuti</code></a>)</p> </li> <li> <p>Changed the parameter type annotation in <code>anyio.Path.write_bytes()</code> to accept any <code>ReadableBuffer</code>, thus allowing it to accept <code>bytearray</code> and <code>memoryview</code> to match <code>pathlib.Path.write_bytes()</code> (<a href="https://redirect.github.com/agronholm/anyio/issues/1135">#1135</a>; PR by <a href="https://github.com/SAY-5"><code>@SAY-5</code></a>)</p> </li> <li> <p>Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:</p> <ul> <li><code>TaskGroup.start_soon()</code></li> <li><code>TaskGroup.start()</code></li> <li><code>anyio.from_thread.run()</code></li> </ul> <p>This reverts an earlier change from v3.7.0 which was made in error. (<a href="https://redirect.github.com/agronholm/anyio/pull/1153">#1153</a>)</p> </li> <li> <p>Changed <code>anyio.run</code> to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (<a href="https://redirect.github.com/agronholm/anyio/pull/1171">#1171</a>; PR by <a href="https://github.com/gschaffner"><code>@gschaffner</code></a>)</p> </li> <li> <p>Changed several classes (and their subclasses) to have <code>__slots__</code> (with <code>__weakref__</code>):</p> <ul> <li><code>anyio.CancelScope</code></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/agronholm/anyio/commit/c384f99687c64c59ed8a11c3a0f11a2d57daff71"><code>c384f99</code></a> Bumped up the version</li> <li><a href="https://github.com/agronholm/anyio/commit/dbba29d1ade7936f18fb71ba24aa92978673482a"><code>dbba29d</code></a> Fixed 100% CPU spin on cancel scope misuse (<a href="https://redirect.github.com/agronholm/anyio/issues/1217">#1217</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6bbc6c33caabc13af5bc4256f745027cf8d5d7b8"><code>6bbc6c3</code></a> Fix CapacityLimiter over-granting tokens on asyncio (<a href="https://redirect.github.com/agronholm/anyio/issues/1172">#1172</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/6f82b2537cbbe98f3df3f295499056ab7de0b15b"><code>6f82b25</code></a> Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky</li> <li><a href="https://github.com/agronholm/anyio/commit/be24b0414f67f604bcbdd5ea3bcc56ab920d872e"><code>be24b04</code></a> Relaxed timeouts to fix test flakiness</li> <li><a href="https://github.com/agronholm/anyio/commit/81135065749b4f60c06619b9caaf0a11871c1ddf"><code>8113506</code></a> Fix test flakiness caused by slow callback duration logging</li> <li><a href="https://github.com/agronholm/anyio/commit/1e988b617b69588e33fecb75e36a9837245f562f"><code>1e988b6</code></a> Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1">#1</a>...</li> <li><a href="https://github.com/agronholm/anyio/commit/44713f345cd29dd4e7d76553c134543a1296cc62"><code>44713f3</code></a> Pin setup-uv to a commit sha across downstream jobs (<a href="https://redirect.github.com/agronholm/anyio/issues/1213">#1213</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"><code>f1b7301</code></a> Fixed stderr writes in a worker subprocess causing a deadlock (<a href="https://redirect.github.com/agronholm/anyio/issues/1207">#1207</a>)</li> <li><a href="https://github.com/agronholm/anyio/commit/212be93c2cf2c841e753e95e5e2c543ee7feca90"><code>212be93</code></a> Fix flaky test_tcp_listener_same_port using a hardcoded port (<a href="https://redirect.github.com/agronholm/anyio/issues/1206">#1206</a>)</li> <li>Additional commits viewable in <a href="https://github.com/agronholm/anyio/compare/4.12.1...4.14.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
c81c13533e |
chore(deps): bump soupsieve from 2.8.4 to 2.9 in /libs/langgraph (#8958)
Bumps [soupsieve](https://github.com/facelessuser/soupsieve) from 2.8.4 to 2.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/facelessuser/soupsieve/releases">soupsieve's releases</a>.</em></p> <blockquote> <h2>2.9</h2> <ul> <li><strong>NEW</strong>: Drop Python 3.9 support.</li> <li><strong>NEW</strong>: Lazy compile selector patterns to improve initial import speed.</li> <li><strong>FIX</strong>: Correct <code>:nth-child</code>/<code>:nth-of-type</code> (and <code>-last-</code> variants) for <code>An+B</code> values whose sequence steps onto index 0 or onto the last child (e.g. <code>:nth-child(2n-2)</code>, <code>:nth-child(n-1)</code>, <code>:nth-child(n+5)</code>), which previously matched the wrong elements or nothing at all (<a href="https://github.com/gaoflow"><code>@gaoflow</code></a>).</li> <li><strong>FIX</strong>: More efficient CSS ID matching (<a href="https://github.com/kaimandalic"><code>@kaimandalic</code></a>).</li> <li><strong>FIX</strong>: Fix inefficient trimming of comments and white space (<a href="https://github.com/kaimandalic"><code>@kaimandalic</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/facelessuser/soupsieve/commit/8763f914472fc83652babda708bed5c8ef287004"><code>8763f91</code></a> Format changelog message</li> <li><a href="https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda"><code>cf198fc</code></a> Fix inefficient trimming of comments and white space</li> <li><a href="https://github.com/facelessuser/soupsieve/commit/ce44e4996e6632871c18cdd7a7fb641be8ef34ef"><code>ce44e49</code></a> Merge commit from fork</li> <li><a href="https://github.com/facelessuser/soupsieve/commit/751c57b2c7e978e206b94b7dba17f8e2af392e19"><code>751c57b</code></a> Fix :nth-child/:nth-of-type matching for An+B index boundaries (<a href="https://redirect.github.com/facelessuser/soupsieve/issues/297">#297</a>)</li> <li><a href="https://github.com/facelessuser/soupsieve/commit/08e9ede4dcfafef860155319ef5eb9708e75d10b"><code>08e9ede</code></a> Drop Python 3.9</li> <li><a href="https://github.com/facelessuser/soupsieve/commit/d6e68303a6c3e0e410530939b92955ba24a07a81"><code>d6e6830</code></a> Rework selector mapping</li> <li><a href="https://github.com/facelessuser/soupsieve/commit/d2d1581fe275f89cb2e792589fed770aeb9e99b3"><code>d2d1581</code></a> Utilize property for accessing lazy regular expression pattern</li> <li><a href="https://github.com/facelessuser/soupsieve/commit/b8701dec25c84a3910fd9a03222a3804fa119a1d"><code>b8701de</code></a> Build patterns and regexes lazily in css_parser (<a href="https://redirect.github.com/facelessuser/soupsieve/issues/296">#296</a>)</li> <li>See full diff in <a href="https://github.com/facelessuser/soupsieve/compare/2.8.4...2.9">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Elior Nataf LackritzandGitHub
|
448a763779 |
feat(langgraph): add response_schema to interrupt() (#8886)
Adds an optional keyword-only `response_schema` to `interrupt()`, carried on `Interrupt.response_schema` as JSON Schema so clients (LangGraph Studio first) can render a typed form for the resume value instead of a free-form JSON box. Default `None`, so nothing changes for existing graphs. - Accepts a JSON Schema dict (passed through, not validated) or a Pydantic model / `TypedDict` / dataclass, converted with `TypeAdapter.json_schema()`. For those, the resume value is validated and the validated object is what `interrupt()` returns; an invalid value raises from the node before it is committed, so the next resume works. - Additive on the `stream_mode="debug"` payload: interrupt dicts gain `response_schema` (it is a dataclass field, serialized with `asdict`). - `libs/sdk-py`: mirrors the field on the `Interrupt` TypedDict as `NotRequired`; the server omits the key when no schema was given. JS counterpart: langchain-ai/langgraphjs#2824. Verified: new tests parametrized across every checkpointer backend (schema kinds, coercion, invalid resume) plus the full `libs/langgraph` suite and downstream `prebuilt`, `cli`, `sdk-py`; round-tripped end to end through the agent server with this branch installed. |
||
|
Lauren Hirata SinghandGitHub
|
230927fb3a |
docs: publish the generated llms.txt instead of a hand-written copy (#8922)
## Why `docs/llms.txt` is written by hand and was last touched in February, so the index served at <https://langchain-ai.github.io/langgraph/llms.txt> had drifted badly: - 12 pages listed, against the 43 the docs site publishes. - One entry, `/oss/python/langgraph/why-langgraph`, now 404s. The deploy workflow only fires on `docs/**` pushes, so nothing brought the file back in line as the docs site changed. It is served verbatim: `generate_redirects.py` copies it into `docs/_site` via a `static_files` list, and `deploy-redirects.yml` uploads that directory to Pages. The docs site already generates exactly this index, and regenerates it on every deploy: ``` https://docs.langchain.com/oss/python/langgraph/llms.txt ``` ## What changed `generate_redirects.py` now fetches that index at build time and writes it into `_site`, so the published file cannot drift from the docs site. The committed `docs/llms.txt` stays as a fallback only, refreshed here to current content. `deploy-redirects.yml` gains a weekly `schedule:` trigger, so docs changes that never touch this repo still reach the deployed file. The `permissions:` block is unchanged. ## Fetching remote content in CI The fetched body is published on a public Pages site, so it is validated before it is written: - The URL is a hardcoded module constant, never built from input. - Both that URL and the post-redirect `response.url` are checked against an HTTPS-plus-single-host allowlist. `urlopen` follows redirects, so checking only the request URL would not be enough. - 30 second timeout, response capped at 1MB, decoded as UTF-8. - The body must open with a markdown heading and contain a docs.langchain.com link, which rejects an error page or a truncated response. Any failure returns `None` and falls back to the committed copy, so a docs.langchain.com outage degrades to a stale file rather than a broken deploy or a published error page. ## Verification Ran `python docs/generate_redirects.py`: 294 redirect files, `llms.txt` fetched, 43 entries. Each rejection path was exercised against a stubbed `urlopen` and all fall back to the committed file: | Case | Result | |---|---| | Network error | falls back | | Timeout | falls back | | Redirect to another host | falls back | | Body over 1MB | falls back | | Invalid UTF-8 | falls back | | HTML error page | falls back | | Empty body | falls back | | Valid index | published | Allowlist rejects `http://docs.langchain.com/...`, `https://evil.com/...`, and `https://docs.langchain.com.evil.com/...`. ## Note on ordering The fallback committed here is labelled "LangGraph (Python)", which is what the docs site will serve once langchain-ai/docs#6032 deploys. Until then the fetched file reads "Open source (Python)". No action needed; it self-corrects. --- Written with Claude Code; I reviewed the diff and ran the verification above. |
||
|
|
e539ac122f |
chore(deps): fix vulnerable dev dependencies (#8449)
## Summary Patch both `js-yaml` release lines in `libs/cli/js-examples` for GHSA-2883-xcg3-v3hh: Jest's transitive copy to 3.15.2 and ESLint's to 4.3.2. Updates the existing fix rather than opening a duplicate; no runtime dependencies added and no major-version overrides. Addresses Dependabot alerts [#398](https://github.com/langchain-ai/langgraph/security/dependabot/398) and [#397](https://github.com/langchain-ai/langgraph/security/dependabot/397). These are real vulnerable versions in example development tooling; patch rather than dismiss. Alerts remain open until this reaches `main` and GitHub rescans. ## Verification - [x] Yarn 1.22.22 regenerated the lockfile with lifecycle scripts disabled; diff limited to the two js-yaml entries and scoped resolutions. - [x] `yarn install --frozen-lockfile --ignore-scripts --force --non-interactive` in `libs/cli/js-examples`. - [x] `yarn why js-yaml`: ESLint 4.3.2 and Jest/Istanbul 3.15.2. - [x] Resolved versions checked against freshly retrieved GitHub advisory patched versions for both alerts. - [x] `yarn format:check` and `git diff --check`. - [ ] Build fails in unchanged `tests/graph.int.test.ts:7`: `input` is not a valid update property (also recorded in the earlier PR verification). - [ ] Unit-test script fails because it uses Jest's removed `--testPathPattern` option; Jest requires `--testPathPatterns`. - [ ] Lint fails because ESLint 10 requires `eslint.config.*`, which this example lacks. The build/test/lint configuration issues are outside this scoped dependency patch and remain unresolved. No full test-pass claim. --------- Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com> |
||
|
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>John Kennedy |
ff4529380d |
chore(deps): bump httpx2 from 2.10.0 to 2.12.0 in /libs/cli (#8863)
Bumps [httpx2](https://github.com/pydantic/httpx2) from 2.10.0 to 2.12.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/httpx2/releases">httpx2's releases</a>.</em></p> <blockquote> <h2>v2.12.0</h2> <h2>Highlights</h2> <h3>🛡️ Bounded response decompression</h3> <p><code>httpx2</code> now decodes <code>gzip</code>, <code>deflate</code>, Brotli, and Zstandard responses incrementally. Each decode step emits at most 1 MiB, so streaming a highly compressed response no longer requires materializing an entire inflated network chunk in memory (<a href="https://redirect.github.com/pydantic/httpx2/pull/1126">pydantic/httpx2#1126</a>).</p> <h3>📦 Shared Zstandard API</h3> <p>Python 3.13 and earlier now use <code>backports.zstd</code>, which provides the same bounded incremental decompression API as <code>compression.zstd</code> on Python 3.14 and later (<a href="https://redirect.github.com/pydantic/httpx2/pull/1146">pydantic/httpx2#1146</a>).</p> <h2>httpx2</h2> <h3>Changed</h3> <ul> <li>Use <code>backports.zstd</code> for Zstandard decoding on Python 3.13 and earlier by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1146">pydantic/httpx2#1146</a></li> </ul> <h3>Fixed</h3> <ul> <li>Bound peak memory while streaming compressed responses and close response streams when decoding fails by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1126">pydantic/httpx2#1126</a></li> </ul> <h2>httpcore2</h2> <p>No changes since <code>2.11.0</code>. Version bumped to stay in lockstep with <code>httpx2</code>.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/httpx2/compare/v2.11.0...v2.12.0">https://github.com/pydantic/httpx2/compare/v2.11.0...v2.12.0</a></p> <h2>v2.11.0</h2> <h2>Highlights</h2> <h3>🌐 Public origin API</h3> <p><code>httpx2</code> now includes an immutable and hashable <code>Origin</code> value object, available through <code>URL.origin</code>. It provides normalized scheme, host, and effective port comparisons without including URL paths, queries, fragments, or credentials (<a href="https://redirect.github.com/pydantic/httpx2/pull/1134">pydantic/httpx2#1134</a>).</p> <h3>🛠️ Request compatibility and validation</h3> <ul> <li>Explicit <code>Transfer-Encoding</code> headers now take precedence over body-derived <code>Content-Length</code> headers (<a href="https://redirect.github.com/pydantic/httpx2/pull/1137">pydantic/httpx2#1137</a>).</li> <li>Deprecated status code aliases are available again (<a href="https://redirect.github.com/pydantic/httpx2/pull/1135">pydantic/httpx2#1135</a>).</li> <li>Multipart part headers are validated before serialization (<a href="https://redirect.github.com/pydantic/httpx2/pull/1142">pydantic/httpx2#1142</a>).</li> </ul> <h2>httpx2</h2> <h3>Added</h3> <ul> <li>Add the public <code>Origin</code> value object and <code>URL.origin</code> property by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1134">pydantic/httpx2#1134</a></li> </ul> <h3>Changed</h3> <ul> <li>Require Brotli 1.2.0 or later for the <code>brotli</code> extra by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1141">pydantic/httpx2#1141</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pydantic/httpx2/blob/main/src/httpx2/CHANGELOG.md">httpx2's changelog</a>.</em></p> <blockquote> <h2>2.12.0 (August 18th, 2026)</h2> <h3>Changed</h3> <ul> <li>Use <code>backports.zstd</code> for Zstandard decoding on Python 3.13 and earlier. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1146">#1146</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Bound peak memory while streaming compressed responses and close response streams when decoding fails. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1126">#1126</a>)</li> </ul> <h2>2.11.0 (August 18th, 2026)</h2> <h3>Added</h3> <ul> <li>Add the public <code>Origin</code> value object and <code>URL.origin</code> property for normalized, hashable origin comparisons. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1134">#1134</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Require Brotli 1.2.0 or later for the <code>brotli</code> extra. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1141">#1141</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Restore deprecated status code aliases. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1135">#1135</a>)</li> <li>Extract HTTP/2 release notes from changelog headings correctly. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1136">#1136</a>)</li> <li>Respect explicit <code>Transfer-Encoding</code> headers and expose buffered request body lengths to WSGI applications. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1137">#1137</a>)</li> <li>Validate multipart part header names and values before serialization. (<a href="https://redirect.github.com/pydantic/httpx2/pull/1142">#1142</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/httpx2/commit/71ae23be5448f859c2b4e21d9972ddfa7b8d759d"><code>71ae23b</code></a> Version 2.12.0 (<a href="https://redirect.github.com/pydantic/httpx2/issues/1147">#1147</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/4fd0c70a3f207c618b145934792f791bccfb39f8"><code>4fd0c70</code></a> Decode compressed response bodies incrementally (<a href="https://redirect.github.com/pydantic/httpx2/issues/1126">#1126</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/d588e528a11eb20323031ee571fadc668bb81b3f"><code>d588e52</code></a> Use <code>backports.zstd</code> on Python 3.13 and earlier (<a href="https://redirect.github.com/pydantic/httpx2/issues/1146">#1146</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/344589da2a992f7e5a0c25c68cc78c25ec6d70bd"><code>344589d</code></a> Version 2.11.0 (<a href="https://redirect.github.com/pydantic/httpx2/issues/1143">#1143</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/de96d810ee4e309d118982fe7084a46a2bcd600d"><code>de96d81</code></a> Validate multipart part headers (<a href="https://redirect.github.com/pydantic/httpx2/issues/1142">#1142</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/51c32698ce029140cb69a26921d017e3edda80fa"><code>51c3269</code></a> Require brotli 1.2.0 in the brotli extra (<a href="https://redirect.github.com/pydantic/httpx2/issues/1141">#1141</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/829b93a2393212996f613e635261f777d9ec6eab"><code>829b93a</code></a> Respect explicit Transfer-Encoding headers (<a href="https://redirect.github.com/pydantic/httpx2/issues/1137">#1137</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/4fa6c8ee96fb79035c6820e4f44a10b6262d9c9f"><code>4fa6c8e</code></a> Fix changelog extraction regex for H2 release headings (<a href="https://redirect.github.com/pydantic/httpx2/issues/1136">#1136</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/8a6f37063514ee2a2601607c20be72667fdfa3be"><code>8a6f370</code></a> Restore deprecated status code aliases (<a href="https://redirect.github.com/pydantic/httpx2/issues/1135">#1135</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/d03f1ec6a1a323f951a8c21cd14f9c02f2d1e855"><code>d03f1ec</code></a> Add public Origin API (<a href="https://redirect.github.com/pydantic/httpx2/issues/1134">#1134</a>)</li> <li>See full diff in <a href="https://github.com/pydantic/httpx2/compare/v2.10.0...v2.12.0">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com> |
||
|
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>John Kennedyopen-swe[bot] <open-swe@users.noreply.github.com> |
c0b884e6d8 |
chore(deps): bump js-yaml from 4.3.1 to 4.3.2 in /libs/cli/js-monorepo-example (#8867)
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.1 to 4.3.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>4.3.2 - 2026-08-26</h2> <h3>Changed</h3> <ul> <li>[backport] Hard-limit merge sequence size to 100.</li> </ul> <h3>Security</h3> <ul> <li>[backport] Count empty mappings in merge sequences toward <code>maxTotalMergeKeys</code> to limit CPU usage, <a href="https://redirect.github.com/nodeca/js-yaml/issues/797">#797</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodeca/js-yaml/commit/79ca68d90f333fbe6d9e42827527e62636200191"><code>79ca68d</code></a> 4.3.2 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b"><code>d90b661</code></a> Backport merge limits from v5.4.1</li> <li>See full diff in <a href="https://github.com/nodeca/js-yaml/compare/4.3.1...4.3.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
|
3299a1f563 |
chore(deps): bump httpcore2 from 2.5.0 to 2.10.0 in /libs/cli (#8864)
Bumps [httpcore2](https://github.com/pydantic/httpx2) from 2.5.0 to 2.10.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/httpx2/releases">httpcore2's releases</a>.</em></p> <blockquote> <h2>v2.10.0</h2> <h2>Highlights</h2> <h3>🚀 Performance and memory improvements</h3> <ul> <li>Sending large HTTP/2 request bodies no longer copies the body quadratically - sending a 256 MiB body went from ~36s to under 0.1s (<a href="https://redirect.github.com/pydantic/httpx2/pull/1127">pydantic/httpx2#1127</a>).</li> <li>SSE parsing is up to 35x faster on highly fragmented streams (<a href="https://redirect.github.com/pydantic/httpx2/pull/1117">pydantic/httpx2#1117</a>).</li> <li>Cookie extraction is now skipped for responses without a <code>Set-Cookie</code> header, making typical requests roughly 8% faster (<a href="https://redirect.github.com/pydantic/httpx2/pull/1107">pydantic/httpx2#1107</a>).</li> </ul> <h3>🕸️ WebAssembly / Emscripten support</h3> <p><code>httpx2</code> now runs on Pyodide / Emscripten, using a JavaScript <code>fetch</code>-based transport defined in <code>httpx2-jsfetch</code> (<a href="https://redirect.github.com/pydantic/httpx2/pull/1119">pydantic/httpx2#1119</a>, <a href="https://redirect.github.com/pydantic/httpx2/pull/1114">pydantic/httpx2#1114</a>). Thanks <a href="https://github.com/hoodmane"><code>@hoodmane</code></a>!</p> <h2>httpx2</h2> <h3>Added</h3> <ul> <li>Add support for running on WebAssembly / Emscripten via Pyodide by <a href="https://github.com/hoodmane"><code>@hoodmane</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1119">pydantic/httpx2#1119</a></li> <li>Add <code>max_event_size</code> to cap SSE event buffering by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1071">pydantic/httpx2#1071</a></li> <li>Add RFC 9110 status code constants by <a href="https://github.com/mbeijen"><code>@mbeijen</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1069">pydantic/httpx2#1069</a></li> <li>Add support for Python 3.15 by <a href="https://github.com/hugovk"><code>@hugovk</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1090">pydantic/httpx2#1090</a></li> </ul> <h3>Changed</h3> <ul> <li>Improve SSE chunk buffering performance by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1117">pydantic/httpx2#1117</a></li> <li>Skip cookie extraction without <code>Set-Cookie</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1107">pydantic/httpx2#1107</a></li> <li>Return <code>str | None</code> instead of <code>Any</code> from <code>Headers.get</code> by <a href="https://github.com/ItsDrike"><code>@ItsDrike</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1121">pydantic/httpx2#1121</a></li> </ul> <h3>Fixed</h3> <ul> <li>Enforce WebSocket max message size across fragments by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1085">pydantic/httpx2#1085</a></li> <li>Ignore unsolicited and duplicate Pong frames by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1122">pydantic/httpx2#1122</a></li> </ul> <h2>httpcore2</h2> <h3>Added</h3> <ul> <li>Add support for Python 3.15 by <a href="https://github.com/hugovk"><code>@hugovk</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1090">pydantic/httpx2#1090</a></li> </ul> <h3>Changed</h3> <ul> <li>Avoid quadratic copying when sending large HTTP/2 request bodies by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1127">pydantic/httpx2#1127</a></li> </ul> <h3>Fixed</h3> <ul> <li>Propagate the original exception instead of raising <code>KeyError</code> when an HTTP/2 stream fails by <a href="https://github.com/yhay81"><code>@yhay81</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1093">pydantic/httpx2#1093</a></li> <li>Start TLS for the <code>wss</code> scheme in SOCKS5 proxy connections by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/pydantic/httpx2/pull/1104">pydantic/httpx2#1104</a></li> </ul> <h2>🙏 New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/httpx2/commit/a966320e75477b8c55ee78fdb8f57ead6a574cb0"><code>a966320</code></a> Version 2.10.0 (<a href="https://redirect.github.com/pydantic/httpx2/issues/1129">#1129</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/586f968f5510aa4d3b7edd1f1b039684c42945ee"><code>586f968</code></a> Avoid quadratic copying when sending large HTTP/2 request bodies (<a href="https://redirect.github.com/pydantic/httpx2/issues/1127">#1127</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/dee1d1ace3021404d0aa255957821eda97c94c43"><code>dee1d1a</code></a> Return <code>str | None</code> instead of <code>Any</code> from <code>Headers.get</code> (<a href="https://redirect.github.com/pydantic/httpx2/issues/1121">#1121</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/dec24ad57d1d337de7de23c011eb566a145e7b40"><code>dec24ad</code></a> Use <code>httpx2-jsfetch</code> on Emscripten (<a href="https://redirect.github.com/pydantic/httpx2/issues/1119">#1119</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/454b8b2197f62d699ff3ad762917643926b4da77"><code>454b8b2</code></a> Ignore unsolicited and duplicate Pong frames (<a href="https://redirect.github.com/pydantic/httpx2/issues/1122">#1122</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/cbfc0e04ef6507da29ccbb3b9c2e5b23dd693414"><code>cbfc0e0</code></a> Improve SSE chunk buffering performance (<a href="https://redirect.github.com/pydantic/httpx2/issues/1117">#1117</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/ad141d876c7d3c3f58555cbb0a178ec2c1f15b51"><code>ad141d8</code></a> Refactor SSE parser coordination (<a href="https://redirect.github.com/pydantic/httpx2/issues/1118">#1118</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/e0b01245e42d2091034ee9455cbb068bc0d6c0c6"><code>e0b0124</code></a> Make <code>_client</code> depend on the <code>_transports</code> package instead of its submodules ...</li> <li><a href="https://github.com/pydantic/httpx2/commit/e52f963c62f397f225c8d29573aedbe5ae613906"><code>e52f963</code></a> Skip dependencies not needed on Emscripten (<a href="https://redirect.github.com/pydantic/httpx2/issues/1114">#1114</a>)</li> <li><a href="https://github.com/pydantic/httpx2/commit/5d9eedc98186c612d0e426df417f78f6ec21e9ca"><code>5d9eedc</code></a> Add <code>max_event_size</code> to cap SSE event buffering (<a href="https://redirect.github.com/pydantic/httpx2/issues/1071">#1071</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pydantic/httpx2/compare/v2.5.0...v2.10.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Parker J. RuleandGitHub
|
0199b519e1 |
fix(cli): clarify missing deploy config (#8854)
Shows an actionable, docs-linked error when `langgraph deploy` is run without a `langgraph.json` instead of exposing a traceback. |
||
|
Nick HollonandGitHub
|
81bf17b231 | fix(langgraph): type undeclared v3 stream projections (#8596) | ||
|
|
11738d83db |
chore(langgraph): bump mistune to 3.3.4 (#8804)
Updates the `libs/langgraph/uv.lock` development dependency from Mistune 3.3.0 to 3.3.4, resolving GHSA-6m44-fpc8-c3rq (Dependabot #389). The change is scoped to the affected lockfile. Validation: `uv lock --project libs/langgraph --locked`. Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com> |
||
|
|
1983e60971 |
chore(deps): bump browserslist from 4.28.1 to 4.28.8 in /libs/cli/js-examples (#8797)
Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.28.1 to 4.28.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/browserslist/browserslist/releases">browserslist's releases</a>.</em></p> <blockquote> <h2>4.28.8</h2> <ul> <li>Fixed <code>including kaios</code> in baseline queries (by <a href="https://github.com/Jaybhade"><code>@Jaybhade</code></a>).</li> </ul> <h2>4.28.7</h2> <ul> <li>Improved parsing performance.</li> <li>Fixed unbounded memory growth (by <a href="https://github.com/alanturing881"><code>@alanturing881</code></a>).</li> <li>Fixed prototype write issue (by <a href="https://github.com/alanturing881"><code>@alanturing881</code></a>).</li> </ul> <h2>4.28.6</h2> <ul> <li>Fixed Electron version queries (by <a href="https://github.com/spokodev"><code>@spokodev</code></a>).</li> </ul> <h2>4.28.5</h2> <ul> <li>Fixed <code>></code> and <code>>=</code> queries (by <a href="https://github.com/spokodev"><code>@spokodev</code></a>).</li> </ul> <h2>4.28.4</h2> <ul> <li>Fixed <code>SyntaxError</code> regression of 4.28.3.</li> </ul> <h2>4.28.3</h2> <ul> <li>Fixed baseline query case-insensitivity (by <a href="https://github.com/swwind"><code>@swwind</code></a>).</li> </ul> <h2>4.28.2</h2> <ul> <li>Fix prototype pollution (by <a href="https://github.com/chluo1997"><code>@chluo1997</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md">browserslist's changelog</a>.</em></p> <blockquote> <h2>4.28.8</h2> <ul> <li>Fixed <code>including kaios</code> in baseline queries (by <a href="https://github.com/Jaybhade"><code>@Jaybhade</code></a>).</li> </ul> <h2>4.28.7</h2> <ul> <li>Improved parsing performance.</li> <li>Fixed unbounded memory growth (by <a href="https://github.com/alanturing881"><code>@alanturing881</code></a>).</li> <li>Fixed prototype write issue (by <a href="https://github.com/alanturing881"><code>@alanturing881</code></a>).</li> </ul> <h2>4.28.6</h2> <ul> <li>Fixed Electron version queries (by <a href="https://github.com/spokodev"><code>@spokodev</code></a>).</li> </ul> <h2>4.28.5</h2> <ul> <li>Fixed <code>></code> and <code>>=</code> queries (by <a href="https://github.com/spokodev"><code>@spokodev</code></a>).</li> </ul> <h2>4.28.4</h2> <ul> <li>Fixed <code>SyntaxError</code> regression of 4.28.3.</li> </ul> <h2>4.28.3</h2> <ul> <li>Fixed baseline query case-insensitivity (by <a href="https://github.com/swwind"><code>@swwind</code></a>).</li> </ul> <h2>4.28.2</h2> <ul> <li>Fix prototype pollution (by <a href="https://github.com/chluo1997"><code>@chluo1997</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/browserslist/browserslist/commit/f2f2e6cfb01bb4942941d328737546f4e2ae41ad"><code>f2f2e6c</code></a> Release 4.28.8 version</li> <li><a href="https://github.com/browserslist/browserslist/commit/d0787c88fa29ba895fea51cfe921232c7b5d1377"><code>d0787c8</code></a> Update dependencies</li> <li><a href="https://github.com/browserslist/browserslist/commit/fcf8fa9857b30ccdf801a548f5d09d3c4ff0d43f"><code>fcf8fa9</code></a> Merge pull request <a href="https://redirect.github.com/browserslist/browserslist/issues/939">#939</a> from Jaybhade/fix/baseline-kaios-without-downstream</li> <li><a href="https://github.com/browserslist/browserslist/commit/57ecd64454e9252afdd6a7e76926e13dda48a38c"><code>57ecd64</code></a> fix: support "including kaios" without downstream</li> <li><a href="https://github.com/browserslist/browserslist/commit/093a0f67bb0becda55235d767b134df3197c54a1"><code>093a0f6</code></a> Update EM banner</li> <li><a href="https://github.com/browserslist/browserslist/commit/b637868045806d2fba4c24eb0060e4cc8b1db276"><code>b637868</code></a> Release 4.28.7 version</li> <li><a href="https://github.com/browserslist/browserslist/commit/313f4659b9f985ade89d1d6a54a860371c41cc46"><code>313f465</code></a> Update dependencies</li> <li><a href="https://github.com/browserslist/browserslist/commit/c935c5a206f8b13db8846818bc03643e147dcbdf"><code>c935c5a</code></a> Fix regexp performance</li> <li><a href="https://github.com/browserslist/browserslist/commit/d7e9e653cb53399065943f59f0b3063987b0a008"><code>d7e9e65</code></a> Rewrite structure parsing to make it always fast</li> <li><a href="https://github.com/browserslist/browserslist/commit/ec4a55efd76bdfa506ec7ce4fea1691559e9ca8f"><code>ec4a55e</code></a> Fix import order</li> <li>Additional commits viewable in <a href="https://github.com/browserslist/browserslist/compare/4.28.1...4.28.8">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for browserslist since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
d07198a53c |
chore(deps): bump @humanfs/node from 0.16.7 to 0.16.8 in /libs/cli/js-examples (#8798)
Bumps [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) from 0.16.7 to 0.16.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/humanwhocodes/humanfs/releases">@humanfs/node's releases</a>.</em></p> <blockquote> <h2>node: v0.16.8</h2> <h2><a href="https://github.com/humanwhocodes/humanfs/compare/node-v0.16.7...node-v0.16.8">0.16.8</a> (2026-04-17)</h2> <h3>Bug Fixes</h3> <ul> <li>Include type dependencies at runtime (<a href="https://github.com/humanwhocodes/humanfs/commit/956ce7aac2a998d0af23b7cb08e7630b69693138">956ce7a</a>), closes <a href="https://redirect.github.com/humanwhocodes/humanfs/issues/145">#145</a></li> </ul> <h3>Dependencies</h3> <ul> <li>The following workspace dependencies were updated <ul> <li>dependencies <ul> <li><code>@humanfs/core</code> bumped from ^0.19.1 to ^0.19.2</li> </ul> </li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md">@humanfs/node's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/humanwhocodes/humanfs/compare/node-v0.16.7...node-v0.16.8">0.16.8</a> (2026-04-17)</h2> <h3>Bug Fixes</h3> <ul> <li>Ensure symlinks are copied as symlinks in <code>copy()</code> and <code>copyAll()</code> (<a href="https://github.com/humanwhocodes/humanfs/commit/22bbaa4487a3e6c1197ca619840de4615d0c3404">22bbaa44</a>)</li> <li>Include type dependencies at runtime (<a href="https://github.com/humanwhocodes/humanfs/commit/956ce7aac2a998d0af23b7cb08e7630b69693138">956ce7a</a>), closes <a href="https://redirect.github.com/humanwhocodes/humanfs/issues/145">#145</a></li> </ul> <h3>Dependencies</h3> <ul> <li>The following workspace dependencies were updated <ul> <li>dependencies <ul> <li><code>@humanfs/core</code> bumped from ^0.19.1 to ^0.19.2</li> </ul> </li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/humanwhocodes/humanfs/commit/e96070e897f017ae8abd2b0676d98d14e49665cc"><code>e96070e</code></a> chore: release main (<a href="https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node/issues/146">#146</a>)</li> <li><a href="https://github.com/humanwhocodes/humanfs/commit/22bbaa4487a3e6c1197ca619840de4615d0c3404"><code>22bbaa4</code></a> Merge commit from fork</li> <li><a href="https://github.com/humanwhocodes/humanfs/commit/956ce7aac2a998d0af23b7cb08e7630b69693138"><code>956ce7a</code></a> fix: Include type dependencies at runtime</li> <li>See full diff in <a href="https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>John Kennedyopen-swe[bot] <open-swe@users.noreply.github.com> |
c0a13bb22d |
chore(deps): bump the minor-and-patch group across 1 directory with 7 updates (#8779)
Bumps the minor-and-patch group with 7 updates in the /libs/sdk-py directory: | Package | From | To | | --- | --- | --- | | [orjson](https://github.com/ijl/orjson) | `3.11.9` | `3.12.0` | | [langchain-protocol](https://github.com/langchain-ai/agent-protocol) | `0.0.18` | `0.0.19` | | [langchain-core](https://github.com/langchain-ai/langchain) | `1.5.3` | `1.6.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.1` | `0.16.5` | | [ty](https://github.com/astral-sh/ty) | `0.0.66` | `0.0.75` | | [starlette](https://github.com/Kludex/starlette) | `1.3.1` | `1.6.0` | | [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` | Updates `orjson` from 3.11.9 to 3.12.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ijl/orjson/releases">orjson's releases</a>.</em></p> <blockquote> <h2>3.12.0</h2> <h3>Changed</h3> <ul> <li>Serialization implementation substantially rewritten.</li> <li>Publish PyPI wheels for Python 3.15. For Python 3.15 and later, <code>manylinux_2_39</code> (2024) is targeted instead of <code>manylinux_2_17</code> (2012).</li> <li>No longer publish PyPI wheels for ppc64le and s390x.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ijl/orjson/blob/master/CHANGELOG.md">orjson's changelog</a>.</em></p> <blockquote> <h2>3.12.0 - 2026-08-14</h2> <h3>Changed</h3> <ul> <li>Serialization implementation substantially rewritten.</li> <li>Publish PyPI wheels for Python 3.15. For Python 3.15 and later, <code>manylinux_2_39</code> (2024) is targeted instead of <code>manylinux_2_17</code> (2012).</li> <li>No longer publish PyPI wheels for ppc64le and s390x.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ijl/orjson/commit/6737895a1a4e3e26df0569a40147893a786f9a58"><code>6737895</code></a> 3.12.0</li> <li><a href="https://github.com/ijl/orjson/commit/c2a6e8ff7b898635fb68a85bd5a62df1edf61cfc"><code>c2a6e8f</code></a> JsonWriter, iterators</li> <li><a href="https://github.com/ijl/orjson/commit/6a2d7a7d66dc3c5698625a7b334c40db459e46ae"><code>6a2d7a7</code></a> yyjson 1ea2fb0</li> <li><a href="https://github.com/ijl/orjson/commit/97bf170d9726e91c891f35eae4892801520b9dce"><code>97bf170</code></a> build update</li> <li>See full diff in <a href="https://github.com/ijl/orjson/compare/3.11.9...3.12.0">compare view</a></li> </ul> </details> <br /> Updates `langchain-protocol` from 0.0.18 to 0.0.19 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/agent-protocol/releases">langchain-protocol's releases</a>.</em></p> <blockquote> <h2>langchain-protocol==0.0.19</h2> <h2>What's Changed</h2> <ul> <li>fix(tooling): resolve datamodel-code-generator alerts by <a href="https://github.com/jkennedyvz"><code>@jkennedyvz</code></a> in <a href="https://redirect.github.com/langchain-ai/agent-protocol/pull/93">langchain-ai/agent-protocol#93</a></li> <li>feat: add LangSmith routing to run start by <a href="https://github.com/mdrxy"><code>@mdrxy</code></a> in <a href="https://redirect.github.com/langchain-ai/agent-protocol/pull/95">langchain-ai/agent-protocol#95</a></li> <li>release: v0.19.0 by <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a> in <a href="https://redirect.github.com/langchain-ai/agent-protocol/pull/96">langchain-ai/agent-protocol#96</a></li> <li>fix(py): pin hatchling to avoid metadata 2.5 publish failure by <a href="https://github.com/christian-bromann"><code>@christian-bromann</code></a> in <a href="https://redirect.github.com/langchain-ai/agent-protocol/pull/97">langchain-ai/agent-protocol#97</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/langchain-ai/agent-protocol/compare/langchain-protocol==0.0.18...langchain-protocol==0.0.19">https://github.com/langchain-ai/agent-protocol/compare/langchain-protocol==0.0.18...langchain-protocol==0.0.19</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/agent-protocol/commit/59c02be488eb7adb98ae3450983fff293294e67a"><code>59c02be</code></a> fix(py): pin hatchling to avoid metadata 2.5 publish failure (<a href="https://redirect.github.com/langchain-ai/agent-protocol/issues/97">#97</a>)</li> <li><a href="https://github.com/langchain-ai/agent-protocol/commit/c59077b743fd3dd0b86f048a2b59128de413663d"><code>c59077b</code></a> release: v0.19.0 (<a href="https://redirect.github.com/langchain-ai/agent-protocol/issues/96">#96</a>)</li> <li><a href="https://github.com/langchain-ai/agent-protocol/commit/870ef9560fab320236d6e24770e8950c5a9be63d"><code>870ef95</code></a> Merge pull request <a href="https://redirect.github.com/langchain-ai/agent-protocol/issues/95">#95</a> from langchain-ai/open-swe/v3-replica-routing</li> <li><a href="https://github.com/langchain-ai/agent-protocol/commit/175a1b8f2ac974e9b5097de90a51f1bc7ade73e0"><code>175a1b8</code></a> feat(protocol): add LangSmith routing to run start</li> <li><a href="https://github.com/langchain-ai/agent-protocol/commit/d9fd23d762bf4cffe876890a854fb79bcdd14f1a"><code>d9fd23d</code></a> Merge pull request <a href="https://redirect.github.com/langchain-ai/agent-protocol/issues/93">#93</a> from langchain-ai/langster/fix-datamodel-code-generato...</li> <li><a href="https://github.com/langchain-ai/agent-protocol/commit/9476948ab0ce1027131b58b9813f6bd3ba238ef8"><code>9476948</code></a> fix(tooling): update code generator dependencies</li> <li>See full diff in <a href="https://github.com/langchain-ai/agent-protocol/compare/langchain-protocol==0.0.18...langchain-protocol==0.0.19">compare view</a></li> </ul> </details> <br /> Updates `langchain-core` from 1.5.3 to 1.6.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-core's releases</a>.</em></p> <blockquote> <h2>langchain-core==1.6.1</h2> <p>Changes since langchain-core==1.6.0</p> <p>revert: release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39971">#39971</a>) release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39967">#39967</a>) fix(core): shore up indexing in genai v1 streaming content (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39964">#39964</a>) fix(core): make <code>StructuredTool</code> JSON-serializable (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39631">#39631</a>) chore(deps): bump minor and patch dependencies (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39869">#39869</a>) release(core): 1.6.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39832">#39832</a>) feat(core): propagate gateway information on error path (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39829">#39829</a>)</p> <h2>langchain-core==1.6.0</h2> <p>Changes since langchain-core==1.5.6</p> <p>release(core): 1.6.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39760">#39760</a>) fix(core): resolve postponed annotations in <code>StructuredTool._injected_args_keys</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39602">#39602</a>) feat(core): add standard model exception types (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39538">#39538</a>) fix(core): allow deserializing <code>RunnablePick</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39753">#39753</a>) fix(core): make <code>convert_to_openai_function</code> handle callables and non-dict mappings (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39750">#39750</a>) fix(core): make subprocess and temporary file tests portable on Windows (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39664">#39664</a>) fix(core): fail fast when tool schemas can't resolve forward refs during serialization (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39570">#39570</a>) test(core): avoid version-dependent runnable snapshots (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39705">#39705</a>) fix(core): require all nested properties for strict tool schemas (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39306">#39306</a>) fix(core): remove stale sync-stream <code>xfail</code> [closes <a href="https://redirect.github.com/langchain-ai/langchain/issues/39720">#39720</a>] (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39723">#39723</a>) perf(core): Lazily import transformers (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38037">#38037</a>) fix(core): accept non-dict Mapping values in mustache templates (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39680">#39680</a>) docs(core): clarify <code>Runnable</code> pipe coercion [closes <a href="https://redirect.github.com/langchain-ai/langchain/issues/39075">#39075</a>] (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39707">#39707</a>) fix(core): finalize chain-group runs on <code>BaseException</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39699">#39699</a>)</p> <h2>langchain-core==1.5.6</h2> <p>Changes since langchain-core==1.5.5</p> <p>chore(core): release 1.5.6 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39704">#39704</a>) feat(core): incorporate gateway metadata to traces (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39703">#39703</a>)</p> <h2>langchain-core==1.5.5</h2> <p>Changes since langchain-core==1.5.4</p> <p>release(core): 1.5.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39655">#39655</a>) fix(core): make abatch_iterate consistent with batch_iterate for None and zero size (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39367">#39367</a>) fix(core): respect pydantic aliases when validating tool inputs (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39572">#39572</a>) fix(core): issues in merging chunks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39535">#39535</a>) fix(core): handle v1 base model validation in async path (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39576">#39576</a>) fix(core): handle tool descriptions for infer_schema=False (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39573">#39573</a>) fix(core): clear usage metadata callback on exceptions in context manager (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39616">#39616</a>) fix(core): handle falsy LLM and chat model caches (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39283">#39283</a>) chore(core): add httpx as an explicit dep (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39612">#39612</a>) fix(core): preserve non-str/non-dict items in <code>DictPromptTemplate</code> list values (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39588">#39588</a>) fix(core): raise ValueError when explicit tool_outputs length mismatches tool_calls in tool_example_to_messages (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39142">#39142</a>) fix(core): guard malformed Anthropic content blocks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38670">#38670</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/4fe9d3062f4b68e2e472eb92decf369c93aebb46"><code>4fe9d30</code></a> chore(openai): fix tests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39972">#39972</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/8fa38dc143faecec0287395bce4484af4b82254c"><code>8fa38dc</code></a> revert: release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39971">#39971</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/122030d79e944a5b55c33847d29bcfbe64488372"><code>122030d</code></a> release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39967">#39967</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/7d4b42b57235020e6f496fdfebab44c3ca1b1f5b"><code>7d4b42b</code></a> release(langchain): 1.3.18 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39966">#39966</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4a66e355da07b8fad7d6cb8db99287fb4d7e6d83"><code>4a66e35</code></a> fix(langchain): preserve content-block shape in PIIMiddleware redaction (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39894">#39894</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/38e211359f0b65b480d9ee4c53f2385f8c249bb3"><code>38e2113</code></a> fix(core): shore up indexing in genai v1 streaming content (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39964">#39964</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/13b1b2feae476fdcebc0a285a723d5cbfed9df2e"><code>13b1b2f</code></a> fix(core): make <code>StructuredTool</code> JSON-serializable (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39631">#39631</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/3b3b308e6d956c9a670e41e66a468466fe6f8c26"><code>3b3b308</code></a> release(anthropic): 1.7.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39963">#39963</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/e3f6adfe1976a773704a20fef7bb03ac0309e0e4"><code>e3f6adf</code></a> feat(anthropic): support top-level param for skills via <code>container</code>; `updates...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/c253f54b905f9648c50b723f01945f39a256d8aa"><code>c253f54</code></a> fix(openai): correct <code>reasoning_effort_levels</code> for gpt-5 and gpt-5.1 profiles...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.5.3...langchain-core==1.6.1">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.1 to 0.16.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.5</h2> <h2>Release Notes</h2> <p>Released on 2026-08-27.</p> <h3>Preview features</h3> <ul> <li>Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28049">#28049</a>)</li> <li>Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27666">#27666</a>)</li> <li>Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/pull/27877">#27877</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-async</code>] Detect blocking generic HTTP requests (<code>ASYNC210</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28024">#28024</a>)</li> <li>[<code>flake8-datetimez</code>] Allow timezone-safe <code>strptime</code> chains (<code>DTZ007</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28023">#28023</a>)</li> <li>[<code>flake8-simplify</code>] Respect side effects in <code>lambda</code> defaults (<code>SIM401</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28000">#28000</a>)</li> </ul> <h3>Server</h3> <ul> <li>Fix duplicated "of" in <code>ClientOptions</code> doc comment (<a href="https://redirect.github.com/astral-sh/ruff/pull/27978">#27978</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/pull/27910">#27910</a>)</li> <li>Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27906">#27906</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/AlexWaygood"><code>@AlexWaygood</code></a></li> <li><a href="https://github.com/sharkdp"><code>@sharkdp</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/aarushkandukoori"><code>@aarushkandukoori</code></a></li> </ul> <h2>Install ruff 0.16.5</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex" </code></pre> <h2>Download ruff 0.16.5</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.5</h2> <p>Released on 2026-08-27.</p> <h3>Preview features</h3> <ul> <li>Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28049">#28049</a>)</li> <li>Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27666">#27666</a>)</li> <li>Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/pull/27877">#27877</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-async</code>] Detect blocking generic HTTP requests (<code>ASYNC210</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28024">#28024</a>)</li> <li>[<code>flake8-datetimez</code>] Allow timezone-safe <code>strptime</code> chains (<code>DTZ007</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28023">#28023</a>)</li> <li>[<code>flake8-simplify</code>] Respect side effects in <code>lambda</code> defaults (<code>SIM401</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28000">#28000</a>)</li> </ul> <h3>Server</h3> <ul> <li>Fix duplicated "of" in <code>ClientOptions</code> doc comment (<a href="https://redirect.github.com/astral-sh/ruff/pull/27978">#27978</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/pull/27910">#27910</a>)</li> <li>Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27906">#27906</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/AlexWaygood"><code>@AlexWaygood</code></a></li> <li><a href="https://github.com/sharkdp"><code>@sharkdp</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/aarushkandukoori"><code>@aarushkandukoori</code></a></li> </ul> <h2>0.16.4</h2> <p>Released on 2026-08-20.</p> <h3>Preview features</h3> <ul> <li>[<code>flake8-use-pathlib</code>] Add autofix for <code>PTH116</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/26460">#26460</a>)</li> <li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to lists (<code>FURB131</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27711">#27711</a>)</li> <li>[<code>refurb</code>] Skip <code>FURB101</code> and <code>FURB103</code> when the <code>open</code> argument is a file descriptor (<a href="https://redirect.github.com/astral-sh/ruff/pull/27643">#27643</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not support <code>POPCNT</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27803">#27803</a>)</li> <li>[<code>pyflakes</code>] Emit semantic syntax errors in string type definitions as <code>F722</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27835">#27835</a>)</li> <li>[<code>pylint</code>] Allow <code>os._exit</code> imports in <code>import-private-name</code> (<code>PLC2701</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27738">#27738</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a"><code>9e4938c</code></a> Bump 0.16.5 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28110">#28110</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd"><code>aad0e90</code></a> Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/issues/28049">#28049</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4"><code>5fdab73</code></a> Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/issues/27877">#27877</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4"><code>29c8e5b</code></a> Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/issues/27910">#27910</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f"><code>50a4d7f</code></a> Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/issues/27906">#27906</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2"><code>ada8795</code></a> Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/issues/27666">#27666</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0"><code>d894723</code></a> [ty] Infer lambda parameters through callable type aliases (<a href="https://redirect.github.com/astral-sh/ruff/issues/28109">#28109</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06"><code>2685fde</code></a> [ty] Narrow functional enum members in <code>==</code> and <code>match</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28103">#28103</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec"><code>efcffd2</code></a> [ty] Intersection simplifications with subtype-related generic specialization...</li> <li><a href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b"><code>eb78048</code></a> [ty] Bump ecosystem-analyzer for HTML escaping (<a href="https://redirect.github.com/astral-sh/ruff/issues/28104">#28104</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.1...0.16.5">compare view</a></li> </ul> </details> <br /> Updates `ty` from 0.0.66 to 0.0.75 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ty/releases">ty's releases</a>.</em></p> <blockquote> <h2>0.0.75</h2> <h2>Release Notes</h2> <p>Released on 2026-08-26.</p> <h3>Preview features</h3> <ul> <li>Initialize PEP 723 script environments in the CLI (<a href="https://redirect.github.com/astral-sh/ruff/pull/27544">#27544</a>)</li> <li>Refresh PEP 723 script environments in watch mode (<a href="https://redirect.github.com/astral-sh/ruff/pull/27617">#27617</a>)</li> <li>Run PEP 723 script synchronization on bounded workers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27615">#27615</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Specialize <code>Self</code> bounds of inherited methods (<a href="https://redirect.github.com/astral-sh/ruff/pull/27990">#27990</a>)</li> </ul> <h3>LSP server</h3> <ul> <li>Add "Go to Definition" support for pytest fixtures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27444">#27444</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix documented Python package build command (<a href="https://redirect.github.com/astral-sh/ty/pull/4384">#4384</a>)</li> <li>Link untyped-call tracking issue in migration guide (<a href="https://redirect.github.com/astral-sh/ty/pull/4382">#4382</a>)</li> </ul> <h3>Library support</h3> <ul> <li>Resolve imported pytest fixture exposures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27539">#27539</a>)</li> <li>Resolve installed core pytest fixture providers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27770">#27770</a>)</li> <li>Resolve pytest fixtures through conftest (<a href="https://redirect.github.com/astral-sh/ruff/pull/27540">#27540</a>)</li> </ul> <h3>Diagnostics</h3> <ul> <li>Add more autofixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28029">#28029</a>)</li> <li>Add a dedicated missing-slot diagnostic (<a href="https://redirect.github.com/astral-sh/ruff/pull/28039">#28039</a>)</li> <li>Explain missing storage for declared slotted attributes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27969">#27969</a>)</li> <li>Improve diagnostic spans for unpacked variable assignments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28041">#28041</a>)</li> </ul> <h3>Core type checking</h3> <ul> <li>Account for known subclasses in equality inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28005">#28005</a>)</li> <li>Expand <code>ParamSpec</code> signatures inferred from bound receivers (<a href="https://redirect.github.com/astral-sh/ruff/pull/28020">#28020</a>)</li> <li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols (<a href="https://redirect.github.com/astral-sh/ruff/pull/28016">#28016</a>)</li> <li>Fix <code>TypedDict</code> variance inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28052">#28052</a>)</li> <li>Fix unsound narrowing through branch-assigned conditions (<a href="https://redirect.github.com/astral-sh/ruff/pull/28006">#28006</a>)</li> <li>Ignore inconsistent binding decorators on overloads (<a href="https://redirect.github.com/astral-sh/ruff/pull/28036">#28036</a>)</li> <li>Infer <code>yield from</code> send/return types from the iterator returned by <code>__iter__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27987">#27987</a>)</li> <li>Infer tuple type parameters from union arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28062">#28062</a>)</li> <li>Infer variance through nonrecursive protocol references (<a href="https://redirect.github.com/astral-sh/ruff/pull/28065">#28065</a>)</li> <li>Preserve bounds of non-literal metaclasses (<a href="https://redirect.github.com/astral-sh/ruff/pull/28046">#28046</a>)</li> <li>Preserve correlated generic-call inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28043">#28043</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md">ty's changelog</a>.</em></p> <blockquote> <h2>0.0.75</h2> <p>Released on 2026-08-26.</p> <h3>Preview features</h3> <ul> <li>Initialize PEP 723 script environments in the CLI (<a href="https://redirect.github.com/astral-sh/ruff/pull/27544">#27544</a>)</li> <li>Refresh PEP 723 script environments in watch mode (<a href="https://redirect.github.com/astral-sh/ruff/pull/27617">#27617</a>)</li> <li>Run PEP 723 script synchronization on bounded workers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27615">#27615</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Specialize <code>Self</code> bounds of inherited methods (<a href="https://redirect.github.com/astral-sh/ruff/pull/27990">#27990</a>)</li> </ul> <h3>LSP server</h3> <ul> <li>Add "Go to Definition" support for pytest fixtures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27444">#27444</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix documented Python package build command (<a href="https://redirect.github.com/astral-sh/ty/pull/4384">#4384</a>)</li> <li>Link untyped-call tracking issue in migration guide (<a href="https://redirect.github.com/astral-sh/ty/pull/4382">#4382</a>)</li> </ul> <h3>Library support</h3> <ul> <li>Resolve imported pytest fixture exposures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27539">#27539</a>)</li> <li>Resolve installed core pytest fixture providers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27770">#27770</a>)</li> <li>Resolve pytest fixtures through conftest (<a href="https://redirect.github.com/astral-sh/ruff/pull/27540">#27540</a>)</li> </ul> <h3>Diagnostics</h3> <ul> <li>Add more autofixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28029">#28029</a>)</li> <li>Add a dedicated missing-slot diagnostic (<a href="https://redirect.github.com/astral-sh/ruff/pull/28039">#28039</a>)</li> <li>Explain missing storage for declared slotted attributes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27969">#27969</a>)</li> <li>Improve diagnostic spans for unpacked variable assignments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28041">#28041</a>)</li> </ul> <h3>Core type checking</h3> <ul> <li>Account for known subclasses in equality inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28005">#28005</a>)</li> <li>Expand <code>ParamSpec</code> signatures inferred from bound receivers (<a href="https://redirect.github.com/astral-sh/ruff/pull/28020">#28020</a>)</li> <li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols (<a href="https://redirect.github.com/astral-sh/ruff/pull/28016">#28016</a>)</li> <li>Fix <code>TypedDict</code> variance inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28052">#28052</a>)</li> <li>Fix unsound narrowing through branch-assigned conditions (<a href="https://redirect.github.com/astral-sh/ruff/pull/28006">#28006</a>)</li> <li>Ignore inconsistent binding decorators on overloads (<a href="https://redirect.github.com/astral-sh/ruff/pull/28036">#28036</a>)</li> <li>Infer <code>yield from</code> send/return types from the iterator returned by <code>__iter__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27987">#27987</a>)</li> <li>Infer tuple type parameters from union arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28062">#28062</a>)</li> <li>Infer variance through nonrecursive protocol references (<a href="https://redirect.github.com/astral-sh/ruff/pull/28065">#28065</a>)</li> <li>Preserve bounds of non-literal metaclasses (<a href="https://redirect.github.com/astral-sh/ruff/pull/28046">#28046</a>)</li> <li>Preserve correlated generic-call inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28043">#28043</a>)</li> <li>Preserve invariant materialization constraints (<a href="https://redirect.github.com/astral-sh/ruff/pull/28047">#28047</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ty/commit/a553dcc1a4c464b22d6fff8c46d444e326e0ae2d"><code>a553dcc</code></a> Bump version to 0.0.75 (<a href="https://redirect.github.com/astral-sh/ty/issues/4396">#4396</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/26b1b50998e92a5f50c342dc4a1fed84db2f8ee4"><code>26b1b50</code></a> Update prek dependencies (<a href="https://redirect.github.com/astral-sh/ty/issues/4392">#4392</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/73d226ee4d5a9274bc559c50a244159b61dfa315"><code>73d226e</code></a> Fix documented Python package build command (<a href="https://redirect.github.com/astral-sh/ty/issues/4384">#4384</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/5e264dac66970648d461a3fc8f2ebebd30a44dc9"><code>5e264da</code></a> Link untyped-call tracking issue in migration guide (<a href="https://redirect.github.com/astral-sh/ty/issues/4382">#4382</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/00199f0aaa6a8cd264fea08eae4f3c3fe4451c17"><code>00199f0</code></a> Bump version to 0.0.74 (<a href="https://redirect.github.com/astral-sh/ty/issues/4351">#4351</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/5769062fa10db84f6c03145bdf42d0b8da9aeb63"><code>5769062</code></a> Update mypy/pyright comparison table (<a href="https://redirect.github.com/astral-sh/ty/issues/4165">#4165</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/4fcb06010f2219b80adf3e688964abd9b0d72866"><code>4fcb060</code></a> Remove Zulip from the PGO training (<a href="https://redirect.github.com/astral-sh/ty/issues/4336">#4336</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/a7a706442a710db4a93c1a79779dff5ec5824cf6"><code>a7a7064</code></a> Use the versions bot's ruleset bypass when merging (<a href="https://redirect.github.com/astral-sh/ty/issues/4333">#4333</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/01b0fab0093c64535a401bc2731f80d7f5b6a7a8"><code>01b0fab</code></a> Update prek dependencies (<a href="https://redirect.github.com/astral-sh/ty/issues/4325">#4325</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/deef42f517bfbacb2ffe673046bef1e206c6b8ab"><code>deef42f</code></a> Update dependency python to 3.14 (<a href="https://redirect.github.com/astral-sh/ty/issues/4326">#4326</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ty/compare/0.0.66...0.0.75">compare view</a></li> </ul> </details> <br /> Updates `starlette` from 1.3.1 to 1.6.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/releases">starlette's releases</a>.</em></p> <blockquote> <h2>Version 1.6.0</h2> <h2>What's Changed</h2> <ul> <li>Add <code>max_body_size</code> to <code>Starlette</code> and route classes by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3431">Kludex/starlette#3431</a></li> <li>Expose <code>http.response.debug</code> info via response extensions by <a href="https://github.com/y2kbugger"><code>@y2kbugger</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3130">Kludex/starlette#3130</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/y2kbugger"><code>@y2kbugger</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3130">Kludex/starlette#3130</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.5.1...1.6.0">https://github.com/Kludex/starlette/compare/1.5.1...1.6.0</a></p> <h2>Version 1.5.1</h2> <h2>What's Changed</h2> <ul> <li>Reject inverted single-byte Range like <code>bytes=5-4</code> by <a href="https://github.com/nikolauspschuetz"><code>@nikolauspschuetz</code></a> in <a href="https://redirect.github.com/encode/starlette/pull/3389">encode/starlette#3389</a></li> <li>Limit <code>FileResponse</code> to 100 ranges by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/encode/starlette/pull/3430">encode/starlette#3430</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/encode/starlette/compare/1.5.0...1.5.1">https://github.com/encode/starlette/compare/1.5.0...1.5.1</a></p> <h2>Version 1.5.0</h2> <p>This release is all about giving <code>GZipMiddleware</code> some love. 🗜️</p> <h2>What's Changed</h2> <ul> <li>Add <code>exclude_content_types</code> parameter to <code>GZipMiddleware</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/encode/starlette/pull/3418">encode/starlette#3418</a></li> <li>Flush GZip output for each streamed chunk by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/encode/starlette/pull/3419">encode/starlette#3419</a></li> <li>Skip compression of partial responses in <code>GZipMiddleware</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/encode/starlette/pull/3420">encode/starlette#3420</a></li> <li>Expand default excluded content types in <code>GZipMiddleware</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/encode/starlette/pull/3421">encode/starlette#3421</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/encode/starlette/compare/1.4.1...1.5.0">https://github.com/encode/starlette/compare/1.4.1...1.5.0</a></p> <h2>Version 1.4.1</h2> <h2>What's Changed</h2> <ul> <li>Default <code>thread_minimum_size</code> in <code>GZipResponder</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3415">Kludex/starlette#3415</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.4.0...1.4.1">https://github.com/Kludex/starlette/compare/1.4.0...1.4.1</a></p> <h2>Version 1.4.0</h2> <h2>What's Changed</h2> <ul> <li>Lazily allocate GZipMiddleware compression resources by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3407">Kludex/starlette#3407</a></li> <li>Use <code>zlib.compressobj</code> instead of <code>GzipFile</code> in <code>GZipMiddleware</code> by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3411">Kludex/starlette#3411</a></li> <li>Offload large GZip compression by <a href="https://github.com/Kludex"><code>@Kludex</code></a> in <a href="https://redirect.github.com/Kludex/starlette/pull/3410">Kludex/starlette#3410</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/benberryallwood"><code>@benberryallwood</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3334">Kludex/starlette#3334</a></li> <li><a href="https://github.com/lkk7"><code>@lkk7</code></a> made their first contribution in <a href="https://redirect.github.com/Kludex/starlette/pull/3359">Kludex/starlette#3359</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/Kludex/starlette/compare/1.3.1...1.4.0">https://github.com/Kludex/starlette/compare/1.3.1...1.4.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Kludex/starlette/blob/main/docs/release-notes.md">starlette's changelog</a>.</em></p> <blockquote> <h2>1.6.0 (August 8, 2026)</h2> <h4>Added</h4> <ul> <li>Add <code>max_body_size</code> to <code>Starlette</code> and route classes <a href="https://redirect.github.com/encode/starlette/pull/3431">#3431</a>.</li> <li>Expose <code>http.response.debug</code> information via response extensions <a href="https://redirect.github.com/encode/starlette/pull/3130">#3130</a>.</li> </ul> <h2>1.5.1 (August 8, 2026)</h2> <h4>Fixed</h4> <ul> <li>Reject inverted single-byte ranges in <code>FileResponse</code> <a href="https://redirect.github.com/encode/starlette/pull/3389">#3389</a>.</li> <li>Limit <code>FileResponse</code> to 100 ranges <a href="https://redirect.github.com/encode/starlette/pull/3430">#3430</a>.</li> </ul> <h2>1.5.0 (August 8, 2026)</h2> <h4>Added</h4> <ul> <li>Add <code>exclude_content_types</code> parameter to <code>GZipMiddleware</code> <a href="https://redirect.github.com/encode/starlette/pull/3418">#3418</a>.</li> </ul> <h4>Changed</h4> <ul> <li>Expand default excluded content types in <code>GZipMiddleware</code> <a href="https://redirect.github.com/encode/starlette/pull/3421">#3421</a>.</li> </ul> <h4>Fixed</h4> <ul> <li>Flush GZip output for each streamed chunk <a href="https://redirect.github.com/encode/starlette/pull/3419">#3419</a>.</li> <li>Skip compression of partial responses in <code>GZipMiddleware</code> <a href="https://redirect.github.com/encode/starlette/pull/3420">#3420</a>.</li> </ul> <h2>1.4.1 (August 5, 2026)</h2> <h4>Fixed</h4> <ul> <li>Default <code>thread_minimum_size</code> to 128 KiB in <code>GZipResponder</code>, keeping it usable without the new keyword argument <a href="https://redirect.github.com/encode/starlette/pull/3415">#3415</a>.</li> </ul> <h2>1.4.0 (August 5, 2026)</h2> <h4>Added</h4> <ul> <li>Offload large GZip compression to a worker thread, keeping the event loop responsive. <code>GZipMiddleware</code> accepts a new <code>thread_minimum_size</code> parameter (default 128 KiB) controlling the minimum body chunk size compressed in a thread <a href="https://redirect.github.com/encode/starlette/pull/3410">#3410</a>.</li> </ul> <h4>Changed</h4> <ul> <li>Use <code>zlib.compressobj</code> instead of <code>GzipFile</code> in <code>GZipMiddleware</code>, reducing memory usage during compression <a href="https://redirect.github.com/encode/starlette/pull/3411">#3411</a>.</li> <li>Lazily allocate <code>GZipMiddleware</code> compression resources, avoiding compressor allocation for responses that are never compressed <a href="https://redirect.github.com/encode/starlette/pull/3407">#3407</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Kludex/starlette/commit/4f250d6b814587e20c5365f0a5f0c4d42bcb929f"><code>4f250d6</code></a> Version 1.6.0 (<a href="https://redirect.github.com/Kludex/starlette/issues/3434">#3434</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/9eea41ad3c26ad21b9bdfe4578c1cdad6c9b9ac2"><code>9eea41a</code></a> Expose <code>http.response.debug</code> info via response extensions (<a href="https://redirect.github.com/Kludex/starlette/issues/3130">#3130</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/38f8999a229610b36f39d11f67d80515a15c6330"><code>38f8999</code></a> Add <code>max_body_size</code> to <code>Starlette</code> and route classes (<a href="https://redirect.github.com/Kludex/starlette/issues/3431">#3431</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/c41236c03868fb3779a64101f4ea88cd47877e23"><code>c41236c</code></a> Version 1.5.1 (<a href="https://redirect.github.com/Kludex/starlette/issues/3432">#3432</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/9c500db197859dba4a8db13fa8e7d2c55de8152c"><code>9c500db</code></a> Limit <code>FileResponse</code> to 100 ranges (<a href="https://redirect.github.com/Kludex/starlette/issues/3430">#3430</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/78ae82cad482fe66a73fb1217f0a6609b3f998f6"><code>78ae82c</code></a> Reject inverted single-byte Range like bytes=5-4 (<a href="https://redirect.github.com/Kludex/starlette/issues/3389">#3389</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/c1d6edaf43920104d4389e983c3e0314f6af14cf"><code>c1d6eda</code></a> chore(deps): bump pymdown-extensions from 11.0 to 11.0.1 (<a href="https://redirect.github.com/Kludex/starlette/issues/3429">#3429</a>)</li> <li><a href="https://github.com/Kludex/starlette/commit/ee66ca48418780d6415d231851b31464febc32de"><code>ee66ca4</code></a> chore(deps): bump the python-packages group across 1 directory with 8 updates...</li> <li><a href="https://github.com/Kludex/starlette/commit/00d10167523f819d39d5ca36732348d58645a447"><code>00d1016</code></a> fix(tests): skip test_staticfiles_filename_too_long on Windows where os.pathc...</li> <li><a href="https://github.com/Kludex/starlette/commit/d96887ea7b49db3d1d15994be6438c7fe99936f4"><code>d96887e</code></a> Add Pydantic Logfire banner to the docs (<a href="https://redirect.github.com/Kludex/starlette/issues/3428">#3428</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Kludex/starlette/compare/1.3.1...1.6.0">compare view</a></li> </ul> </details> <br /> Updates `pydantic` from 2.13.4 to 2.13.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/releases">pydantic's releases</a>.</em></p> <blockquote> <h2>v2.13.5 (2026-08-28)</h2> <h3>What's Changed</h3> <h4>Fixes</h4> <ul> <li>Allow reuse of validators when plugins are set by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13535">#13535</a></li> <li>Fix missing GC traversal on some <code>pydantic-core</code> struct fields by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13624">#13624</a></li> <li>Fix missing GC traversal in <code>pydantic-core</code> for <code>GeneralFieldsSerializer</code> by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13629">#13629</a></li> <li>Count validated model fields once in smart unions by <a href="https://github.com/tamird"><code>@tamird</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13731">#13731</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md">pydantic's changelog</a>.</em></p> <blockquote> <h2>v2.13.5 (2026-08-28)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.13.5">GitHub release</a></p> <h3>What's Changed</h3> <h4>Fixes</h4> <ul> <li>Allow reuse of validators when plugins are set by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13535">#13535</a></li> <li>Fix missing GC traversal on some <code>pydantic-core</code> struct fields by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13624">#13624</a></li> <li>Fix missing GC traversal in <code>pydantic-core</code> for <code>GeneralFieldsSerializer</code> by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13629">#13629</a></li> <li>Count validated model fields once in smart unions by <a href="https://github.com/tamird"><code>@tamird</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13731">#13731</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/pydantic/commit/001dea020e0809844e5b17666432c9135a976f46"><code>001dea0</code></a> Bump <code>pypa/gh-action-pypi-publish</code> action to v1.14.2</li> <li><a href="https://github.com/pydantic/pydantic/commit/558379fee957fad25858e33596146c72d5674843"><code>558379f</code></a> Bump twine to v7.0.0</li> <li><a href="https://github.com/pydantic/pydantic/commit/2cfd5d3d2ae721ea882c045f83b7f7a4003aab01"><code>2cfd5d3</code></a> Do not check for docs build</li> <li><a href="https://github.com/pydantic/pydantic/commit/a735bee5c64e1fe50785c376adaf1275e752b8ac"><code>a735bee</code></a> Fix more Clippy lints</li> <li><a href="https://github.com/pydantic/pydantic/commit/7eed4a16b87afaced4d0eafae230453de3410d64"><code>7eed4a1</code></a> Fix Clippy 0.1.95 warnings</li> <li><a href="https://github.com/pydantic/pydantic/commit/b353bbb20a4989b4c033e2be2b4a40d36178b16a"><code>b353bbb</code></a> Prepare release v2.13.5</li> <li><a href="https://github.com/pydantic/pydantic/commit/63d2cccd6e760da6bbc7fe81a53cb2bde3768f5e"><code>63d2ccc</code></a> Count validated model fields once in smart unions</li> <li><a href="https://github.com/pydantic/pydantic/commit/a53ec2ed342fda4e6aa3684399d04ea57be9a6e4"><code>a53ec2e</code></a> Speed up PyPy CI tests</li> <li><a href="https://github.com/pydantic/pydantic/commit/d65e0f96e890ca82f4b66a15d5b3bd65af2c661c"><code>d65e0f9</code></a> Workaround circular import error in Mypy</li> <li><a href="https://github.com/pydantic/pydantic/commit/47a6dbf8ad6216211bd0df6ec5c2c6c6ed905b72"><code>47a6dbf</code></a> Fix missing GC traversal in <code>pydantic-core</code> for <code>GeneralFieldsSerializer</code></li> <li>Additional commits viewable in <a href="https://github.com/pydantic/pydantic/compare/v2.13.4...v2.13.5">compare view</a></li> </ul> </details> <br /> Made by [Open SWE](https://openswe.vercel.app/agents/0758e158-6746-5095-b8a0-7f69acf36b73) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>John Kennedyopen-swe[bot] <open-swe@users.noreply.github.com> |
7bfee11ad5 |
chore(deps): bump the minor-and-patch group across 1 directory with 4 updates (#8782)
Bumps the minor-and-patch group with 4 updates in the /libs/langgraph directory: [langchain-core](https://github.com/langchain-ai/langchain), [pydantic](https://github.com/pydantic/pydantic), [ruff](https://github.com/astral-sh/ruff) and [ty](https://github.com/astral-sh/ty). Updates `langchain-core` from 1.5.3 to 1.6.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-core's releases</a>.</em></p> <blockquote> <h2>langchain-core==1.6.1</h2> <p>Changes since langchain-core==1.6.0</p> <p>revert: release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39971">#39971</a>) release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39967">#39967</a>) fix(core): shore up indexing in genai v1 streaming content (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39964">#39964</a>) fix(core): make <code>StructuredTool</code> JSON-serializable (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39631">#39631</a>) chore(deps): bump minor and patch dependencies (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39869">#39869</a>) release(core): 1.6.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39832">#39832</a>) feat(core): propagate gateway information on error path (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39829">#39829</a>)</p> <h2>langchain-core==1.6.0</h2> <p>Changes since langchain-core==1.5.6</p> <p>release(core): 1.6.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39760">#39760</a>) fix(core): resolve postponed annotations in <code>StructuredTool._injected_args_keys</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39602">#39602</a>) feat(core): add standard model exception types (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39538">#39538</a>) fix(core): allow deserializing <code>RunnablePick</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39753">#39753</a>) fix(core): make <code>convert_to_openai_function</code> handle callables and non-dict mappings (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39750">#39750</a>) fix(core): make subprocess and temporary file tests portable on Windows (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39664">#39664</a>) fix(core): fail fast when tool schemas can't resolve forward refs during serialization (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39570">#39570</a>) test(core): avoid version-dependent runnable snapshots (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39705">#39705</a>) fix(core): require all nested properties for strict tool schemas (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39306">#39306</a>) fix(core): remove stale sync-stream <code>xfail</code> [closes <a href="https://redirect.github.com/langchain-ai/langchain/issues/39720">#39720</a>] (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39723">#39723</a>) perf(core): Lazily import transformers (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38037">#38037</a>) fix(core): accept non-dict Mapping values in mustache templates (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39680">#39680</a>) docs(core): clarify <code>Runnable</code> pipe coercion [closes <a href="https://redirect.github.com/langchain-ai/langchain/issues/39075">#39075</a>] (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39707">#39707</a>) fix(core): finalize chain-group runs on <code>BaseException</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39699">#39699</a>)</p> <h2>langchain-core==1.5.6</h2> <p>Changes since langchain-core==1.5.5</p> <p>chore(core): release 1.5.6 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39704">#39704</a>) feat(core): incorporate gateway metadata to traces (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39703">#39703</a>)</p> <h2>langchain-core==1.5.5</h2> <p>Changes since langchain-core==1.5.4</p> <p>release(core): 1.5.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39655">#39655</a>) fix(core): make abatch_iterate consistent with batch_iterate for None and zero size (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39367">#39367</a>) fix(core): respect pydantic aliases when validating tool inputs (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39572">#39572</a>) fix(core): issues in merging chunks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39535">#39535</a>) fix(core): handle v1 base model validation in async path (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39576">#39576</a>) fix(core): handle tool descriptions for infer_schema=False (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39573">#39573</a>) fix(core): clear usage metadata callback on exceptions in context manager (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39616">#39616</a>) fix(core): handle falsy LLM and chat model caches (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39283">#39283</a>) chore(core): add httpx as an explicit dep (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39612">#39612</a>) fix(core): preserve non-str/non-dict items in <code>DictPromptTemplate</code> list values (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39588">#39588</a>) fix(core): raise ValueError when explicit tool_outputs length mismatches tool_calls in tool_example_to_messages (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39142">#39142</a>) fix(core): guard malformed Anthropic content blocks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38670">#38670</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/4fe9d3062f4b68e2e472eb92decf369c93aebb46"><code>4fe9d30</code></a> chore(openai): fix tests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39972">#39972</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/8fa38dc143faecec0287395bce4484af4b82254c"><code>8fa38dc</code></a> revert: release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39971">#39971</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/122030d79e944a5b55c33847d29bcfbe64488372"><code>122030d</code></a> release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39967">#39967</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/7d4b42b57235020e6f496fdfebab44c3ca1b1f5b"><code>7d4b42b</code></a> release(langchain): 1.3.18 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39966">#39966</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4a66e355da07b8fad7d6cb8db99287fb4d7e6d83"><code>4a66e35</code></a> fix(langchain): preserve content-block shape in PIIMiddleware redaction (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39894">#39894</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/38e211359f0b65b480d9ee4c53f2385f8c249bb3"><code>38e2113</code></a> fix(core): shore up indexing in genai v1 streaming content (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39964">#39964</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/13b1b2feae476fdcebc0a285a723d5cbfed9df2e"><code>13b1b2f</code></a> fix(core): make <code>StructuredTool</code> JSON-serializable (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39631">#39631</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/3b3b308e6d956c9a670e41e66a468466fe6f8c26"><code>3b3b308</code></a> release(anthropic): 1.7.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39963">#39963</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/e3f6adfe1976a773704a20fef7bb03ac0309e0e4"><code>e3f6adf</code></a> feat(anthropic): support top-level param for skills via <code>container</code>; `updates...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/c253f54b905f9648c50b723f01945f39a256d8aa"><code>c253f54</code></a> fix(openai): correct <code>reasoning_effort_levels</code> for gpt-5 and gpt-5.1 profiles...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.5.3...langchain-core==1.6.1">compare view</a></li> </ul> </details> <br /> Updates `pydantic` from 2.13.4 to 2.13.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/releases">pydantic's releases</a>.</em></p> <blockquote> <h2>v2.13.5 (2026-08-28)</h2> <h3>What's Changed</h3> <h4>Fixes</h4> <ul> <li>Allow reuse of validators when plugins are set by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13535">#13535</a></li> <li>Fix missing GC traversal on some <code>pydantic-core</code> struct fields by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13624">#13624</a></li> <li>Fix missing GC traversal in <code>pydantic-core</code> for <code>GeneralFieldsSerializer</code> by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13629">#13629</a></li> <li>Count validated model fields once in smart unions by <a href="https://github.com/tamird"><code>@tamird</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13731">#13731</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md">pydantic's changelog</a>.</em></p> <blockquote> <h2>v2.13.5 (2026-08-28)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.13.5">GitHub release</a></p> <h3>What's Changed</h3> <h4>Fixes</h4> <ul> <li>Allow reuse of validators when plugins are set by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13535">#13535</a></li> <li>Fix missing GC traversal on some <code>pydantic-core</code> struct fields by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13624">#13624</a></li> <li>Fix missing GC traversal in <code>pydantic-core</code> for <code>GeneralFieldsSerializer</code> by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13629">#13629</a></li> <li>Count validated model fields once in smart unions by <a href="https://github.com/tamird"><code>@tamird</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13731">#13731</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/pydantic/commit/001dea020e0809844e5b17666432c9135a976f46"><code>001dea0</code></a> Bump <code>pypa/gh-action-pypi-publish</code> action to v1.14.2</li> <li><a href="https://github.com/pydantic/pydantic/commit/558379fee957fad25858e33596146c72d5674843"><code>558379f</code></a> Bump twine to v7.0.0</li> <li><a href="https://github.com/pydantic/pydantic/commit/2cfd5d3d2ae721ea882c045f83b7f7a4003aab01"><code>2cfd5d3</code></a> Do not check for docs build</li> <li><a href="https://github.com/pydantic/pydantic/commit/a735bee5c64e1fe50785c376adaf1275e752b8ac"><code>a735bee</code></a> Fix more Clippy lints</li> <li><a href="https://github.com/pydantic/pydantic/commit/7eed4a16b87afaced4d0eafae230453de3410d64"><code>7eed4a1</code></a> Fix Clippy 0.1.95 warnings</li> <li><a href="https://github.com/pydantic/pydantic/commit/b353bbb20a4989b4c033e2be2b4a40d36178b16a"><code>b353bbb</code></a> Prepare release v2.13.5</li> <li><a href="https://github.com/pydantic/pydantic/commit/63d2cccd6e760da6bbc7fe81a53cb2bde3768f5e"><code>63d2ccc</code></a> Count validated model fields once in smart unions</li> <li><a href="https://github.com/pydantic/pydantic/commit/a53ec2ed342fda4e6aa3684399d04ea57be9a6e4"><code>a53ec2e</code></a> Speed up PyPy CI tests</li> <li><a href="https://github.com/pydantic/pydantic/commit/d65e0f96e890ca82f4b66a15d5b3bd65af2c661c"><code>d65e0f9</code></a> Workaround circular import error in Mypy</li> <li><a href="https://github.com/pydantic/pydantic/commit/47a6dbf8ad6216211bd0df6ec5c2c6c6ed905b72"><code>47a6dbf</code></a> Fix missing GC traversal in <code>pydantic-core</code> for <code>GeneralFieldsSerializer</code></li> <li>Additional commits viewable in <a href="https://github.com/pydantic/pydantic/compare/v2.13.4...v2.13.5">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.1 to 0.16.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.5</h2> <h2>Release Notes</h2> <p>Released on 2026-08-27.</p> <h3>Preview features</h3> <ul> <li>Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28049">#28049</a>)</li> <li>Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27666">#27666</a>)</li> <li>Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/pull/27877">#27877</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-async</code>] Detect blocking generic HTTP requests (<code>ASYNC210</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28024">#28024</a>)</li> <li>[<code>flake8-datetimez</code>] Allow timezone-safe <code>strptime</code> chains (<code>DTZ007</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28023">#28023</a>)</li> <li>[<code>flake8-simplify</code>] Respect side effects in <code>lambda</code> defaults (<code>SIM401</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28000">#28000</a>)</li> </ul> <h3>Server</h3> <ul> <li>Fix duplicated "of" in <code>ClientOptions</code> doc comment (<a href="https://redirect.github.com/astral-sh/ruff/pull/27978">#27978</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/pull/27910">#27910</a>)</li> <li>Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27906">#27906</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/AlexWaygood"><code>@AlexWaygood</code></a></li> <li><a href="https://github.com/sharkdp"><code>@sharkdp</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/aarushkandukoori"><code>@aarushkandukoori</code></a></li> </ul> <h2>Install ruff 0.16.5</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex" </code></pre> <h2>Download ruff 0.16.5</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.5</h2> <p>Released on 2026-08-27.</p> <h3>Preview features</h3> <ul> <li>Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28049">#28049</a>)</li> <li>Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27666">#27666</a>)</li> <li>Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/pull/27877">#27877</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-async</code>] Detect blocking generic HTTP requests (<code>ASYNC210</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28024">#28024</a>)</li> <li>[<code>flake8-datetimez</code>] Allow timezone-safe <code>strptime</code> chains (<code>DTZ007</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28023">#28023</a>)</li> <li>[<code>flake8-simplify</code>] Respect side effects in <code>lambda</code> defaults (<code>SIM401</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28000">#28000</a>)</li> </ul> <h3>Server</h3> <ul> <li>Fix duplicated "of" in <code>ClientOptions</code> doc comment (<a href="https://redirect.github.com/astral-sh/ruff/pull/27978">#27978</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/pull/27910">#27910</a>)</li> <li>Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27906">#27906</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/AlexWaygood"><code>@AlexWaygood</code></a></li> <li><a href="https://github.com/sharkdp"><code>@sharkdp</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/aarushkandukoori"><code>@aarushkandukoori</code></a></li> </ul> <h2>0.16.4</h2> <p>Released on 2026-08-20.</p> <h3>Preview features</h3> <ul> <li>[<code>flake8-use-pathlib</code>] Add autofix for <code>PTH116</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/26460">#26460</a>)</li> <li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to lists (<code>FURB131</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27711">#27711</a>)</li> <li>[<code>refurb</code>] Skip <code>FURB101</code> and <code>FURB103</code> when the <code>open</code> argument is a file descriptor (<a href="https://redirect.github.com/astral-sh/ruff/pull/27643">#27643</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not support <code>POPCNT</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27803">#27803</a>)</li> <li>[<code>pyflakes</code>] Emit semantic syntax errors in string type definitions as <code>F722</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27835">#27835</a>)</li> <li>[<code>pylint</code>] Allow <code>os._exit</code> imports in <code>import-private-name</code> (<code>PLC2701</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27738">#27738</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a"><code>9e4938c</code></a> Bump 0.16.5 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28110">#28110</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd"><code>aad0e90</code></a> Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/issues/28049">#28049</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4"><code>5fdab73</code></a> Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/issues/27877">#27877</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4"><code>29c8e5b</code></a> Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/issues/27910">#27910</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f"><code>50a4d7f</code></a> Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/issues/27906">#27906</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2"><code>ada8795</code></a> Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/issues/27666">#27666</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0"><code>d894723</code></a> [ty] Infer lambda parameters through callable type aliases (<a href="https://redirect.github.com/astral-sh/ruff/issues/28109">#28109</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06"><code>2685fde</code></a> [ty] Narrow functional enum members in <code>==</code> and <code>match</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28103">#28103</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec"><code>efcffd2</code></a> [ty] Intersection simplifications with subtype-related generic specialization...</li> <li><a href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b"><code>eb78048</code></a> [ty] Bump ecosystem-analyzer for HTML escaping (<a href="https://redirect.github.com/astral-sh/ruff/issues/28104">#28104</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.1...0.16.5">compare view</a></li> </ul> </details> <br /> Updates `ty` from 0.0.66 to 0.0.75 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ty/releases">ty's releases</a>.</em></p> <blockquote> <h2>0.0.75</h2> <h2>Release Notes</h2> <p>Released on 2026-08-26.</p> <h3>Preview features</h3> <ul> <li>Initialize PEP 723 script environments in the CLI (<a href="https://redirect.github.com/astral-sh/ruff/pull/27544">#27544</a>)</li> <li>Refresh PEP 723 script environments in watch mode (<a href="https://redirect.github.com/astral-sh/ruff/pull/27617">#27617</a>)</li> <li>Run PEP 723 script synchronization on bounded workers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27615">#27615</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Specialize <code>Self</code> bounds of inherited methods (<a href="https://redirect.github.com/astral-sh/ruff/pull/27990">#27990</a>)</li> </ul> <h3>LSP server</h3> <ul> <li>Add "Go to Definition" support for pytest fixtures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27444">#27444</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix documented Python package build command (<a href="https://redirect.github.com/astral-sh/ty/pull/4384">#4384</a>)</li> <li>Link untyped-call tracking issue in migration guide (<a href="https://redirect.github.com/astral-sh/ty/pull/4382">#4382</a>)</li> </ul> <h3>Library support</h3> <ul> <li>Resolve imported pytest fixture exposures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27539">#27539</a>)</li> <li>Resolve installed core pytest fixture providers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27770">#27770</a>)</li> <li>Resolve pytest fixtures through conftest (<a href="https://redirect.github.com/astral-sh/ruff/pull/27540">#27540</a>)</li> </ul> <h3>Diagnostics</h3> <ul> <li>Add more autofixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28029">#28029</a>)</li> <li>Add a dedicated missing-slot diagnostic (<a href="https://redirect.github.com/astral-sh/ruff/pull/28039">#28039</a>)</li> <li>Explain missing storage for declared slotted attributes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27969">#27969</a>)</li> <li>Improve diagnostic spans for unpacked variable assignments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28041">#28041</a>)</li> </ul> <h3>Core type checking</h3> <ul> <li>Account for known subclasses in equality inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28005">#28005</a>)</li> <li>Expand <code>ParamSpec</code> signatures inferred from bound receivers (<a href="https://redirect.github.com/astral-sh/ruff/pull/28020">#28020</a>)</li> <li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols (<a href="https://redirect.github.com/astral-sh/ruff/pull/28016">#28016</a>)</li> <li>Fix <code>TypedDict</code> variance inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28052">#28052</a>)</li> <li>Fix unsound narrowing through branch-assigned conditions (<a href="https://redirect.github.com/astral-sh/ruff/pull/28006">#28006</a>)</li> <li>Ignore inconsistent binding decorators on overloads (<a href="https://redirect.github.com/astral-sh/ruff/pull/28036">#28036</a>)</li> <li>Infer <code>yield from</code> send/return types from the iterator returned by <code>__iter__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27987">#27987</a>)</li> <li>Infer tuple type parameters from union arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28062">#28062</a>)</li> <li>Infer variance through nonrecursive protocol references (<a href="https://redirect.github.com/astral-sh/ruff/pull/28065">#28065</a>)</li> <li>Preserve bounds of non-literal metaclasses (<a href="https://redirect.github.com/astral-sh/ruff/pull/28046">#28046</a>)</li> <li>Preserve correlated generic-call inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28043">#28043</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md">ty's changelog</a>.</em></p> <blockquote> <h2>0.0.75</h2> <p>Released on 2026-08-26.</p> <h3>Preview features</h3> <ul> <li>Initialize PEP 723 script environments in the CLI (<a href="https://redirect.github.com/astral-sh/ruff/pull/27544">#27544</a>)</li> <li>Refresh PEP 723 script environments in watch mode (<a href="https://redirect.github.com/astral-sh/ruff/pull/27617">#27617</a>)</li> <li>Run PEP 723 script synchronization on bounded workers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27615">#27615</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Specialize <code>Self</code> bounds of inherited methods (<a href="https://redirect.github.com/astral-sh/ruff/pull/27990">#27990</a>)</li> </ul> <h3>LSP server</h3> <ul> <li>Add "Go to Definition" support for pytest fixtures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27444">#27444</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix documented Python package build command (<a href="https://redirect.github.com/astral-sh/ty/pull/4384">#4384</a>)</li> <li>Link untyped-call tracking issue in migration guide (<a href="https://redirect.github.com/astral-sh/ty/pull/4382">#4382</a>)</li> </ul> <h3>Library support</h3> <ul> <li>Resolve imported pytest fixture exposures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27539">#27539</a>)</li> <li>Resolve installed core pytest fixture providers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27770">#27770</a>)</li> <li>Resolve pytest fixtures through conftest (<a href="https://redirect.github.com/astral-sh/ruff/pull/27540">#27540</a>)</li> </ul> <h3>Diagnostics</h3> <ul> <li>Add more autofixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28029">#28029</a>)</li> <li>Add a dedicated missing-slot diagnostic (<a href="https://redirect.github.com/astral-sh/ruff/pull/28039">#28039</a>)</li> <li>Explain missing storage for declared slotted attributes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27969">#27969</a>)</li> <li>Improve diagnostic spans for unpacked variable assignments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28041">#28041</a>)</li> </ul> <h3>Core type checking</h3> <ul> <li>Account for known subclasses in equality inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28005">#28005</a>)</li> <li>Expand <code>ParamSpec</code> signatures inferred from bound receivers (<a href="https://redirect.github.com/astral-sh/ruff/pull/28020">#28020</a>)</li> <li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols (<a href="https://redirect.github.com/astral-sh/ruff/pull/28016">#28016</a>)</li> <li>Fix <code>TypedDict</code> variance inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28052">#28052</a>)</li> <li>Fix unsound narrowing through branch-assigned conditions (<a href="https://redirect.github.com/astral-sh/ruff/pull/28006">#28006</a>)</li> <li>Ignore inconsistent binding decorators on overloads (<a href="https://redirect.github.com/astral-sh/ruff/pull/28036">#28036</a>)</li> <li>Infer <code>yield from</code> send/return types from the iterator returned by <code>__iter__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27987">#27987</a>)</li> <li>Infer tuple type parameters from union arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28062">#28062</a>)</li> <li>Infer variance through nonrecursive protocol references (<a href="https://redirect.github.com/astral-sh/ruff/pull/28065">#28065</a>)</li> <li>Preserve bounds of non-literal metaclasses (<a href="https://redirect.github.com/astral-sh/ruff/pull/28046">#28046</a>)</li> <li>Preserve correlated generic-call inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28043">#28043</a>)</li> <li>Preserve invariant materialization constraints (<a href="https://redirect.github.com/astral-sh/ruff/pull/28047">#28047</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ty/commit/a553dcc1a4c464b22d6fff8c46d444e326e0ae2d"><code>a553dcc</code></a> Bump version to 0.0.75 (<a href="https://redirect.github.com/astral-sh/ty/issues/4396">#4396</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/26b1b50998e92a5f50c342dc4a1fed84db2f8ee4"><code>26b1b50</code></a> Update prek dependencies (<a href="https://redirect.github.com/astral-sh/ty/issues/4392">#4392</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/73d226ee4d5a9274bc559c50a244159b61dfa315"><code>73d226e</code></a> Fix documented Python package build command (<a href="https://redirect.github.com/astral-sh/ty/issues/4384">#4384</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/5e264dac66970648d461a3fc8f2ebebd30a44dc9"><code>5e264da</code></a> Link untyped-call tracking issue in migration guide (<a href="https://redirect.github.com/astral-sh/ty/issues/4382">#4382</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/00199f0aaa6a8cd264fea08eae4f3c3fe4451c17"><code>00199f0</code></a> Bump version to 0.0.74 (<a href="https://redirect.github.com/astral-sh/ty/issues/4351">#4351</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/5769062fa10db84f6c03145bdf42d0b8da9aeb63"><code>5769062</code></a> Update mypy/pyright comparison table (<a href="https://redirect.github.com/astral-sh/ty/issues/4165">#4165</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/4fcb06010f2219b80adf3e688964abd9b0d72866"><code>4fcb060</code></a> Remove Zulip from the PGO training (<a href="https://redirect.github.com/astral-sh/ty/issues/4336">#4336</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/a7a706442a710db4a93c1a79779dff5ec5824cf6"><code>a7a7064</code></a> Use the versions bot's ruleset bypass when merging (<a href="https://redirect.github.com/astral-sh/ty/issues/4333">#4333</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/01b0fab0093c64535a401bc2731f80d7f5b6a7a8"><code>01b0fab</code></a> Update prek dependencies (<a href="https://redirect.github.com/astral-sh/ty/issues/4325">#4325</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/deef42f517bfbacb2ffe673046bef1e206c6b8ab"><code>deef42f</code></a> Update dependency python to 3.14 (<a href="https://redirect.github.com/astral-sh/ty/issues/4326">#4326</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ty/compare/0.0.66...0.0.75">compare view</a></li> </ul> </details> <br /> Made by [Open SWE](https://openswe.vercel.app/agents/0758e158-6746-5095-b8a0-7f69acf36b73) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>John Kennedyopen-swe[bot] <open-swe@users.noreply.github.com> |
eae02c622d |
chore(deps): bump the minor-and-patch group in /libs/checkpoint with 4 updates (#8777)
Bumps the minor-and-patch group in /libs/checkpoint with 4 updates: [langchain-core](https://github.com/langchain-ai/langchain), [redis](https://github.com/redis/redis-py), [ruff](https://github.com/astral-sh/ruff) and [ty](https://github.com/astral-sh/ty). Updates `langchain-core` from 1.5.2 to 1.6.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/langchain-ai/langchain/releases">langchain-core's releases</a>.</em></p> <blockquote> <h2>langchain-core==1.6.1</h2> <p>Changes since langchain-core==1.6.0</p> <p>revert: release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39971">#39971</a>) release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39967">#39967</a>) fix(core): shore up indexing in genai v1 streaming content (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39964">#39964</a>) fix(core): make <code>StructuredTool</code> JSON-serializable (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39631">#39631</a>) chore(deps): bump minor and patch dependencies (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39869">#39869</a>) release(core): 1.6.1 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39832">#39832</a>) feat(core): propagate gateway information on error path (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39829">#39829</a>)</p> <h2>langchain-core==1.6.0</h2> <p>Changes since langchain-core==1.5.6</p> <p>release(core): 1.6.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39760">#39760</a>) fix(core): resolve postponed annotations in <code>StructuredTool._injected_args_keys</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39602">#39602</a>) feat(core): add standard model exception types (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39538">#39538</a>) fix(core): allow deserializing <code>RunnablePick</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39753">#39753</a>) fix(core): make <code>convert_to_openai_function</code> handle callables and non-dict mappings (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39750">#39750</a>) fix(core): make subprocess and temporary file tests portable on Windows (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39664">#39664</a>) fix(core): fail fast when tool schemas can't resolve forward refs during serialization (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39570">#39570</a>) test(core): avoid version-dependent runnable snapshots (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39705">#39705</a>) fix(core): require all nested properties for strict tool schemas (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39306">#39306</a>) fix(core): remove stale sync-stream <code>xfail</code> [closes <a href="https://redirect.github.com/langchain-ai/langchain/issues/39720">#39720</a>] (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39723">#39723</a>) perf(core): Lazily import transformers (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38037">#38037</a>) fix(core): accept non-dict Mapping values in mustache templates (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39680">#39680</a>) docs(core): clarify <code>Runnable</code> pipe coercion [closes <a href="https://redirect.github.com/langchain-ai/langchain/issues/39075">#39075</a>] (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39707">#39707</a>) fix(core): finalize chain-group runs on <code>BaseException</code> (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39699">#39699</a>)</p> <h2>langchain-core==1.5.6</h2> <p>Changes since langchain-core==1.5.5</p> <p>chore(core): release 1.5.6 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39704">#39704</a>) feat(core): incorporate gateway metadata to traces (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39703">#39703</a>)</p> <h2>langchain-core==1.5.5</h2> <p>Changes since langchain-core==1.5.4</p> <p>release(core): 1.5.5 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39655">#39655</a>) fix(core): make abatch_iterate consistent with batch_iterate for None and zero size (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39367">#39367</a>) fix(core): respect pydantic aliases when validating tool inputs (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39572">#39572</a>) fix(core): issues in merging chunks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39535">#39535</a>) fix(core): handle v1 base model validation in async path (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39576">#39576</a>) fix(core): handle tool descriptions for infer_schema=False (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39573">#39573</a>) fix(core): clear usage metadata callback on exceptions in context manager (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39616">#39616</a>) fix(core): handle falsy LLM and chat model caches (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39283">#39283</a>) chore(core): add httpx as an explicit dep (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39612">#39612</a>) fix(core): preserve non-str/non-dict items in <code>DictPromptTemplate</code> list values (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39588">#39588</a>) fix(core): raise ValueError when explicit tool_outputs length mismatches tool_calls in tool_example_to_messages (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39142">#39142</a>) fix(core): guard malformed Anthropic content blocks (<a href="https://redirect.github.com/langchain-ai/langchain/issues/38670">#38670</a>)</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/langchain-ai/langchain/commit/4fe9d3062f4b68e2e472eb92decf369c93aebb46"><code>4fe9d30</code></a> chore(openai): fix tests (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39972">#39972</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/8fa38dc143faecec0287395bce4484af4b82254c"><code>8fa38dc</code></a> revert: release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39971">#39971</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/122030d79e944a5b55c33847d29bcfbe64488372"><code>122030d</code></a> release(core): 1.6.2 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39967">#39967</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/7d4b42b57235020e6f496fdfebab44c3ca1b1f5b"><code>7d4b42b</code></a> release(langchain): 1.3.18 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39966">#39966</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/4a66e355da07b8fad7d6cb8db99287fb4d7e6d83"><code>4a66e35</code></a> fix(langchain): preserve content-block shape in PIIMiddleware redaction (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39894">#39894</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/38e211359f0b65b480d9ee4c53f2385f8c249bb3"><code>38e2113</code></a> fix(core): shore up indexing in genai v1 streaming content (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39964">#39964</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/13b1b2feae476fdcebc0a285a723d5cbfed9df2e"><code>13b1b2f</code></a> fix(core): make <code>StructuredTool</code> JSON-serializable (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39631">#39631</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/3b3b308e6d956c9a670e41e66a468466fe6f8c26"><code>3b3b308</code></a> release(anthropic): 1.7.0 (<a href="https://redirect.github.com/langchain-ai/langchain/issues/39963">#39963</a>)</li> <li><a href="https://github.com/langchain-ai/langchain/commit/e3f6adfe1976a773704a20fef7bb03ac0309e0e4"><code>e3f6adf</code></a> feat(anthropic): support top-level param for skills via <code>container</code>; `updates...</li> <li><a href="https://github.com/langchain-ai/langchain/commit/c253f54b905f9648c50b723f01945f39a256d8aa"><code>c253f54</code></a> fix(openai): correct <code>reasoning_effort_levels</code> for gpt-5 and gpt-5.1 profiles...</li> <li>Additional commits viewable in <a href="https://github.com/langchain-ai/langchain/compare/langchain-core==1.5.2...langchain-core==1.6.1">compare view</a></li> </ul> </details> <br /> Updates `redis` from 8.0.1 to 8.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/redis/redis-py/releases">redis's releases</a>.</em></p> <blockquote> <h2>8.1.0</h2> <h1>Changes</h1> <h2>✨ Highlights</h2> <h3>Async maintenance notifications</h3> <p>redis-py now supports server-pushed <strong>maintenance notifications</strong> in the asyncio stack for both standalone and cluster clients, bringing the async client to parity with the sync implementation. When a Redis deployment signals maintenance events (such as node migration or failover windows), the async client reacts through the maintenance-notifications handler (<code>redis/maint_notifications.py</code> and its async integration under <code>redis/asyncio/</code>), allowing applications to adapt connection handling during maintenance without downtime. (<a href="https://redirect.github.com/redis/redis-py/issues/4177">#4177</a>)</p> <h3>Expanded command coverage</h3> <p>This release adds a batch of new command surfaces across core data types and modules:</p> <ul> <li><strong>Lists</strong> — <code>LMOVEM</code> / <code>BLMOVEM</code> for moving multiple elements between lists (<a href="https://redirect.github.com/redis/redis-py/issues/4174">#4174</a>).</li> <li><strong>Sets</strong> — <code>SDIFFCARD</code> and <code>SUNIONCARD</code> cardinality commands (<a href="https://redirect.github.com/redis/redis-py/issues/4171">#4171</a>).</li> <li><strong>Streams</strong> — <code>MAXCOUNT</code> / <code>MAXSIZE</code> options for <code>XREAD</code> and <code>XREADGROUP</code> (<a href="https://redirect.github.com/redis/redis-py/issues/4173">#4173</a>).</li> <li><strong>Time Series</strong> — <code>TS.READ</code> (<a href="https://redirect.github.com/redis/redis-py/issues/4170">#4170</a>), <code>TS.QUERYLABELS</code> (<a href="https://redirect.github.com/redis/redis-py/issues/4197">#4197</a>), <code>TS.NRANGE</code> / <code>TS.NREVRANGE</code> (<a href="https://redirect.github.com/redis/redis-py/issues/4163">#4163</a>), and an <code>exclude_empty</code> (<code>EXCLUDEEMPTY</code>) option for <code>TS.MRANGE</code> / <code>TS.MREVRANGE</code> (<a href="https://redirect.github.com/redis/redis-py/issues/4188">#4188</a>).</li> <li><strong>Search</strong> — <code>FT.ALIASLIST</code> (<a href="https://redirect.github.com/redis/redis-py/issues/4198">#4198</a>) and a <code>COLLECT</code> reducer for aggregations (<a href="https://redirect.github.com/redis/redis-py/issues/4179">#4179</a>).</li> <li><strong>Sentinel</strong> — replica sentinel aliases (<a href="https://redirect.github.com/redis/redis-py/issues/4127">#4127</a>).</li> </ul> <h2>🚀 New Features</h2> <ul> <li>Add replica sentinel aliases (<a href="https://redirect.github.com/redis/redis-py/issues/4127">#4127</a>)</li> <li>Add TS.NRANGE and TS.NREVRANGE support to the timeseries command surface (<a href="https://redirect.github.com/redis/redis-py/issues/4163">#4163</a>)</li> <li>feat: add TS.READ command support to the timeseries module (<a href="https://redirect.github.com/redis/redis-py/issues/4170">#4170</a>)</li> <li>feat: add SDIFFCARD and SUNIONCARD command support (<a href="https://redirect.github.com/redis/redis-py/issues/4171">#4171</a>)</li> <li>feat: add MAXCOUNT/MAXSIZE support to XREAD and XREADGROUP (<a href="https://redirect.github.com/redis/redis-py/issues/4173">#4173</a>)</li> <li>feat: add LMOVEM and BLMOVEM commands for moving multiple list elements (<a href="https://redirect.github.com/redis/redis-py/issues/4174">#4174</a>)</li> <li>feat: add async maintenance-notifications support for standalone and cluster clients (<a href="https://redirect.github.com/redis/redis-py/issues/4177">#4177</a>)</li> <li>feat: add COLLECT reducer support to search aggregations (<a href="https://redirect.github.com/redis/redis-py/issues/4179">#4179</a>)</li> <li>feat: add exclude_empty (EXCLUDEEMPTY) option to TS.MRANGE and TS.MREVRANGE (<a href="https://redirect.github.com/redis/redis-py/issues/4188">#4188</a>)</li> <li>feat: add TS.QUERYLABELS support to the timeseries command surface (<a href="https://redirect.github.com/redis/redis-py/issues/4197">#4197</a>)</li> <li>feat: add FT.ALIASLIST support (<a href="https://redirect.github.com/redis/redis-py/issues/4198">#4198</a>)</li> </ul> <h2>⚠️ Experimental</h2> <ul> <li>feat: add client-side HIMPORT fieldset support for standalone and cluster clients (<a href="https://redirect.github.com/redis/redis-py/issues/4205">#4205</a>)</li> </ul> <p>The feature considered unstable and <strong>public API might be changed in the future minor version</strong></p> <h2>🐛 Bug Fixes</h2> <ul> <li>fix: detect closed pooled connection without consuming pending push data (RESP3 + hiredis) (<a href="https://redirect.github.com/redis/redis-py/issues/4156">#4156</a>)</li> <li>Fix Sentinel pool capacity loss after failover (<a href="https://redirect.github.com/redis/redis-py/issues/4193">#4193</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/redis/redis-py/commit/e013126df18e476fbb8b8215f040f39bd3242683"><code>e013126</code></a> Testing with 8.10 GA (<a href="https://redirect.github.com/redis/redis-py/issues/4227">#4227</a>)</li> <li><a href="https://github.com/redis/redis-py/commit/059d1e97d88dd7ed516628e0a9765ab8e0e299f1"><code>059d1e9</code></a> Fixed TS.NRANGE commands to correctly apply aggregators (<a href="https://redirect.github.com/redis/redis-py/issues/4225">#4225</a>)</li> <li><a href="https://github.com/redis/redis-py/commit/d486a0a982dcdf316006474dc286ca65cbec5a9f"><code>d486a0a</code></a> Fix FIELDNAME alias dropping first character of un-prefixed fields (<a href="https://redirect.github.com/redis/redis-py/issues/4224">#4224</a>)</li> <li><a href="https://github.com/redis/redis-py/commit/fb931042420baaa5fbb9021955e444f7afa66dc2"><code>fb93104</code></a> feat: add client-side HIMPORT fieldset support for standalone and cluster cli...</li> <li><a href="https://github.com/redis/redis-py/commit/9197609f48eb9713411a50534ca48210486a4bf9"><code>9197609</code></a> Fix lat/lon swap in search querystring geo() helper (<a href="https://redirect.github.com/redis/redis-py/issues/4223">#4223</a>)</li> <li><a href="https://github.com/redis/redis-py/commit/14714a0812d3ff03ad34c89ce6f79e287a04e9fb"><code>14714a0</code></a> fix: Fixed double decoding issue with unquote() (<a href="https://redirect.github.com/redis/redis-py/issues/4222">#4222</a>)</li> <li><a href="https://github.com/redis/redis-py/commit/227280a939718d09ff9d7c41f9785ffdc21bdc2a"><code>227280a</code></a> Update lib version to 8.1.0</li> <li><a href="https://github.com/redis/redis-py/commit/88d16d0db10c852d1d292628b2c832f1ed117056"><code>88d16d0</code></a> Decode ACL LOG string values on the default RESP3 legacy callback (<a href="https://redirect.github.com/redis/redis-py/issues/4201">#4201</a>)</li> <li><a href="https://github.com/redis/redis-py/commit/599fd75ca7d0745928280ff3a64ccd224dbf2b76"><code>599fd75</code></a> feat: add FT.ALIASLIST support (<a href="https://redirect.github.com/redis/redis-py/issues/4198">#4198</a>)</li> <li><a href="https://github.com/redis/redis-py/commit/71e275e6eae94d202b49bccce10ef0d2a59050e7"><code>71e275e</code></a> test: add VectorField RERANK serialization tests for sync and async search (#...</li> <li>Additional commits viewable in <a href="https://github.com/redis/redis-py/compare/v8.0.1...v8.1.0">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.0 to 0.16.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.5</h2> <h2>Release Notes</h2> <p>Released on 2026-08-27.</p> <h3>Preview features</h3> <ul> <li>Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28049">#28049</a>)</li> <li>Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27666">#27666</a>)</li> <li>Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/pull/27877">#27877</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-async</code>] Detect blocking generic HTTP requests (<code>ASYNC210</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28024">#28024</a>)</li> <li>[<code>flake8-datetimez</code>] Allow timezone-safe <code>strptime</code> chains (<code>DTZ007</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28023">#28023</a>)</li> <li>[<code>flake8-simplify</code>] Respect side effects in <code>lambda</code> defaults (<code>SIM401</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28000">#28000</a>)</li> </ul> <h3>Server</h3> <ul> <li>Fix duplicated "of" in <code>ClientOptions</code> doc comment (<a href="https://redirect.github.com/astral-sh/ruff/pull/27978">#27978</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/pull/27910">#27910</a>)</li> <li>Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27906">#27906</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/AlexWaygood"><code>@AlexWaygood</code></a></li> <li><a href="https://github.com/sharkdp"><code>@sharkdp</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/aarushkandukoori"><code>@aarushkandukoori</code></a></li> </ul> <h2>Install ruff 0.16.5</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex" </code></pre> <h2>Download ruff 0.16.5</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.5</h2> <p>Released on 2026-08-27.</p> <h3>Preview features</h3> <ul> <li>Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28049">#28049</a>)</li> <li>Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27666">#27666</a>)</li> <li>Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/pull/27877">#27877</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-async</code>] Detect blocking generic HTTP requests (<code>ASYNC210</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28024">#28024</a>)</li> <li>[<code>flake8-datetimez</code>] Allow timezone-safe <code>strptime</code> chains (<code>DTZ007</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28023">#28023</a>)</li> <li>[<code>flake8-simplify</code>] Respect side effects in <code>lambda</code> defaults (<code>SIM401</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28000">#28000</a>)</li> </ul> <h3>Server</h3> <ul> <li>Fix duplicated "of" in <code>ClientOptions</code> doc comment (<a href="https://redirect.github.com/astral-sh/ruff/pull/27978">#27978</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/pull/27910">#27910</a>)</li> <li>Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27906">#27906</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/AlexWaygood"><code>@AlexWaygood</code></a></li> <li><a href="https://github.com/sharkdp"><code>@sharkdp</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/aarushkandukoori"><code>@aarushkandukoori</code></a></li> </ul> <h2>0.16.4</h2> <p>Released on 2026-08-20.</p> <h3>Preview features</h3> <ul> <li>[<code>flake8-use-pathlib</code>] Add autofix for <code>PTH116</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/26460">#26460</a>)</li> <li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to lists (<code>FURB131</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27711">#27711</a>)</li> <li>[<code>refurb</code>] Skip <code>FURB101</code> and <code>FURB103</code> when the <code>open</code> argument is a file descriptor (<a href="https://redirect.github.com/astral-sh/ruff/pull/27643">#27643</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not support <code>POPCNT</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27803">#27803</a>)</li> <li>[<code>pyflakes</code>] Emit semantic syntax errors in string type definitions as <code>F722</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27835">#27835</a>)</li> <li>[<code>pylint</code>] Allow <code>os._exit</code> imports in <code>import-private-name</code> (<code>PLC2701</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27738">#27738</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a"><code>9e4938c</code></a> Bump 0.16.5 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28110">#28110</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd"><code>aad0e90</code></a> Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/issues/28049">#28049</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4"><code>5fdab73</code></a> Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/issues/27877">#27877</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4"><code>29c8e5b</code></a> Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/issues/27910">#27910</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f"><code>50a4d7f</code></a> Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/issues/27906">#27906</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2"><code>ada8795</code></a> Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/issues/27666">#27666</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0"><code>d894723</code></a> [ty] Infer lambda parameters through callable type aliases (<a href="https://redirect.github.com/astral-sh/ruff/issues/28109">#28109</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06"><code>2685fde</code></a> [ty] Narrow functional enum members in <code>==</code> and <code>match</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28103">#28103</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec"><code>efcffd2</code></a> [ty] Intersection simplifications with subtype-related generic specialization...</li> <li><a href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b"><code>eb78048</code></a> [ty] Bump ecosystem-analyzer for HTML escaping (<a href="https://redirect.github.com/astral-sh/ruff/issues/28104">#28104</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.0...0.16.5">compare view</a></li> </ul> </details> <br /> Updates `ty` from 0.0.64 to 0.0.75 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ty/releases">ty's releases</a>.</em></p> <blockquote> <h2>0.0.75</h2> <h2>Release Notes</h2> <p>Released on 2026-08-26.</p> <h3>Preview features</h3> <ul> <li>Initialize PEP 723 script environments in the CLI (<a href="https://redirect.github.com/astral-sh/ruff/pull/27544">#27544</a>)</li> <li>Refresh PEP 723 script environments in watch mode (<a href="https://redirect.github.com/astral-sh/ruff/pull/27617">#27617</a>)</li> <li>Run PEP 723 script synchronization on bounded workers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27615">#27615</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Specialize <code>Self</code> bounds of inherited methods (<a href="https://redirect.github.com/astral-sh/ruff/pull/27990">#27990</a>)</li> </ul> <h3>LSP server</h3> <ul> <li>Add "Go to Definition" support for pytest fixtures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27444">#27444</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix documented Python package build command (<a href="https://redirect.github.com/astral-sh/ty/pull/4384">#4384</a>)</li> <li>Link untyped-call tracking issue in migration guide (<a href="https://redirect.github.com/astral-sh/ty/pull/4382">#4382</a>)</li> </ul> <h3>Library support</h3> <ul> <li>Resolve imported pytest fixture exposures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27539">#27539</a>)</li> <li>Resolve installed core pytest fixture providers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27770">#27770</a>)</li> <li>Resolve pytest fixtures through conftest (<a href="https://redirect.github.com/astral-sh/ruff/pull/27540">#27540</a>)</li> </ul> <h3>Diagnostics</h3> <ul> <li>Add more autofixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28029">#28029</a>)</li> <li>Add a dedicated missing-slot diagnostic (<a href="https://redirect.github.com/astral-sh/ruff/pull/28039">#28039</a>)</li> <li>Explain missing storage for declared slotted attributes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27969">#27969</a>)</li> <li>Improve diagnostic spans for unpacked variable assignments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28041">#28041</a>)</li> </ul> <h3>Core type checking</h3> <ul> <li>Account for known subclasses in equality inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28005">#28005</a>)</li> <li>Expand <code>ParamSpec</code> signatures inferred from bound receivers (<a href="https://redirect.github.com/astral-sh/ruff/pull/28020">#28020</a>)</li> <li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols (<a href="https://redirect.github.com/astral-sh/ruff/pull/28016">#28016</a>)</li> <li>Fix <code>TypedDict</code> variance inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28052">#28052</a>)</li> <li>Fix unsound narrowing through branch-assigned conditions (<a href="https://redirect.github.com/astral-sh/ruff/pull/28006">#28006</a>)</li> <li>Ignore inconsistent binding decorators on overloads (<a href="https://redirect.github.com/astral-sh/ruff/pull/28036">#28036</a>)</li> <li>Infer <code>yield from</code> send/return types from the iterator returned by <code>__iter__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27987">#27987</a>)</li> <li>Infer tuple type parameters from union arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28062">#28062</a>)</li> <li>Infer variance through nonrecursive protocol references (<a href="https://redirect.github.com/astral-sh/ruff/pull/28065">#28065</a>)</li> <li>Preserve bounds of non-literal metaclasses (<a href="https://redirect.github.com/astral-sh/ruff/pull/28046">#28046</a>)</li> <li>Preserve correlated generic-call inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28043">#28043</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ty/blob/main/CHANGELOG.md">ty's changelog</a>.</em></p> <blockquote> <h2>0.0.75</h2> <p>Released on 2026-08-26.</p> <h3>Preview features</h3> <ul> <li>Initialize PEP 723 script environments in the CLI (<a href="https://redirect.github.com/astral-sh/ruff/pull/27544">#27544</a>)</li> <li>Refresh PEP 723 script environments in watch mode (<a href="https://redirect.github.com/astral-sh/ruff/pull/27617">#27617</a>)</li> <li>Run PEP 723 script synchronization on bounded workers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27615">#27615</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Specialize <code>Self</code> bounds of inherited methods (<a href="https://redirect.github.com/astral-sh/ruff/pull/27990">#27990</a>)</li> </ul> <h3>LSP server</h3> <ul> <li>Add "Go to Definition" support for pytest fixtures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27444">#27444</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix documented Python package build command (<a href="https://redirect.github.com/astral-sh/ty/pull/4384">#4384</a>)</li> <li>Link untyped-call tracking issue in migration guide (<a href="https://redirect.github.com/astral-sh/ty/pull/4382">#4382</a>)</li> </ul> <h3>Library support</h3> <ul> <li>Resolve imported pytest fixture exposures (<a href="https://redirect.github.com/astral-sh/ruff/pull/27539">#27539</a>)</li> <li>Resolve installed core pytest fixture providers (<a href="https://redirect.github.com/astral-sh/ruff/pull/27770">#27770</a>)</li> <li>Resolve pytest fixtures through conftest (<a href="https://redirect.github.com/astral-sh/ruff/pull/27540">#27540</a>)</li> </ul> <h3>Diagnostics</h3> <ul> <li>Add more autofixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28029">#28029</a>)</li> <li>Add a dedicated missing-slot diagnostic (<a href="https://redirect.github.com/astral-sh/ruff/pull/28039">#28039</a>)</li> <li>Explain missing storage for declared slotted attributes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27969">#27969</a>)</li> <li>Improve diagnostic spans for unpacked variable assignments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28041">#28041</a>)</li> </ul> <h3>Core type checking</h3> <ul> <li>Account for known subclasses in equality inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28005">#28005</a>)</li> <li>Expand <code>ParamSpec</code> signatures inferred from bound receivers (<a href="https://redirect.github.com/astral-sh/ruff/pull/28020">#28020</a>)</li> <li>Fix <code>Self</code> binding in <code>ParamSpec</code> protocols (<a href="https://redirect.github.com/astral-sh/ruff/pull/28016">#28016</a>)</li> <li>Fix <code>TypedDict</code> variance inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28052">#28052</a>)</li> <li>Fix unsound narrowing through branch-assigned conditions (<a href="https://redirect.github.com/astral-sh/ruff/pull/28006">#28006</a>)</li> <li>Ignore inconsistent binding decorators on overloads (<a href="https://redirect.github.com/astral-sh/ruff/pull/28036">#28036</a>)</li> <li>Infer <code>yield from</code> send/return types from the iterator returned by <code>__iter__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27987">#27987</a>)</li> <li>Infer tuple type parameters from union arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/28062">#28062</a>)</li> <li>Infer variance through nonrecursive protocol references (<a href="https://redirect.github.com/astral-sh/ruff/pull/28065">#28065</a>)</li> <li>Preserve bounds of non-literal metaclasses (<a href="https://redirect.github.com/astral-sh/ruff/pull/28046">#28046</a>)</li> <li>Preserve correlated generic-call inference (<a href="https://redirect.github.com/astral-sh/ruff/pull/28043">#28043</a>)</li> <li>Preserve invariant materialization constraints (<a href="https://redirect.github.com/astral-sh/ruff/pull/28047">#28047</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ty/commit/a553dcc1a4c464b22d6fff8c46d444e326e0ae2d"><code>a553dcc</code></a> Bump version to 0.0.75 (<a href="https://redirect.github.com/astral-sh/ty/issues/4396">#4396</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/26b1b50998e92a5f50c342dc4a1fed84db2f8ee4"><code>26b1b50</code></a> Update prek dependencies (<a href="https://redirect.github.com/astral-sh/ty/issues/4392">#4392</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/73d226ee4d5a9274bc559c50a244159b61dfa315"><code>73d226e</code></a> Fix documented Python package build command (<a href="https://redirect.github.com/astral-sh/ty/issues/4384">#4384</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/5e264dac66970648d461a3fc8f2ebebd30a44dc9"><code>5e264da</code></a> Link untyped-call tracking issue in migration guide (<a href="https://redirect.github.com/astral-sh/ty/issues/4382">#4382</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/00199f0aaa6a8cd264fea08eae4f3c3fe4451c17"><code>00199f0</code></a> Bump version to 0.0.74 (<a href="https://redirect.github.com/astral-sh/ty/issues/4351">#4351</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/5769062fa10db84f6c03145bdf42d0b8da9aeb63"><code>5769062</code></a> Update mypy/pyright comparison table (<a href="https://redirect.github.com/astral-sh/ty/issues/4165">#4165</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/4fcb06010f2219b80adf3e688964abd9b0d72866"><code>4fcb060</code></a> Remove Zulip from the PGO training (<a href="https://redirect.github.com/astral-sh/ty/issues/4336">#4336</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/a7a706442a710db4a93c1a79779dff5ec5824cf6"><code>a7a7064</code></a> Use the versions bot's ruleset bypass when merging (<a href="https://redirect.github.com/astral-sh/ty/issues/4333">#4333</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/01b0fab0093c64535a401bc2731f80d7f5b6a7a8"><code>01b0fab</code></a> Update prek dependencies (<a href="https://redirect.github.com/astral-sh/ty/issues/4325">#4325</a>)</li> <li><a href="https://github.com/astral-sh/ty/commit/deef42f517bfbacb2ffe673046bef1e206c6b8ab"><code>deef42f</code></a> Update dependency python to 3.14 (<a href="https://redirect.github.com/astral-sh/ty/issues/4326">#4326</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ty/compare/0.0.64...0.0.75">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Made by [Open SWE](https://openswe.vercel.app/agents/0758e158-6746-5095-b8a0-7f69acf36b73) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>John Kennedyopen-swe[bot] <open-swe@users.noreply.github.com> |
bbd6e2da0b |
chore(deps-dev): bump syrupy from 5.5.3 to 6.0.0 in /libs/prebuilt in the major group (#8780)
Bumps the major group in /libs/prebuilt with 1 update: [syrupy](https://github.com/syrupy-project/syrupy). Updates `syrupy` from 5.5.3 to 6.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/syrupy-project/syrupy/releases">syrupy's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <h1>Syrupy 6.0.0</h1> <p><em>(2026-08-22)</em></p> <p>Syrupy 6 focuses on better built-in serialization, clearer snapshot workflows, and large-suite performance. Please review the <strong>breaking changes</strong> before upgrading.</p> <p>Most suites should not need significant snapshot updates on upgrade — the main exception is <strong>dataclass</strong> usage (see below). Syrupy v6 does <strong>not</strong> change the required Python version or other package dependencies. Support for Python 3.10 will instead be dropped in the next Syrupy major version (v7).</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/syrupy-project/syrupy/compare/v5.5.3...v6.0.0">https://github.com/syrupy-project/syrupy/compare/v5.5.3...v6.0.0</a></p> <hr /> <h2>Breaking Changes</h2> <h3>Built-in dataclass serialization (removed <code>DataclassPlugin</code>)</h3> <p>stdlib dataclasses are now serialized natively by the Amber serializer. The separate <code>DataclassPlugin</code> has been <strong>removed</strong>.</p> <ul> <li><strong>If you used <code>DataclassPlugin</code>:</strong> remove imports and plugin wiring. Behavior should match what the plugin produced; no snapshot rewrite should be needed for the dataclass shape itself.</li> <li><strong>If you did <em>not</em> use the plugin:</strong> dataclass snapshots may change from a <code>repr</code>-style string to structured Amber form (field-by-field). Re-run with <code>--snapshot-update</code> where those assertions fail.</li> </ul> <p>Example of what to remove:</p> <pre lang="python"><code># Before (v5) from syrupy.extensions.amber.dataclasses_plugin import DataclassPlugin <p>class MySerializer(AmberDataSerializer): serializer_plugins = [DataclassPlugin, ...] </code></pre></p> <pre lang="python"><code># After (v6) — dataclasses work with the default Amber extension assert MyDataclass(...) == snapshot </code></pre> <p>Attrs and Pydantic models are unchanged and still need their serializer plugins. See the <a href="https://github.com/syrupy-project/syrupy/blob/main/tests/syrupy/extensions/amber/test_amber_serializer_plugins.py">serializer plugins example</a>.</p> <p>(<a href="https://redirect.github.com/syrupy-project/syrupy/pull/1220">#1220</a>, closes <a href="https://redirect.github.com/syrupy-project/syrupy/issues/1048">#1048</a>)</p> <h3>JSON <code>datetime.date</code> snapshots</h3> <p>The JSON extension now serializes <code>datetime.date</code> as <code>YYYY-MM-DD</code> instead of a <code>repr</code> string. Existing JSON snapshots that contain dates will need an update.</p> <p>(<a href="https://redirect.github.com/syrupy-project/syrupy/pull/1216">#1216</a>, closes <a href="https://redirect.github.com/syrupy-project/syrupy/issues/1058">#1058</a>)</p> <h3><code>path_value</code> nested path replacement in default (literal) mode</h3> <p><code>path_value(..., regex=False)</code> now correctly replaces values at nested paths such as <code>user.token</code>. Previously, the default-mode lookup missed escaped path keys, so nested values were left unchanged (and could leak into committed snapshots).</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/syrupy-project/syrupy/blob/main/CHANGELOG.md">syrupy's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/syrupy-project/syrupy/releases/tag/v6.0.0">v6.0.0</a> (2026-08-22)</h2> <h2>What's Changed</h2> <ul> <li>chore(deps): bump pygments from 2.19.2 to 2.20.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1151">syrupy-project/syrupy#1151</a></li> <li>chore(deps): update dependency hypothesis to v6.156.5 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1152">syrupy-project/syrupy#1152</a></li> <li>chore(deps): update dependency ruff to v0.15.21 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1153">syrupy-project/syrupy#1153</a></li> <li>chore(deps): update dependency hypothesis to v6.156.6 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1154">syrupy-project/syrupy#1154</a></li> <li>chore(deps): update dependency coverage to v7.15.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1157">syrupy-project/syrupy#1157</a></li> <li>chore(deps): update dependency mypy to v2.3.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1158">syrupy-project/syrupy#1158</a></li> <li>fix: make set/dict serialization deterministic for partial-order elements by <a href="https://github.com/chuenchen309"><code>@chuenchen309</code></a> in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1159">syrupy-project/syrupy#1159</a></li> <li>docs: add chuenchen309 as a contributor for bug by <a href="https://github.com/allcontributors"><code>@allcontributors</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1160">syrupy-project/syrupy#1160</a></li> <li>chore(deps): update dependency coverage to v7.15.2 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1163">syrupy-project/syrupy#1163</a></li> <li>chore(deps): update dependency ruff to v0.15.22 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1164">syrupy-project/syrupy#1164</a></li> <li>chore(deps): update dependency hypothesis to v6.156.7 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1165">syrupy-project/syrupy#1165</a></li> <li>chore(deps): update dependency hypothesis to v6.156.9 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1166">syrupy-project/syrupy#1166</a></li> <li>chore(deps): update dependency hypothesis to v6.157.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1167">syrupy-project/syrupy#1167</a></li> <li>fix(matchers): replace values at nested paths in path_value default mode by <a href="https://github.com/chuenchen309"><code>@chuenchen309</code></a> in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1162">syrupy-project/syrupy#1162</a></li> <li>fix: preserve skipped single-file snapshots by <a href="https://github.com/KSmanis"><code>@KSmanis</code></a> in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1161">syrupy-project/syrupy#1161</a></li> <li>docs: add KSmanis as a contributor for bug by <a href="https://github.com/allcontributors"><code>@allcontributors</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1168">syrupy-project/syrupy#1168</a></li> <li>chore(deps): update pypa/gh-action-pypi-publish action to v1.14.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1169">syrupy-project/syrupy#1169</a></li> <li>chore(deps): update dependency hypothesis to v6.157.2 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1171">syrupy-project/syrupy#1171</a></li> <li>chore(deps): update actions/checkout action to v7.0.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1170">syrupy-project/syrupy#1170</a></li> <li>chore(deps): update dependency hypothesis to v6.158.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1172">syrupy-project/syrupy#1172</a></li> <li>chore(deps): update astral-sh/setup-uv action to v9 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1174">syrupy-project/syrupy#1174</a></li> <li>chore(deps): update dependency hypothesis to v6.158.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1173">syrupy-project/syrupy#1173</a></li> <li>chore(deps): update dependency hypothesis to v6.160.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1176">syrupy-project/syrupy#1176</a></li> <li>feat: support in-memory snapshot diff data by <a href="https://github.com/yangfan-yf-yf"><code>@yangfan-yf-yf</code></a> in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1175">syrupy-project/syrupy#1175</a></li> <li>docs: add yangfan-yf-yf as a contributor for code by <a href="https://github.com/allcontributors"><code>@allcontributors</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1178">syrupy-project/syrupy#1178</a></li> <li>chore(deps): update dependency hypothesis to v6.161.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1177">syrupy-project/syrupy#1177</a></li> <li>chore(deps): update dependency hypothesis to v6.161.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1180">syrupy-project/syrupy#1180</a></li> <li>chore(deps): update dependency hypothesis to v6.161.4 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1182">syrupy-project/syrupy#1182</a></li> <li>chore(deps): update dependency hypothesis to v6.161.6 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1183">syrupy-project/syrupy#1183</a></li> <li>chore(deps): update dependency ruff to >=0.16,<0.17 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1179">syrupy-project/syrupy#1179</a></li> <li>chore(deps): update dependency hypothesis to v6.161.7 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1184">syrupy-project/syrupy#1184</a></li> <li>chore(deps): update pypa/gh-action-pypi-publish action to v1.14.2 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1186">syrupy-project/syrupy#1186</a></li> <li>perf: compress xdist snapshot reports by <a href="https://github.com/w3lld1"><code>@w3lld1</code></a> in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1188">syrupy-project/syrupy#1188</a></li> <li>docs: add w3lld1 as a contributor for code by <a href="https://github.com/allcontributors"><code>@allcontributors</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1190">syrupy-project/syrupy#1190</a></li> <li>chore(deps): update dependency ruff to v0.16.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1189">syrupy-project/syrupy#1189</a></li> <li>chore(deps): update dependency hypothesis to v6.164.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1187">syrupy-project/syrupy#1187</a></li> <li>chore(deps): update dependency hypothesis to v6.165.0 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1191">syrupy-project/syrupy#1191</a></li> <li>chore(deps): update dependency coverage to v7.15.3 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1192">syrupy-project/syrupy#1192</a></li> <li>chore(deps): update python docker tag to v3.14.7 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1195">syrupy-project/syrupy#1195</a></li> <li>chore(deps): update dependency coverage to v7.15.4 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1197">syrupy-project/syrupy#1197</a></li> <li>chore(deps): update dependency hypothesis to v6.165.2 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1194">syrupy-project/syrupy#1194</a></li> <li>chore(deps): update dependency ruff to v0.16.2 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1198">syrupy-project/syrupy#1198</a></li> <li>chore(deps): update dependency hypothesis to v6.165.3 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1199">syrupy-project/syrupy#1199</a></li> <li>chore(deps): update astral-sh/setup-uv action to v10 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1200">syrupy-project/syrupy#1200</a></li> <li>chore(deps): update dependency hypothesis to v6.165.5 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1201">syrupy-project/syrupy#1201</a></li> <li>chore(deps): update dependency ruff to v0.16.3 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1202">syrupy-project/syrupy#1202</a></li> <li>chore(deps): update astral-sh/setup-uv action to v10.0.1 by <a href="https://github.com/renovate"><code>@renovate</code></a>[bot] in <a href="https://redirect.github.com/syrupy-project/syrupy/pull/1205">syrupy-project/syrupy#1205</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/syrupy-project/syrupy/commit/621af75dd8dfa3301b503099b204a3d874e787d7"><code>621af75</code></a> chore(release): 6.0.0 [skip ci]</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/3a9f69182366401c372dd0a1690177e70e994fec"><code>3a9f691</code></a> fix: single file snapshot no longer buffers in memory (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1223">#1223</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/ab13f8d4a9eeba10572a6a12f485f79a6e0a1b23"><code>ab13f8d</code></a> chore: sponsorship (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1224">#1224</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/98f989c42a7c1c9cf49e031e9b97374bf97a6b6d"><code>98f989c</code></a> feat: add --snapshot-declaration-order for respecting declaration order (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1222">#1222</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/b549b4b6329cca03f871162748b3ea8597add1a3"><code>b549b4b</code></a> feat: built-in support for Dataclasses (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1220">#1220</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/d34933fce2d8eb65c24a89f29f5900b413775b5e"><code>d34933f</code></a> chore: use the benchmarks git branch (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1221">#1221</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/f6eda020d8671fc1648c0d94ed436805d5548978"><code>f6eda02</code></a> chore(ci): permissions for gh-pages</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/a5ce0492e68525f499f5cb395e273d3ac5a1f8e3"><code>a5ce049</code></a> chore(deps): update actions/configure-pages action to v6 (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1219">#1219</a>)</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/c0cb162f5fbaca6eeda43937152db314e0313c82"><code>c0cb162</code></a> chore: update github pages</li> <li><a href="https://github.com/syrupy-project/syrupy/commit/4d59bde91c87f6a2fb3b476ea995246a43449bc2"><code>4d59bde</code></a> chore: update docs for v6 release (<a href="https://redirect.github.com/syrupy-project/syrupy/issues/1218">#1218</a>)</li> <li>Additional commits viewable in <a href="https://github.com/syrupy-project/syrupy/compare/v5.5.3...v6.0.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Made by [Open SWE](https://openswe.vercel.app/agents/0758e158-6746-5095-b8a0-7f69acf36b73) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com> Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> |
||
|
|
b7bcf0083c |
chore(deps): bump tornado from 6.5.7 to 6.5.8 in /libs/langgraph (#8792)
Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.7 to 6.5.8. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst">tornado's changelog</a>.</em></p> <blockquote> <h1>Release notes</h1> <p>.. toctree:: :maxdepth: 2</p> <p>releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tornadoweb/tornado/commit/a55abe3e3bf59994f29b2f7084c46341f0d4f6a7"><code>a55abe3</code></a> Merge pull request <a href="https://redirect.github.com/tornadoweb/tornado/issues/3704">#3704</a> from bdarnell/security-6.5.8</li> <li><a href="https://github.com/tornadoweb/tornado/commit/fc794885f0ccf9c33f3a66d890abcc237dd50b3c"><code>fc79488</code></a> docs: add additional credit to release notes</li> <li><a href="https://github.com/tornadoweb/tornado/commit/7b017630d3139ca0d1ebdf6ac3b3ffe7725a7129"><code>7b01763</code></a> Fix test_strip_headers_on_redirect's URL-embedded-credentials cases</li> <li><a href="https://github.com/tornadoweb/tornado/commit/d72fff8d7b9b8f6aa68505847e5483d600e3184c"><code>d72fff8</code></a> release notes and version bump for 6.5.8</li> <li><a href="https://github.com/tornadoweb/tornado/commit/b168818f8aae39808b981878fb358cbe02a6238e"><code>b168818</code></a> auth: Formally deprecated OpenIDMixin</li> <li><a href="https://github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7"><code>da28476</code></a> web: Also check for semicolons in deprecated mixed-case cookie args</li> <li><a href="https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de"><code>8d6363e</code></a> httputil: Enforce a new limit on the number of arguments in a request</li> <li><a href="https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05"><code>de85b3f</code></a> httputil: Apply multipart max_parts limit earlier</li> <li>See full diff in <a href="https://github.com/tornadoweb/tornado/compare/v6.5.7...v6.5.8">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/langgraph/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |